Alfred Laugros
email: alfred.laugros@atos.net

Alice Caplier
email: alice.caplier@grenoble-inp.fr

Matthieu Ospici
email: matthieu.ospici@atos.net

Addressing Neural Network Robustness with Mixup and Targeted Labeling Adversarial Training

Keywords: Neural Network, Robustness, Common Corruptions, Adversarial Training, Mixup

Despite their performance, Artificial Neural Networks are not reliable enough for most of industrial applications. They are sensitive to noises, rotations, blurs and adversarial examples. There is a need to build defenses that protect against a wide range of perturbations, covering the most traditional common corruptions and adversarial examples. We propose a new data augmentation strategy called M-TLAT and designed to address robustness in a broad sense. Our approach combines the Mixup augmentation and a new adversarial training algorithm called Targeted Labeling Adversarial Training (TLAT). The idea of TLAT is to interpolate the target labels of adversarial examples with the groundtruth labels. We show that M-TLAT can increase the robustness of image classifiers towards nineteen common corruptions and five adversarial attacks, without reducing the accuracy on clean samples.

Introduction

Artificial neural networks have been proven to be very efficient in various image processing tasks [START_REF] Krizhevsky | Imagenet classification with deep convolutional neural networks[END_REF], [START_REF] Ren | Faster r-cnn: Towards real-time object detection with region proposal networks[END_REF], [START_REF] Taigman | Deepface: Closing the gap to humanlevel performance in face verification[END_REF]. Unfortunately, in real-world computer vision applications, a lot of common corruptions may be encountered such as blurs, colorimetry variations, or noises, etc. Such corruptions can dramatically decrease neural network efficiency [START_REF] Engstrom | A rotation and a translation suffice: Fooling cnns with simple transformations[END_REF], [START_REF] Dodge | Understanding how image quality affects deep neural networks[END_REF], [START_REF] Karahan | How image degradations affect deep cnn-based face recognition?[END_REF], [START_REF] Vasiljevic | Examining the impact of blur on recognition by convolutional networks[END_REF]. Besides, deep neural networks can be easily attacked with adversarial examples [START_REF] Szegedy | Intriguing properties of neural networks[END_REF]. These attacks can reduce the performance of most of the state-of-the-art neural networks to zero [START_REF] Kurakin | Adversarial examples in the physical world[END_REF], [START_REF] Papernot | Practical black-box attacks against machine learning[END_REF].

Some techniques have been proposed to make neural networks more robust. When a specific perturbation is considered, we can build a defense to protect a neural network against it, whether it is a common corruption [START_REF] Koziarski | Image recognition with deep neural networks in presence of noise dealing with and taking advantage of distortions[END_REF], [START_REF] Zhou | On classification of distorted images with deep convolutional neural networks[END_REF], [START_REF] Vasiljevic | Examining the impact of blur on recognition by convolutional networks[END_REF] or an adversarial attack [START_REF] Madry | Towards deep learning models resistant to adversarial attacks[END_REF], [START_REF] Xu | Feature squeezing: Detecting adversarial examples in deep neural networks[END_REF], [START_REF] Samangouei | Defense-GAN: Protecting classifiers against adversarial attacks using generative models[END_REF]. However, increasing robustness towards a specific perturbation generally does not help with another kind of perturbation. For instance, geometric transformation robustness is orthogonal with worst-case additive noise [START_REF] Engstrom | Exploring the landscape of spatial robustness[END_REF]. Fine tuning on blur does not increase the robustness to Gaussian noise [START_REF] Dodge | Quality resilient deep neural networks[END_REF]. Even worse, making a model robust to one specific perturbation can make it more sensitive to another one. For instance, a data augmentation with corruptions located in the high frequency domain tends to decrease the robustness to corruptions located in the low frequency domain [START_REF] Yin | A fourier perspective on model robustness in computer vision[END_REF]. Besides, increasing adversarial robustness often implies a diminution of the clean accuracy (the accuracy of a model on not-corrupted samples) [START_REF] Kurakin | Adversarial machine learning at scale[END_REF], [START_REF] Tsipras | Robustness may be at odds with accuracy[END_REF]. Therefore, a company or a public organism may feel reluctant to use neural networks in their projects since it is hard to make them robust to a large diversity of corruptions, and it is difficult to predict how a neural network will react to unexpected corruptions. There is a need to build new defenses that address robustness in a broad sense, covering the most encountered common corruptions and adversarial examples.

We propose to address this issue with a new data augmentation approach called M-TLAT. M-TLAT is a combination of Mixup [START_REF] Zhang | mixup: Beyond empirical risk minimization[END_REF] and a new kind of adversarial training called Targeted Labeling Adversarial Training (TLAT). The idea of this adversarial training is to label target adversarial examples with soft labels that contain information about the used target. We show that M-TLAT can increase the robustness of image classifiers to nineteen common corruptions and five adversarial attacks, without reducing the accuracy on clean samples. This algorithm is easy to implement and to integrate to an existing training process. It intends to make the neural networks used in real-world applications more reliable.

Related Works

Protecting Neural Networks against Common Corruptions

Neural Networks are known to be sensitive to a lot of perturbations such as noises [START_REF] Koziarski | Image recognition with deep neural networks in presence of noise dealing with and taking advantage of distortions[END_REF], rotations [START_REF] Engstrom | A rotation and a translation suffice: Fooling cnns with simple transformations[END_REF], blurs [START_REF] Vasiljevic | Examining the impact of blur on recognition by convolutional networks[END_REF] or colorimetry variations [START_REF] Karahan | How image degradations affect deep cnn-based face recognition?[END_REF], etc. We call these perturbations common corruptions. They are often encountered in industrial applications, but generally absent from academic datasets. For instance the faces in the dataset celeba are always well illuminated with a consistent eyes positioning [START_REF] Liu | Deep learning face attributes in the wild[END_REF], yet those conditions are not always guaranteed in the industrial applications. Because of common corruptions, the performance of a neural network can be surprisingly low [START_REF] Geirhos | Generalisation in humans and deep neural networks[END_REF].

There are a few methods that succeded in increasing the robustness to several common corruptions simoultaneously. Among them, the robust pre-training algorithm proposed by Liu et al. can make classifiers more robust to noises, occlusions and blurs [START_REF] Liu | Enhance visual recognition under adverse conditions via deep networks[END_REF]. In [START_REF] Geirhos | Imagenet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustness[END_REF], it is proposed to change the style of the training images using style transfer [START_REF] Gatys | Image style transfer using convolutional neural networks[END_REF]. Neural networks trained this way are obliged to focus more on shapes than textures. The Augmix algorithm proposes to interpolate a clean image with perturbed versions of this image [START_REF] Hendrycks | Augmix: A simple method to improve robustness and uncertainty under data shift[END_REF]. The obtained images are used to augment the training set of a neural network. These methods are useful to make neural networks more robust to common corruptions but they do not address the case of adversarial examples.

Protecting Neural Networks against Adversarial Examples

Adversarial Examples are another threat that can make neural networks give unexpected answers [START_REF] Szegedy | Intriguing properties of neural networks[END_REF]. Unlike common corruptions they are artificial distortions. They are crafted by humans so as to especially fool neural networks. Adversarial examples can completely fool even the state-of-the-art models [START_REF] Kurakin | Adversarial machine learning at scale[END_REF]. Those perturbations are even more dangerous because humans can hardly see if an image has been adversarially corrupted or not [START_REF] Kurakin | Adversarial examples in the physical world[END_REF], [START_REF] Papernot | Practical black-box attacks against machine learning[END_REF]. In other words, a system can be attacked without anyone noticing it. They are two kinds of adversarial examples called white-box and black-box attacks.

White-box attacks. The attacker has access to the whole target network: its parameters and its architecture. White-box attacks are tailored so as to especially fool a specific network. White-box adversarial examples are very harmful, defending a model against it is a tough task [START_REF] Tsipras | Robustness may be at odds with accuracy[END_REF], [START_REF] Schmidt | Adversarially robust generalization requires more data[END_REF], [START_REF] Athalye | Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples[END_REF].

Black-Box attacks. An adversarial example crafted with a limited access to the targeted network is called a black-box attack. When only the training set of a neural network is known, it is still possible to make a transfer attack. Considering a dataset and two neural networks trained with it, it has been shown that an adversarial example crafted using one of the models, can harm the other one [START_REF] Szegedy | Intriguing properties of neural networks[END_REF], [START_REF] Goodfellow | Explaining and harnessing adversarial examples[END_REF]. This phenomenon occurs even when the two models have distinct architectures and parameters.

A lot of methods have been proposed to protect against adversarial examples. Adversarial training uses adversarial examples to augment the training set of a neural network [START_REF] Madry | Towards deep learning models resistant to adversarial attacks[END_REF], [START_REF] Tramr | Ensemble adversarial training: Attacks and defenses[END_REF]. Defense-Gan [START_REF] Samangouei | Defense-GAN: Protecting classifiers against adversarial attacks using generative models[END_REF] and feature squeezing [START_REF] Xu | Feature squeezing: Detecting adversarial examples in deep neural networks[END_REF] are used to remove adversarial patterns from images. Stochastic Activation Pruning [START_REF] Dhillon | Stochastic activation pruning for robust adversarial defense[END_REF] and defensive dropout [START_REF] Wang | Defensive dropout for hardening deep neural networks under adversarial attacks[END_REF] make the internal operations of neural networks more difficult to access in order to make these networks more difficult to attack. These methods can significantly increase the robustness of neural networks to adversarial examples but they do not provide any protection towards common corruptions.

Addressing Robustness in a Broad Sense

The methods mentioned above increase either the adversarial robustness or the robustness to common corruptions. Unfortunately, increasing the robustness to common corruptions generally does not imply increasing the robustness to adversarial examples and conversely [START_REF] Laugros | Are adversarial robustness and common perturbation robustness independant attributes ?[END_REF]. The experiments carried out in [START_REF] Yin | A fourier perspective on model robustness in computer vision[END_REF] show that data augmentation with traditional adversarial examples makes models less robust to low frequency corruptions. Robustness to translations and rotations is independent from robustness to the L p bounded adversarial examples [START_REF] Engstrom | Exploring the landscape of spatial robustness[END_REF].

A natural approach to address robustness in a broad sense is to combine defenses that address common corruptions with defenses that address adversarial examples. Unfortunately, it is possible that two defenses are not compatible and do not combine well [START_REF] Tramer | Adversarial training and robustness for multiple perturbations[END_REF], [START_REF] Yin | A fourier perspective on model robustness in computer vision[END_REF], [START_REF] Kang | Testing robustness against unforeseen adversaries[END_REF].

