Abbass Madi

Oana Stan

Renaud Sirdey

Cedric Gouy-Pailler

Cédric Gouy-Pailler

SecTL: Secure and Verifiable Transfer Learning-based inference

Keywords: Homomorphic Encryption, Verifiable Computing, Transfer Learning

INTRODUCTION

In recent years, a major domain of research concerns the machine learning (ML) methods and the efforts in having high quality predictive models. [START_REF] Yin | Efficient classification across multiple database relations: A crossmine approach[END_REF][START_REF] Kuncheva | Classifier ensembles with a random linear oracle[END_REF][START_REF] Baralis | A lazy approach to associative classification[END_REF]. Yet, in practical usage scenario, it is often necessary to evaluate these models in a privacy-preserving fashion, for example by evaluating a model on a server over encrypted data, the inputs or the derived predictions are not disclosed to the server. In this context, this paper studies how complex machine learning can be performed securely in practice by combining Fully Homomorphic Encryption (for computing over encrypted data), Verifiable Computing (for integrity guarantees) as well as Transfer Learning (as a means for scaling without prohibitively large volumes of costly encrypted operations). The common point of the most previous works in the Machine Learning domain is that the training data and testing data enjoy precisely the same feature space and identical data distributions. In contrast, Transfer Learning (TL) aims to build an effective model that transfers knowledge in one context to enhance learning in a different context. Therefore, it predicts even if the data distribution is not identical with the previous one, without constructing a new model from the scratch. This is interesting for various reasons such as saving efforts, energy, and time.

Classification is one of the most investigated applications of transfer learning [START_REF] Tommasi | The more you know, the less you learn: from knowledge transfer to oneshot learning of object categories[END_REF][START_REF] Tommasi | Safety in numbers: Learning categories from few examples with multi model knowledge transfer[END_REF][START_REF] Wang | Dyadic transfer learning for cross-domain image classification[END_REF][START_REF] Aytar | Tabula rasa: Model transfer for object category detection[END_REF][START_REF] Jie | Multiclass transfer learning from unconstrained priors[END_REF][START_REF] Zhu | Heterogeneous transfer learning for image classification[END_REF][START_REF] Kuzborskij | From n to n+ 1: Multiclass transfer incremental learning[END_REF][START_REF] Long | Transfer feature learning with joint distribution adaptation[END_REF][START_REF] Patricia | Learning to learn, from transfer learning to domain adaptation: A unifying perspective[END_REF][START_REF] Rohrbach | Transfer learning in a transductive setting[END_REF][START_REF] Srivastava | Discriminative transfer learning with tree-based priors[END_REF][START_REF] Wang | Transfer feature representation via multiple kernel learning[END_REF]. The problem of lacking sufficient labeled or unlabeled data in a target domain can be solved by the transfer learning, which also leads to more reliable classification results. Other typical applications exploiting TL have been proposed in recent years, such as pedestrian detection [START_REF] Cao | Transfer learning for pedestrian detection[END_REF], improved image recognition in the medical field [START_REF] Romera-Paredes | Transfer learning to account for idiosyncrasy in face and body expressions[END_REF], improving visual tracking [START_REF] Gao | Transfer learning based visual tracking with gaussian processes regression[END_REF], and features selection [START_REF] Kuzborskij | Transfer learning through greedy subset selection[END_REF][START_REF] Kuzborskij | Scalable greedy algorithms for transfer learning[END_REF]. In the machine learning context, one important issue is data confidentiality and model integrity. Homomorphic Encryption is one of the methods to ensure the data privacy that allows to apply an operation over encrypted data without decrypting it first. The integrity of computation on encrypted data or clear data can be further on verified using verifiable computing techniques.

In this context, this paper against addresses the confidentiality threat and the leakage of information in the transfer learning process. We leverage homomorphic encryption and verifiable computing to provide solutions for the secure evaluation step of the transfer learning. Our contributions are as follows:

• Propose a secure architecture for privacypreserving and verifiable TL by means on Ho-momorphic Encryption and Verifiable Computing. Beside this architecture, we also give an example of a practical medical use case for our secure transfer learning solution.

