Marc Babut
email: marc.babut@inrae.fr

Philippe Marchand

Anaïs Vénisseau

Bruno Veyrand

J Benoit

Benoit J Ferrari

Legacy and emerging halogenated

Keywords: Lake Geneva, Halogenated flame retardants, PBDE, hexabromocyclododecane, dechlorane, DBDPE, roach, burbot

come

Introduction

Lake Geneva is one of the largest (580 km²) and deepest (309 m) lakes in Western Europe (CIPEL 2014). It provides about one million surrounding-area inhabitants with various services, including drinking water supply, recreation or fisheries. The international commission for the protection of Lake Geneva waters (CIPEL) was established in 1957 by a French-Swiss treaty in order to monitor water quality, coordinate water protection or remediation-related environmental management, and inform the public (CIPEL 2014).

The analysis of mercury and other trace elements in fish meat was first introduced in CIPEL's monitoring program in 1975 and has since continued uninterrupted. Legacy contaminants (polychlorinated biphenyls, dichloro-diphenyl trichlorethane and its metabolites) were added to the list of contaminants monitored in the 1980s.

In 2006, Europe banned the use of PBDEs in most of its current applications (E.C. 2003; E.P. and E.C. 2013). The ban was expected to bring about a decrease in the concentrations PBDEs found in freshwater fish meat.

However, the market then replaced PBDEs with alternative flame retardants (FRs), including hexabromocyclododecane (HBCDD), a brominated flame retardant used primarily in expandable polystyrene but also in other applications including electronics, textiles and upholstery [START_REF] Kemi | Risk assessment hexabromocyclododecane -Final report[END_REF]. Europe has restricted the use of HBCDD since 2011, under Annex XIV of the REACH regulation (E.C. 2011a). The market shares of alternative FRs should therefore increase. Both PBDEs and HBCDD are included in the European Union's list of priority substances, and both should be monitored in biota (E.P. and E.C. 2013). In the case of Lake Geneva, polybrominated diphenyl ethers (PBDEs) have been considered since 2008 [START_REF] Ortelli | Trophic transfer of flame retardants (PBDEs) in the food web of Lake Erie[END_REF]); HBCDD compound was first considered in the 2012 CIPEL fish contamination survey. As alternative FRs may share some properties with PBDEs, such as hydrophobicity, there is accordingly a need to determine whether these chemicals are also of concern for biota in the lake or not.

This study is part of the Lake Geneva fish survey campaign carried out in 2018. Its specific objectives regarding flame-retardants were (i) to determine the current status of fish contamination by PBDEs and HBCDD, and (ii) to assess the occurrence and contamination levels of an array of emerging HFRs. The previous fish contamination surveys used regulatory thresholds for fish consumption as interpretative criteria. This kind of benchmark has some advantages, in particular in terms of communication to the public, but the previous surveys unfortunately failed to follow some of the sampling requirements for the use of regulatory thresholds for fish consumption, as presented in (E.C. 2011b) and other sources. Moreover, the lake is bordered by France on one side and Switzerland on the other, so each nation may have its own different approach to consumer protection against food contaminants, whereas the CIPEL's goal is to advise both the French and Swiss authorities on potential threats to the ecosystem services provided by the lake, and on the related trends.

These considerations prompted a move to adopt interpretative criteria focusing on ecosystem protection instead of sanitary thresholds for the 2018 survey.

Materials and Methods

Sampling

We selected two fish species, i.e. burbot (Lota lota) and roach (Rutilus rutilus), that represent different habitats, feeding behaviors and metabolic capacities. Burbot live deeper than roach, and feeds on benthic invertebrates, while roach feeds on zooplankton and occasionally on algae or plants [START_REF] Horppila | A bioenergetic approach on food consumption of roach (Rutilus rutilus (L.)) in a eutrophic lake[END_REF][START_REF] Kamjunke | Consumption of cyanobacteria by roach (Rutilus rutilus): useful or harmful to the fish?[END_REF]. Specimens of both species were collected from professional fishermen in four areas of the lake (Figure 1), during the summer 2018, so as to avoid the reproduction period. These four areas were those surveyed in previous CIPEL monitoring campaigns, namely (A) "Petit Lac", (B) in front of the French shore, (C) in front of the Swiss shore in the Vaud canton, and (D) in the Eastern end of the lake in the Valais canton. Ideally, five to seven individuals of each species were required in each zone. A total of 45 fish were obtained, namely 27 roach individuals and 18 burbot; fishermen could not provide burbot in zone A and only six roach specimens were collected in zone C. Note that this HFR study was part of a wider survey, targeting many other contaminants, and seven specimens of each species were kept apart (not analyzed for HFRs) for specific purposes, not concerned by the present study. Thus, 20 roach and 11 burbot were ultimately processed for HFR analysis (Table S1 in Supplementary Material, SM). Immediately after collection, the fish were measured and weighed and the samples were placed in refrigerated boxes (at approximately 4°C) until they could be frozen (-20°C), and then sent to LABERCA (French Reference Laboratory for halogenated pollutants in food) for analysis. ,4, ethane (BTBPE); except PBBz and HBBz, abbreviations were taken from (Bergman et al. 2012). All these compounds are hydrophobic and persistent (Table S2 in Supplementary Material -SM).

The method is described in details elsewhere [START_REF] Malak | Occurrence of Dechlorane Plus and related compounds in catfish (Silurus spp.) from rivers in France[END_REF][START_REF] Bichon | Simultaneous analysis of historical, emerging and novel brominated flame retardants in food and feed using a common extraction and purification method[END_REF]. Each individual fish was defrosted, ground whole, then freeze-dried, and the resulting material was ground again to get a homogenous powder. The lipid fraction was extracted from 1.5 g of dry matrix by pressurized liquid extraction (Speed Extractor, Büchi, Rungis, France) using a toluene/acetone (70/30 v/v) mixture at high pressure (100 bar) and high temperature (120 °C). The extracts were evaporated, and the dry residues dissolved in hexane for the purification step. All labelled standards ( 13 C) corresponding to each substance to be quantified were added prior to the extraction step, except for PBT which was quantified using 13 C PBBz, and DDC-ANT, quantified using 13 C Anti-DP. Standard solutions were purchased from Wellington Laboratories (Guelph, Ontario, Canada).