A few standalone methods have been recently proposed to address adversarial robustness and robustness to common corruptions at the same time. In [START_REF] Orhan | Robustness properties of facebook's resnext WSL models[END_REF], [START_REF] Xie | Self-training with noisy student improves imagenet classification[END_REF], a large set of unlabeled data are leveraged to get a significant increase in common corruption robustness and a limited increase in adversarial robustness. However, using these methods has a prohibitive computational cost. Adversarial Noise Propagation adds adversarial noise into the hidden layers of neural networks during the training phase to address both robustnesses [START_REF] Liu | Training robust deep neural networks via adversarial noise propagation[END_REF]. Adversarial Logit Pairing (ALP) encourages trained models to output similar logits for adversarial examples and their clean counterparts [START_REF] Kannan | Adversarial logit pairing[END_REF]. In addition to the adversarial robustness provided, it has been reported that ALP increases the robustness to some common corruptions [START_REF] Hendrycks | Benchmarking neural network robustness to common corruptions and perturbations[END_REF]. The drawback of these methods is that they reduce the clean accuracy of trained models.

To be useful in real-world applications, we want our method to preserve the clean accuracy of the trained models, to increase the robustness to both adversarial examples and common corruptions, and to be easy to integrate into an existing training framework.

Combining Mixup with Targeted Labeling Adversarial

Training: M-TLAT Our approach called M-TLAT is a combination of two data augmentation algorithms, which are Mixup [START_REF] Zhang | mixup: Beyond empirical risk minimization[END_REF] and a new adversarial training strategy called Targeted Labeling Adversarial Training (TLAT). Basically, Mixup aims to increase the common corruption robustness while TLAT aims to increase the adversarial robustness. We go more into details in Section 5.3 to understand the contribution of each component. In practice, we observe that those augmentations combine well to address robustness in a broad sense.

Mixup

Let us consider the couples (x i , y i ) and (x j , y j ), where x i and x j are images of the training set and y i and y j are their associated one-hot encoding labels. Mixup [START_REF] Zhang | mixup: Beyond empirical risk minimization[END_REF] is a data augmentation algorithm that interpolates linearly samples and labels (see Figure 1):

x mix = λ * x i + (1 -λ) * x j y mix = λ * y i + (1 -λ) * y j ( 1
)
where λ is drawn from a Beta distribution defined by an hyperparameter α: λ ∼ Beta(α, α). This augmentation strategy encourages the trained models to have a linear behavior in-between training samples [START_REF] Zhang | mixup: Beyond empirical risk minimization[END_REF], [START_REF] Verma | Manifold mixup: Better representations by interpolating hidden states[END_REF]. In practice, Mixup reduces the generalization error of classifiers, makes neural networks less sensitive to corrupted labels and slightly improves the robustness to adversarial examples. In the ablation study carried out in Section 5.3, we detail the influence of Mixup on neural network robustness.

Augmenting datasets by interpolating samples of training sets have been largely studied [START_REF] Tokozume | Between-class learning for image classification[END_REF], [START_REF] Inoue | Data augmentation by pairing samples for images classification[END_REF]. Among the most successful, the Manifold Mixup interpolates hidden representations instead of interpolating the inputs directly [START_REF] Verma | Manifold mixup: Better representations by interpolating hidden states[END_REF]. The Mixup Inference proposes to use Mixup in the inference phase to degrade the perturbations that may corrupt the input images [START_REF] Pang | Mixup inference: Better exploiting mixup to defend adversarial attacks[END_REF]. Directional Adversarial Training and Untied Mixup are alternative policies to pick the interpolation ratios of the mixuped samples and labels [START_REF] Archambault | Mixup as directional adversarial training[END_REF]. The proposed M-TLAT algorithm uses the standard Mixup, but it is not incompatible with the other interpolation strategies mentioned in this paragraph.

Targeted Labeling Adversarial Training: TLAT

M-TLAT relies on a second data augmentation procedure: adversarial training, which consists in adding adversarial examples into the training set [START_REF] Goodfellow | Explaining and harnessing adversarial examples[END_REF], [START_REF] Madry | Towards deep learning models resistant to adversarial attacks[END_REF]. It is one of the most efficient defenses against adversarial examples [START_REF] Athalye | Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples[END_REF]. We consider an unperturbed sample x clean of size S and its label y clean . We can corrupt x clean to build an adversarial example x adv :

x adv = x clean + arg max δ∈[-, ] S {L(x clean + δ, y clean , θ)} y adv = y clean (2)
Where θ are the parameters of the attacked model. L is a cost function like the cross-entropy function. The value defines the amount of the introduced adversarial perturbation. As suggested in [START_REF] Kurakin | Adversarial examples in the physical world[END_REF], adversarial training is even more efficient when it uses adversarial examples that target a specific class y target . The augmentation strategy becomes:

x adv = x clean -arg max δ∈[-, ] S {L(x clean + δ, y target , θ)} y adv = y clean (3)
One advantage to use target adversarial examples during training is to prevent label leaking [START_REF] Kurakin | Adversarial machine learning at scale[END_REF]. We propose to improve this augmentation strategy by using y target in the labeling of the adversarial examples. In particular, we propose to mix the one-hot encoding ground-truth labels of the original samples with the one-hot encoding target labels used to craft the adversarial examples:

x adv = x clean -arg max δ∈[-, ] S {L(x clean + δ, y target , θ)} y adv = (1 -) * y clean + * y target (4)
We call this augmentation strategy Targeted Labeling Adversarial Training (TLAT). The arg max part is approximated with an adversarial example algorithm such as target FGSM [START_REF] Kurakin | Adversarial examples in the physical world[END_REF]:

x adv = x clean - * sign(∇ x clean L(x clean , y target , θ)) (5)
FGSM is used because it is a computationally efficient way to craft adversarial examples [START_REF] Goodfellow | Explaining and harnessing adversarial examples[END_REF], [START_REF] Tramr | Ensemble adversarial training: Attacks and defenses[END_REF]. As for traditional adversarial trainings, models trained with TLAT should be trained on both clean samples and adversarial samples [START_REF] Kurakin | Adversarial examples in the physical world[END_REF]. The advantage of TLAT is to make models have a high clean accuracy compared to the models trained with a standard adversarial training algorithm. More details can be found in Section 5.4.

TLAT uses soft labels instead of one-hot encoding labels. Using soft labels is a recurrent idea in the methods that address robustness. As mentioned above, Mixup interpolates training labels to generate soft labels [START_REF] Zhang | mixup: Beyond empirical risk minimization[END_REF]. Label smoothing replaces the zeros of one-hot encoding labels by a smoothing parameter s > 0 and normalizes the high value so that the distribution still sums to one [START_REF] Szegedy | Rethinking the inception architecture for computer vision[END_REF]. Distillation learning uses the logits of a trained neural network to train a second neural network [START_REF] Papernot | Distillation as a defense to adversarial perturbations against deep neural networks[END_REF]. The second network is enforced to make smooth predictions by learning on soft labels. Bilateral training generates soft labels by adversarially perturb training labels [START_REF] Wang | Bilateral adversarial training: Towards fast training of more robust models against adversarial attacks[END_REF]. It uses the gradient of the cost function of an attacked model to generate adversarial labels. Models trained on both adversarial examples and adversarial labels are encouraged to have a small gradient magnitude which makes them more robust to adversarial examples.

The originality of TLAT is to use the target labels of adversarial attacks as a component of the soft labels. Intuitions about why this labeling strategy works are provided in Section 5.4.

M-TLAT

The idea of M-TLAT is to generate new training couples by applying sequentially the TLAT perturbations (4) after the Mixup interpolations (1):

x mtlat = x mix -arg max δ∈[-, ] S {L(x mix + δ, y target , θ)} y mtlat = (1 -) * y mix + * y target (6)
As displayed in Figure 1, x mtlat contains features that come from three distinct sources: two clean images and an adversarial perturbation that targets a specific class. The label y mtlat contains the class and the weight associated with each source of features. These weights are determined by the values λ and . A model trained with M-TLAT is not only constraint to predict the classes that correspond to the three sources. It also has to predict the weight of each source within the features of x mtlat . We believe that being able to predict the class and the weighting of the three sources requires a subtle understanding of the features present in images. In practice, being trained with augmented couples (x mtlat , y mtlat ) makes neural networks more robust.

The expressions [START_REF] Dhillon | Stochastic activation pruning for robust adversarial defense[END_REF] are the essence of the algorithm. The whole process of one training step with M-TLAT is provided in the algorithm description 1. As recommended in [START_REF] Kurakin | Adversarial examples in the physical world[END_REF], the training minibatches contain both adversarial and nonadversarial samples. In our algorithm, the non-adversarial samples are obtained using a standard Mixup interpolation, the adversarial samples are crafted by combining Mixup and TLAT.

Another recently proposed approach combines Mixup and adversarial training [START_REF] Lamb | Interpolated adversarial training: Achieving robust neural networks without sacrificing too much accuracy[END_REF]. Their method called Interpolated Adversarial Training (IAT) is different from M-TLAT for two main reasons. Most importantly, they do not use the labeling strategy of TLAT. Basically, their adversarially corrupted samples are labeled using the standard Mixup interpolation while our labels contain information about the amount and the target of the used adversarial examples. Secondly, we interpolate images before adding the adversarial corruptions. On the contrary they adversarially corrupt images before mixing them up. In practice, we get better adversarial robustness when we proceed in our order. Besides, proceeding in their order doubles the number of adversarial perturbations to compute: it increases the training time. In Section 5.2, we compare the robustness of two models trained with these approaches.

Experiment Set-up

Perturbation Benchmark

We want to evaluate the robustness of neural networks in a broad sense, covering the most encountered common corruptions and adversarial examples. To achieve this, we gather a large set of perturbations that contains nineteen common corruptions and five adversarial attacks.

= λ1 * x1 + (1 -λ1) * x2 ymix1 = λ1 * y1 + (1 -λ1) * y2 xmix2 = λ2 * x3 + (1 -λ2) * x4 ymix2 = λ2 * y3 + (1 -λ2) * y4 x mtlat = xmix2 - * sign(∇x mix2 L(xmix2, ytarget, θ)) y mtlat = (1 -) * ymix2 + * ytarget loss1 = L(xmix1, ymix1, θ) loss2 = L(x mtlat , y mtlat , θ) loss = loss1 + loss2 gradients = ∇ θ loss optim.update(gradient, θ)
The optimizer updates θ according to the gradients Common Corruptions. The benchmark includes the common corruptions of ImageNet-C [START_REF] Hendrycks | Benchmarking neural network robustness to common corruptions and perturbations[END_REF]. The ImageNet-C set of perturbations contains diverse kinds of common corruptions such as 1) noises: Gaussian noise, shot noise and impulse noise 2) blurs: defocus blur, glass blur, motion blur and zoom blur 3) weather related corruptions: snow, frost, fog and brightness 4) digital distortions: contrast, elastic, pixelate and jpeg compression. Each corruption is associated with five severity levels. We use the corruption functions3 provided by the authors to generate those perturbations. The rotation, translation, color distortion and occlusion common corruptions are absent from ImageNet-C, yet they are often encountered in industrial applications. We decided to add those four perturbations to the pool of common corruptions. The occlusion perturbation is modeled by masking a randomly selected region of images with a grey square. For the images corrupted with color distortion, one of the RGB channel is randomly chosen and a constant is added to all the pixels of this channel. For the rotation and translation perturbations, the pixel values of the area outside the transformed images are set to zero.