• Provide an instantiation of our framework using the VC protocol from [START_REF] Fiore | Efficiently verifiable computation on encrypted data[END_REF] with the BFV [START_REF] Fan | Somewhat practical fully homomorphic encryption[END_REF] homomorphic encryption scheme, to classify an encrypted image into two classes (dogs and cats)1 .

• Propose PEOLE, a method of dimension reduction of the features space in order to efficiently apply the homomorphic encryption techniques without a significant accuracy loss.

• Evaluate the practical performances of our architecture (≈2 min for prediction an encrypted image) by several classification experiments consisting in extracting the featurea from a pre-trained model VGG16 [START_REF] Simonyan | Very deep convolutional networks for large-scale image recognition[END_REF] for image classification and train a MLP (Multi-Layer Perceptron) classifier on top of it.

RELATED WORK

It is worth noting that most of the studies in the privacy of data to machine learning consisting of applying homomorphic encryption to machine learning models concentrates on making the inference on private data (e.g. CryptoNets [START_REF] Gilad-Bachrach | CryptoNets: Applying neural networks to encrypted data with high throughput and accuracy[END_REF], TAPAS [START_REF] Sanyal | TAPAS: Tricks to accelerate (encrypted) prediction as a service[END_REF], NED [START_REF] Hesamifard | Deep neural networks classification over encrypted data[END_REF]) and not so much on the training phase. Other notable works [START_REF] Zhu | Semi-supervised learning literature survey[END_REF][START_REF] Nigam | Text classification from labeled and unlabeled documents using em[END_REF][START_REF] Blum | Combining labeled and unlabeled data with co-training[END_REF][START_REF] Joachims | Transductive inference for text classification using support vector machines[END_REF]. [START_REF] Zhu | Class noise handling for effective cost-sensitive learning by cost-guided iterative classification filtering[END_REF] have finestudied how to deal with noisy class label problems in the line of research between supervised and unsupervised learning. In another line of research, Yang et al. [START_REF] Yang | Testcost sensitive classification on data with missing values[END_REF] have studied the cost of learning when the additional tests can be made to future samples.

A particularly interesting application approach using encryption for performing machine learning for Deep Neural Network nets (DNNs) has been done in [START_REF] Tanaka | Learnable image encryption[END_REF] where all the images used for training are encrypted using a tailored-made cryptosystem called Tanaka. Sirichotedumrong, Kinoshita, and Kiya (SKK) scheme [START_REF] Sirichotedumrong | Privacy-preserving deep neural networks with pixel-based image encryption considering data augmentation in the encrypted domain[END_REF] proposed a privacy-preserving scheme for DNN that encrypts the images ( pixel-based image encryption method) under different keys, and allows one to use data augmentation in the encrypted domain. Glyph [START_REF] Lou | Glyph: Fast and accurately training deep neural networks on encrypted data[END_REF] is another approach, based on homomorphic encryption, allowing to fast and accurately train DNNs on encrypted data by switching between TFHE (Fast Fully Homomorphic Encryption over the Torus) and BGV cryptosystems.

The problem of ensuring privacy and verifiability in a deep learning system is examined in a few works such as SafetyNets [START_REF] Ghodsi | Safetynets: Verifiable execution of deep neural networks on an untrusted cloud[END_REF], and Slalom [START_REF] Tramer | Slalom: Fast, verifiable and private execution of neural networks in trusted hardware[END_REF]. However, these schemes (SafetyNets, Slalom) propose only a small variety of activation functions or require additional hardware assistance as in [START_REF] Tramer | Slalom: Fast, verifiable and private execution of neural networks in trusted hardware[END_REF]). An interesting architecture proposed by [START_REF] Madi | Computing neural networks with homomorphic encryption and verifiable computing[END_REF] to achieve both confidentiality and integrity for the inference step of a neural network is comprised of three entities: client, server, and operator. Even if similar to ours, in their case, the server executes the first layers privately (using FHE and VC) and it is the operator which is performing on clear the last layers of the NN. As such, they cannot take advantage of a public pre-trained model and moreover, they are obliged to use an adversarial learning model against the leakage of information after decryption on the operator side.