Purification involved two or three successive steps, depending of the analyte: first, the hexane extracts were passed through a homemade multilayer acidic silica column (5 g of silica gel at bottom, 20 g of 22% acidified silica in the middle, 25 g of 44 % acidified silica at top) to separate out the substances according to their affinity with the phase and solvent. PBDEs, PBBs and alternative HFRs were first eluted using hexane, then dichloromethane was used to eluate HBCDDs. The HBCDD fraction was further separated and purified by liquid/liquid repartition with a hexane and sodium hydroxide solution, while the remaining fractions containing other HFRs passed through a homemade Florisil® column (6 g) in order to separate the hexane fraction containing PBDEs and some HFRs, and the toluene fraction containing other HFRs. This non-PBDE fraction was then re-purified again on a carbon/celite column.

PBDEs and most HFRs were analyzed by gas chromatography (Agilent 7890, Palo Alto, CA) coupled with high resolution mass spectrometry (Jeol JMS 800D, Tokyo, Japan), whereas HBCDD was quantified by liquid chromatography (Agilent 1200 HPLC) coupled with tandem mass spectrometry (Agilent 6410, Santa Clara, USA).

All methods were performed according to an ISO standard 17025-accredited system. The methods used were validated and ISO 17025-accredited for PBDEs and HBCDDs and characterized for other compounds.

In order to validate the quality of the analysis, internal standards were added to each sample and complementary labeled standards were added at the end of each process in order to calculate recoveries. The method met the quality assurance requirements of the European Commission Regulation (EU) N°2017/644 (Annex III) that deals with certain halogenated persistent organic pollutants (POPs) using quantification analysis by isotopic dilution (E.C. 2017). All the calculated recoveries were between 65% and 115%. Moreover, heated laboratory glassware was rinsed with dichloromethane prior to use and all the steps for preparation, freezedrying and purification steps were carried out in an over-pressurized room to avoid any contamination coming from the materials and air. For each sample batch, one blank consisting of one celite sample and one QC sample was added and implemented in blank and QC charts. As analytical contamination was fully under control, the values found in blanks were not deducted. The laboratory participates in regular (twice-a-year) proficiency tests organized by the European Reference Laboratory (EURL) for POPs, which serves to guarantee the accuracy of the analytical method.

Contamination assessment

For PBDEs and HBCDD, the contamination magnitude was assessed by comparing the geometric means of measured concentrations against the European standards for secondary poisoning (QSsec-pois). This criterion belongs to the set of quality standards (QS) determined prior to the establishment of an Environmental Quality Standard under the Water Framework Directive in Europe (E.C. 2011c). The QSsec-pois aims to protect wildlife from adverse effects resulting from the predation of contaminated fish. It was derived based on review of existing toxicological data for wildlife and the use of extrapolation factors, which depend of the kind of data collected (E.C. 2011c). The QSsec-pois may or may not be the EQS ultimately selected, depending on a comparative assessment involving the QSs set for food consumption, drinking water or protection of pelagic organisms (E.C. 2011c): for HBCDD, the QSsec-pois is far below the QS for food consumption, and is thus the EQS, whereas for PBDEs it the QSsec-pois is far above the EQS, which is based on a food consumption benchmark (E.C. 2014).

Targeting the protection of wildlife against secondary poisoning entails the analysis of whole fish, as secondary predators are presumed to eat practically all their prey (E.C. 2014).

Data processing, statistics

We used Pro-UCL 5.1 (https://www.epa.gov/land-research/proucl-software ) for the determination of quantiles of measured concentrations while accounting for non-detects. These quantiles were not estimated when detection rates were below 50 %. Comparisons were performed using Mann Whitney or Kruskal-Wallis tests, which were run on XLStat v.19.4 software. Potential relationships among variables were assessed either with a Pearson correlation test, or by multiple linear regression. The default significance threshold was set at 0.05.

Results and discussion

Roach ranged in size from 15 to 34 cm (mean 22.6 ± 4.8 cm) and in mass from 40.6 to 452 g (mean 138 ± 102 g). Burbot displayed similar size and mass ranges, i.e. 22 to 39 cm (mean 29.6 ± 5.0 cm) and 68 to 530 g (mean 157 ± 137 g) respectively. The burbot specimens were leaner overall than roach, with mean lipid contents of 3.71 ± 1.81% and 7.33 ± 2.89% respectively. Sex ratios were unbalanced in both species, with a majority of male roach specimens and a majority of female burbot specimens. However, there were 36 % sexually immature burbot individuals, and 35 % sexually immature roach.

PBDE

All six PBDE congeners were quantified in all samples (Table S3 in SM). The sum of concentrations of these six congeners (PBDE) ranged between 0.597 ng g -1 wet weight (ww) and 9.86 ng g -1 ww for roach, and between 0.544 ng g -1 ww and 2.60 ng g -1 ww for burbot, showing no significant between-species difference in contamination (Mann-Whitney test, p-value 0.502). The respective contamination profiles were nevertheless clearly distinct, especially with a higher BDE 47 proportion in roach (67 to 80 %) than in burbot (31 to 56 %).