These four corruptions are associated with a severity range. The lower bound of the severity range has been set to reduce the accuracy of the standard ResNet-50 by five percent on the test set. The upper bound has been set to reduce its accuracy by thirty percent. As a result, the rotations can turn images from 8 to 40 degrees. In other words, when the images of the test set are rotated by eight degrees, the accuracy of the standard ResNet-50 is five percent lower than for a not-corrupted test set. The side of the square mask used in the occlusions varies from 60 to 127 pixels. The translations can move images from 15 to 62 pixels. For the color distortion corruption, the values of the pixels of the perturbed channel are increased from 8% to 30% of the maximum possible pixel value.

Adversarial Examples. Following the recommendations in [START_REF] Carlini | On evaluating adversarial robustness[END_REF], we carefully choose the adversarial examples to be added to the benchmark. Firstly, we use adversarial examples in both white box and black box settings. Secondly, we use two different metrics, the L ∞ and the L 2 norms, to compute the bound of adversarial attacks. Thirdly, we employ targeted and untargeted attacks. Fourthly, several amounts of adversarial perturbations are used. Finally, the selected adversarial examples are not used during trainings. We build a set of adversarial examples to cover all the conditions mentioned above.

We note the amount of the introduced perturbation in adversarial examples. We use PGD with = 0.04 as a white-box L ∞ bounded attack [START_REF] Madry | Towards deep learning models resistant to adversarial attacks[END_REF]. We generate targeted adversarial attacks by using PGD LL, which targets the least likely class according to attacked models [START_REF] Kurakin | Adversarial examples in the physical world[END_REF]. We use MI FGSM with = 0.04 and = 0.08 as black-box attacks [START_REF] Dong | Boosting adversarial attacks with momentum[END_REF]. A VGG network trained on the same training set is used to craft these black-box attacks. PGD, PGD LL and MI FGSM are computed over ten iterations. We use the Carlini-Wagner attack (CW 2 ) as a L 2 white-box bounded attack [START_REF] Carlini | Towards evaluating the robustness of neural networks[END_REF]. We perform the optimization process of this attack with 40 iterations and a confidence score of 50.

The gathered common perturbations and adversarial examples constitute the perturbation benchmark. It is used in the experimental section in order to evaluate and compare the robustness of models.

Training Details

The trained models are either a ResNet-50 [START_REF] He | Deep residual learning for image recognition[END_REF] or a ResNeXt-50 with the 32x4d template [START_REF] Xie | Aggregated residual transformations for deep neural networks[END_REF]. We use a batch size of 256 and 90 training epochs. The Adam optimizer [START_REF] Kingma | Adam: A method for stochastic optimization[END_REF] is used with a learning rate of 0.002 and a weight decay of 10 -4 . At the end of the epochs 30, 60 and 80, the learning rate is divided by 10. The cost function is the cross entropy. We use the same hyperparameters for all trainings.

All models are trained and tested using ImageNet. Because of a limited computational budget, we used a subset of ImageNet built on 100 randomly chosen classes. For each class, ten percent of the images are preserved for the test set. Then, the training set and the test set contain respectively 10 5 and 10 4 images. The only pre-processing used is the resizing of images to the 224*224 format.

We call the models trained without any data augmentation the standard models. We observed that the highest clean accuracy for the models trained with mixup is reached when α = 0.4, so we used this value in all experiments.

The adversarial examples used in trainings are crafted using FGSM with ∼ U [0, 0.025]. The range of pixel values of images in our experiments is [0, 1].

Performance Evaluation

Robustness Score

To measure the robustness of a model to a perturbation, we compare the performance of this model on clean samples with its performance on perturbed samples:

R φ N = A φ A clean (7)
We call R φ N the robustness score of a neural network N towards a perturbation φ. A clean is the accuracy of the model on the clean test set and A φ is its accuracy on the test set corrupted with the φ perturbation. φ can be either a common corruption or an adversarial attack.

This robustness score metric should be used carefully because it masks the clean accuracy of neural networks. Indeed, an untrained model that always makes random outputs, would have the same accuracy for clean samples than for corrupted samples. Its robustness scores would be equal to 1, so it could be considered as completely robust to any common corruption. Therefore, in this study, before comparing the robustness scores of two neural networks we always make sure that their clean accuracies are also comparable.

Performances of M-TLAT on the Perturbation Benchmark

For the first experiment we train one Resnet-50 and one ResNeXt-50, using the M-TLAT algorithm. The training of these models took a dozen of hours using a single GPU Nvidia Tesla V100. We also train one Resnet-50 and one ResNeXt-50 with the IAT algorithm [START_REF] Lamb | Interpolated adversarial training: Achieving robust neural networks without sacrificing too much accuracy[END_REF]. We compute the robustness scores of the trained models towards all the perturbations of the benchmark. The results are reported in Table 1.

In Tables 1 and2, the Clean column contains the accuracy of the models on the not-corrupted test set. Each of the other columns contains the robustness scores to a perturbation of the benchmark. For the corruptions of the ImageNet-C benchmark, the displayed scores correspond to the mean robustness score of the corruptions computed with their five severity levels. To better visualize the effect of the augmentation algorithms, we use either a "-" index or a "+" index, to signify if a model is less or more robust than the standard model to a perturbation.

We observe in Table 1 that the models trained with M-TLAT are slightly more accurate than the standard models on clean images. They are also more robust than the standard models to every single tested common corruption. We see that using M-TLAT makes neural networks much more robust to the CW 2 and PGD LL attacks. It also makes models less sensitive to black-box adversarial examples. We observe that the robustness gain for the PGD attack is less important. For comparison, the IAT algorithm tends to reduce the clean accuracy. It does not increase the robustness to all the common corruption of the benchmark. In particular, it significantly decreases the robustness towards the Jpeg perturbation. Besides, the IAT models are significantly less robust to adversarial examples than the M-TLAT models.

Using FGSM during training is known to poorly defend models against iterative adversarial attack such as PGD [START_REF] Kurakin | Adversarial machine learning at scale[END_REF]. The robustness of the M-TLAT models towards PGD can likely be increased by replacing FGSM by an iterative adversarial attack [START_REF] Madry | Towards deep learning models resistant to adversarial attacks[END_REF]. But this would increase significantly the training time. That is the reason why this option has not been tested yet.

To our knowledge, M-TLAT is the first data augmentation approach that is able to increase the robustness to every single common corruption and adversarial example of a large set of diverse perturbations, without reducing the clean accuracy.

Complementarity between Mixup and TLAT

To better understand the effect of each constituent of the M-TLAT algorithm, we proceed to an ablation study. Two ResNet-50 are respectively trained with the Mixup and TLAT data augmentations. We report their robustness to the perturbation benchmark in Table 2.

First, we notice that Mixup causes an increase of the clean accuracy, which is coherent with observations made in [START_REF] Zhang | mixup: Beyond empirical risk minimization[END_REF]. On the contrary, TLAT makes the trained model less accurate on the clean data. But those two effects seem to cancel each other because the M-TLAT model and the standard model have comparable clean accuracies as observed in Table 1a. In Tables 2a and2b, we observe that Mixup makes the trained model more robust than the standard model to all the common corruptions but the Motion Blur, Pixelate and Jpeg corruptions. We observe in Table 2c that Mixup has a little influence on adversarial robustness, with either a slight increase or decrease of the robustness depending on the considered attack.

Fortunately, TLAT makes models much more robust to any adversarial attacks. Indeed, the TLAT model is much more difficult to attack with the black box adversarial examples or with the CW 2 attack. It is also significantly more robust to PGD LL and slightly more robust to PGD. For common corruptions, the effect of TLAT is very contrasted. Concerning the noise and blur corruptions (the seven first corruptions of the Table 2a), the TLAT model is much more robust than the standard model. For some other common corruptions like Fog or Contrast, the TLAT augmentation decreases significantly the robustness scores.

It is clear that the M-TLAT models are much more robust to adversarial examples thanks to the contribution of TLAT. However, for common corruptions, Mixup and TLAT are remarkably complementary. Concerning the few corruptions for which Mixup has a very negative effect on robustness (Jpeg and Pixelate), TLAT has a strong positive effect. Similarly, for the Fog and Contrast corruptions, TLAT makes models less robust while Mixup makes them much more robust.

The ablation study indicates that both components are important to increase the robustness to a large diversity of perturbations.

Labeling in Adversarial Trainings

Comparison of the Labeling Strategies

Adversarial trainings increase the adversarial robustness of the trained models, but they also reduce their accuracy on clean samples [START_REF] Tsipras | Robustness may be at odds with accuracy[END_REF], [START_REF] Kurakin | Adversarial machine learning at scale[END_REF]. In this section, we want to show that TLAT decreases less the clean accuracy of the trained models than traditional adversarial trainings.

To achieve it, we trained four ResNet-50 with different kinds of adversarial training algorithms. The first model is trained using untarget FGSM and the second is trained using target FGSM with randomly chosen target. Both use adversarial examples labeled with the ground-truth labels. We train another model with target FGSM but regularized via label smoothing (LS) [START_REF] Szegedy | Rethinking the inception architecture for computer vision[END_REF], we call it the LS model. For this model, we use a smoothing parameter equal to , where is the amount of the FGSM perturbation. In other words, the one values of the one-hot encoding vectors are replaced by 1 -and the zeros are replaced by /N where N is the number of classes. The fourth model is trained using the TLAT algorithm. All models are trained with minibatches that contain both clean samples and adversarial examples. We measure the clean accuracy of those models: results are displayed in Table 3.

We see that TLAT is the adversarial training method that reduces the less the clean accuracy. This result shows that TLAT is important to preserve the clean accuracy of the models trained with M-TLAT, all the while making them more robust to adversarial examples.

Using soft labels in trainings is known to help models to generalize [START_REF] Papernot | Distillation as a defense to adversarial perturbations against deep neural networks[END_REF], [START_REF] Szegedy | Rethinking the inception architecture for computer vision[END_REF]. Here we want to make sure that the usage of soft labels is not the main reason of high clean accuracy of TLAT. To achieve it, we compare the performances of the TLAT and LS models. Even if the LS model also uses soft labels during training, it performs worse than the TLAT model. Consequently, the good performances of TLAT are not due to the usage of soft labels. We believe TLAT performs well because it uses labels that contain information about the target of the adversarial examples.

Interpretation

The TLAT augmentation is motivated by the works of Ilyas et al [START_REF] Ilyas | Adversarial examples are not bugs, they are features[END_REF]. In their study, they reveal the existence of brittle yet highly predictive features in the data. Neural networks largely depend on those features even if they are nearly invisible to human eye. They are called non-robust features. Ilyas et al. show that a model that only uses non-robust features to complete properly a task still generalize well on unseen data. They use this phenomenon to interpret adversarial vulnerability. Adversarial attacks are small perturbations, so they mainly affect non-robust features. They can especially make those brittle features anti-correlated with the true label. As neural networks largely rely on non-robust features, their behaviour is completely disturbed by adversarial attacks.

