S Merlet

P Gillot

B Cheng

R Karcher

A Imanaliev

L Timmen

F Pereira

Dos Santos

Calibration of a superconducting gravimeter with an absolute atom gravimeter

We present a 27-days long common view measurement of an absolute cold atom gravimeter (CAG) and a relative iGrav superconducting gravimeter, which we use to calibrate the iGrav scale factor. This allowed us to push the CAG long-term stability down to the level of 0.5 nm.s -2 . We investigate the impact of the duration of the measurement on the uncertainty in the determination of the correlation factor and show that it is limited to about 3‰ by the coloured noise of our cold atom gravimeter. A 3-days long measurement session with an additional FG5X absolute gravimeter allows us to directly compare the calibration results obtained with two different absolute meters. Based on our analysis, we expect that with an improvement of its long term stability, the CAG will allow to calibrate the iGrav scale factor to better than the per mille level (1σ level of confidence) after only one-day of concurrent measurements for maximum tidal amplitudes.

Introduction

Because of their high sensitivity, low drift and reasonable maintenance costs, superconducting gravimeters (SG) [START_REF] Goodkind | The superconducting gravimeter[END_REF] are today the key instruments for the continuous monitoring of gravity variations. Nevertheless, being relative meters, they need to be calibrated and their drift to be determined, the methods for this being summarised for instance in Refs. [START_REF] Imanishi | Calibration of the superconducting gravimeter T011 by parallel observation with the absolute gravimeter FG5#210 -a Bayesian approach[END_REF] and [START_REF] Rosat | Analysis of a 10-year (1997-2007) record of time-varying gravity in Strasbourg using absolute and superconducting gravimeters: New results on the calibration and comparison with GPS height changes and hydrology[END_REF]. For their calibration, one can either use long tidal measurements [START_REF] Melchior | A new data bank for tidal gravity measurements (DB 92)[END_REF], induce controlled gravity changes by displacing masses, or the SG itself [START_REF] Warburton | The effect of Ocean Tide Loading on Tides of the Solid Earth Observed with the Superconducting Gravimeter[END_REF], [START_REF] Achilli | A calibration system for superconducting gravimeters[END_REF], [START_REF] Richter | The Frankfurt calibration system for relative gravimeters[END_REF], [START_REF] Falk | Calibration of the Superconducting Gravimeters SG103, C023, CD029 and CD030[END_REF], perform co-located measurements with relative spring gravimeters [START_REF] Meurers | Aspects of gravimeter calibration by time domain comparison of gravity records[END_REF], [START_REF] Meurers | Superconducting Gravimeter Calibration by Colocated Gravity Observations: Results from GWRC025[END_REF] or with absolute gravimeters (AG) [START_REF] Hinderer | On the calibration of a superconducting gravimeter using absolute gravity measurements[END_REF], [START_REF] Francis | Calibration of the C021 superconducting gravimeter in Membach (Belgium) using 47 days of absolute gravity measurements[END_REF], [START_REF] Francis | Calibration of a superconducting gravimeter by comparison with an absolute gravimeter FG5 in Boulder[END_REF], this last method being today the most common. Although less precise in the end than using a calibration platform [START_REF] Falk | Calibration of the Superconducting Gravimeters SG103, C023, CD029 and CD030[END_REF], it has the advantage that it does not require moving the SG. Moreover, this is the only method which allows in addition to evaluate precisely the SG drift. With free fall corner cube AGs, such as the FG5s [START_REF] Niebauer | A new generation of absolute gravimeters[END_REF], a precision of 1‰ is typically reached in less than a week of concurrent measurement [START_REF] Francis | Calibration of a superconducting gravimeter by comparison with an absolute gravimeter FG5 in Boulder[END_REF], [START_REF] Imanishi | Calibration of the superconducting gravimeter T011 by parallel observation with the absolute gravimeter FG5#210 -a Bayesian approach[END_REF], [START_REF] Tamura | Scale factor calibration of a superconducting gravimeter at Esahi Station, Japan, using absolute gravity measurements[END_REF], [START_REF] Fuduka | Calibration of the superconducting gravimeter CT#043 with an absolute gravimeter FG5#210 at Syowa Station, Antartica[END_REF], [START_REF] Rosat | Analysis of a 10-year (1997-2007) record of time-varying gravity in Strasbourg using absolute and superconducting gravimeters: New results on the calibration and comparison with GPS height changes and hydrology[END_REF], [START_REF] Hinderer | Gravimetric Methods -Superconducting Gravity Meters[END_REF].

For applications in geophysics [START_REF] Crossley | Network of superconducting gravimeters benefits a number of disciplines[END_REF], [START_REF] Baker | Validating Earth and ocean tide models using tidal gravity measurements[END_REF], [START_REF] Meurers | Temporal variation of tidal parameters in superconducting gravimeter time-series[END_REF], [21] the accurate determination of the SG scale factor is important, and a long term stability of the gravity measurements is desirable. This motivates the regular intercomparison of SGs with AGs in order to track SGs drifts, potential changes in their scale factor, as well as offsets related to maintenance operations, or uncontrolled systematic effects.

Atom gravimeters based on atom interferometry [START_REF] Kasevich | Atomic interferometry using stimulated Raman transition[END_REF] offer new measurement capabilities, by combining high sensitivities [START_REF] Peters | High-precision gravity measurements using atom interferometry[END_REF], [START_REF] Hu | Demonstration of an ultrahigh-sensitivity atom-interferometry absolute gravimeter[END_REF], [START_REF] Gillot | Stability comparison of two absolute gravimeters: optical versus atomic interferometers[END_REF], [START_REF] Freier | Mobile quantum gravity sensor with unprecedented stability[END_REF] and accuracies at the best level of a few tens of nm.s -2 [START_REF] Peters | High-precision gravity measurements using atom interferometry[END_REF], [START_REF] Merlet | Comparison between two mobile absolute gravimeters: optical versus atomic interferometers[END_REF], [START_REF] Karcher | Improving the accuracy of atom interferometers with ultracold sources[END_REF], with the possibility to perform continuous measurements [START_REF] Peters | High-precision gravity measurements using atom interferometry[END_REF], [START_REF] Louchet-Chauvet | Influence of transverse motion within an atomic gravimeter[END_REF], [START_REF] Hauth | First gravity measurements using the mobile atom interferometer GAIN[END_REF], [START_REF] Wang | Shift evaluation of the atomic gravimeter NIM-AGrb-1 and its comparison with FG5X[END_REF], [START_REF] Ménoret | Gravity measurements below 10 -9 g with a transportable absolute quantum gravimeter[END_REF]. Being absolute meters, their scale factor is accurately determined and do not need calibration. This is essential for applications in the frame of fundamental metrology, such as for the determination of the Planck constant with a Kibble balance [START_REF] Thomas | A determination of the Planck constant using the LNE Kibble balance in air[END_REF] and new realisation of the kilogram in the revised International System of Units [START_REF] Stock | The revision of the SI-the result of three decades of progress in metrology[END_REF]. As AGs, they are expected to play a role in the quest for the establishment of a global absolute gravity reference system and frame [START_REF] Wziontek | Status of the International Gravity Reference System and Frame[END_REF]. The study of long-term stability of atom gravimeters, as for any type of AGs, requires the precise knowledge of temporal fluctuations of gravity, in order to be able to separate them from fluctuations of systematic effects in the sensors. Even the best tide models are not enough for that purpose, as they do not account for all processes that do change the local value of gravity. This prevented us for a long time to assess the long-term stability of our Cold Atom Gravimeter (CAG), such as in Ref. [START_REF] Louchet-Chauvet | Influence of transverse motion within an atomic gravimeter[END_REF] where one could not assess whether the long-term stability of a 12-days continuous gravity measurement was limited by the instrument or by the tidal model. In 2013, the comparison of our measurements with an improved tidal model allowed to demonstrate a stability of 2 nm.s -2 at 1 000 s measurement time [START_REF] Gillot | Stability comparison of two absolute gravimeters: optical versus atomic interferometers[END_REF]. Nevertheless, direct comparisons between different sensors, and in particular with SGs, is preferable. In 2015, the GAIN gravimeter of Humboldt-Universität zu Berlin reached an unprecedented stability of 0.5 nm.s -2 in 10 5 s of measurement time when compared to an Observatory SG (OSG) [START_REF] Freier | Mobile quantum gravity sensor with unprecedented stability[END_REF].