Conversely, BDE 99 represented less than 3 % of PBDE in roach but ranged between 21.5 and 44.4 % in burbot (Figure 2). These contrasted ratios suggest that roach and burbot differ in their respective metabolic capacities to debrominate the higher-brominated congeners such as BDE99, as already demonstrated for other species [START_REF] Stapleton | Debromination of Polybrominated Diphenyl Ether Congeners BDE 99 and BDE 183 in the Intestinal Tract of the Common Carp (Cyprinus carpio)[END_REF]Tomy et al. 2004b). Multiple linear regression analysis found that both size and lipid content contributed significantly to explaining the variability of PBDE in roach (p-values 0.02 and 0.05 respectively), but overall the variance explained was low (adjusted R² = 0.217). We did not test for the influence of sex, as the sample sex ratio was too unbalanced and the sample size was too small. None of the PBDE values exceeded nor was even close to the QSsec-pois of 44 ng g -1 ww. Checking the compliance to the EQSbiota, of 0.0085 ng g -1 ww (E.P. and E.C. 2013) would rely on measurements in fillets, as this standard is based on human consumption (E.C. 2014). Considering whole-body to fillet concentration ratios between 1.2 and 1.8 [START_REF] Fliedner | Biota monitoring under the Water Framework Directive: On tissue choice and fish species selection[END_REF], or even between 2.5 and 5 [START_REF] Gandhi | Polybrominated diphenyl ethers (PBDEs) in Great Lakes fish: Levels, patterns, trends and implications for human exposure[END_REF], it seems likely that all fish samples would exceed the EQSbiota. This same exceedance was also found in German rivers [START_REF] Edder | Current levels and trends of selected EU Water Framework Directive priority substances in freshwater fish from the German environmental specimen bank[END_REF], as well as in Lake Maggiore [START_REF] Guzzella | Spatial and temporal trends of target organic and inorganic micropollutants in Lake Maggiore and Lake Lugano (Italian-Swiss water bodies): contamination in sediments and biota[END_REF]), a large Alpine lake comparable to Lake Geneva in terms of climate and anthropic pressure.

Reported concentrations of persistent contaminants in lake fish from industrialized regions vary greatly; sources of variability include lake characteristics [START_REF] Houde | Influence of lake characteristics on the biomagnification of persistent organic pollutants in lake trout food webs[END_REF], anthropic pressures, species monitored and more. This makes it difficult, if not wholly misleading, to compare PBDE contamination levels among lakes.

Several studies point to BDE 47 as dominant in PBDE (e.g. Perez-Fuentetaja et al. 2015;[START_REF] Poma | Concentrations and trophic interactions of novel brominated flame retardants, HBCD, and PBDEs in zooplankton and fish from Lake Maggiore (Northern Italy)[END_REF], even when more congeners were analyzed [START_REF] Gandhi | Polybrominated diphenyl ethers (PBDEs) in Great Lakes fish: Levels, patterns, trends and implications for human exposure[END_REF]). The higher proportion of BDE 47 is generally attributed to debromination of more brominated congeners, including BDE 209 [START_REF] Poma | Concentrations and trophic interactions of novel brominated flame retardants, HBCD, and PBDEs in zooplankton and fish from Lake Maggiore (Northern Italy)[END_REF] and lipid content are commonly cited as controlling PBDE levels (e.g. [START_REF] Gandhi | Polybrominated diphenyl ethers (PBDEs) in Great Lakes fish: Levels, patterns, trends and implications for human exposure[END_REF], along with fish trophic position [START_REF] Guzzella | Spatial and temporal trends of target organic and inorganic micropollutants in Lake Maggiore and Lake Lugano (Italian-Swiss water bodies): contamination in sediments and biota[END_REF]Perez-Fuentetaja et al. 2015), but the relative influence of these factors on PBDE accumulation nevertheless appear to vary between species and ecosystems [START_REF] Gandhi | Polybrominated diphenyl ethers (PBDEs) in Great Lakes fish: Levels, patterns, trends and implications for human exposure[END_REF].

Following the ban of most common commercial formulations, PBDE declined in Great Lakes fish [START_REF] Gandhi | Polybrominated diphenyl ethers (PBDEs) in Great Lakes fish: Levels, patterns, trends and implications for human exposure[END_REF] as well as in fish from US water bodies downstream from textile manufacturing sites [START_REF] Chen | Do Temporal and Geographical Patterns of HBCD and PBDE Flame Retardants in U.S. Fish Reflect Evolving Industrial Usage?[END_REF]).

However, given the global PBDE stocks involved [START_REF] Abbasi | Global Historical Stocks and Emissions of PBDEs[END_REF], PBDEs are set to persist in the environment for decades.

PBDEs only screened for twice in past CIPEL fish surveys -first in 2008 [START_REF] Ortelli | Trophic transfer of flame retardants (PBDEs) in the food web of Lake Erie[END_REF]) and then in 2012 [START_REF] Edder | Current levels and trends of selected EU Water Framework Directive priority substances in freshwater fish from the German environmental specimen bank[END_REF]). The fish species in these studies included burbot, perch (Perca fluviatilis), whitefish (Coregonus lavaretus) and Arctic char (Salvelinus alpinus), and analyses were performed on fillets. Furthermore, the set of congeners analyzed in both studies included the same six congeners as in the current study, plus BDE183. Arctic char was the most contaminated species in both campaigns, followed by whitefish in 2008 (Figure 3-A). PBDE concentrations were found lower in 2012 than in 2008 for Arctic char and whitefish, but slightly (though significantly) higher for perch. Burbot cannot be compared between campaigns due to the low number of samples analyzed in 2008 and the shift from fillet to whole-body in 2018. The interspecies differences in 2008 and 2012 may reflect both respective lipid contents and trophic positions. Indeed, in 2008 Arctic char fillets had a higher lipid content (4.1 -11.4 %) than perch (0.9 -1.3 %) but less than whitefish (4.6 -8.2 %), and its trophic position is estimated at 4.4 ± 0.5, similar to perch (4.4 ± 0.0) but higher than whitefish (3. 3-B), but the difference was only significant for perch, which is similar to the recent trend observed for the bream in some German rivers [START_REF] Edder | Current levels and trends of selected EU Water Framework Directive priority substances in freshwater fish from the German environmental specimen bank[END_REF]).