In Adversarial trainings, neural networks encounter adversarial examples that can have non-robust features uncorrelated with the true label. The trained models are then constrained to less rely on non-robust features. This can explain the success of adversarial training: adversarially trained models give less importance to non-robust features so they are much more difficult to attack with small perturbations.

Despite its efficiency, adversarial training generally causes a decrease in clean accuracy [START_REF] Tsipras | Robustness may be at odds with accuracy[END_REF], [START_REF] Kurakin | Adversarial machine learning at scale[END_REF], [START_REF] Zhang | Theoretically principled trade-off between robustness accuracy[END_REF]. One possible reason could be that adversarial patterns in the training adversarial examples are not coherent with the ground-truth label. Consequently, an adversarially trained model encounters samples for which the features are not completely coherent with labelling.

The proposed method tries to make the labeling of target adversarial examples more correlated with its non-robust features. Targeted adversarial attacks make non-robust features of a sample correlated with a target class. So instead of labelling only with the ground-truth class of the attacked sample, the method introduces a part related to the target class. Therefore, the trained model still learns the true original class of the attacked sample, but the label used for learning is more correlated with the non-robust features of this sample. We believe this could be the reason why our method has better performance than traditional target adversarial training in practice.

Conclusion

We propose a new data augmentation strategy that increases the robustness of neural networks to a large set of common corruptions and adversarial examples. The experiments carried out suggest that the effect of M-TLAT is always positive: basically, it increases the robustness to any corruption without reducing the clean accuracy. We believe using M-TLAT can be particularly useful to help industrials to increase the robustness of their neural networks without being afraid of any counterpart.

As part of the M-TLAT algorithm, we use the new adversarial augmentation strategy TLAT. We show that models trained with TLAT have a better accuracy on clean samples than the models trained with a standard adversarial training algorithm. The idea of TLAT is to interpolate the target labels of adversarial examples with the ground-truth labels. This operation is computationally negligible and can be used in any trainings with target adversarial examples in order to improve the clean accuracy.

In future works, we would like to replace FGSM by an iterative adversarial attack in our algorithm and observe how this would influence the clean accuracy and the adversarial robustness of the models trained with M-TLAT. It would be also interesting to replace Mixup by a different interpolation strategy such as Manifold Mixup [START_REF] Verma | Manifold mixup: Better representations by interpolating hidden states[END_REF], and test if it further improves the performances of the algorithm.

Fig. 1 :

 1 Fig. 1: Visualising of the generation of a new training couple using M-TLAT

Algorithm 1

 1 One training step of the M-TLAT algorithm Require: θ the parameters of the trained neural network Require: L a cross entropy function Require: (x1, y1), (x2, y2), (x3, y3), (x4, y4) ∼ Dataset Require: λ1, λ2 ∼ Beta(α, α) Require: ∼ U [0, max] where U is a uniform distribution and max is the maximum perturbation allowed Require: ytarget ∼ U [0, N ] where N is the number of classes Require: optim an optimizer like Adam or SGD xmix1

Table 1 :

 1 Effect on robustness of M-TLAT and comparison with IAT (a) Robustness scores towards the common corruptions of ImageNet-C -0.47 + 0.46 + 0.42 + 0.51 + 0.65 + 0.58 + 0.68 + 0.49 + 0.78 + 0.66 + 0.79 + 0.78 + 0.84 + 0.82 + 0.63 - M-TLAT 73.9 + 0.56 + 0.54 + 0.52 + 0.41 + 0.61 + 0.58 + 0.63 + 0.49 + 0.59 + 0.61 + 0.82 + 0.58 + 0.85 + 0.94 + 0.95 + -0.46 + 0.44 + 0.43 + 0.53 + 0.67 + 0.62 + 0.70 + 0.51 + 0.73 + 0.69 + 0.81 + 0.80 + 0.85 + 0.83 + 0.59 - M-TLAT 76.5 + 0.57 + 0.55 + 0.54 + 0.44 + 0.64 + 0.60 + 0.66 + 0.52 + 0.68 + 0.67 + 0.86 + 0.70 + 0.85 + 0.95 + 0.95 +

		Clean Gauss Shot Impul Defocus Glass Motion Zoom Snow Fog	Frost Bright Contr Elastic Pixelate Jpeg
	ResNet	standard 73.3	0.17	0.17	0.12	0.25	0.35	0.41	0.47	0.31	0.48	0.34	0.78	0.34	0.73	0.65	0.80
	IAT 73.2 ResNeXt standard 76.4	0.25	0.25	0.20	0.28	0.37	0.44	0.48	0.36	0.53	0.37	0.79	0.36	0.75	0.72	0.74
	IAT 74.7 (b) Robustness scores towards our	(c) Robustness scores towards adversarial
	additional common corruptions						examples
		Obstru Color	Trans	Rot				pgd =0.04	pgd ll =0.04	cw l2 mi fgsm =0.04	mi fgsm =0.08
	ResNet	standard IAT M-TLAT 0.75 + 0.74 0.71 -	0.76 0.89 + 0.75 -0.72 + 0.78 0.68 0.86 + 0.79 + 0.74 +	ResNet	standard IAT M-TLAT 0.08 + 0.00 0.01 +	0.00 0.08 + 0.84 + 0.87 + 0.00 0.58 0.45 + 1.00 + 0.96 +		0.34 0.78 + 0.87 +
	ResNeXt standard IAT M-TLAT 0.76 + 0.75 0.72 -	0.82 0.90 + 0.77 -0.71 -0.82 0.72 0.89 + 0.82 0.74 +	ResNeXt standard IAT M-TLAT 0.09 + 0.00 0.01 +	0.00 0.11 + 0.95 + 0.87 + 0.00 0.58 0.38 + 0.99 + 0.95 +		0.33 0.81 + 0.87 +

Table 2 :

 2 Influence on robustness of the Mixup and TLAT data augmentations (a) Robustness scores towards the corruptions of ImageNet-C + 0.28 + 0.28 + 0.24 + 0.25 0.38 + 0.39 -0.53 + 0.38 + 0.79 + 0.53 + 0.78 0.75 + 0.75 + 0.58 -0.61 - TLAT 69.4 -0.57 + 0.54 + 0.51 + 0.43 + 0.60 + 0.56 + 0.60 + 0.41 + 0.15 -0.41 + 0.78 0.13 -0.84 + 0.94 + 0.97 +

		Clean Gauss Shot Impul Defocus Glass Motion Zoom Snow Fog	Frost Bright Contr Elastic Pixelate Jpeg
	ResNet	standard 73.3	0.17	0.17	0.12	0.25	0.35	0.41	0.47	0.31	0.48	0.34	0.78	0.34	0.73	0.65	0.80
	Mixup 74.9 (b) Robustness scores towards our		(c) Robustness scores towards adversarial
	additional common corruptions						examples
			Obstru Color	Trans	Rot				pgd =0.04	pgd ll =0.04	cw l2 mi fgsm =0.04	mi fgsm =0.08
	ResNet standard Mixup TLAT	0.74 0.75 + 0.69 -	0.76 0.88 + 0.76	0.78 0.79 + 0.67 -	0.68 0.71 + 0.66 -	ResNet standard Mixup TLAT	0.00 0.00 0.10 +	0.00 0.00 0.74 +	0.00 0.202 + 0.61 + 0.58 0.97 + 0.98 +	0.34 0.22 -0.93 +

Table 3 :

 3 Comparison of the performances of the TLAT augmentation with the performances of other kinds of adversarial trainings

		standard	FGSM	target-FGSM	LS	TLAT
	clean accuracy	73.3	65.8	68.3	67.1	69.4

https://github.com/hendrycks/robustness


Gilles Arnold
email: gilles.arnold@uha.fr

Rodrigo Labat

Rachid Rahouadj

Mechanical behavior of rat tendons under cyclic tensile loadings

). It results a complex mechanical behavior (which is also coupled with bio-chemical phenomena). Tendinitis is a common disease of the tendon which if untreated can result in serious long-term complications. It is generally treated using nonsteroidal anti-inflammatory drugs (NSAID) which give good results against pain. An alternative to drugs is Low Level Laser Therapy (LLLT). The aim of this study is to compare the effect of LLLT and NSAID treatment on the mechanical properties in the case of acute inflammation of tendon. In a first step, indicators of the mechanical performance of tendons are proposed. In a second step the link with the microstructure is discussed to find more pertinent indicators of the general mechanical properties of tendons.

INTRODUCTION

To characterize the mechanical behavior of the tendon, the current literature refers primarily to the strength and elongation at rupture and to the stiffness measured in the linear region of the tensile curve (Sahin et al., 2012). These mechanical properties correspond to the behavior under monotonic loading which doesn't reflect adequately the in vivo conditions. In this study, cyclic loading have been performed on rats tendons after different treatments. Numerous mechanical properties were extracted from each test. There modifications were evaluated and linked to the acute inflammatory process and treatments. The correlations between mechanical properties and biochemical indicators have been analyzed (Marcos et al., 2013).

APPROACH

The experimental protocol was conducted as described in a previous paper (Marcos et al., 2013).

Samples preparation

Tendinitis was induced in a group of male Wistar rats using collagenase, an enzyme that degrades collagen and induces an acute inflammatory process. The same procedure was used for a control group (CTL) without collagenase. A first group (DIC) was treated using diclofenac sodium (Voltaren injectable® -Novartis 2.5 mg/kg). Two other groups (L1J and L3J) were treated by laser irradiation with doses of 1 J and 3 J respectively. The last group (TEN) was not subjected to any treatment of tendinitis. The animals of the DIC, L1J and L3J groups were treated in the same conditions for 6 days. On day 7, animals were sacrificed with halothane. Achilles tendons were dissected and immediately used for biomechanical analysis.