Since the very beginning of 2013, we operate a superconducting gravimeter in our gravity laboratory at LNE [START_REF] Merlet | Microgravity investigations for the LNE watt balance project[END_REF]. The CAG also operates in this laboratory since the end of the CIPM Key Comparison CCM.G-K1 which occurred during ICAG'09 [START_REF] Jiang | The 8 th International Comparison of Absolute Gravimeters 2009: the first Key Comparison (CCM.G-K1) in the field of absolute gravimetry[END_REF].

Since then, we have been continuously working at improving the instrument performance, except when participating to comparisons in other laboratories [START_REF] Francis | The European Comparison of Absolute Gravimeters 2011 (ECAG-2011)[END_REF], [START_REF] Francis | CCM.G-K2 key comparison[END_REF] or demonstrating the capabilities of atom interferometers [START_REF] Farah | Underground operation at best sensitivity of the mobile LNE-SYRTE Cold Atom Gravimeter[END_REF] in the LSBB underground facility for the MIGA project [START_REF] Geiger | Matter-wave laser Interferometric Gravitation Antenna (MIGA) : New perspectives for fundamental physics and geosciences[END_REF]. We performed a one-month long gravity measurement performed simultaneously by the iGrav005 and the CAG, to investigate the long term stability of our atomic instrument. We present in this paper this measurement and take advantage to study the calibration of the SG and discuss the uncertainty of this calibration.

Continuous common view gravity measurement with atom and superconducting gravimeters

The LNE gravimetry laboratory is equipped with a 33 m 2 pillar, large enough to accommodate several AGs at a time for intercomparisons. A superconducting gravimeter (iGrav005) 8 is operating since 2013 at one of the pillar's corners. It is placed on top of a rock pedestal, so as to raise the measurement height of the instrument at mid human height (∼ 0.95 m) which reduces the gravity effect of the CAG operators. Figure 1 shows the two gravimeters, the iGrav005 on the stone and the CAG at the centre of the laboratory. They are located 3.5 m apart in the horizontal plane and their measurement height differs by 0.1 m. The direct comparison between these two instruments is of interest as they rely on very different measurement methods, and do not in principle suffer from common systematic effects that might exist when comparing instruments of the same technology, if not from the same family.

The iGrav output signal is the feedback signal that controls the levitation of a superconducting sphere in a magnetic field generated with superconducting coils [START_REF] Goodkind | The superconducting gravimeter[END_REF]. When gravity changes, this output feedback signal, a voltage, is modified. As for the CAG, the signal of interest is a frequency chirp applied to the interferometer lasers, which continuously stirs the phase of the interferometer to the center of the fringe pattern [START_REF] Louchet-Chauvet | Influence of transverse motion within an atomic gravimeter[END_REF], [START_REF] Farah | Underground operation at best sensitivity of the mobile LNE-SYRTE Cold Atom Gravimeter[END_REF]. The CAG has already been presented in detail, for instance in [START_REF] Louchet-Chauvet | Influence of transverse motion within an atomic gravimeter[END_REF]. We recall here the features mostly relevant for this study. Its measurement height is 0.835 m. In short, it performs cyclic measurements of g, with a cycle time of 380 ms. Its principle of operation is based on the realisation of a Mach Zehnder type atom interferometer with 87 Rb cold atoms. A measurement protocol, also described in [START_REF] Louchet-Chauvet | Influence of transverse motion within an atomic gravimeter[END_REF], and based on alternating 4 different measurement configurations, allows to reject most of the systematics. Each measurement configuration is repeated 100 times after which a number of relevant parameters, such as tilts, optical powers and frequency quartz reference for example, are monitored. It leads to a gravity measurement average over 177 s. The CAG accuracy has recently been improved to 20 nm.s -2 [START_REF] Karcher | Improving the accuracy of atom interferometers with ultracold sources[END_REF] but was in the range 40-50 nm.s -2 for the measurements presented in the following.

Figure 2 displays the results of a continuous gravity measurement session performed with the two instruments (CAG and iGrav) from April the 7 th to May the 4 th of 2015. Signals severely perturbed by the occurence of an earthquake, or by a failure of the CAG due to lasers going out of lock have been removed, leading to a few gaps in the data. The iGrav005 data are corrected for a linear drift of (0.027 ± 0.006) nm.s -2 .d -1 evaluated over 4 years from 2014 to 2018.

doi.org/10.5880/igets.tr.l1.001 The difference δg between the two instrument measurements after the calibration of the iGrav scale factor is represented in grey on the bottom graph (δg = g CAG -g iGrav ). A shorter sample spanning over a week-end is highlighted in black.

Instrumental delays

As for tidal analysis [START_REF] Baker | Validating Earth and ocean tide models using tidal gravity measurements[END_REF], an accurate timing of the data is required when comparing the gravity variations of the two instruments to calibrate the iGrav output signal [START_REF] Meurers | Aspects of gravimeter calibration by time domain comparison of gravity records[END_REF], [START_REF] Van Camp | Optimized strategy for the calibration of superconducting gravimeters at the one per mille level[END_REF]. The effect of a lack of synchronisation on the calibration of the SG depends on the amplitude of gravity variations and the duration of the common view measurement. For a 11 days session, which allows to observe tides with large and small amplitudes, with 30 s averaged data to filter and decrease the noise, a 30 s difference between the two instrument timings leads to an effect lower than 0.1‰ on the calibration factor (CF) determination such as results of [START_REF] Meurers | Aspects of gravimeter calibration by time domain comparison of gravity records[END_REF], [START_REF] Van Camp | Optimized strategy for the calibration of superconducting gravimeters at the one per mille level[END_REF]. For a one day session, the effect varies from 0.2‰ to 0.01‰ depending on the magnitude of the tides. The time stamping of CAG data is performed by the clock of its control computer, which is locked on UTC via the NTP protocol. The iGrav SG uses a GPS receiver to correct GPS time into UTC. In addition, one should also take into account delays due to the time response of the sensors to gravity changes. While the CAG suffers negligible delay when considering the time of the measurement at the middle of the interferometer, appreciable delays are present in the case of the SG, owing not only to their mechanical response function but also on the use of additional filters. A precise determination of the response function can in principle be performed via self calibration, but this functionality was not available in our iGrav. While the theoretical transfer function given in the iGrav Operator Manual allows us to estimate a delay of 10.9 s, Ref. [START_REF] Francis | Comprison between the Transfer Functions of three Superconducting Gravimeters[END_REF] points out the need for considering instead real transfer functions, which can differ for each SG. A rough confirmation of this delay was obtained via the direct measurement of the gravity change when bringing suddenly 4 operators next to the meter and having them sit on the floor. We observed a gravity change by (11.6 ± 0.3) nm.s -2 with a delay of (11 ± 1) s, in agreement with the theoretical estimation. Finally, this delay could also be extracted from the analysis of the time correlation between the signals of the two meters of figure 2, which allows for the determination of a delay of (10.3 ± 0.3) s. Note that these last two methods determine the overall SG delay, including additional delays by the data acquisition system [START_REF] Van Camp | Accurate transfer function determination for superconducting gravimeters[END_REF].