[PBDE] (ng g -1 ww)

HBCDD

Detection rates varied among the three main isomers: HBCDD was systematically detected and quantified, whereas HBCDD and HBCDD were less frequently detected (20 % and 80 %, respectively, in roach, and 45 % and 45 %, respectively, in burbot; Table S4 in SM). Consequently, HBCDD represented on average 94.8 ± 5.9%

of HBCDD (sum of concentrations of  and  isomers) in roach and 96.9 ± 2.1% in burbot, in line with previous observations [START_REF] Du | Diastereoisomer-and enantiomer-specific accumulation, depuration, and bioisomerization of hexabromocyclododecanes in Zebrafish (Danio rerio)[END_REF][START_REF] Hühnerfuss | Chromatographic enantiomer separation of chiral xenobiotics and their metabolites -A versatile tool for process studies in marine and terrestrial ecosystems[END_REF]Tomy et al. 2004a ). The magnitude of contamination was similar in both species, ranging from 0.445 ng g -1 ww to 3.477 ng g -1 ww in roach and from 0.253 ng g -1 ww to 2.689 ng g -1 ww in burbot. All HBCDD values were far below the QSsec-pois for this substance (167 ng g -1 ww).

There is little data available for HBCDD in Lake Geneva prior the 2018 survey: a single pool of ten whitefish [START_REF] Gerecke | Detection of α-isomer dominated HBCD (hexabromocyclododecane) in Swiss fish at levels comparable to PBDEs (polybrominated diphenyl ethers)[END_REF], nine male lake trout (Salmo trutta lacustris) individuals collected in November 2004 [START_REF] Cheaib | Brominated Flame Retardants in Fish of Lake Geneva (Switzerland)[END_REF], and 27 individuals from six species (pike -Esox lucius, Arctic char -Salvelinus fontinalis, perch -Perca fluviatilis, burbot, whitefish and trout) analyzed in the CIPEL 2012 survey. In all these studies, fillet was the matrix analyzed. Concentrations observed in 2012 were highest in Arctic char (1.457 -5.019 ng g -1 ww), followed by whitefish and perch (0.405 -0.727 ng g -1 ww and 0.427 -0.764 ng g -1 ww respectively).

Burbot (0.144 -0.380 ng g -1 ww) and pike (0.101 -0.259 ng g -1 ww) were the least contaminated.

Contamination levels measured in 2012 and 2018 in Lake Geneva fish were thus low, contrasting with the trend observed in some German rivers where HBCDD concentrations have been increasing since 2013 [START_REF] Edder | Current levels and trends of selected EU Water Framework Directive priority substances in freshwater fish from the German environmental specimen bank[END_REF]. A similar trend was also noticed downstream from textile manufacturing sites in the USA after the Penta-BDE ban [START_REF] Chen | Do Temporal and Geographical Patterns of HBCD and PBDE Flame Retardants in U.S. Fish Reflect Evolving Industrial Usage?[END_REF].

Alternative HFRs

The frequency of occurrence of alternative HFRs was low (3.2% -19.4 %) for most compounds, and even null for PBB 101. Four compounds, i.e. DBDPE and dechloranes (DDC-DBF, DDC-Ant, DDC-CO), were quantified rates at rates above 50 %, enabling us to estimate their respective quantiles while accounting for non-detects (Table 1). The maximum concentrations of the less-frequent compounds remained close to their respective limits of quantification, whereas the concentrations of dechloranes spanned a range of 5 to 10 times the respective limits of quantification (Table S5 1: Whole-body concentration distributions (ng g -1 ww) of emerging halogenated FRs detected in roach and burbot from Lake Geneva. Quartile and median concentrations were not determined when quantification rates were < 50 % DBDPE concentrations ranged between < LOQ (i.e. 0.005 ng g -1 ww) and 2.89 ng g -1 ww. Fish above the third quartile (0.552 ng g -1 ww when both species are considered together) were sampled in areas B, C and D, and were partitioned evenly between the two species. These findings contrast with a recent study on Northern American Great Lake fish, where PBBs and dechloranes were predominant while DBDPE remained below the limit of detection and was considered as practically non-bioavailable (Wu et al. 2019). DBDPE was not detected in Lake Maggiore zooplankton and fish, despite concentrations as high as 30 ng g -1 dry weight (dw) in sediments [START_REF] Poma | Concentrations and trophic interactions of novel brominated flame retardants, HBCD, and PBDEs in zooplankton and fish from Lake Maggiore (Northern Italy)[END_REF]. DBDPE was also frequently measured in suspended matter from German rivers at concentrations as high as 3 ng g -1 dw but not in bream (Abramis brama) fillets from the same sites, suggesting that this compound is less bioaccumulative than PBDEs [START_REF] Dreyer | Recent findings of halogenated flame retardants (HFR) in the German and Polar environment[END_REF]. There is currently no standard or benchmark available for DBDPE and knowledge about its toxicity is scarce. It is therefore impossible to conclude about adverse effects of DBDPE on the species sampled or their predators.

Conclusion

The 2018 sampling campaign found that none of the legacy FRs were of concern in terms of risk of secondary poisoning. However, the temporal trends for PBDE or HBCDD remain unclear. BDE209, which was authorized for use years after the first restrictions on PBDE, has so far not been analyzed and should be accounted for in future monitoring campaigns. Among the emerging halogenated FRs introduced as alternatives to PBDEs and HBCDD, dechloranes were frequently detected but their concentrations remained close to the LOQ; only DBDPE was found at concentrations most often above its LOQ.