Biomechanical Analysis

Musculotendinous junction (MTJ) was fixed in the lower grip as osteotendinous junction (OTJ) was fixed in the upper one using a universal tensile test machine (zL2.5 Zwick-Roell -Germany). The distance L 0 between the grips (Fig. 1b) was measured before each test, its mean value was approximately 2 mm. Displacement u was controlled following loading and unloading cycles at a constant velocity of 1 mm/min. At each cycle, maximal displacement applied to tendon was increased of 10% of L 0 and tensile force F was released until 0.1 N. The sequence was repeated until rupture (Fig. 2). Several mechanical characteristics were extracted from the forcedisplacement curves obtained from cyclic loadings of each tendon. The consideration of numerous characteristics enables description of tendon mechanical behavior without to prejudge the choice of a particular set of parameters. Three stiffnesses were measured at each loading unloading cycle (indexed i) as illustrated in Fig. 2: secant stiffness k s as the load / displacement ratio; tangent stiffness k t as the local slope of the envelope of the loading curve; unloading stiffness k u as the slope of the curve immediately after a maximum point M i ( Fi , u i ):

i i i s u F k  1 1      i i i i i t u u F F k with i ={1…n} and (F 0 = 0, u 0 = 0)        i dF i u M u

RESULTS AND DISCUSSION

Representative loaddisplacement curves are shown in Fig. 3 for the DIC and L1J groups as examples. Envelope curves exhibit the typical response obtained for tendon under monotonic loading: i.e. a "toe" region, followed by a "linear" part up to a maximum ( Fmax , F max ) beyond which the force decreases. This evolution is commonly explained by the helical shape of the collagen molecules (Grytz et al., 2009) and by the well-known phenomena of gradual recruitment of collagen fibers. Large differences of load levels were also observed. Because of the shape of the load displacement envelope curves, the evolution of stiffnesses k s and k t with displacement u (Fig. 3) exhibited an increasing phase, a maximum and a final decreasing phase where k t reached negative values. If the initially increasing evolution of k t was linked to the reorientation of the fibers, the suddenly decreasing evolution of k t could be explained by a gradual fracture of the fibers that could be described using a damage variable (Weisbecker et al., 2012). The evolution of the unloading stiffness k u with displacement was different but could also be partially explained by damage: it increased linearly up to saturation close to the maximum load. One can note that the maximum value of the secant stiffness k s was reached when the secant was tangent to the envelope curve, corresponding to the maximum global stiffness of the tendon. Tangent stiffness k t and unloading stiffness k u describe the response of the tendon under an increasing or a decreasing load, respectively. The tangent stiffness k t reveals the ability of the tendon to resist to a force increment at a given force level. The unloading stiffness values were much higher than the values of secant and tangent stiffnesses. This difference could be related with the viscoelastic behavior that was not assessed in this study.

CONCLUSION AND FUTURE WORK

In the framework of this study, the definition of different stiffnesses has enabled to describe the evolution of the mechanical properties of the tendons under cyclic loading. In a future work, models of the literature could be adapted and identified using these results in order to assess more accurate information on the behavior like viscosity and damage.

KEYWORDS

Tendon, LLLT, stiffness, tensile behavior

Figure 1 :

 1 Figure 1: (a) Multiscale microstructure from tendon (from Screen et al., 2005); (b) Rat Achilles tendon.

F k 0

 0 The stretch  was defined as the ratio L / L 0 where L and L 0 are respectively the current and initial distances between the two grips of the loading device (L = L 0 + u). The maximum value of the force F max and the corresponding value of the stretch  Fmax characterize the mechanical strength in term of load and elongation. The maximum of each stiffness was measured: k s max , k t max and k u max , as well as the corresponding force and stretch values: (F ks max ,  ks max ), (F kt max ,  kt max ) and (F ku max ,  ku max ) respectively. Finally 11 measured values were considered for each tested tendon.

Figure 2 :

 2 Figure 2: Definition of the 3 different stiffnesses at each cycle.

Figure 3 :

 3 Figure 3: Representative F-u curve, k s ,k t and k u evolution for DIC and L1J groups.


I Balbzioui
email: issam.balbzioui@uha.fr

B Hasiaoui
email: basma.hasiaoui@uha.frc

G Barbier
email: gérald.barbier@uha.frd

G L'hostis
email: gildas.lhostis@uha.fre

F Laurent

) A Ibrahim

B Durand

A COMBINAISON OF UV CURING TECHNOLOGY WITH ATL PROCESS

In order to reduce the time and the cost of manufacturing composite, UV curing technology combined with automated tape placement process (ATL) based on reverse approach by working with a fixed head was studied in this article. First, a brief description of the developed head placement is presented. Mechanical properties are then evaluated by varying process parameters, including compaction force and tape placement speed. Finally, a parametric study is carried out to identify suitable materials and process parameters to manufacture a photo composite material with high mechanical performances. The obtained results show that UV curing is a very good alternative for thermal polymerization because of its fast cure speed due to less dependency on temperature.

INTRODUCTION

In automobile and aircraft sectors, the use of composites can reduce fuel consumption and thereby contribute to reduce the environmental impact [START_REF] Guillaume | Comparaison de concepts de moteur diesel en vue de leur hybridation[END_REF]. For this reason, since 1970, there has been observed a tremendous growth in the field of automated manufacturing process and yet there seems no end to this progressing trend. Several new techniques started to appear on the composite material market. Automated Tape Laying (ATL) and Automated Fiber Placement (AFP) are the two main technologies used to automate the lay-up of thermoset and thermoplastic prepreg [START_REF] Lindbäckand | New Automated Composite Manufacturing Process[END_REF]. These processes consist of delivering prepreg (wide prepreg tape in ATL or tow in AFP) onto the adjacent surfaces to cover the entire mold. In both processes an automated machine (5 axis, or robot 6 axis) is used to ensure the kinematic motion of the prepreg placement system named as head placement. The current composite market placement philosophy consists of working with a fixed mold and a removable head placement. There are many advantages of this operating mode such as, the good mastery of the programing placement trajectory and the capacity to manufacture largesized parts as aircraft wings, and to keep stable the deposited prepreg. But the main problem of this approach is the cumbersome of the head placement, which limits their use to large-sized parts only and makes it difficult for small parts. In first step, consequently, we intend to work with a reverse approach, using removable mold and fixed head placement.

The second part of this work will investigate the consolidation by using UV technology (UV Curing). In spite of the proper advantages that this technology presents, like fast cure speed without decreasing the mechanical properties, lower cost when compared to thermal technologies, and the absence of phenomena associated to the temperature, there are still few researchers who dealt with this topic. So this field seems very promising and worthy to explore.

Finally, the obtained UV composite is performed to investigate the effect of process parameters on the mechanical properties. The obtained results show that the approach used in this paper is promising and will allow us to achieve high photo-composite material performances.

REVERSE APPROACHE OF PREPREG TAPE PLACEMENT Head Placement System

The existing head placement systems include several functions like, road prepreg system, cut system, priming system and heating system (IR, Laser,…). In addition to these mechanical systems, there are also automatic parts, for instance the servo control of the pregreg feed speed compared to the displacement speed of the robot. All these operations make these current placement systems very cumbersome. This does not allow these systems to fabricate small parts with low curvature radius, and a preform operation has to be done after the prepreg placement on a plane. In order to overcome these convenient, in this paper we propose to work with a fixed head, having a specific geometry for the compacting area. This choice makes the accessibility of the feed roller easier for all mold surface types (plane, concave or convex; with a low or high curvature radius). So the mold is removable and holds by a 6-axis robot. The advantage of this approach is that it can be adapted to the fabrication of parts of small or large dimensions, and make our process suitable to all sectors (automotive, aerospace….), contrary to the existing ones which are limited to large parts and specific sectors like aerospace (aircraft fuselage, wings..) or renewable energy (wind turbine…).

(a) (b)

Figure 1 shows the difference between the existing approach (a), and the approach proposed in this paper (b). This inverse approach requires a different programming for the robot, in particular linked to the basis and tool frame definitions. However, it is a known operating mode, which already exists in all current robot softs (mode similar to the seal deposit process for example).

The presented head placement (figure 1b), includes:  Cutting system  Priming system, which is ensured by the motor of a conditioning system for the prepreg protective film.  3D force sensor, to measure the force variation in the three directions. To keep a constant pressure during the process whatever the geometry, the head is mounted on a horizontal slideway, and the compaction is ensured by a pneumatic cylinder, which also plays the role of shock absorber. The force sensor is independently managed and operated, to simplify the functioning system.  Tension control system of the prepreg.

UV Curing

After having deposit prepreg tapes on the mold, a step of consolidation is primordial to form the final part. The resulting composite quality depends strongly on the consolidation pressure. Two types of consolidation can be used namely, in-situ consolidation, which is reached in one step under the compacting roller, and autoclave consolidation, which needs two stages (i.e. compaction by roller and autoclave cycle). In-situ consolidation with traditional heating source is very hard to be achieved, and requires a decrease in the placement speed. Thereby, using UV cure technology offers many advantages as short curing period without worrying about thermal phenomenon, less pollution, and reduction of manufacturing cost compared to the conventional head curing process [3][4]. Therefore a combination of UV curing technology and Automated Tape Placement (ATL) process is implemented to manufacture a thermoset photo composite.

Materials

Apart The UV prepreg was obtained by a impregnator machine. The polymer matrix is Nuvopole Based (Mader Research company), unsaturated 70% and diluated by 30% of styrene. As photo-initiator, 2% of Bis Acyl Phosphine Oxide (BAPO) (BASF Company) complement the mixture.

The reinforcement is a UD Glass fibers (8033F/A) from Chomarat with a width of 70mm, and a weight of 506g/m2. The mass rate of resin in the prepreg is 37±2%.

EXPERIMENTAL METHOD

It was necessary to start by carrying out preliminary tests to determine the optimal exposure dose to insure a good polymerization of laminate. The assembly developed in figure 2 allows measuring light dose transmittance during process.

. As illustrated in figure 2, the initial UV dose emitted by the lamp, is scattered on absorbed dose, reflected dose and transmitted dose. We suppose that reflected dose quantity is neglected, while the transmission (T) is expressed as:

T = I T I 0 ( 1
)
Where IT is the transmitted intensity (w/cm2), and I0 is initial intensity (w/cm2). Knowing that:

D = I 0 ´t (2)
Where D is the light dose of lamp (nm) and t is time (s) At first, a no load test (without layers) is performed to determine the emitted light dose by the lamp at a given speed of the mold (which is carried by the robot). The absence of layers allows neglecting the absorbed light and considering The second step, consists of depositing prepreg layers on the mold surface by the head placement system, and the process parameters used are defined using a design of experiments which will be introduced in a later paragraph.

The mold, which is carried by the robot, makes several passes under the lamp. It is considered that the substrate is completely polymerized when the dose emitted by the lamp is equal to the reference dose.

Figure 3 illustrates the evolution of the light penetration as a function the number of passes under the lamp.

INFLUENCE OF PROCESS PARAMETRES ON MECANICAL PROPERTIES

The objective of this part is to investigate the effect of process parameters on the mechanical properties for a 3 layers composite with a thickness of 1,7mm.

A full factorial design of the type nk was used is where k represents the number of factors (k=2) and n corresponds to the number of levels (n=3).

Factors represent the process parameters namely:

-Compacting force: varied between 200 and 600N -Speed placement prepreg: varied between 0,2 and 1m/s The mechanical properties testes performed are tensile test following NF EN ISO 527-5 standard and three-point bending following NF EN ISO 14125 standard.

Figure 4 show the influence of compacting force on the constraint and the module of tensile.

FIGURE 1 :

 1 FIGURE 1: Head placement system. (a) existing approach, (b) proposed approach

Figure 2 :

 2 Figure 2: Transmitted UV light dose measurement

Figure 4 :Figure 3 :

 43 Figure 4: Influence of compacting force on mechanical properties

ACKNOWLEDGMENTS

The authors express their grateful acknowledgement for financial support received from ADEM and Arkema. Sincere thanks also due to Ms A. Ibrahim (assistant Professor at LPIM laboratory), Mr. D. Marechal (Project engineer at Mader research company) for their valuable support.