Direct calibration of the superconducting gravimeter

Methods to calibrate SGs have already been investigated in detail in [START_REF] Hinderer | On the calibration of a superconducting gravimeter using absolute gravity measurements[END_REF] [13] and later improved in [START_REF] Van Camp | Optimized strategy for the calibration of superconducting gravimeters at the one per mille level[END_REF]. The relationship between the two signals (expressed in nm.s -2 for the CAG and in volts for the iGrav) can simply be determined via a simple linear regression:

AG = CF × SG + Offset (1)
In ref. [START_REF] Hinderer | On the calibration of a superconducting gravimeter using absolute gravity measurements[END_REF] a linear drift was added to take into account possible drift between AG and SG observations. When using new generation AGs (model FG5) refs. [START_REF] Almavict | Comparisons between absolute (AG) and superconducting (SG) gravimeters[END_REF] and [START_REF] Francis | Calibration of a superconducting gravimeter by comparison with an absolute gravimeter FG5 in Boulder[END_REF] did not include any additional linear or polynomial part, but based the CF determination on equation 1. When the calibration involve such as a calibrated SG versus a spring gravimeter to be calibrated for instance, the use of polynomials is required [START_REF] Francis | Calibration of the LaCoste-Romberg 906 by comparison with the superconducting gravimeter C021 in Membach (Belgium)[END_REF]. The polynomial term has the advantage of removing any drift of the SG or any residual drift after an imperfect drift removal. It can then also in principle remove drifts due to fluctuations of uncontrolled systematic effect of the AG. We will discuss them in section 8. In such a case, the polynomial term prevent to discriminate the relative contribution of the two instruments in the adjusted drift. Given that we are interested in assessing the potential of high stability atom gravimeters for the purpose of calibrating SGs, we choose first not to use additional polynomials for our study, though it is a common practice, which was shown to improve the CF determination in Ref. [START_REF] Meurers | Aspects of gravimeter calibration by time domain comparison of gravity records[END_REF].

Figure 3 illustrates the correlation between the measurements of the two instruments. We used equation 1 to determine the CFs over two sets of data of different lengths. The first set displayed in grey corresponds to the whole measurement period of 27-days, while the second in black corresponds to a more quiet period of 1.7-days, starting before midnight on a Friday and ending after midday on the next Sunday, the noise during weekends being reduced by the absence of on site human activity. We obtain two calibration factors of respectively (-898.25 ± 0.20) nm.s -2 /V and (-899.00 ± 0.50) nm.s -2 /V, in agreement within their uncertainties, which are given here by the errors of the fits (1σ), ie the standard errors of the regression slopes. The first calibration factor was then used to convert the SG voltage samples into gravity data, and the difference between CAG and the calibrated SG measurements was calculated. This difference is displayed in the bottom part of figure 2. A statistical analysis of this difference over the two sets of data was then performed by calculating their Allan standard deviations, which are displayed on figure 4. For the selected 1.7-day period, the Allan standard deviation averages down to 0.5 -0.6 nm.s -2 , with a τ -1/2 slope characteristic of white noise, as already observed in [START_REF] Freier | Mobile quantum gravity sensor with unprecedented stability[END_REF]. As for the Allan standard deviation of the 27-days common view measurement, it also decreases with the same slope down to the 2 -3 nm.s -2 level for about 3 000 -4 000 s, but reaches a plateau for larger averaging times.

Segmented duration analysis

To perform a statistically relevant study of the uncertainty associated with the calibration factor determination, several independent such determinations would be required. We thus take advantage of the time-length of the measurement to carry out a segmented analysis and calculate an iGrav CF for each day of measurement. The 27 resulting one-day calibration factors are displayed in figure 5, with uncertainties given by the errors of the linear fits. Remarkably, the standard deviation of the one-day CFs, which amounts to 2.77 nm.s -2 /V, is three times larger than the mean value of the errors of the fits of 1.05 nm.s -2 /V. This tends to indicate that the errors of the fits underestimate the uncertainty in the CF determinations. The peak-to-peak variation of the one-day CFs is 10 nm.s -2 /V, twice smaller than in Ref. [START_REF] Imanishi | Calibration of the superconducting gravimeter T011 by parallel observation with the absolute gravimeter FG5#210 -a Bayesian approach[END_REF], where a similar analysis was carried out between a SG and a FG5 AG over a similar 27-days long period, with peak to peak gravity variations up to 2 400 nm.s -2 . 1 0 0 1 0 0 0 1 0 0 0 0 1 0 0 0 0 0 We stress here that the observed variations of the CFs are not correlated with changes of the signal to noise ratio (S/N) which we define here as the ratio between i) the difference between maximal and minimal tidal values over the one-day long observation and ii) the Allan standard deviation of the signal for an averaging time of 177 s, which we take here as the short term noise. Such variation can in practice impact the CF as discussed in Ref. [START_REF] Van Camp | Optimized strategy for the calibration of superconducting gravimeters at the one per mille level[END_REF]. Nevertheless, given that SG data are averaged over a relatively long duration of 177 s, the SG noise is here too small to lead to significant attenuations of the CFs, comparable to the amplitude of the fluctuation we observe on figure 5. Yet, one can notice that the CF values determined for large peak-to-peak tide amplitudes, and in particular between day 57 129 and 57 135, show less scattering.

1 1 0 ؓ g ( ؔ) ( n m . s -2 ) ؔ ( s )
Here, as for the global CF determination of previous section, we used equation 1 for each day segment analysis. As discussed later, we repeated the protocole with a polynomial part added to equation 1 which did not modified the results whereas we used first or second order polynomial. To better understand the figure 5 behavior and compare the results we obtain with simulated data, we generated a synthetic AG signal, obtained out of the iGrav output signal converted into a gravity signal with the first CF obtained in figure 3, to which a white noise of the same amplitude as the short term noise of the CAG was added. We then used this synthetic signal to calibrate the iGrav, repeating our segmented analysis, but for different measurement durations, spanning from 7 h to 200 h. As the total common view measurement is 27-days long, we obtained several distributions with numbers of samples ranging from 91 to 3 respectively. We report on figure 6 the standard deviations of these distributions as open blue dots, as well as the corresponding means of the errors of the fits as grey diamonds, and we find a fair agreement between them. This shows that the mean errors of the fits are good estimates of the uncertainties in the CF determinations when the differential noise between the sensors is white. By contrast, the same analysis performed with the real CAG signal shows a different behavior. Indeed, the standard deviations, which are displayed as blue dots on figure 6, clearly feature a plateau, showing that measurements longer than about a day do not help to reduce the uncertainty on the CF determination. On the other hand, for durations of up to a day or so, the errors of the CF fits could be taken as reasonable estimators of the uncertainty of the CFs, despite being about twice overoptimistic. With this analysis, we understand that the behaviors we observe with the real data are related to coloured noise. Though at this stage, the question remains in principle open whether the coloured noise arises from the CAG or from the iGrav, we attribute it to the CAG. Indeed, the Allan standard deviations of the residuals of the gravity data corrected from tides, with a tidal model obtained with a spring gravimeter two years long continuous measurement session which improved the initial determination of Ref. [START_REF] Merlet | Microgravity investigations for the LNE watt balance project[END_REF], and from atmospheric effects, show for the CAG a behavior similar to the grey curve of figure 4 whereas, for the iGrav005, the stability is about three times lower at a 10 000 s averaging time.

Comparison of calibrations with different types absolute gravimeters

In Ref. [START_REF] Francis | Evaluation of the precision of using absolute gravimeters to calibrate superconducting gravimeters[END_REF], the authors calibrated a SG with four FG5 AGs during a single measurement session. The different CFs they obtained agreed with each other, demonstrating the robustness of using any FG5 AG for such calibration. Yet, one could not exclude a possible unaccounted-for bias because the experiment was limited to only FG5 AGs, which motivates carrying similar studies with AGs relying on different technologies.

To do so, we took the opportunity of a measurement campaign organised in the frame of the ITOC project [START_REF] Denker | Geodetic methods to determine the relativistic redshift at the level of 10 -18 in the context of international timescales: a review and practical results 2018[END_REF] to welcome again in the LNE gravimetry laboratory the free fall corner cube gravimeter FG5-220 of the Institute of Geodesy of Leibniz University Hannover, in its improved version [START_REF] Niebauer | Simultaneous gravity and gradient measurements from a recoil-compensated absolute gravimeter[END_REF], namely the FG5X-220. As a remark, absolute gravity measurements performed by the AGs agree with a difference of 1 nm.s -2 compatible with their measurement uncertainties. But, of particular interest for the present study, we took advantage of a week-end to perform a common view continuous measurement between the three instruments (iGrav, CAG, FG5X) to repeat the analysis presented above in section 5. Note that for these measurements, i) the FG5X-220 performed one free fall every 30 s continuously during close to 3 days, a duration not far from the 4-5 days required to calibrate an SG at the 1‰ level with an FG5, according to [START_REF] Francis | Calibration of a superconducting gravimeter by comparison with an absolute gravimeter FG5 in Boulder[END_REF]; ii) the CAG cycling g measurement was 360 ms which led to g measurement averaged over 164 s in the protocole summarised in section 2 and iii) the maximum gravity difference due to peak-to-peak tide variations was 1 500 nm.s -2 .