To the best of our knowledge, this is the first work to use the application of the verifiable computing and homomorphic encryption for the transfer learning setting (i.e. verify the integrity of the encrypted prediction results returned by the model).

BACKGROUND

Transfer Learning (TL)

Transfer Learning (TL) is the process of learning to solve a problem in a "target" domain using part of the knowledge acquired on the reference problem to solve a similar target problem. In this context, we can distinguish several approaches depending on what, when and how we want to transfer. The application of this idea in ML implies reusing all or part of a model learned on reference data to solve a target problem by re-learning on the target data. This is attractive for several purposes, such as learning about sensitive data, while respecting privacy policies and business requirements and in different domains like the health or the autonomous driving field.

In a Transfer Learning setting, some labeled data D src are available in a source domain, while only unlabeled data D tar are available in the target domain. We denote the source domain data as D src = {(x src 1 , y src 1 ), . . . , (x src n 1 , y src n 1 )}, where x src i ∈ R m is the input data and y src i is the corresponding label.

Furthermore, we indicate the target domain data as D tar = {x tar 1 , . . . , x tar n 2 }, and, without loss the gener- ality, we suppose the input x tar i in R m . Let P (X src ) and Q (X tar ) (denoted by P , and Q in short) being the marginal distributions of X src and X tar , respectively. Generally, they can be different. The task of transfer learning is then to predict the labels y tar i corresponding to the inputs x tar i ∈ D tar .

Homomorphic Encryption (HE)

Fully Homomorphic Encryption (FHE) schemes allow to perform arbitrary computations directly over encrypted data. That is, with a fully homomorphic encryption scheme E, we can compute E(m 1 + m 2 ) and E(m 1 × m 2 ) from encrypted messages E(m 1 ) and E(m 2 ).

In this section we recall the general principles of the BFV homomorphic cryptosystem [START_REF] Fan | Somewhat practical fully homomorphic encryption[END_REF], which we use in combination with a VC scheme. Since we know in advance the function to be evaluated homomorphically, we can restrain to the somewhat homomorphic version described below.

The biggest problem of Homomorphic Encryption, especially in the homomorphic multiplicative is the size of the ciphertext that is growing exponentially in the number of operations, which can have a great influence on the correctness and the capability of decryption. For this reason for some HE scheme, there exists a relinearisation operation to solve the growth of error rate. We skip the description of the relinearisation step for the BFV since this is not needed for our usage -we evaluate only multi-variate quadratic polynomials of degree at most 2 (i.e. at most 2 multiplications and a modular reduction which can be realized upon decryption).

Let R = Z [x] /Φ m (x) denote the polynomial ring modulo the m-cyclotomic polynomial with n = ϕ(m). The ciphertexts in the scheme are elements of polynomial ring R q , where R q is the set of polynomials in R with coefficients in Z q . The plaintexts are polynomials belonging to the ring R t = R/tR.

As such, BFV scheme is defined by the following probabilistic polynomial-time algorithms: BFV.ParamGen(λ): → (n , q,t, χ key , χ err , w). It uses the security parameter λ to fix several other parameters such as n , the degree of the polynomials, the ciphertext modulus q, the plaintext modulus t, the error distributions, etc. BFV.KeyGen(n , q,t, χ key , χ err , w):→ (pk, sk, evk). Taking as input the parameters generated in BFV.ParamGen, it calculates the private, public and evaluation key. Besides the public and the private keys, an evaluation key is generated to be used during computation on ciphertexts in order to reduce the noise. BFV.Enc pk (m):→ c = (c 0 , c 1 , c 2 = 0) It produces a ciphertext c according to BFVcryptosystem for a plaintext m using the public key pk. BFV.Dec sk (c):→ m It computes the plaintext m from the ciphertext c, using private key sk.

BFV.Eval pk,evk ( f , c 1 , . . . , c n ):→ c, with c =BFV.Enc pk ( f (m 1 , . . . , m n ))
, where c i =BFV.Enc pk (m i ), and f has n inputs and has degree at most two. It allows the homomorphic evaluation of f , gateby-gate over c i using the following functions:

BFV.Add(c 1 , c 2 ) and BFV.Mul evk (c 1 , c 2 ).
For further details on this scheme, we refer the reader to the paper [START_REF] Fan | Somewhat practical fully homomorphic encryption[END_REF].