Outlook

Demand for FRs remains high, and the latest studies posit a diversification of the FRs brought to market [START_REF] Dreyer | Recent findings of halogenated flame retardants (HFR) in the German and Polar environment[END_REF]Gustavsson et al. 2018)

Figure 1 -

 1 Figure 1 -Lake Geneva and fish sampling areas Analysis The legacy HFRs included six PBDE congeners representing a mixture of Penta-and Octa-BDE technical products, namely BDE 28, 47, 99, 100, 153 and 154, three HBCDD stereo-isomers (,  and ). All six PBDEs are listed along with HBCDD as priority substances in the European Union, which is not yet the case for other BDE congeners such as BDE209. Alternative HFRs included penta-and hexabromobenzene (PBBz and HBBz respectively); pentabromotoluene (PBT), three polybrominated biphenyls (PBB 52, 101 and 153), three dechloranes, namely Dec-602 (DDC-DBF), Dec-603 (DDC-Ant) and Dechlorane + (DDC-CO), which corresponds to the sum of Syn-DP and Anti-DP, decabromodiphenyl ethane (DBDPE) and 1,4,

Figure 2 :

 2 Figure 2: Distributions of PBDE congener ratios to PBDE in roach (grey) and burbot (cross-hatched)

  in SM).

	A-Burbot
	Chemical	LOQ	Quantification	Maximum	1 st quartile Median	3 rd quartile
			rate (%)	concentration
	PBB52	0.005	0.0%	<LQ
	PBB101	0.005	0.0%	<LQ
	PBB153	0.005	9.1%	0.010
	PBT	0.005	18.2%	0.019
	HBB	0.005	0.0%	<LQ
	PBBz	0.005	0.0%	<LQ
	DBDPE	0.005	90.9%	2.889	0.110	0.174	0.484
	BTBPE	0.002	9.1%	0.006
	DDC-DBF	0.002	100.0%	0.028	0.011	0.011	0.018
	DDC-Ant	0.002	54.5%	0.010	0.002	0.003	0.004
	DDC-CO	0.005	100.0%	0.044	0.014	0.026	0.029
	B-Roach
	Chemical	LOQ	Quantification	Maximum	1 st quartile	Median	3 rd quartile
			rate (%)	concentration
	PBB52	0.005	10.0%	0.007
	PBB101	0.005	0.0%	<LQ
	PBB153	0.005	0.0%	<LQ
	PBT	0.005	15.0%	0.020
	HBB	0.005	25.0%	0.030
	PBBz	0.005	5.0%	0.005
	DBDPE	0.005	100.0%	1.539	0.157	0.270	0.431
	BTBPE	0.002	25.0%	0.010
	DDC-DBF	0.002	100.0%	0.086	0.009	0.012	0.023
	DDC-Ant	0.002	75.0%	0.009	0.002	0.003	0.004
	DDC-CO	0.005	40.0%	0.169
	Table

Table S 2

 S . Future monitoring campaigns should therefore address a larger set of FRs, in particular organophosphate FRs (Castro-Jiménez et al. 2016; van der Veen and de Boer 2012) while continuing to survey PBDEs (including BDE 209) for at least some time to come. van der Veen I, de Boer J (2012) Phosphorus flame retardants: Properties, production, environmental occurrence, toxicity and analysis Chemosphere 88:1119-1153 doi:10.1016/j.chemosphere.2012.03.067 Wu Y, Tan H, Zhou C, Crimmins BS, Holsen TM, Pagano JJ, Chen D (2019) Spatial and Temporal Trends (2004 -2016) of Selected Alternative Flame Retardants in Fish of the Laurentian Great Lakes Environ Sci Technol 53:1786-1796 doi:10.1021/acs.est.8b05300Legacy and alternative halogenated flame retardants in Lake Geneva fish Authors: Babut, Marc a,d *, Marchand, Philippe b , Venisseau, Anaïs b , Veyrand, Bruno b , Ferrari, Benoit J.D c,d -Main characteristics of HFRs selected for this study (acronyms following(Bergman et al. 2012) -Log Kow values were found in(Gustavsson et al. 2018) or PubChem (https://pubchem.ncbi.nlm.nih.gov/ )Table S 5 -Concentrations of alternative halogenated flame-retardants in whole fish (ng g -1 ww)