Global and segmentation analysis

Figure 7 presents the results of the statistical analysis of the iGrav CFs determined for segment sizes varying from 4 h to 62.5 h, corresponding respectively to numbers of independent determinations of the CF ranging from 15 to 1. We used the FG5X-220 drops and verified that the FG5X values were not affected by aliasing effect due to the 30 s measurement period [START_REF] Van Camp | Uncertainty of absolute gravity instruments[END_REF]. The analysis leads to a CF difference of (3.2 ± 2.2) nm.s -2 /V for the whole measurement duration. The mean of the errors of the CF fit, which we take here as fair estimates of the uncertainties in the CF determinations, is three times better for the CAG determination due to its better short term sensitivity [START_REF] Gillot | Stability comparison of two absolute gravimeters: optical versus atomic interferometers[END_REF]. Nevertheless, in principle these uncertainties associated to the FG5X could be reduced by increasing the repetition rate. Expressed as in many papers [START_REF] Francis | Calibration of a superconducting gravimeter by comparison with an absolute gravimeter FG5 in Boulder[END_REF], [START_REF] Imanishi | Calibration of the superconducting gravimeter T011 by parallel observation with the absolute gravimeter FG5#210 -a Bayesian approach[END_REF], [START_REF] Tamura | Scale factor calibration of a superconducting gravimeter at Esahi Station, Japan, using absolute gravity measurements[END_REF], [START_REF] Fuduka | Calibration of the superconducting gravimeter CT#043 with an absolute gravimeter FG5#210 at Syowa Station, Antartica[END_REF], [START_REF] Rosat | Analysis of a 10-year (1997-2007) record of time-varying gravity in Strasbourg using absolute and superconducting gravimeters: New results on the calibration and comparison with GPS height changes and hydrology[END_REF], [START_REF] Meurers | Superconducting Gravimeter Calibration by Colocated Gravity Observations: Results from GWRC025[END_REF], [START_REF] Crossley | More Thoughts on AG-SG Comparisons and SG Scale Factor Determinations[END_REF] in relative units, it corresponds to a relative uncertainty of 0.7‰ for the CAG and 2.3‰ for the FG5X. The latter value being compatible with similar previous studies [START_REF] Francis | Calibration of a superconducting gravimeter by comparison with an absolute gravimeter FG5 in Boulder[END_REF].

Focus on one-day segmentation

As the measurement with the FG5X was not exactly 3-days long, we then split the measurement data into 3 slightly overlapping periods of 1 day length in order to perform three 1-day analysis such as the one presented in figure 5. The overlap between two consecutive segments is of order of 10%. Figure 8 displays the results of these 1-day analysis for both instruments. As in the analysis of section 5, the CFs vary from one day to the other: 7.5 nm.s -2 /V peak-to-peak with the CAG and 17.8 nm.s -2 /V with FG5X. As expected from the above global analysis we do not find statistically resolved differences between the CFs of the CAG and the FG5X, their differences being lower than their combined 2σ uncertainties. Nevertheless, the two determinations of the first day lie a bit off with respect to the 2 others. (opened squares). The 1 st day result obtained with CAG measurement corrected from a linear drift (see Fig. 9) is represented with a cyan dot. The error bars are the individual fit errors.

Discussion of the results

In principle, differences in the CFs represented in figure 8 could be explained either by i) real gravity fluctuations, which are not perfectly correlated between the instruments, ii) instability of the SG, iii) instability of the AGs. The proximity between the sensors (1.4 m between iGrav and FG5X-220, 2.1 m between FG5X-220 and CAG and 3.5 m between iGrav and CAG) rules out the first hypothesis. For the second, even if SGs have been shown to be stable [START_REF] Rosat | Limits of detection of gravimetric signals on Earth[END_REF], we cannot at this stage exclude a problem with ours.

To investigate this, we calculated CFs by comparing SG data corrected from pressure and polar motion effects with the tidal model improved from [START_REF] Merlet | Microgravity investigations for the LNE watt balance project[END_REF] presented in section 5.

We then found the three one-day determinations in agreement within 0.8 nm.s -2 /V, with an average value of (-897.3 ± 0.3) nm.s -2 /V, confirming the good behavior of the SG. Finally, gravity measurements from the three meters were corrected from the same tidal model and other corrections mentioned above, leading to the residuals displayed in figure 9. For a better readability, the three curves are offset by 15 nm.s -2 . While SG residuals can be attributed to imperfect tidal predictions and corrections, the AG residuals display clear drifts which we attribute to bias instabilities. Residuals for both AGs do show a similar trend (a linear drift) at the beginning, while after about a day, the CAG residual remain more or less stable while the FG5X residual drifts in the opposite direction. We calculated daily linear drifts for each instruments, which are displayed as dashed lines in figure 9. For instance a drift of (-10.19 ± 0.06) nm.s -2 .d -1 was found over the first day for the CAG. Correcting CAG data from this drift changes the first CF value by 5.4 nm.s -2 /V, and brings it as expected closer to the two others (see the point in cyan in figure 8). A similar analysis with FG5X show the same behavior. When correcting from a quadratic drift the global 3 days analysis, we reduce the difference between the CFs down to (1.2 ± 2.2) nm.s -2 /V. This clearly shows that the determinations are affected by the instabilities of the AGs. When the fluctuation is "deterministic", such as in the case of a linear (or eventually polynomial) trend, one can account for it in the fit formula for the CF determination [START_REF] Hinderer | On the calibration of a superconducting gravimeter using absolute gravity measurements[END_REF]. While this turns efficient in the example above, we found no significant difference in the dispersion of the figure 2 CFs for the 27-days measurement when adding in the fit a drift, be it linear or quadratic. This arrises from the fact that AGs instabilities are not necessarily well captured by linear or polynomial trends. Nevertheless, for peak-to-peak gravity variations ranging from 900 nm.s -2 to 2 000 nm.s -2 over a day, we find with the CAG that error fit represented in figure 6 could lead to CF relative uncertainty better than the 1‰ level (1σ) as early as one day of measurement. This is all the more true for higher gravity variations.

More generally, our analyse is well in line with the recent study of Ref. [START_REF] Scherneck | Superconducting gravimeter and seismometer shedding light on FG5's offset, trends and noise: what observations at Onsala Space Observatory can tell us[END_REF] which highlights the crucial impact of long-term instabilities of AGs for SG calibrations and also shows the absolute atom instruments capabilities and the potential they offer for the determination of precise SG CFs. In particular the unprecedented measurement stability of 0.5 nm.s -2 obtained with an AG [START_REF] Freier | Mobile quantum gravity sensor with unprecedented stability[END_REF] allows for determining the CF with a relative uncertainty of 0.3‰ in a 5.8 d measurement during peak-to-peak gravity variations of 1 200 nm.s -2 .

Instrumental fluctuations

We finally investigate the sources of the drifts observed in the residuals represented in figure 9, by looking at correlations with relevant experimental parameters.

We found no correlation between the residuals and any of the parameters monitored for the FG5X. However this instrument class has a tendency to lose its verticality due to temperature variation for exemple, which thus decrease gravity value. This parameter is not monitored during measurements. Despite the laboratory temperature varied of 0.15 • C peak-to-peak during the measurement, we cannot exclude a thermal and/or mechanical effect relaxation on the alignments due to operator manual adjustments on the sensor. The verticality could have varied during the week-end measurement and came back to the initial value when we enter back in the laboratory.