Let us just note that a BFV ciphertext c can be seen as an element in R q [y] = Z/qZ[X,Y ]/Φ m (x) with a degree at most 2 (i.e., c = c 0 + c 1 y + c 2 y 2 ).

Verifiable Computing (VC)

Verifiable computation VC techniques allow to prove and verify the integrity of computations on authenticated data. A Verifiable Computation scheme is defined as a protocol in which a client (usually weak) has a function f and some data denoted x and delegates to another client (in most cases a server) the computation of y = f (x). Then the same client or another one can receive the result y plus a short proof of its correctness. More in details, a user generates an authentication tag σ x associated with his/her data x with his/her secret key and the server computes an authentication tag σ f ,y that certifies the value y = f (x) as an output of the function f . Now, anyone using the verification key (public or secret) can verify y to check that y is indeed the result of f (x).

A VC scheme includes the following algorithms: 1. (PK,SK)←KeyGen( f , λ): Taking as input the security parameter λ and a function f , this randomized key generation algorithm generates a public key (that encodes the target function f ) used by the server to compute f . It also computes a matching secret key, kept private by the client. 2. (σ x ,τ x )←ProbGen SK (x): The problem generation algorithm uses the secret key SK to encode the input x as a public value σ x , given to the server to compute with, and a secret value τ x which is kept private by the client. 3. σ y ←Compute PK (σ x ): Using the client's public key and the encoded input, the server computes an encoded version for the function output y = f (x).

4. (acc, y) ←Verify SK (τ x ,σ y ): Using the secret key SK and the secret τ x , this algorithm converts the server output into a bit acc and a string y. If acc = 1 we say that the client accepts y = f (x), meaning that the proof is correct, else (i.e. acc = 0) we say that the client rejects it.

PROPOSED APPROACH

Our Model

We begin by explaining our proposal for an architecture allowing to deploy the secure transfer learning model using homomorphic encryption and verifiable computing. Our architecture is composed of three entities: user, server, and operator. In the following, we describe a high-level view of our TL design with the role of each entity as revealed in the Figure 1. Let us denote by f , the global Machine Learning model deployed by our architecture, consisting of n layers and taking as input the data x.

1. The user -owner of some data denoted x -starts the process by applying the first (n-i) layers of the model, i.e. f n-i (x) When the result is calculated, the user encrypts homomorphically f n-i (x) , and she generates the associated integrity tag. These encryption data and the associated tag are sent to the server.

2. The server has the task of evaluating in the homomorphic domain, the remaining layers of the neural network over the private data [ f n-i (x)] HE . Due to the restrictions imposed by the Verifiable Computing protocol used in our approach (i.e. ability to evaluate the correctness of the evaluation of multi-variate polynomials of degree at most two), in our case the server will homomorphically evaluate only a quadratic function (which is totally feasible and with really good performances by existing FHE means). Now, the homomorphic evaluation of the private part of the model along with the associated integrity proof is sent to the operator.

3. The operator has access to the evaluation of the server evaluation, and to the result of the TL model. Therefore, it can check the validity of the server computation. If it is correct it decrypts the result, and then employs it as it wants.

We note that the number of layer i evaluated on the server side depends directly on the limitation of the VC and FHE methods.

Security Guarantees and Threats

Unlike other works using homomorphic encryption for private inference, we set up our study in the case of a malicious server, which can possible alter the results of the evaluation (e.g. by not running the specified algorithm). We argue that it is necessary to have integrity guarantees against threats coming from this adversary in addition to the confidentiality offered by the homomorphic encryption.The malicious adversaries may conduct arbitrarily (i.e. execute any computation) for stealing, corrupting, and modifying data, without any specifications, and may compute any function over data instead of the required computation (function delegated). For this goal, in our approach, we use verifiable computing technique, in particular the VC protocol of Fiore et al. [START_REF] Fiore | Efficiently verifiable computation on encrypted data[END_REF], that allows anyone to check efficiently the calculation evaluated on the server over encrypted data, in order to check that the server correctly calculates the layers delegated to it. To the best of our knowledge, this VC is the most practical verifiable computing protocol to address the validity of computation over encrypted data with the limitation that it evaluates mutivariate functions of degree at most 22 . Therefore, this constraint restrains the number of layers that can be delegated to the server in our architecture (i.e. the server can evaluate homomorphically maximum the last quadratic layers of a model).