Sergei Kuksin
email: kuksin@ma.hw.ac.uk.

Armen Shirikyan
email: a.shirikyan@ma.hw.ac.uk

On random attractors for mixing-type systems

The paper deals with infinite-dimensional random dynamical systems. Under the condition that a system in question is of mixing type and possesses a random compact attracting set, we show that the support of the unique invariant measure is a minimal random point attractor. The results obtained apply to the randomly forced 2D Navier-Stokes system.

Introduction

This paper deals with random dynamical systems (RDS) on a Polish 1 space H,

ϕ k : H → H, H u → ϕ k u, k ≥ 0. (0.1)
Here ϕ k 's are random transformations (so ϕ k = ϕ k (ω), where ω is a random parameter). As functions of k, the transformations are assumed to have independent increments. Usually the time will be discrete (i.e., k ∈ Z + ); however, RDS with continuous time will also be briefly discussed in the context of stochastic PDE's. Many features of long-time behaviour of trajectories for (0.1) are described by random attractors for this RDS. Among many possible definitions of random attractors (e.g., see [START_REF] Crauel | Markov measures for random dynamical systems[END_REF][START_REF] Crauel | Random attractors[END_REF][START_REF] Arnold | Random Dynamical Systems[END_REF]), we choose the following: a compact random set A ω is called a random attractor if all trajectories ϕ k (ω)u of (0.1) converge to A ω in probability. See Subsection 1.2 for a precise definition and its discussion.

The RDS (0.1) defines a Markov chain in H with the transition function

P k (u, Γ) = P{ω : ϕ k (ω)u ∈ Γ}, (0.2)
where Γ is a Borel subset in H. Long-time behaviour of this process is described, up to some extent, by its stationary measures. Recall that a probability Borel 1 measure µ on H is said to be stationary if

µ(Γ) = H P k (u, Γ)µ(du)
for every k ≥ 0 and every Borel set Γ. For systems in questions, every stationary measure µ admits a Markov disintegration:

µ(Γ) = E µ ω (Γ).
Here ω → µ ω is a measure-valued map measurable with respect to the past, i.e., the σ-algebra generated by the random transformations ϕ k (θ -m ω), where k ≥ m ≥ 0 and θ n is the corresponding measure-preserving shift in the probability space; see [START_REF] Crauel | Markov measures for random dynamical systems[END_REF][START_REF] Arnold | Random Dynamical Systems[END_REF] and Subsection 1.1. It is known that supp µ ω ⊂ A ω a.s., (0.3)

where A ω is an arbitrary random attractor; see [START_REF]Random point attractors versus random set attractors[END_REF] and Subsection 1.2.

The main result of this paper is Theorem 2.4 which states that the support of disintegration of the unique stationary measure for the discrete time RDS (0.1) is its minimal random attractor if the system satisfies a non-restrictive compactness condition and is of mixing type in the sense that, for any bounded continuous function f :

H → R, E f (ϕ k (ω)u) → H f (u)µ(du) as k → +∞, (0.4)
where u ∈ H is an arbitrary initial point and µ is a stationary measure. In other words, under the above conditions we have the equality in (0.3), where A ω is the minimal random attractor. The proof is based on an ergodic-type theorem for the dynamical system {Θ k } defined on the phase space Ω × H as the skewproduct of θ k and ϕ k :

Θ k (ω, u) = (θ k ω, ϕ k (ω)u), k ≥ 0, see Theorem 2.3.
In Section 4 we consider the randomly forced 2D Navier-Stokes equations u -ν∆u + (u, ∇)u + ∇p = η(t, x), div u = 0, (0.5)

where u = u(t, x) is the velocity field, p = p(t, x) is the pressure, and η(t, x) is a random external force. The equations are supplemented by the Dirichlet or the periodic boundary conditions. The random force η is smooth in x, while as a function of t it is either a kick-force (then (0.5) defines a discrete-time RDS), or a white-force (then it defines a continuous-time RDS). In both cases the RDS satisfies the compactness condition. Assuming certain non-restrictive non-degeneracy assumption and evoking the results from [START_REF]A coupling approach to randomly forced nonlinear PDE's. I[END_REF] or [START_REF]Coupling approach to white-forced nonlinear PDE's[END_REF] respectively, we get that the RDS satisfies the mixing-type condition as well. Therefore the abstract Theorems 2.3 and 2.4 apply to system (0.5), both for the kick-and white-forces. Accordingly, the support of the Markov disintegration for the unique stationary measure defines a minimal random attractor for (0.5) (see Theorems 4.1 and 4.2), and functionals, depending both on solutions u and the corresponding forces, satisfy a theorem of ergodic type (see Theorem 4.3). Notation. Let (H, d) be a Polish space, let C b (H) be the space of bounded continuous functions on H endowed with the norm sup u∈H |f (u)|, and let L(H) be the space of functions f :

H → R such that f L(H) = sup u∈H |f (u)| + sup u,v∈H |f (u) -f (v)| |u -v| < ∞.
If (Ω, F, P) is a probability space and F is a sub-σ-algebra, then we denote by L(H, F ) the set of functions F (ω, u) : Ω × H → R that are F -measurable in ω for any fixed u ∈ H and satisfy the condition

ess sup ω∈Ω F (ω, •) L(H) < ∞. (0.6)
For u ∈ H and A ⊂ H we define the distance between u and A as

d(u, A) = inf v∈A d(u, v).
Acknowledgements. We thank James Robinson for discussion. The work was supported by EPSRC, grant GR/N63055/01.

Preliminaries

In this section, we recall some basic notions of the theory of random dynamical systems (RDS) and formulate a few results that will be used later. We mainly follow the book [START_REF] Arnold | Random Dynamical Systems[END_REF]. To simplify the presentation, we confine ourselves to the case of discrete time.

Random dynamical systems

Let (Ω, F, P) be a probability space, let θ k : Ω → Ω, k ∈ Z, be a group of measure preserving transformations of Ω, and let H be a Polish space endowed with a metric d and the Borel σ-algebra B H . Definition 1.1. A (continuous) random dynamical system over θ k is defined as a family of mappings ϕ k (ω) : H → H, where k ∈ Z + and ω ∈ Ω, that possesses the following properties:

(i) Measurability. The mapping (ω, u) → ϕ k (ω)u from the space Ω × H endowed with the σ-algebra F ⊗ B H to H is measurable for any k ≥ 0;

(ii) Continuity. For any ω ∈ Ω and k ≥ 0, the mapping ϕ k (ω) is continuous;

(iii) Cocycle property. For any ω ∈ Ω, we have

ϕ 0 (ω) = Id H , ϕ k+l (ω) = ϕ k (θ l ω) • ϕ l (ω) for all k, l ≥ 0. (1.1)
For any integers m ≤ n, we denote by F [m,n] the σ-algebra generated by the family of H-valued random variables ϕ k (θ m-1 ω)u, where u ∈ H and k = 0, . . . , n -m + 1. We extend this notation to the case when m = -∞ and/or n = +∞ by setting

F [-∞,n] = σ{F [m,n] , m ≤ n} and similarly for F [m,+∞] and F [-∞,+∞] . It is a matter of direct verification to show that θ -1 k F [m,n] = F [m+k,n+k]
for all m ≤ n and k.

(1.

2)

The σ-algebras F -= F [-∞,0] and F + = F [1,+∞] are called the past and the future of ϕ k (ω). Let P P be the set of probability measures on (Ω × H, F ⊗ B H ) whose projections to Ω coincide with P. It is well known (see [Arn98, Section 1.4]) that any measure M ∈ P P admits a unique disintegration ω → µ ω , which is a random variable valued in the space of measures such that

M(Γ) = Ω H I Γ (ω, u)µ ω (du)P(dω) ∀ Γ ∈ F ⊗ B H ,
where I Γ is the indicator function of Γ.

Given an RDS ϕ k (ω) over θ k , we introduce the following semigroup of measurable mappings on Ω × H:

Θ k (ω, u) = θ k ω, ϕ k (ω)u , k ≥ 0.
The semigroup Θ k is called the skew-product of θ k and ϕ k (ω). A measure M ∈ P P is said to be invariant for

Θ k if Θ k (M) = M (that is, M(Θ -1 k (Γ)) = M(Γ)
for any Γ ∈ F ⊗ B H ). By Theorem 1.4.5 in [START_REF] Arnold | Random Dynamical Systems[END_REF], a measure M ∈ P P is invariant if and only if its disintegration µ ω satisfies the relation below for P-a.a. ω ∈ Ω:

ϕ k (ω)µ ω = µ θ k ω for all k ≥ 0.
The set of all invariant measures for Θ k will be denoted by I P (ϕ).

Definition 1.2. An invariant measure M ∈ I P (ϕ) is said to be Markov if its disintegration µ ω is measurable with respect to the past F -. The set of such measures will be denoted by I P,F -(ϕ).

We now turn to the important class of RDS with independent increments (also called white noise RDS ).

Definition 1.3. We shall say that an RDS ϕ k (ω) has independent increments if its past and future are independent.

It follows from (1.2) that ϕ k (ω) has independent increments if and only if the σ-algebras F [m,n] and F [m ,n ] are independent for any non-intersecting (finite or infinite) intervals [m, n] and [m , n ].

For any RDS ϕ k (ω) with independent increments, the set of random sequences {ϕ k (•)u, k ≥ 0}, u ∈ H, is a family of Markov chains with respect to the filtration F k = θ -1 k F -. The corresponding transition function P k (u, Γ) has the form (0.2) and the Markov operators associated with P k are given by the formulas

P k f (u) = H P k (u, dv)f (v), P * k µ(Γ) = H P k (u, Γ)µ(du),
where f ∈ C b (H) and µ ∈ P(H). We recall that µ ∈ P(H) is called a stationary measure for the Markov family if P * 1 µ = µ. The set of such measures will be denoted by S ϕ . The following important result is established (for different situations) in [Led86, Le 87, Cra91].

Proposition 1.4. Let ϕ k (ω) be an RDS with independent increments. Then there is a one-to-one correspondence between Markov invariant measures I P,F -(ϕ) for the skew-product Θ k and the stationary measures S ϕ for the associated Markov family. Namely, if µ ∈ S ϕ , then the limit

µ ω = lim k→+∞ ϕ k (θ -k ω)µ (1.3)
exists in the weak * topology almost surely and gives the disintegration of a Markov invariant measure M. Conversely, if M ∈ I P,F -is a Markov invariant measure and µ ω is its disintegration, then µ = E µ ω is a stationary measure for the Markov family.

Point attractors

Let {ϕ k (ω)} be an RDS in a Polish space H over {θ k } as above. A family of subsets

A ω , ω ∈ Ω, is called a random compact (closed ) set if A ω is compact (closed)
P d(ϕ k (ω)u, A θ k ω ) > δ = 0. (1.4)
A random point attractor A ω is said to be minimal if for any other random point attractor A ω we have A ω ⊂ A ω for a.a. ω.