The trend in the CAG data is well correlated with a drift in the optical powers of the lasers used to drive the interferometer. The evolution of these laser optical powers leads to an evolution of the so called two photon light shift (TPLS) [START_REF] Gauguet | Off-resonant Raman transition impact in an atom interferometer[END_REF]. It drifted linearly with a trend expressed in terms of acceleration, of +14.4 nm.s -2 .d -1 during gravity trend was -10.2 nm.s -2 .d -1 and then remained stable. The initial trend due to TPLS is not enough to explain the gravity trend. Other parameters fluctuate in the CAG measurements. They are mostly due to the initial cold atom source position that can fluctuate with optical power and polarisation of other optical beams used to cool down the atoms [START_REF] Farah | Effective velocity distribution in an atom gravimeter: Effect of the convolution with the response of the detection[END_REF]. When released, the atomic cloud expands and the atoms sample inhomogeneous laser wavefronts distortions across the laser beam, which leads to the so-called wavefront aberration bias [START_REF] Louchet-Chauvet | Influence of transverse motion within an atomic gravimeter[END_REF], [START_REF] Karcher | Improving the accuracy of atom interferometers with ultracold sources[END_REF] and so to measurement instabilities. While variations of the TPLS were the dominant source of instability for the measurements up to 2014, the implementation of laser intensity locks since then allowed to improve the long term stability. For the 27-days long measurement session presented above, this effect kept a constant value of (39.7 ± 0.4) nm.s -2 , so that we attribute the dispersion of the CFs to variations of the wavefront aberration bias.

Repeated calibrations over 7 years

To conclude with the iGrav005 CFs, figure 10 displays as black dots the results of repeated calibration campaigns realised with the CAG since 2013. The dispersion of the CFs is there comparable to the one of the CFs obtained in this paper for oneday calibrations (displayed on the same figure as blue dots), and comparable to the 15 nm.s -2 /V peak-to-peak fluctuations obtained again with FG5 in other works (over 5 months in [START_REF] Almavict | Comparisons between absolute (AG) and superconducting (SG) gravimeters[END_REF] and over 10 years in [START_REF] Rosat | Analysis of a 10-year (1997-2007) record of time-varying gravity in Strasbourg using absolute and superconducting gravimeters: New results on the calibration and comparison with GPS height changes and hydrology[END_REF]). Given that we do not expect that the mean of many such determinations would be biased, we take the average of all the measurements as our best estimate of our CF with a very conservative uncertainty given by the standard deviation of the distribution. It amounts to (-897.6 ± 2.7) nm.s -2 /V.

Conclusion

We have performed the calibration of the relative SG iGrav005, using a 27-days long common view measurement with the SYRTE atomic absolute gravimeter CAG. This allowed to evaluate the long term stability of the residuals obtained by taking the difference between gravity data of the CAG and the calibrated SG. The Allan standard deviation of these residuals can reach 0.5 nm.s -2 after averaging over close to two days for a selected quiet period, but tend to flicker at a level of about 2 -3 nm.s -2 when averaging over the whole period. We attribute this behavior to instabilities of CAG systematic effects rather than instabilities of the SG. By carrying out a detailed statistical analysis and a comparison with simulated data, we show how the CAG instability imposes a limit on the relative uncertainty of the determination of the SG calibration factor, of about 3‰ (1σ). This could be improved well below the ‰ level with an improved long term stability of the CAG. In particular we found relative errors for the fits of the CF below the ‰ level, for peak-to-peak gravity variations larger than 1 500 nm.s -2 in a day of measurement. As an example, we demonstrated 0.5‰ after less than 2 days of measurement with a selected quiet set of data. A comparison with the calibrations realised with a corner cube FG5X gravimeter has also been performed, which shows the better performance of the CAG. Moreover, the iGrav calibration factors determined by these two types of sensors, are found in reasonable agreement but do exhibit fluctuations arising from bias instabilities.

Figure 1 .Figure 2 .

 12 Figure 1. Picture of the LNE gravimetry laboratory. A 6 m × 5.5 m pillar can host several gravimeters at a time for calibration and comparison campaigns. The iGrav005 is installed onto a cubic stone attached to the laboratory pillar at one of its corners. The CAG is placed at the center of the pillar. The FG5X-220 of Institute of Geodesy of Leibniz University Hannover is installed at one of the four remaining measurement stations.

Figure 3 .

 3 Figure3. Calibration of the iGrav output signal for the whole 27-days long measurement period (in grey) and for a selected shorter 1.7-day long period (in black).

Figure 4 .

 4 Figure 4. Allan Standard deviations of the difference between the CAG and iGrav gravity signals, for the whole 27-days long measurement period (in grey) and for a selected shorter 1.7-day long period (in black).

Figure 5 .

 5 Figure 5. iGrav one-day calibration factors. The error bars are the errors of the individual fits. The dashed purple line represents the peak-to-peak tidal gravity change over one day.

Figure 6 .

 6 Figure 6. Statistic analysis of iGrav CF determinations for different durations of measurement segmentation. Standard deviations of the distribution of the CFs are represented in blue dots: full dots for the real CAG data, and open dots for the synthetic AG signal. Grey diamonds display the means of the errors of the CF fits for the synthetic signal.

Figure 7 .

 7 Figure 7. Mean calibration factors of the iGrav005, and mean CF fit errors, obtained with the CAG (full dots and diamonds) and the FG5X-220 (opened squares and diamonds) for different durations of segmentation of the measurement.

Figure 8 .

 8 Figure 8. iGrav calibration factors determined during three consecutive one-day common view measurements obtained with the CAG (blue dots) and FG5X-220 (opened squares). The 1 st day result obtained with CAG measurement corrected from a linear drift (see Fig.9) is represented with a cyan dot. The error bars are the individual fit errors.

Figure 9 .

 9 Figure 9. Gravity variations corrected for tides, atmospheric pressure and polar motion effects during the 2014 common view measurement. iGrav005 residual is represented in blue, FG5X-220 is red and CAG in black. The three individual smoothed residuals are shifted for legibility. The dashed lines represent 9 individual linear drifts calculated for each one day measurement of each instrument.

Figure 10 .

 10 Figure 10. Calibration factors of the iGrav005 obtained with the CAG since 2013 (full dots). The blue dots display the 1-day calibration CFs presented in figures 5 and 8. The opened squares display the CF obtained with the FG5X-220 in figure 8.

Acknowledgments

This research is carried on within the kNOW and ITOC projects, which acknowledges the financial support of the EMRP. The EMRP was jointly funded by the European Metrology Research Programme (EMRP) participating countries within the European Association of National Metrology Institutes (EURAMET) and the European Union. B.C. thanks the Labex First-TF for financial support. This work has been supported by the Paris Île-de-France Région in the framework of DIM SIRTEQ.


João Paulo Esper
email: joaopauloesper@dcc.ufmg.br

Kleber Nadjib Achir
email: nadjib.achir@inria.fr

Vieira Cardoso

Jussara Almeida
email: jussara@dcc.ufmg.br

Impact of User Privacy and Mobility on Edge Offloading

Keywords: offloading, MEC, mobility, privacy

à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Impact of User Privacy and Mobility on Edge Offloading

João Paulo Esper * , Nadjib Achir † ‡ , Kleber Vieira Cardoso § , Jussara M. Almeida *

I. Introduction

Mobile devices have undergone a significant transformation from small devices with limited capacity to mobile minicomputers, leading to exponential growth in the mobile application markets. However, with this growth comes a sharp increase in application needs in terms of computational resources from applications such as virtual reality (VR), augmented reality (AR), and interactive games [START_REF] Addad | Fast service migration in 5G trends and scenarios[END_REF], which even our modern mobile terminals cannot well fulfill.

To tackle this issue, edge computing was proposed as a technology in which computational resources are moved to the Edge of the network to reduce latency and guarantee the quality of service [START_REF] Abbas | Mobile edge computing: A survey[END_REF]. Thus, users may run their applications on the Edge using offloading techniques. This combination provides the user equipment (UEs) with reduced CPU usage, extended battery life, support for more robust and sophisticated applications, and potentially unlimited storage [START_REF] Zhan | Mobilityaware multi-user offloading optimization for mobile edge computing[END_REF].