In our architecture, unlike other works using homomorphic encryption, especially Glyph [START_REF] Lou | Glyph: Fast and accurately training deep neural networks on encrypted data[END_REF] and Madi et al. work (Madi et al., 2020), the server evaluates in the homomorphic domain the last layers of the model as knowing the encrypted of f n-i (x) to obtain the encryption of f (x). The operator, after receiving the encryption result decrypts f (x), which is contrary to the Glyph and Madi approach, where they compute the first layers of the model and send this encrypted to the operator that decrypts this result and obtain f 1 (x) and complete model. Therefore, at the level of leakage information, it is clear that our model is the best in the prevention of reduce the leakage of information. In summary, using our architecture we prevent threats coming from the server executing the last layer and wanting to infer information about the learning.

Medical Use-case

As quickly described in [START_REF] Mormont | Comparison of deep transfer learning strategies for digital pathology[END_REF], imagine a scenario where a radiologist (user) has just ac- quired images from the body of one of its patient and needs to interact with a remote proprietary diagnostic service (server) to get some insights. The service itself is expecting images as input and crunches them through an advanced deep neural network which outputs highly reliable insights in terms of the pathology the patient is suffering from as well as personalized treatment approaches. Clearly, as health-related data, the patient images and data are considered sensitive and cannot be shared without protecting their confidentiality. On the other hand, the neural network has been carefully crafted by the service provider using a lot of precious hard-earned training data and is considered critical intellectual property. In this scenario, it is thus acceptable neither that the service provider is granted access to the patient data (or to a by-product of these) nor that the radiologist is disclosed the network. Thus without additional means to prevent disclosure of these assets, a high value service is prevented to exist.

One way to resolve these conflicting requirements is by bringing privacy preserving FHE calculations into the picture. In principle, in the above scenario, the radiologist may be the owner of a FHE cryptosystem and send its patient's data encrypted under that cryptosystem to the service provider. The service provider then evaluates its neural network directly over these encrypted data, producing results which are sealed under the radiologist's cryptosystem. The final results are then sent back to the radiologist who is the only party able to decrypt them. So we are done. The patient data are not disclosed to the service provider (since they, and their by-products, are sealed under a cryptographic layer at all time) and the network is not disclosed to the radiologist since it stays on the service provider computing premises. Unfortunately, this naïve view is impractical since, despite the advances made and yet to be made in FHE operators efficiency, it is unlikely that they will be sufficient to enable practical homomorphic evaluation of the large scale neural nets involved in advanced machine learning tasks. Fortunately, as we shall now see, scaling FHE calculations to complex machine learning tasks does not necessarily mean scaling FHE calculations to large scale models. Now let us assume that the service provider has followed the transfer learning philosophy to build its neural network. As such, its network can thus be split in two parts:

• A first preprocessing network (e.g. VGG16)

which is publicly available and has no dependencies on the precious hard-earned training data of the service provider.

• A second much smaller decisional network trained on the service provider sensitive data which turns VGG16 ouputs into the highly reliable insights expected by the radiologist.

In light of the above, we can now rework our scenario to make it much more FHE friendly. Indeed, the publicly available preprocessing network can be disclosed to the radiologist's information system and run in the clear domain before encryption. So rather than sending FHE-encrypted images, the radiologist('s information system) only sends a FHE-encryption of the resulting feature vector(s), which is furthermore of much smaller size than high-resolution images. On the service provider side, only the smaller decisional network has to be run in the encrypted domain therefore dramatically decreasing the footprint of FHEcalculations and resulting de facto in much better scaling properties. Since transfer learning techniques are widely applicable and applied in the neural network community we can therefore claim that performing advanced machine learning tasks over encrypted data does not require scaling encrypted-domain calculation to large networks, as, as argued above, the fact of running the preprocessing on the user/radiologist side does not impact the confidentiality properties of the setup.