	13	3.1.3 Alternative halogenated flame retardants
		2 Chemicals Sample # PBB 52	PBB 101	PBB 153		PBT	HBBz	PBBz	DBDPE		BTBPE	DDC-DBF	DDC-ANT	DDC-CO
		Substance LQ	0.005	CAS# 0.005	Log Kow 0.005	0.005	0.005	0.005	0.005		0.005	0.002	0.002	0.005
		BDE 28 FRG02		0.005	41318-75-6 0.005	5.88 0.005		0.005	0.005	0.005	1.539		0.005	0.019	0.003	0.055
		BDE 47 FRG03 Affiliations: BDE 99 FRG04		0.005 0.005	5436-43-1 0.005 32534-81-9 0.005	6.77 0.005 6.84 0.005		0.020 0.005	0.005 0.005	0.005 0.005	0.209 0.375		0.005 0.005	0.011 0.010	0.002 0.003	0.005 0.005
		a INRAE, RIVERLY, 5 rue de la Doua CS 20244, F-69625 Villeurbanne, France BDE 100 189084-64-8 7.66 FRG05 0.005 0.005 0.005 0.005 0.005	0.005	0.660		0.005	0.013	0.005	0.005
		BDE 153 FRG06 b LABERCA, Oniris, INRA, Université Bretagne Loire, F-44307, Nantes, France. 68631-49-2 8.55 0.005 0.005 0.005 0.005 0.005 BDE 154 207122-15-4 FRG07 0.005 0.005 0.005 0.005 0.005 8.55 c Swiss Centre for Applied Ecotoxicology, EPFL ENAC IIE-GE, Station 2, CH-1015 Lausanne, Switzerland 0.005 0.186 0.005 0.108 HBCDD 3194-55-6 7.74 VDG03 0.005 0.005 0.005 0.005 0.009 0.005 1.503	0.006 0.005 0.005	0.021 0.037 0.019	0.004 0.004 0.007	0.005 0.007 0.016
		PBBz VDG04 d CIPEL Scientific Council, Agroscope Changins Bâtiment DC Route de Duillier 50 Case postale 1080 CH -1260 608-90-2 6.44 0.005 0.005 0.005 0.006 0.011 0.005 0.090 0.005 HBBz 87-82-1 6.07 VDG05 0.005 0.005 0.005 0.005 0.005 0.005 0.008 0.005 Nyon (Switzerland) PBT 87-83-2 6.99 0.005 0.005 0.005 0.005 0.006 0.005 1.216 0.006 VDG06 * corresponding author marc.babut@inrae.fr (+33 4 72 20 87 28) PBB 52 40088-45-7 7.32 VSG03 0.005 0.005 0.005 0.005 0.005 0.005 0.767 0.005	0.028 0.009 0.011 0.021	0.002 0.002 0.002 0.002	0.057 0.008 0.016 0.005
		PBB 101 VSG04 Supplementary Material 56307-79-0 0.005 0.005 PBB 153 59080-40-9 VSG05 0.005 0.005	7 0.005 7.93 0.005		0.005 0.012	0.005 0.030	0.005 0.005	0.164 0.418		0.005 0.005	0.011 0.007	0.004 0.003	0.005 0.169
		DDC-DBF VSG06		0.007	31107-44-5 0.005	6 0.005		0.005	0.005	0.005	0.302		0.005	0.086	0.009	0.005
		1 Characterization of fish samples DDC-Ant 13560-92-4 VSG07 0.006 0.005 0.005 7.2		0.005	0.005	0.005	0.235		0.005	0.072	0.007	0.016
		Zone DDC-CO GEG03 DBDPE GEG04 A BTBPE GEG05 A GEG06 A GEG07 FRL04		Species 0.005 0.005 roach 0.005 roach 0.005 roach 0.005 0.005	Sample # 13560-89-9 0.005 84852-53-9 0.005 GEG03 37853-59-1 0.005 GEG04 0.005 GEG05 0.005 0.005	Fish mass (g) 11.27 0.005 0.005 Fish size (cm) 11.1 0.005 0.005 116.27 9.15 0.005 0.005 95.02 0.005 0.005 69.55 0.005 0.005 0.010 0.005	Sex 21 nd 0.005 0.005 0.005 20 nd 0.005 19 male (?) 0.005 0.005 0.005 0.005 0.005 0.005 0.005 0.005	0.122 Lipid 0.239 content (%) 0.135 13.7 0.319 9.7 0.470 7.6 0.116	0.005 0.010 0.007 0.006 0.005 0.005	0.004 0.007 0.017 0.004 0.009 0.021	0.002 0.002 0.003 0.002 0.004 0.007	0.005 0.005 0.005 0.005 0.005 0.011
		A FRL05		roach 0.005	GEG06 0.005	0.005	52.21 0.005	17 nd 0.005	0.005	0.104	7.2	0.005	0.028	0.010	0.030
		A FRL06		roach 0.005	GEG07 0.005	0.005	84.61 0.005	20 male (?) 0.005 0.005	0.005	9.0	0.005	0.019	0.004	0.026
		B FRL07	roach 0.005	FRG02 0.005	0.005	94.81 0.005	20 male (?) 0.005 0.005	2.889	5.2	0.005	0.011	0.004	0.022
		B VDL03	roach 0.005	FRG03 0.005	0.005	92.09 0.005	20 male 0.005	0.005	0.238	4.2	0.005	0.010	0.002	0.044
		B VDL04	roach 0.005	FRG04 0.005	0.005	94.27 0.005	21 male 0.005	0.005	0.333	4.1	0.005	0.012	0.002	0.029
		B VDL05	roach 0.005	FRG05 0.005	0.005	128.24 0.005	22 male (?) 0.005 0.005	0.635	5.7	0.005	0.011	0.002	0.028
		B VDL06	roach 0.005	FRG06 0.005	0.005	88.28 0.019	21 male (?) 0.005 0.005	0.092	3.4	0.005	0.005	0.002	0.016
		B VDL07	roach 0.005	FRG07 0.005	0.005	96.94 0.011	20 male 0.005	0.005	0.174	5.9	0.006	0.008	0.002	0.011
		B VSL03	burbot 0.005	FRL04 0.005	0.005	68.81 0.005	26 nd 0.005	0.005	0.127	1.2	0.005	0.017	0.003	0.010
		B VSL05	burbot 0.005	FRL05 0.005	0.005	98.50 0.005	27 nd 0.005	0.005	1.309	1.7	0.005	0.011	0.003	0.040
		B	burbot	FRL06		168.16	31 female		3.4
		B	burbot	FRL07		67.98	25 nd			1.9
		C	roach	VDG03		345.49	31 male		12.5
		C	roach	VDG04		451.54	33 male		11.1
		C	roach	VDG05		40.61	16 nd			5.4
		C	roach	VDG06		48.27	15 male (?)		5.5
		C	burbot	VDL03		102.06	23 female		5.1
		C	burbot	VDL04		137.46	26 female		4.6
		C	burbot	VDL05		78.35	22 female		5.2
		C	burbot	VDL06		104.80	23 nd			5.2
		C	burbot	VDL07		87.30	23 female		5.6
		D	roach	VSG03		164.74	26 male			8.8
		D	roach	VSG04		227.74	27 nd			9.1
		D	roach	VSG05		172.03	24 male (?)		8.0
		D	roach	VSG06		158.60	26 nd			5.9
		D	roach	VSG07		153.78	25 nd			4.4
		D	burbot	VSL03		278.34	39 male			1.4
		D	burbot	VSL05		531.60	38 male			5.4
		Table S 1 -Fish characteristics (nd: undetermined; (?): uncertain)

Protection of Lake Geneva waters (CIPEL https://www.cipel.org/ ) for funding and technical support, as well as members of CIPEL's scientific advisory board, for discussion of the monitoring results. We thank Johan Lemarchand (http://johan.lemarchand.free.fr/cartes/ ) for the map of Europe displayed in Figure 1, and Glen McCulley for copyediting the manuscript.