One challenge that offloading algorithms face is related to user mobility [START_REF] Yang | Efficient mobilityaware task offloading for vehicular edge computing networks[END_REF]. Users who run their applications on the Edge can move freely in the city, which may significantly affect some applications. Thus, adapting to the users' mobility patterns becomes a challenge as Multi-access Edge Computing (MEC) providers want to keep users' Quality of Experience (QoE) while also dealing with the stress of mobility on their infrastructure through complex operations, e.g., task reallocation.

Another issue that operators and service providers have recently faced is that users are becoming increasingly aware and concerned about their privacy. As such, governments in various parts of the world responded to this concern with data protection and privacy regulations, e.g., RGPD1 in Europe and LGPD2 in Brazil. For example, as illustrated by Figure 1, Android 12, released in 2021, changed how user location is accessed, and now users can choose between providing their precise locations or approximate ones.

Privacy concern is an issue for operators and service providers because they need to keep users' privacy and adapt and improve their techniques, e.g., offloading techniques, to maintain competitive performance. In most cases, the more accurate the information you have about the user (e.g., his location), the easier it becomes to predict and anticipate user demand. Yet, most prior studies have evaluated Edge offloading without any consideration of location privacy, especially in complex scenarios composed of multiple applications, each one with distinct requirements, as well as heterogeneous mobility patterns (reflecting, for instance, different mobility types), while analyzing how each of these factors (and combinations of them) may affect the offloading performance.

Our goal is to fill this gap by investigating the impact of user mobility and privacy when offloading to the Edge in multi-application and multi-mobility scenarios. To that end, we employ a combination of state-of-the-art techniques/tools related to mobility and privacy to simulate a large set of scenarios with different user privacy and mobility patterns. As such, our goal is not to propose a new privacy or security technique but rather to offer insights (e.g., how slow mobility types can suffer more with privacy than fast ones) into the trade-offs between user privacy, mobility, and computational offloading performance.

The rest of the paper is structured as follows. Section II presents related work. Section III describes the system model and problem description. Sections IV and V discuss our evaluation methodology and main results, respectively, while Section VI offers conclusions and directions for future work.

II. Related work

Prior work mostly related to our effort tackles (combinations of) aspects related to user privacy, mobility, multi-application scenarios, edge computing, and offloading. However, many of them only considered a few of these aspects. For example, in [START_REF] He | Privacy-aware offloading in mobileedge computing[END_REF], authors discussed the privacy issues of task offloading with MEC from two perspectives, location privacy, and usage privacy. The authors proposed a Markov decision process to improve latency and energy consumption while keeping pre-specified levels of privacy, but no mobility analysis was offered. Authors in [START_REF] Sun | Reducing offloading latency for digital twin edge networks in 6G[END_REF] focused on minimizing offloading latency considering user mobility and movement for AR users but did not consider privacy. In turn, authors in [START_REF] Wei | UAV-assisted privacy-preserving online computation offloading for internet of things[END_REF] focused on task offloading in a scenario of unmanned aerial vehicles with limited energy and computing capacities. The paper focused on privacy but from a computation offloading preference leakage perspective, not focusing on user location privacy.

In contrast, two recent studies have jointly explored most of those aspects. In [START_REF] Peng | Mobility and Privacy-Aware Offloading of AR Applications for Healthcare Cyber-Physical Systems in Edge Computing[END_REF], the authors proposed a mobility and privacy-aware offloading meta-heuristic method for a particular scenario, namely, AR applications that deal with patients' private information in healthcare systems. Instead, we here consider scenarios where requests from diverse applications compete to be able to offload their requests. In [START_REF] Pang | Towards Online Privacy-preserving Computation Offloading in Mobile Edge Computing[END_REF], the authors focused on the privacy leakage issue of MEC offloading, assuming an honest-but-curious server as we do in this paper. They proposed a computational offloading mechanism that provides user privacy while minimizing the total computation cost. However, their work considered homogeneous user mobility patterns, whereas we explored different mobility classes, which, as will be discussed, significantly impact the results.

III. System model and problem description

Let us consider a MEC environment composed of a set B = {1, 2, ..., B} of base stations (BSs) and a set M = {1, 2, ..., M} of MEC Hosts (MHs), as illustrated in Figure 2. Any BS can reach and offload user applications to any MH of choice. Each BS 𝑖 (MH 𝑗) has a throughput capacity of T 𝐵𝑆 𝑖 (T 𝑀 𝐻 𝑗 ). We consider a set U = {1, 2, ..., U} of users, each one modeled by a mobility type, an application, and a privacy level. The user mobility type can be car passenger, bus passenger, or pedestrian. The application can be video streaming, AR, or VR. Finally, the privacy level can be none, medium, or high. Each application has particular requirements in terms of network resources, which are expressed as:

• A 𝑡 : the throughput demand (i.e., demanded traffic volume), measured in megabits per second (Mbps). • A 𝑙 : the latency demand (i.e., maximum accepted latency), measured in milliseconds (ms). The throughput demand is met if there are enough network resources available at the selected MH 𝑗 (i.e., T 𝑀 𝐻 𝑗 ≥ A 𝑡 ) and if the throughput between the UE and the BS the user is associated to is greater or equal than the throughput demand. The throughput between UE-BS is computed using Shannon's capacity formula [START_REF] Stallings | Data and computer communications[END_REF]. If the total throughput from the UEs connected to BS 𝑖 exceeds T 𝐵𝑆 𝑖 , BS 𝑖's capacity is distributed among them following the proportional fairness method [START_REF] Kim | A proportional fair scheduling for multicarrier transmission systems[END_REF].

The latency demand is met if the latency between the BS the user is associated with and the MH selected to handle his request is less than or equal to the latency demand. The latency between BS-MH in this work is calculated based on the distance between the BS and the MH.

This work assumes that the UE is always associated with the closest (Euclidean distance) BS. Once the UE is associated, it requests the network provider to offload an application. The network provider will then report the UE's position to the MEC provider, which, in turn, will assign the closest MH to the BS the UE is associated with to handle the user's request, i.e., offload the application. Finally, if the requirements of the user's application are met, it is offloaded to the MEC system, consuming A 𝑡 resources from the MH 𝑗 it was allocated to.

Figure 3 illustrates how we model privacy in our system. We assume the existence of two infrastructure entities: i) the network provider; responsible for the BSs, communication, routing, etc., and ii) the MEC provider; responsible for the MH computational resources. We aim to protect user location from the MEC provider's perspective, as trying to mask (or fake) the user's real location from the network provider is a different challenge since the UE is associated with a BS3.

In Figure 3, we represent two different MH selections, a non-private selection and a private selection. A non-private selection, illustrated by the pedestrian in the center of the circle, occurs when the user is not concerned with his location privacy (privacy level set to none). In this case, the network provider will report the user's real location to the MEC provider, and the MEC provider will assign MH1, which corresponds to the closest MH to the BS to which the user is connected. MH1 will then handle the user's request.

A private selection, in turn, occurs when the user is concerned about his location privacy, which corresponds to a privacy level set to medium or high. In this case, the network 3Even though there are works that consider the network and MEC provider being only one entity, this assumption is not in the scope of this work. provider knows the user's real location. Yet, it will apply geoindistinguishability [START_REF] Andrés | Geo-indistinguishability: Differential privacy for location-based systems[END_REF], a state-of-the-art technique based on differential privacy, to generate a fake location, represented by the pedestrian near the circle's edge (see further discussion below). The network provider reports to the MEC provider the user's fake location (not the real one). The MEC provider, in turn, will assume the user is connected to the BS at the bottom of the figure and will assign MH2 to it, as it is the closest MH to that particular BS. MH2 will then handle the user's request. Hence, the user will gain privacy but he may lose performance as his application may no longer be offloaded to the MH that is closest to the BS he is actually connected to. This may affect application latency, resulting in QoE degradation or even failing the application demands, leading to a denied request.