DIMENSIONALITY REDUCTION OF TARGET DOMAIN

In order to provide a good TL model, that can be used with our architecture, we propose a dimensionality reduction method of the target domain D tar .

The proposed TL dimensionality reduction, which will be called Probability Elimination of Output with Light Effect (PEOLE) uses a projection map ψ : R m → R m that eliminates the features extracted by the public model of the public model. It consists in finding the minimal dimension of the feature space such that there is not a very high of accuracy in the prediction of the final model (i.e. finding m s.t. m = ψ(R m ) ).

We note by X ∈ R n 2 ×m the matrix representing the D tar where we put the x tar i in the i -th line of X. We want to find the new matrix X ∈ R n 2 ×m respresenting the D tar .

Our method consists in performing of two steps: First Step. For any column, we calculate the percentage of element less than a chosen threshold s(s can be for example 10 -6 ). Second Step. Eliminate the column that has a percentage bigger than a chosen percentage p for example for p = 90% , and s = 10 -6 , we eliminate the column that has more than 90% elements small than 10 -6 ).

For a percentage p and a sill s, if we delete all the columns of X that have a percentage more than p elements small than s, so we do not lose a remarkable amount of accuracy

EXPERIMENTAL EVALUATION

In our experiments, we want to evaluate our architecture for the case where we extract the features from a pre-trained model for image classification and train a classifier on top of it. We note that the ML implementations in this chapter are done on Google Collab. We use a dataset consisting in images containing only 2 types of animals (dogs and cats)3 where the train folder contains 12500 images for each class. Each image in this folder has the label as part of the filename. The test dataset contains 12,500 images, named according to a numeric id.

As for the public pre-trained model, we used the VGG16 model [START_REF] Simonyan | Very deep convolutional networks for large-scale image recognition[END_REF] to extract the data features, which is a convolutional neural network model proposed by K. Simonyan and A. Zisserman [START_REF] Simonyan | Very deep convolutional networks for large-scale image recognition[END_REF]. We note that this model is trained over the ImageNet4 , a dataset of 14 million images belonging to 1000 classes. Our evaluation metric was the accuracy of prediction for the test sets.

The VGG16 architecture consists of: 1. A total of 16 layers in which weights and bias parameters are learnt. 2. This network contains a total of 13 convolutional layers with 3 * 3 kernel size, and increasing numbers of filters corresponding to the layers, with 3 dense layers for classification (comprises of 4096, 4096, and 1000 nodes each). 3. Each convolutional layers is followed by a ReLu activation, and a final softmax output layer (25, 088 total parameters). 4. A 2 * 2 max pooling applied at different steps (after the: 2nd, 4th, 7th, 10th, 13th convolution layer ) to obtain the informative features. We state that, in our experimentation, we do not want to add the last layer of VGG16 architecture, since we add a classifier, essentially a Multilayer perceptron.

On top of the VGG16 model, we build our own private model, a simple neural network -MLP (Multi-Layer Perceptron) to classify over our own dataset (images of dogs and cats). Then, our private model is a MLP composed of one hidden layer with 55 neurons with an identity activation function that trains using the pre-trained features by VGG16. We note that the weight matrix for the first layer is 25, 088×55 and the hidden layer consists of 55 × 1 weight vector. We recall that the features extracted from VGG16 are in the form of a vector of length 25, 088. The Figure 2 represents the different steps in our test architecture.

The first step of our experiment is to encrypt the extracted features using VGG16 and to generate the corresponding authentication tags. Afterwards, we evaluate the MLP model over these encrypted data and their tags (the server private computation part) and send the encrypted result with the computed result tag to an operator that can verify (over the result tag) that the calculation is correct, and decrypt this result if the verification passed.

We build two distinct sets of experimentation. On one hand, we aimed at reducing the output of VGG16 of 25088 features to an acceptable size which permits us to encrypt it using a homomorphic encryption system and to improve the speedup of the prediction over encrypted features. Using our PEOLE method we tried to find the best set of parameters (s, p) 5 while preserving the accuracy level. Let us emphasise that our main focus was on the evaluation of the techniques for privacy and integrity (i.e. homomorphic encryption and respectively VC) in order to achieve a secure transfer learning model without degrading its performance.