It is clear that a minimal random point attractor is unique (if it exists), i.e., if A ω and A ω are two minimal random attractors, then

A ω = A ω a.s. Since θ k is a measure-preserving transformation, (1.4) is equivalent to lim k→+∞ d(ϕ k (θ -k ω)u, A ω ) = 0, (1.5)
where the limit is understood in the sense of convergence in probability. This type of convergence of a trajectory to a random set-when the initial data are specified at time -k, k → ∞, and the distance is evaluated at time zero-is normally used to define random attractors. We prefer the "forward" definition (1.4), which seems to be more natural. We note that among various types of random attractors, considered now in mathematical literature, that in Definition 1.5 is the smallest, cf. [Cra91, CDF97, Arn98].

If we replace relation (1.4) in Definition 1.5 by the condition that (1.5) holds for all u ∈ H and ω ∈ Ω 0 , where Ω 0 ∈ F is a set of full measure not depending on u, then we obtain the definition of a random point attractor in the sense of almost sure convergence). Since the a.s. convergence implies the convergence in probability, the resulting attractor also satisfies (1.4). In what follows, we mainly deal with random point attractors in the sense of convergence in probability, therefore they will be simply called random attractors.

The following proposition is a straightforward consequence of Theorems 3.4 and 4.3 and Remark 3.5 (iii) in [START_REF]Random point attractors versus random set attractors[END_REF].

Proposition 1.6. (i) Let ϕ k (ω) be an RDS with independent increments. Suppose that there is a random compact set K ω attracting trajectories of ϕ k (ω), i.e., there is a set Ω 0 ∈ F such that P(Ω 0 ) = 1 and

lim k→+∞ d ϕ k (θ -k ω)u, K ω = 0 for any ω ∈ Ω 0 , u ∈ H.
(1.6)

Then ϕ k (ω) possesses a random attractor A ω that is measurable with respect to the past F -.

(ii) For any Markov invariant measure M ∈ I ϕ,F -its disintegration µ ω is supported by each random attractor A ω , i.e., µ ω (A ω ) = 1 a.s. [START_REF]Random point attractors versus random set attractors[END_REF], under the conditions of proposition, the RDS ϕ k (ω) possesses a random point attractor A ω in the sense of almost sure convergence. Since θ k is a measure-preserving transformation, we conclude that (1.5) holds for A ω . The construction implies that A ω is measurable with respect to the past.

Outline of proof. (i) As shown in

(ii) Let A ω be an arbitrary random attractor. To show that the disintegration of any invariant measure M ∈ I ϕ,F -is supported by A ω , it suffices to observe that (1.4) implies the a.s.-convergence (1.5) along an appropriate subsequence k = k n , and to repeat the argument in [Cra01, Theorem 4.3].

Main results

As before, we denote by (Ω, F, P) a probability space and by H a Polish space endowed with a metric d and Borel σ-algebra B H . Let {ϕ k (ω)} be an RDS in H over a measure-preserving group of transformations θ k . We introduce the two hypotheses below.

Condition 2.1. Mixing: The Markov family {ϕ k (ω)u} is a system of mixing type in the following sense: it has a unique stationary measure µ, and for any f ∈ L(H) and any initial point u ∈ H we have

P k f (u) = E f ϕ k (•)u → (µ, f ) = H f (u)µ(du) as k → ∞.
(2.1)

Condition 2.2. Compactness: There is a random compact set attracting trajectories of ϕ k (ω) (in the sense specified in Proposition 1.6). Moreover, for any u ∈ H and ε > 0 there is Ω ε ∈ F, a compact set K ε ⊂ H, and an inte-

ger k ε = k ε (u) ≥ 1 such that P(Ω ε ) ≥ 1 -ε and ϕ k (θ -k ω)u ∈ K ε for ω ∈ Ω ε , k ≥ k ε . (2.2)
Let µ ∈ S ϕ be the unique stationary measure for the Markov semigroup P * k and let M ∈ I ϕ,F -be the corresponding Markov invariant measure for the skew-product Θ k (see Proposition 1.4).

Theorem 2.3. Suppose that Condition 2.1 is satisfied. Then for any function F (ω, u) ∈ L(H, F -) we have

E F Θ k (•, u) → (M, F ) = Ω H F (ω, u)µ ω (du)P(dω) as k → ∞, (2.3)
where u ∈ H is an arbitrary initial point.

We now discuss relationship between invariant measures and random attractors. Let us denote by µ ω the disintegration of M and set

A ω = supp µ ω , ω ∈ Ω 0 , H, ω / ∈ Ω 0 , (2.4)
where Ω 0 ∈ F is a set of full measure on which the limit (1.3) exists. By Corollary 1.6.5 in [START_REF] Arnold | Random Dynamical Systems[END_REF], A ω is a random closed set. Moreover, it follows from (1.3) that A ω is measurable with respect to F -.

Theorem 2.4. Suppose that Conditions 2.1 and 2.2 are satisfied. Then A ω is a minimal random point attractor.

The proofs of the above theorems are given in Section 3. We now discuss a class of RDS that satisfies Conditions 2.1 and 2.2.

Example 2.5. Randomly forced dynamical systems. Let H be a Hilbert space with a norm | • | and an orthonormal basis {e j } and let P N be the orthogonal projection onto the subspace H N ⊂ H generated by e 1 , . . . , e N . Suppose that a continuous operator S : H → H satisfies the following two conditions:

|S(u)| ≤ q|u| for u ∈ H,
(2.5)

P N (S(u) -S(v)) ≤ 1 2 |u -v| for |u| ∨ |v| ≤ R, (2.6)
where q < 1 is a constant not depending on u, R > 0 is an arbitrary constant, and N ≥ 1 is an integer depending only on R. We consider the RDS generated by the equation

u k = S(u k-1 ) + η k , (2.7)
where k ∈ Z and η k is a sequence of i.i.d. H-valued random variables. If the distribution χ of the random variables η k has a compact support, then Condition 2.2 is satisfied. If, in addition, χ is sufficiently non-degenerate (in the sense of [START_REF]A coupling approach to randomly forced nonlinear PDE's. I[END_REF]), then the Markov family corresponding to (2.7) is of mixing type. Thus, under the above hypotheses, the support of the unique invariant measure is a random point attractor. We note that Equation (4.3) below, corresponding to the kick-forced NS system, satisfies (2.5) and (2.6); see [START_REF]A coupling approach to randomly forced nonlinear PDE's. I[END_REF].

Conditions 2.1 and 2.2 are also satisfied for a large class of unbounded kicks η k (see (2.7)). We shall not dwell on that case.

Remark 2.6. Theorems 2.3 and 2.4 remain valid for RDS ϕ t (ω) with continuous time t ≥ 0. In this case, we assume that ϕ t (ω)u is continuous with respect to (t, u) for any fixed ω ∈ Ω and that Conditions 2.1 and 2.2 hold with k replaced by t. Reformulation of the above results for continuous time is rather obvious, and therefore we do not give detailed statements.

Proofs

Proof of Theorem 2.3

Step 1. We first assume that F (ω, u) ∈ L(H, F [-,0] ), where ≥ 0 is an integer. Since θ k is a measure-preserving transformation, for any m ≥ 1 we have

p k (u) :=E F θ k ω, ϕ k (ω)u = E F ω, ϕ k (θ -k ω)u =E E F ω, ϕ k (θ -k ω)u F [1-m,0] .
By the cocycle property (see (1.1)),

ϕ k (θ -k ω) = ϕ m (θ -m ω)ϕ k-m (θ -k ω), m ≤ k. Hence, setting F m (ω, u) = F (ω, ϕ m (θ -m ω)u), for any m ≤ k we derive p k (u) = E E F m ω, ϕ k-m (θ -k ω)u F [1-m,0] . (3.1)
We now note that

F m ∈ L(H, F [1-m,0] ) if m ≥ +1. Since ϕ k-m (θ -k ω)u is mea- surable with respect to F [1-k,-m] and since the σ-algebras F [1-m,0] and F [1-k,-m]
are independent, it follows from (3.1) that

p k (u) = E E F m ω, ϕ k-m (θ -k ω )u = E (P k-m F m )(ω, u), (3.2)
where + 1 ≤ m ≤ k and E denotes the expectation with respect to ω . In view of Condition 2.1 and the Lebesgue theorem, for any m ≥ + 1, the right-hand side of (3.2) tends to E (µ, F m (ω, •)) as k → +∞. Recalling the definition of F m , we see that

µ, F m (ω, •) = ϕ m (θ -m ω)µ, F (ω, •) → µ ω , F (ω, •) as m → ∞,
where we used Proposition 1.4. What has been said implies that

lim k→+∞ p k (u) = E µ ω , F (ω, •) ,
which coincides with (2.3).

Step 2. We now show that (2.3) holds for functions of the form F (ω, u) = f (u)g(ω), where f ∈ L(H) and g is a bounded F --measurable function. To this end, we use a version of the monotone class theorem (see [START_REF] Revuz | Markov Chains[END_REF]Theorem 3.3]).

Let us fix f ∈ L(H) and denote by H the set of those bounded F -measurable functions g for which convergence (2.3) with F = f g holds. It is clear that H is a linear space containing the constant functions. Moreover, as was shown in Step 1, it contains all bounded functions measurable with respect to F [-,0] for some ≥ 0. Since the union of F [-,0] , ≥ 0, generates F -, the required assertion will be proved as soon as we establish the following property: if g n ∈ H is an increasing sequence of non-negative functions such that g = sup g n is bounded, then g ∈ H.

Suppose that a sequence {g n } ⊂ H satisfies the above conditions. Without loss of generality, we shall assume that 0 ≤ g, g n ≤ 1. By Egorov's theorem, for any ε > 0 there is Ω ε ∈ F such that P(Ω ε ) ≥ 1 -ε and lim k→+∞ sup ω∈Ωε g n (ω) -g(ω) = 0.

It follows that for any ε > 0 there is an integer n ε ≥ 1 such that n ε → +∞ as ε → 0 and

g nε (ω) ≤ g(ω) ≤ g nε (ω) + ε + I Ω c ε (ω) for all ω ∈ Ω.
Multiplying this inequality by f (ϕ k (θ -k ω)u), taking the expectation, passing to the limit as k → +∞, and using the estimate P(Ω c ε ) ≤ ε, we derive

E (µ ω , f )g nε (ω) ≤ lim inf k→+∞ E f (ϕ k (θ -k ω)u)g(ω) ≤ lim sup k→+∞ E f (ϕ k (θ -k ω)u)g(ω) ≤ E (µ ω , f )g nε (ω) + 2ε.
Since ε > 0 is arbitrary and

E (µ ω , f )g nε (ω) → E (µ ω , f )g(ω)
as ε → 0 (by the monotone convergence theorem), we conclude that

E f (ϕ k (ω)u)g(θ k ω) = E f (ϕ k (θ -k ω)u)g(ω) k→+∞ -→ E (µ ω , f )g(ω) ,
which means that g ∈ H. This completes the proof of (2.3) in the case when F (ω, u) = f (u)g(ω).