To check if the application latency demand is met, the MEC provider asks the network provider to measure the latency between the selected MH and the BS to which the user is connected. The application is offloaded if the obtained latency is less than or equal to the application demand. We note that the MEC provider could ask the network provider to measure the latency between the selected MH to all BSs to gain more information about the user's real location. Yet, it would be cost-inefficient to do that for every user request in a largescale environment. Also, to efficiently guarantee user location privacy, we assume an honest-but-curious adversary [START_REF] Pang | Towards Online Privacy-preserving Computation Offloading in Mobile Edge Computing[END_REF], [START_REF] Paverd | Modelling and automatically analysing privacy properties for honest-but-curious adversaries[END_REF], meaning that the MEC provider will not deviate from the defined protocol, even though it attempts to learn all possible information from legitimately received requests.

As mentioned, we here use geo-indistinguishability to provide location privacy for the user by producing a new (fake) location. Figure 4 illustrates how this method works. Consider a tourist in Toronto, visiting the Royal Ontario Museum, who intends to offload his application or do any kind of LBS request. The tourist, concerned with his privacy, does not wish to share his precise location (represented by a red point). Instead, he will share an approximate (fake) location. more locations, lowering the probability that real and fake locations are close to each other. Thus, greater privacy levels are achieved by using smaller 𝜀 values as these lead to greater noise added to fake the user's real position.

Given that the relationship between 𝜀 and privacy is inversely proportional, 𝜀 = ∞ is a baseline in this mechanism, and it represents the user's real position, i.e., if 𝜀 = ∞, then privacy is non-existent. In Figure 4, five different 𝜀 values are presented, each one next to the circle it generated, such that 𝜀 ∞ > 𝜀 4 > 𝜀 3 > 𝜀 2 > 𝜀 1 . As illustrated, with a larger value of 𝜀, e.g., 𝜀 4 , geo-indistinguishability has fewer locations to assign a new (fake) position for the tourist, mainly outside of the museum or in nearby streets. In contrast, a smaller value of 𝜀, e.g., 𝜀 3 , can generate fake positions that 𝜀 4 could not, such as the University of Toronto or the Toronto Public Library.

IV. Evaluation methodology

This section defines our evaluation methodology by introducing the main parameters used to build our evaluation scenarios. Recall that our goal is to tackle the question: What are the impacts of user privacy and mobility when offloading to the edge? Thus, our parameters, summarized in Tables I and II, relate to mobility, privacy, and (edge) infrastructure and computational resources.

We simulated different user mobility patterns by considering three mobility types: car passengers, bus passengers, and pedestrians. To that end, we used SUMO (Simulation of Urban MObility)4, a widely used mobility simulator. We simulated 30 different runs with SUMO following the Manhattan Mobility Model5, each time with a different seed. Each run lasts for 1 hour, with a temporal resolution of 1 second, and considers a squared area of 4 km 2 (2 km × 2 km). We used the population density reported in [START_REF] Zhou | On the spatial distribution of base stations and its relation to the traffic density in cellular networks[END_REF], i.e., 312.5 users/km 2 , resulting in a total of 1,250 users, which were distributed into the three mobility types as follows: 400 car passengers, 400 bus passengers, and 450 pedestrians. We assume that each car has one passenger and each bus has 10 passengers, generating a total of 440 vehicles in the area (400 cars and 40 buses). To quantify and position BSs and MHs in the simulated area, we used Homogeneous Poisson point processes (HPPP), as done in [START_REF] Zhou | On the spatial distribution of base stations and its relation to the traffic density in cellular networks[END_REF]. Specifically, we set the HPPP intensity parameter 𝜆 to 118.75, as reported for 'Urban Area 1' in [START_REF] Zhou | On the spatial distribution of base stations and its relation to the traffic density in cellular networks[END_REF], leading to 475 BSs, and used 𝜆=23.75 to generate and position 95 MHs in the simulated area. We assumed that each BS 𝑖 has a capacity T 𝐵𝑆 𝑖 of 10 Gbps, as reported by 3GPP [START_REF] Gpp | Study on scenarios and requirements for next generation access technologies[END_REF], and each MH 𝑗 has a capacity of T 𝑀 𝐻 𝑗 of 10.41 Gbps [START_REF] Spinelli | Toward enabled industrial verticals in 5G: A survey on MEC-based approaches to provisioning and flexibility[END_REF]. We defined three user privacy levels by varying the 𝜀 parameter used by the geo-indistinguishability method. As discussed, the smaller the value of 𝜀, the more private the user's (real) position becomes. The first level, referred to as none, corresponds to 𝜀 = ∞, the case when the user chooses not to have location privacy (user's real and fake positions are the same). It is used here as a baseline for comparison. The other two levels, i.e., medium and high, are defined by setting 𝜀 = 0.1 and 𝜀 = 0.01 respectively, following a prior study on location privacy in the edge [START_REF] Qiao | An effective data privacy protection algorithm based on differential privacy in edge computing[END_REF].

To make our evaluation more realistic, we also considered the throughput and latency requirements of three different types of applications: video streaming, augmented reality (AR), and virtual reality (VR), as presented in Table II. The video streaming and AR requirements were obtained from [START_REF] Spinelli | Toward enabled industrial verticals in 5G: A survey on MEC-based approaches to provisioning and flexibility[END_REF], whereas those for VR were obtained from [START_REF] Lai | Furion: Engineering high-quality immersive virtual reality on today's mobile devices[END_REF], both focusing on 5G scenarios. Following Cisco6 and Ericsson7 forecasts for network traffic in the following years, we defined that 70% of the users are consuming a video streaming application. We distributed the rest of the traffic (30%) evenly between AR and VR. We assume that the VR application does not fit the pedestrian mobility type since they cannot be fully aware of their surroundings if they use a VR headset while walking. Thus, we set that the pedestrians can only use a video streaming or AR application, while other mobility types can use any of the three applications.

We conducted several experiments covering three user mobility patterns, three application types, and three privacy protection scenarios. In short, given an input privacy level (𝜀 = ∞, 0.1 or 0.01), we ran 30 simulations (by varying the seed) with user population (mobility patterns and applications) as described above, producing a total of 90 different experi-6https://www.cisco.com/c/en/us/solutions/collateral/executiveperspectives/annual-internet-report/white-paper-c11-741490.html 7https://www.ericsson.com/en/mobility-report/reports/november-2019/mobile-traffic-by-application-category Table III: Impact of privacy on acceptance of requests: fraction of requests in each category and 95% confidence intervals.

Always offloaded Privacy dependent Never offloaded

56.37% ± 0.06 30.03% ± 0.07 13.58% ± 0.10 ments. As discussed next, our results present very narrow 95% confidence intervals, suggesting high accuracy.

V. Evaluation results

We now discuss our results of the impact of privacy, mobility and application types on the offloading performance.

A. Impact of privacy level

We start by evaluating the impact of the privacy level, captured by the value of 𝜀, on the acceptance of requests. We do so by comparing the outcome of each user request -offload was successful or failed -for each privacy level (𝜀 equal to ∞, 0.1, and 0.01). Recall that an offload request is successful whenever there is enough resource at the selected MH and the user application's bandwidth and latency requirements are met. Considering the totality of user requests issued during a simulation run, we classify them into one of the three scenarios: Always offloaded, Privacy dependent, and Never offloaded. The former corresponds to requests that were successful in all runs, whereas the latter relates to requests that failed in all runs, regardless of the value of 𝜀. Both categories relate to requests that were not impacted by the particular privacy level adopted. Requests whose outcome varied depending on the value of 𝜀 used fall into the privacy dependent category.

Table III presents the average fraction of user requests falling in each category, along with 95% confidence intervals. As shown, most requests (around 56%, on average), were offloaded in all privacy levels. This means that, in all these cases, regardless of the privacy level chosen (∞, 0.1, or 0.01), the user was always able to successfully offload his desired application. We delve deeper into this result by breaking down these requests by application type. We note that over 98% of the requests for AR (the least bandwidth and latency demanding application) were offloaded in all privacy levels. In contrast, only around 47% of the video requests (the most demanding in terms of latency) and 31% of the VR requests (the most demanding in terms of bandwidth) were always offloaded regardless of the privacy level. Thus, as one might expect, privacy has less impact on offloading requests that impose lower requirements. Yet, we note that even though both application requirements and privacy needs could be successfully fulfilled for those requests, users still paid a price for privacy as the latency of these requests did increase for higher levels of protection (as discussed below).