Transfer Learning Parameters

To evaluate the speedup of the prediction process relative to the TL parameter and to accelerate the computation of the private model over encrypted data, we start our experiments by describing the variation of the dimension of the target domain (more precisely the output of VGG16) corresponding to the elimination of the column depending on the percentage p of elements with value less than s = 10 -2 . As expected, the dimension of the features vector after elimination is reduced, as seen in Figure 3. For example, we remark that the dimension of the output VGG vector is decreased by 75% for p=80% meaning that its size decreases from 25088 to 5638.

To show a complete view of our method and its importance, we need to describe the accuracy modification using PEOLE with different values for the percentage p. {10 -6 , 10 -5 , 10 -4 , 10 -3 , 10 -2 }. As we can see in this figure the accuracy for (s, p) = (10 -2 , 80) is 97.5625 for an initial accuracy of 98.3125 (without PEOLE) and then it is an small decrease of accuracy of accuracy(0, 75%).We remark that the accuracy can be the same for multiple choices of s and p, e.g. p=83, 84 and s = 10 -3 , 10 -4 where we obtain an accuracy different from the other s and p.

As such, PEOLE method is a relatively easy way to explore the features space obtained with the initial public model and to diminish its dimension without small loss in the accuracy of the final model -i.e. as seen in the Figure 4, for p = 80% and s = 10 -2 , the accuracy becomes 97.5625. As for the homomorphic encryption the plaintext are polynomials from the ring R t = R/tR with integer coefficients modulo t, where R = Z [x] /Φ m (x) denote the polynomial ring modulo the m-cyclotomic polynomial. One has to encode the features and the parameters of the model before performing homomorphic operations on top of them. As such, we also conducted experiments to analyze the impact of this quantization on the accuracy of the final model. In this test we fixed the parameters s and p to (10 -2 ,80%). The accuracy varies depending on the precision of both features (output of VGG16) and the weights of each layer. In Table 1, we focus on the performance deterioration due to the approximations on both w k and f e by showing the accuracy for the model with regards to the rounding precision for the weights and the features.

Table 1 describes the evolution of accuracy depending on the approximation of both: weight and features with fixed (p, s) = (80%, 10 -2 ). We draw your attention that when we refer to a precision of an element of 10 2 for exemple, then we round it to the nearest integer element by taking only the two-digit after the floating point (i.e; for a feature value of 12, 345 the approximated value will be 1234). As you see in this table the accuracy varies from 97.5625% to 97.5 %, then with loss = 0.0625 %, with precision 10 2 of features for any precision of weights, but it is unremarkable variance. For this reason, and taking into account all of the results for the previously mentioned experiments, we work with the following parameters: s = 10 -2 , p = 80% that produces a feature vector of length 5638, with a good accuracy 97.5 (loss equal 0.8125 %).

Performance of Our Architecture

In the beginning, let us specify that all tests presented in this section were performed on a 2016 DELL PC(Genuine-Intel Core i7 -6600U, 4 cores at 2.60GHz with 16GB RAM at 2.13GHz), on Ubuntu (Linux kernel 4.15.0 -91generic, with the architecture x86 -64 ) as an operating system. Finally we used the C++ language to implement the encryption and verifiable computing part of our architecture.

In our experiments, we encrypt and decrypt homomorphically the data with the SEAL (SEAL, 2018) library and we use the HAL (Zuber and Fiore, 2017) library for authentication but for BFV encrypted data. We note that we choose the security parameters in the way that achieve a 128 bits of security Table 2 shows the sequential evaluation times for the different steps of our architecture to predict the class of one image after applying our PEOLE method for a percentage p = 80% and a sill s = 10 -2 . Then, the dimension of the features extracted using VGG16 passes from 25088 to 5638. As presented in this table the encryption of this vector of 5638 takes 36.6 s and the generation of the tag for authentication takes 0.005 s. The last one is the cost of generation for a single tag since we note that the tags can be generated in parallel for each encrypted element. The application of MLP over this encryption data takes about one minute and the execution of MLP over the tag takes about 2 seconds (1.48 s), we also note that the evaluation of the MLP model and the tag can be executed in parallel. Finally, the verification of authentication the result is very fast and it takes about 0.027 s.