Yuxiao Mao

Vincent Migliore

Vincent Nicomette

Reconfigurable Hardware for Microarchitectural Timing Attacks Detection

Software-based microarchitectural timing attacks evolve quickly, exploiting hardware design properties that widely affect both general-purpose processors and embedded processors. Among the means of attack detection, hardware monitoring benefits from less overhead and less power consumption compared to software monitoring. Nevertheless, as usual hardware cannot be upgraded, the efficiency of a hardware monitor device component cannot be guaranteed against future attacks.

In this paper, we study the feasibility of using reconfigurable hardware alongside software attacks detection to cope with microarchitectural timing attacks. We propose to use the hardware's capability of parallel execution, to deal with the problem that reconfigurable technologies suffer from a lower frequency than hardwired technologies. This architecture is designed to adapt to new attacks, because the processor can decide to reconfigure the detection logic to take them into consideration. We briefly present an implementation of a proof of concept on FPGA to validate our design.

I. INTRODUCTION

Software-based attacks are evolving faster and faster. In recent years, an increasing number of low-level attacks, at the interface between hardware and software have been published, such as microarchitectural timing attacks (MTAs) [START_REF] Ge | A survey of microarchitectural timing attacks and countermeasures on contemporary hardware[END_REF].

During a process's execution, some information related to the execution may be stored in the hardware microarchitecture, such as cache status or execution delay. This information is not supposed to be visible to software. MTAs break this assumption and aim to infer microarchitectural information by measuring the duration of the execution of specific instructions. A noticeable difference in this duration may enable a malicious process to infer some sensitive information of a victim process that shares hardware ressources with the malicious process (such as memory cache lines in the processor). This difference in the execution duration, measured by MTAs, can come from performance optimization, or some design choice [START_REF] Fadiheh | Processor Hardware Security Vulnerabilities and their Detection by Unique Program Execution Checking[END_REF]. As sacrificing the performance gain or completely preventing leak point in all hardware is unrealistic, MTAs present a true threat to cryptography and other security critical algorithm [START_REF] Yarom | FLUSH+RELOAD: a High Resolution, Low Noise, L3 Cache Side-Channel Attack[END_REF].

Software-based protection is often the first choice for attack detection, because it's easy to deploy and to update. However, at runtime, software can only rely on microarchitectural information provided by underlying hardware such as Hardware Performance Counter (HPC) for instance. This limits the effectiveness of software solutions. In the other hand, hardware-based protection has low overhead and low power consumption, but it is a static and deterministic protection that cannot evolve to cope with new attacks. In this context, we believe that introducing flexibility to hardware for MTAs monitoring is an inevitable trend. For that purpose, we propose in the paper a solution that uses reconfigurable hardware, such as Field-Programmable Gate Array (FPGA).

Section II presents a state of the art of MTAs detection techniques and the use of reconfigurable hardware with processor. Section III provides some details about our reconfigurable architecture, while Section IV describes a proof of concept that is currently implemented in FPGA. Section V draws some conclusions.

II. STATE OF THE ART

MTAs detection can be divided into two categories: static analysis and runtime monitoring.

Static analysis aims at analyzing the instructions of a given binary file in order to determine whether it contains an attack [START_REF] Irazoqui | MASCAT: Preventing Microarchitectural Attacks Before Distribution[END_REF] or not. A file that is suspected to include a malicious code may not be allowed to run, or can only run in strict condition. This method is suitable for scans in the applications store for example and is performed before execution of the binary. However, when the code is encrypted, obfuscated or dynamically loaded, static analysis is not efficient any more.

Runtime monitoring consists in monitoring the process' execution at runtime. It is generally more precise than static analysis but has a significant impact on the runtime performance. Some monitoring techniques do not modify the hardware, simply read some information provided by the existing hardware and take a decision using software logic. The information often comes from HPC that are present in most modern processors and may be combined with thresholds, heuristics, or machine learning processing to identify abnormal behavior [START_REF] Chiappetta | Real time detection of cache-based side-channel attacks using hardware performance counters[END_REF]. Our solution can provide complementary hardware-level information to these software methods.

Modifying the hardware for runtime monitoring can provide more effective detection and reduce runtime overhead. Chen et al. [START_REF] Chen | CC-Hunter: Uncovering Covert Timing Channels on Shared Processor Hardware[END_REF] propose to modify some shared hardware components such as caches, in order to include a specific monitoring unit providing specific counters, then collect the data from these custom counters. Their approach enables to collect information that is directly useful to detect microarchitectural attacks and is more precise than HPC. However, the performed modification is only suited for a specific kind of known attacks and may be inefficient to cover another category of attacks.

Ozsoy et al. [START_REF] Ozsoy | Malware-aware processors: A framework for efficient online malware detection[END_REF] proposed a solution that extracts information directly from the processor, combined with a hardware machine learning unit for analysis. This work has some similarities with our proposal, but has put aside the main problem of updating this hardware when new attacks appear.

Using reconfigurable hardware with processors is not a new research topic. High-performance reconfigurable computing has been applied in many fields such as image processing and communication. As regard to the security domain, reconfigurable hardware has already been proposed for cryptography, for power and communication monitoring against hardware attacks [START_REF] Gogniat | Reconfigurable Hardware for High-Security/ High-Performance Embedded Systems: The SAFES Perspective[END_REF], etc. However, to our best knowledge, no one has proposed the use of reconfigurable hardware to dynamically monitor the running software on a processor.

III. ARCHITECTURE DESIGN

A. Overview

The overall architecture that we propose is depicted in Fig. 1. The architecture consists of a main processor core, a reconfigurable detection module, interconnected by three information communication channels, and a trusted software core executed on the main processor. The clock frequency of reconfigurable hardware such as FPGA is an order of magnitude slower than the clock frequency of the mainstream processors. Therefore, in order not to affect the frequency of the main processor, we let the processor runs at a normal high frequency while the Reconfigurable Detection Module runs at a lower frequency. All communication channels are equipped with synchronization logic for clock domain crossing. Reconfigurable Detection Module benefits from the parallel processing capabilities of hardware, to process simultaneously in one single clock cycle multiple information from multiple clock cycles of processor. Taking a modern processor with a clock frequency of 3.2 GHz, and a Detection Module able to process 16 clock cycles of information at the same time, we can use a FPGA running at a frequency of 200 MHz, which can be considered reasonable.