In contrast, around 30% of the requests fell into the Privacy dependent category, implying that the success of the offload depended on the user's privacy level. The vast majority of those requests, or 28% of all requests, were accepted for privacy levels equal to none and medium failing only for privacy level equal to high. Thus, in total, a user was able to successfully offload his application while still maintaining a medium privacy protection in roughly 84% of the time (56% + 28% of all requests). A high privacy level, in turn, is more challenging as it more often leads to request being denied.

We note that around 14% of the requests were never offloaded, regardless of the privacy level (even for no privacy protection). We then zoom deeper into the reasons why users were not able to offload their applications in each of the privacy scenarios. Recall that the denial of an offload request may happen because8: 1) the latency between the BS the UE is associated with and the selected MH is above the application's latency requirement (blue bars); 2) the throughput between the UE and the BS is not enough to meet the application's throughput requirement (green bars); 3) both latency and throughput requirements are not met (red bars).

As shown in Figure 5, for all privacy levels, the first reason -high latency between BS and MH -dominates all cases, often occurring for requests to offload video streaming, the most latency demanding application. Moreover, the fraction of requests denied due to this reason increases with privacy protection. This happens because smaller 𝜀 values imply in greater chance that the MEC operator selects an MH that is farther from the BS the UE is associated with (true and fake user locations far from each other), resulting in higher latency.

The other two reasons, in turn, occurred with much lower frequency, often for requests to offload the VR application (with the highest bandwidth demands). We note that the privacy level does not impact the fraction of requests denied due to lack of throughput between the UE and the BS (reason 2) since there is no privacy from the network operator's standpoint (i.e., user's BS is the same for all privacy levels). Yet, we do observe a small increase in the fraction of requests 8We note that, for simulation purposes and given the limited area considered, all requests are always associated with a BS. Thus, request denials cannot occur due to the lack of coverage by nearby BS. denied due to reason 3, i.e., both application requirements are not fulfilled, in the most private scenario (𝜀 = 0.01). Such increase is mostly due to the longer latency that result from the higher privacy protection, as discussed above.

B. Impact of mobility type

We now turn our attention to how privacy impact the MH selection for different mobility types. As detailed in Section III, the MEC operator selects the MH closer to the BS he thinks the UE is associated with, which might be right or not. Figure 6 presents the fractions of MH selections that differ from the ideal one (closest to the true BS) for each mobility type.

Naturally, with no privacy protection (𝜀 = ∞), the selected MH is always ideal. Yet, the fraction of selections resulting in different MHs increases with the privacy level for all three mobility types, reaching at least 60% for high privacy. Also, Figure 6 shows that the slowest mobility type (pedestrian) is more impacted by privacy than the other two types, reaching 70% of non-ideal MH selections for the high privacy level.

Prior work has analyzed the impact of mobile user's speed on offloading performance under privacy protection [START_REF] Pang | Towards Online Privacy-preserving Computation Offloading in Mobile Edge Computing[END_REF], focusing on a single mobility type. Our result suggests that, in addition to speed, different user mobility patterns, notably where and how the user moves, may also impact offloading with privacy protection. Pedestrians move only on the sidewalks and crosswalks, while cars and buses move only on the streets. Also, car/bus flow is influenced by traffic jams and traffic lights, while pedestrians move more freely on the sidewalks, hardly ever facing traffic lights on crosswalks. Depending on BSs and MHs limitations, MEC selection may be impacted differently as spatial constraints (sidewalks, crosswalks or streets) of each mobility type can offer an advantage (or disadvantage) once privacy protection is applied.

Figure 7 shows the latency increase caused by the nonideal MH selections for each privacy level and mobility type. As shown, car and bus passengers had similar results as they have similar mobility patterns. However, pedestrians again suffered more the impact of privacy, with an average latency increase near 220% for high privacy level. As argued in the previous section, even if the user is able to offload his application, the price of privacy protection comes in the form of increased latency which, as Figure 7 shows, impacts pedestrian's mobility patterns the most.

C. Impact of application type

Our last analysis focuses on the user requests that were successful (i.e., user could successfully offload his applica- tion) when the privacy level was set to none but not on both remaining levels, shedding light into how mobility and application of choice may impact users who could not achieve their desired privacy level. Figure 8 shows the fractions of those requests, computed over the total number of requests for each combination of mobility type and application type. As shown, for all mobility types, requests to the video streaming application, the most demanding in terms of latency, are the most affected by privacy protection. As already argued, the applications' latency requirement is more challenging to maintain than the bandwidth requirement, provided that MH capacity does not saturate. Moreover, once again we observe that pedestrians suffered more than car and bus passengers, emphasizing the importance of mobility patterns and how natural spatial constraints on mobility may yield different offloading performance.

Finally, we make source code and all data used in our experiments (including ∼405 million user requests on different privacy and mobility scenarios) publicly available for the sake of reproducibility and fostering future research9.

VI. Conclusions and future work

In this work, we analyzed the impacts of users' privacy and mobility when offloading to the edge. We carried out a large number of simulations based on multiple real-world scenarios, parameters, and applications, each with a specific user mobility model and privacy requirement scenario, in order to analyze the impacts that privacy and mobility can have. Additionally, we made publicly available code and data necessary for replicating our work. As future work, we plan to test different/adaptive privacy levels based on the UE's Quality of Service (QoS) and on the user's mobility pattern; analyze how different MH selection algorithms from the literature are affected by the privacy, and explore our findings in the design of novel MH selection algorithms that achieve competitive results while keeping predefined user privacy levels.

Figure 1 :

 1 Figure 1: Precise vs. approximate location on Android 12.

Figure 2 :

 2 Figure 2: System overview.

Figure 3 :

 3 Figure 3: Privacy overview.

  Geoindistinguishability works by defining a circle centered around the user's real location and uniformly selecting a new/fake location inside this circle. The circle's radius is computed based on parameter 𝜀. Smaller values of 𝜀 result in greater circle's radius. The new location selection is uniform across the circle. Thus a bigger circle around the user will cover

Figure 4 :

 4 Figure 4: Geo-indistinguishability mechanism representation, inspired by [12].

  High latency between BS and selected MH Not enough bandwidth between UE and BS Both

Figure 5 :

 5 Figure 5: Reasons for request denials for various privacy levels.

Figure 6 :

 6 Figure 6: Impact of privacy and mobility on the MH selection.

Figure 7 :

 7 Figure 7: Impact of privacy and mobility on latency increase.

Table I :

 I Simulation parameters.

	Runs

4https://www.eclipse.org/sumo/ 5https://sumo.dlr.de/docs/Tutorials/Manhattan.html

Area Users Car pas. Bus pas. Pedes. BSs MHs BS capacity MH capacity

										Privacy levels
	30	4 km 2 1250	400	400	450	475	95	10 Gbps	10.41 Gbps	𝜀 = ∞, 0.1, 0.01

Table II :

 II Applications parameters.

	Application Bandwidth req. Latency req. % of cars pas. using % of bus pas. using % of pedes. using
	Video	70 Mbps	10 ms	70%	70%	70%
	AR	100 Mbps	30 ms	15%	15%	30%
	VR	132 Mbps	14 ms	15%	15%	-

Acknowledgements

The authors thank Mário S. Alvim for his contributions and insights regarding privacy protection. This work was supported in part by Conselho Nacional de Desenvolvimento Científico e Tecnológico (CNPq), by Fundação de Amparo à Pesquisa do Estado de Minas Gerais (FAPEMIG), by Coordenação de Aperfeiçoamento de Pessoal de Nível Superior (CAPES) and in by the CAPES-STIC-AMSUD 22-STIC-07 LINT project.