Step 3. Now we consider the general case. Let F ∈ L(H) be an arbitrary function such that F (ω, •) L(H) ≤ 1 for a.e. ω ∈ Ω. For any u ∈ H and ε > 0, we choose an integer k ε (u) ≥ 1 and sets Ω ε ∈ F and K ε H for which (2.2) holds. By the Arzelà-Ascoli theorem, the unit ball

B ε = {f ∈ L(K ε ) : f L(H) ≤ 1} is compact in the space C b (K ε )
, and therefore there is a finite set {h j } ⊂ B ε whose ε-neighbourhood contains B ε . It follows that B ε can be covered by non-intersecting Borel sets U j h j , j = 1, . . . , N , whose diameters do not exceed 2ε. Let us denote by f j ∈ L(H) arbitrary extensions of h j to H such that f j L(H) ≤ 2. For instance, we can take

f j (u) = inf v∈Kε h j (v) + d(u, v) ∧ 1 .
Let us consider the following approximation of F :

G ε (ω, u) = N j=1 f j (u)g j (ω), g j (ω) = I Uj F Kε (ω, •) ,
where F Kε (ω, u) is the restriction of F to Ω × K ε . Since only one of the functions g j can be nonzero, we have G ε (ω, •) ∞ ≤ 2. Therefore, for any u ∈ H and a.e. ω ∈ Ω, we derive

G ε (ω, u) -F (ω, u) ≤ 2ε + I K c ε (u) G ε (ω, •) ∞ + F (ω, •) ∞ ≤ 2ε + 3I K c ε (u), (3.3)
where we used the inequality

F (ω, •) ∞ ≤ 1. Let us set p k (u) = E F (θ k ω, ϕ k (ω)u), p k (u, ε) = E G ε (θ k ω, ϕ k (ω)u).
It is clear that

p k (u)-(M, F ) ≤ p k (u)-p k (u, ε) + p k (u, ε)-(M, G ε ) + (M, G ε -F ) . (3.4)
Let us estimate each term on the right-hand side of (3.4). Combining (2.2) and (3.3), for k ≥ k ε (u) we derive

p k (u) -p k (u, ε) ≤ E F (ω, ϕ k (θ -k ω)u) -G ε (ω, ϕ k (θ -k ω)u) ≤ 2ε + 3P ϕ k (θ -k ω)u) / ∈ K ε ≤ 2ε + 3P(Ω c ε ) ≤ 5ε. (3.5)
Furthermore, the functions g j are F --measurable, and hence, by Step 2, for any fixed ε > 0,

p k (u, ε) → (M, G ε ) as k → +∞. (3.6) Finally, inequality (3.3) implies that (M, G ε -F ) ≤ 2ε + 3(M, I K c ε ) = 2ε + 3µ(K c ε ). (3.7)
Since ε > 0 is arbitrary, it follows from (3.4) -(3.7) that the required convergence (2.3) will be established if we show that µ(K c ε ) → 0 as ε → 0. To this end, we note that

µ(K c ε ) = H P ϕ k (ω)u / ∈ K ε µ(du). (3.8)
It follows from Condition 2.1 that, for any fixed u ∈ H,

lim sup k→+∞ P ϕ k (ω)u / ∈ K ε = lim sup k→+∞ P ϕ k (θ -k ω)u / ∈ K ε ≤ ε.
Passing to the limit k → +∞ in (3.8), we conclude that µ(K c ε ) ≤ ε for any ε > 0. This completes the proof of Theorem 2.3.

Proof of Theorem 2.4

We first show that the random compact set A ω is a random attractor. Let us fix δ ∈ (0, 1) and consider the function

F (ω, u) = 1 -d(u,Aω) δ ∧ 1, u ∈ H, ω ∈ Ω.
We claim that F ∈ L(H, F -). Indeed, the definition implies that F (ω, u) is bounded and that

F (ω, u) -F (ω, v) ≤ d(u,v) δ for all u, v ∈ H, ω ∈ Ω.
So F satisfies (0.6). Since A ω is a random compact set measurable with respect to F -, we conclude that the random variable ω → d(u, A ω ) is measurable with respect to F -for any u ∈ H (see Section 6.1 in [START_REF] Arnold | Random Dynamical Systems[END_REF]). This proves the required properties of F .

Since F (ω, u) = 1 for u ∈ A ω , then (M, F ) = 1. So, applying Theorem 2.3, we get that

E F (θ k ω, ϕ k (ω)u) = 1 -E d(ϕ k (ω)u, A θ k ω ) δ ∧ 1 → (M, F ) = 1.
That is,

p k (u) := E d(ϕ k (ω)u, A θ k ω ) δ ∧ 1 → 0. (3.9)
We now note that, by Chebyshev's inequality,

P d(ϕ k (ω)u, A θ k ω ) > δ ≤ p k (u) δ .
In view of (3.9), the right-hand side of this inequality goes to zero as k → +∞. This completes the proof of the fact that A ω is a random attractor. To show that A ω is a minimal random attractor, it suffices to note that, by Proposition 1.6, the invariant measure M ∈ I P,F -is supported by any random attractor A ω , and therefore supp µ ω ⊂ A ω for a.e. ω ∈ Ω.

Navier-Stokes equations

In this section we consider the randomly forced 2D Navier-Stokes (NS) system u -ν∆u + (u, ∇)u + ∇p = η(t, x), div u = 0.

(4.1)

The space variable x belongs either to a smooth bounded domain D, and then the boundary condition u ∂D = 0 is imposed, or to the torus T 2 = R 2 /2πZ 2 , and then we assume that u dx = η dx ≡ 0. We are interested in time-evolution of the velocity field u (not of the pressure p). Accordingly, we replace the force η by its divergence-free component (neglecting the gradient-component), and assume below that div η = 0.

We first consider the case when the right-hand side η is a random kick force of the form

η(t, x) = k∈Z δ(t -k)η k (x), (4.2)
where η k are i.i.d. random fields as in [START_REF] Kuksin | Stochastic dissipative PDE's and Gibbs measures[END_REF][START_REF]A coupling approach to randomly forced nonlinear PDE's. I[END_REF]. Let us denote by H the Hilbert space of divergence-free vector fields on the domain in question that satisfy the boundary conditions in the usual sense (e.g., see [START_REF] Lions | Quelques Méthodes de Résolution des Problèmes aux Limites Non Linéaires[END_REF]). We normalize the solutions u(t, x) for (4.1), (4.2), treated as random curves in H, to be continuous from the right. Then evaluating the solutions at integer times t = k ∈ Z + and setting u k = u(k, •), we obtain the equation

u k = S(u k-1 ) + η k . (4.3)
Here S is the time-one shift along trajectories of the free NS system (4.1) (with η ≡ 0); see [KS00, KS01] for details. Defining ϕ k , k ≥ 0, as a map sending u ∈ H to a solution u k of (4.3) equal to u at t = 0, we get an RDS of the form (0.1). One easily checks that it satisfies the required compactness condition (cf. [KS00, Section 2.2.1]). Moreover, if the distribution of the kicks η k meets some non-degeneracy assumption specified in [START_REF]A coupling approach to randomly forced nonlinear PDE's. I[END_REF], then the corresponding Markov chain in H has a unique stationary measure µ and the condition (0.4) holds. Hence, Theorem 2.4 applies, and we get the following result:

Theorem 4.1. If the kick force (4.2) satisfies the above conditions, then the support A ω of the Markov disintegration µ ω of its unique stationary measure µ is a minimal random attractor for the RDS (4.3). Moreover, there is a deterministic constant D = D ν such that the Hausdorff dimension of the set A ω does not exceed D for a.e. ω.

In Remark 2.6, we point out that Theorems 2.3 and 2.4 remain valid for a class of RDS with continuous time t ≥ 0. This class includes the system describing the white-forced 2D NS equations, i.e., Equation (4.1) with

η(t, x) = ∂ ∂t ζ(t, x), ζ(t, x) = ∞ j=1 b j β j (t)e j (x). (4.4)
Here {e j } is the L 2 -normalised trigonometric basis in H and {β j , t ∈ R} is a family of independent standard Wiener processes. It is assumed that the real coefficients b j decay faster than any negative degree of j:

|b j | ≤ C m j -m
for all j, m ≥ 1, so that η(t, x) is a.s. smooth in x. Let us denote by H the space of continuous curves ζ : R → H such that ζ(0) = 0 and endow it by the topology of the uniform convergence on bounded intervals. Let B be the σ-algebra of Borel subsets of H, {θ t } be the group of canonical shifts of H, θ t ζ(s) = ζ(s + t) -ζ(t), and P be the distribution of the process ζ in H. We take (H, B, P) for the probability space (Ω, F, P). Then the NS system (4.1), (4.4) defines a continuous-time RDS over θ t (see [START_REF] Arnold | Random Dynamical Systems[END_REF]) and a Markov process in H. The RDS meets the compactness condition, see [CDF97, Section 3.1]. Moreover, it is shown in [START_REF]Coupling approach to white-forced nonlinear PDE's[END_REF] (see also [START_REF] Mattingly | Gibbsian dynamics and ergodicity for the stochastically forced Navier-Stokes equation[END_REF][START_REF] Bricmont | Probabilistic estimates for the two-dimensional stochastic Navier-Stokes equations[END_REF]) that there is an integer N = N ν such that, if b j = 0 for 1 ≤ j ≤ N, (4.5) then the corresponding Markov process in H has a unique stationary measure µ and satisfies (0.4). Thus, we get the following result:

Theorem 4.2. If (4.5) holds, then the white-forced 2D NS system (4.1), (4.4) has a unique stationary measure µ. The supports A ω of its Markov disintegration µ ω define a minimal random attractor for the corresponding RDS in H. Moreover, there is a deterministic constant D = D ν such that the Hausdorff dimension of the set A ω does not exceed D for a.e. ω.

The fact that supp µ ω has finite Hausdorff dimension in both discrete and continuous cases follows from general results on upper bounds for the Hausdorff dimension of global random attractors (see [START_REF] Chepyzhov | A Hausdorff dimension estimate for kernel sections of nonautonomous evolution equations[END_REF][START_REF] Debussche | Hausdorff dimension of a random invariant set[END_REF][START_REF] Chepyzhov | Attractors for Equations of Mathematical Physics[END_REF]), since the latter contain supp µ ω (see Corollary 3.6 in [START_REF]Random point attractors versus random set attractors[END_REF]).

Let us consider the skew-product system {Θ k } corresponding to the RDS above. Applying a continuous-time version of Theorem 2.3, we get the following theorem:

Theorem 4.3. Let G be a bounded measurable functional on H × H, uniformly Lipschitz in the first variable, and such that G(u, ζ(•)) depends only on {ζ(s) , s ≤ 0}. Let u(t) be a solution for (4.1), (4.4) equal to u 0 for t = 0. Then under the assumption (4.5) the following convergence holds for any u 0 ∈ H:

EG(u(t), θ t ζ) → E H F (v, ζ) µ ζ (dv) as t → ∞.