B. Communication channels

The communication between processor and Reconfigurable Detection Module goes through three channels. The first channel is a serial-to-parallel logic, into which high frequency serial data are buffered and converted into low frequency parallel data. It is used to transmit information extracted from the processor to Detection Module for analysis. The second communication channel is an interruption mechanism used to notify the processor of any abnormal situation. The last communication channel is a memory-mapped connection, providing peripheral-like access to the processor. It is used to read data, write some configurations, or even initiate a reconfiguration to the Detection Module.

Since processor microarchitecture cannot be modified during its entire lifetime, the type and number of processor internal state observations sent by the serial-to-parallel logic must be chosen wisely. For cache-based MTAs detection, the observations we chose are the instructions executed by the processor, and a valid bit to keep only one trace for each multi-cycle instruction. They are obtained directly from the execution stage of the processor pipeline. This choice is motivated by the fact the instructions actually executed can potentially help us to detect also transient execution, that is used by Spectre [START_REF] Kocher | Spectre Attacks: Exploiting Speculative Execution[END_REF] for instance. In other words, the choice of using instructions as input increases the likelihood of detecting other software-based attacks that execute special instruction patterns. Other microarchitectural attacks that have physical access, such as electromagnetic side-channel attacks, are out of the scope of this paper.

C. Trusted software kernel

As hardware-level events alone are not enough to make complex decisions, we include a trusted software Kernel in our architecture. It may be embedded in the operating system kernel itself or an hypervisor, running on the main processor, and communicating with the Detection Module.

At runtime, the Kernel receives interruptions and other data from the hardware Detection Module. It synthesizes the situation with other known information of the running process, and determines whether the process may be a MTA. When a process is considered as suspicious, the kernel can react by forcing termination of the process or by enforcing isolation.

As the security requirements may vary from one process to another, the Kernel can adjust the threshold of the hardware Detection Module or reconfigure it according to the current needs. For example, when a cryptography process is running, it can improve detection sensitivity to prevent any possible leak of secret; when a benchmark process is running, it can set a non-interruption mode to prevent unnecessary alarms.

To take into account new attacks, the kernel is also able to perform a hardware reconfiguration of the Detection Module.

D. Detection Module

As discussed before, software monitoring is limited by its characteristics to only analyze serial instructions, and hardware monitoring is only designed to run at the same frequency as the processor. We want to take full advantage of the parallel nature of the hardware to maximize our detection capability in this parallel input context. We target Flush+Reload [START_REF] Yarom | FLUSH+RELOAD: a High Resolution, Low Noise, L3 Cache Side-Channel Attack[END_REF] attack, the most common MTA, and propose a 3-stage detection logic as shown in Fig. 2. In the instruction type analysis stage, the parallel inputs are analyzed with combined gate logic to deduce useful information. For example, this logic may evaluate whether the 16 input instructions include or not at least one instruction to get the value of the internal timer of the processor.

Then, we store the information obtained in a sliding window, and perform further analysis. For example, we may store values obtained from previous 32 clock cycles, and count how many timer instructions have been executed in this window.

At the end, we try to match information in the sliding window with attack patterns. For example, in Flush+Reload attack, the instruction that flushes the cache must be close to the instruction that gets the value of the timer, and this twoinstructions pattern must be repeated multiple times during one attack. Thus, the Signature Matching Module counts the number of occurrences where both the cache flush and timer access instructions are present in a sliding window.

As this part of logic is fully reconfigurable, some other detection logic, such as machine learning algorithm purposely chosen, can be used instead.

IV. IMPLEMENTATION

Our design has been implemented on a Xilinx ML605 Evaluation Board (Virtex-6 FPGA) using the Orca RISC-V softcore processor [START_REF] Vectorblox | Orca[END_REF]. The frequency difference between processor and reconfigurable logic has been modeled with a 1/16 clock divider. To enable dynamic hardware update, we put the Detection Module into a dedicated dynamically reconfigurable area. Up to now, the Trusted Kernel only manages interruptions, reads information from the Detection Module, and sets thresholds.

We adapted the Flush+Reload attack of Mastik toolkit [START_REF] Yarom | Mastik: A Micro-Architectural Side-Channel Toolkit[END_REF] from x86 Instruction Set Architecture (ISA) to RISC-V ISA. In particular, the rdtime instruction was used instead of the rdtscp instruction. The cache flush instruction is not officially defined in RISC-V, nevertheless, we found that in Orca, when opcode is set to MISC-MEM, along with funct3 set to REGION and funct7 set to CACHE-FLUSH, a cache region is flushed. This special flush instruction was used instead of clflush of x86 ISA.

Our Detection Module focuses on instructions that access the timer Control and Status Register (CSR), including rdtime, and the cache flush instruction described below. By looking for timer/timer or timer/flush attack pattern, we successfully detected this Flush+Reload attack.

The synthesis of our Detection Module shows a maximum frequency of 271 MHz. In the fully implemented design, it occupies 235 registers and 400 LUTs. Static synchronization logic occupies additional 793 registers and 256 LUTs.

V. CONCLUSION AND FUTURE WORK

In this paper, we discussed the feasibility of dynamic monitoring using reconfigurable hardware to detect cache timing attacks. We presented how we integrate reconfigurable hardware components into non-reconfigurable hardware and explained how can deal with different execution frequencies of the hardware.

For future work, we plan to improve our Detection Module, in order to be able to detect other cache-based microarchitectural attacks and their variants, and if possible, other softwarebased microarchitectural attacks as well. We continue our experimentation to evaluate the performance and area overhead of this solution. In the longer term, we want to take into account multithreading and context changes.

Fig. 1 .

 1 Fig. 1. Design of overall architecture.

Fig. 2 .

 2 Fig. 2. Design of Detection Module.