CONCLUSION AND FUTURE WORK

The architecture proposed in this paper is the first in the TL domain to address both integrity and confidentiality threats by means of homomorphic and verifiable computing techniques. To validate our approach, we evaluated for the evaluation of the last layer of a ML model using using unencrypted weights and encrypted feature data. In this scenario, we prevent the threats coming from the server executing the last layer and wanting information about the learning, potentially interested in infering. We create our architecture using the Keras [START_REF] Chollet | Keras[END_REF] library to build the VGG16 trained over the Imagenet, and test our approach using the MLP with one hidden layer of 55 neurons that show a good accuracy for the private prediction of the class for one image (∼ 97 % ) in an acceptable time (∼ 2 min=(2min for HE and in parallel 1.512 min for VC) ) with a fast verification of result.

Our architecture remains generic and can be easily extended to further deployments where the private evaluation of the neural network model delegated to the server is more complex (more layers, other activation functions, etc). In order to go further, there are several interesing directions to follow. First, a concrete optimization idea consists in the use of the VC protocols for the homomorphic schemes in batched mode which can improve the performance and reduce the memory used for the encryption data. Other idea is to use newer and more complex verifiable computing protocols, in order to be able to evaluate more than quadratic multivariate polynomials. Finally, we hope that this paper opens the door to further work covering a more general threat model for the secure AI applications using homomorphic encryption.

Figure 1 :

 1 Figure 1: Our architecture for a confidentiality & integrity preserving inference phase of transfer learning.

Figure 2 :

 2 Figure 2: Our test architecture.

Figure 3 :

 3 Figure 3: Variation of VGG16 output vs percentage using our idea PEOLE.

Figure 4 :

 4 Figure 4: Evolution of the model testing accuracy with respect to the percentage p and different s with PEOLE method.

Table 1 :

 1 Accuracy of model after application of our PEOLE method with (p, s) = (80%, 10 -2 ) depending on precision on both w i and f e.

						precision on w i
				10 2	10 3	10 4	10 5	10 6
			10 2	97.5 %	97.5%	97.5%	97.5%	97.5%
	precision	on f e	10 3 10 4 10 5 10 5	97.5625 % 97.5625 % 97.5625 % 97.5625 %	97.5625% 97.5625% 97.5625% 97.5625%	97.5625% 97.5625% 97.5625% 97.5625%	97.5625% 97.5625% 97.5625% 97.5625%	97.5625% 97.5625% 97.5625% 97.5625%

Table 2 :

 2 Costs (in seconds) for our architecture, where x = (x 1 , . . . , x 785 ).

		User-side	Server-side	Operator-side
	Operation	Enc	GenTag	MLP(Enc(x))	MLP(σ 1 , . . . , σ n )	Veri f y	Dec
	times	36.11	0.005	66.3	1.48	0.027	0.002

Dataset available at https://www.kaggle.com/shivamb/ cnn-architectures-vgg-resnet-inception-tl/data.

This is due to the need to go beyond bilinear maps to achieve higher degrees in the underlying cryptographic primitives involved in both VC and FE.

Dataset available at https://www.kaggle.com/shivamb/ cnn-architectures-vgg-resnet-inception-tl/data.

Dataset available at https://www.image-net.org/


Quentin Chauleur

CONTINUUM LIMIT OF THE DISCRETE NONLINEAR KLEIN-GORDON EQUATION

We study the convergence of solutions of the discrete nonlinear Klein-Gordon equation on an infinite lattice in the continuum limit, using recent tools developed in the context of nonlinear discrete dispersive equations. Our approach relies in particular on the use of bilinear estimates of the Shannon interpolation alongside controls on the growth of discrete Sobolev norms of the solution. We conclude by giving perspectives on uniform dispersive estimates for nonlinear waves on lattices.

We consider the discrete nonlinear Klein-Gordon equation (DNLKG) ∂ 2 t u -∆ h u + u + |u| p-1 u = 0 on a lattice hZ d of step size h > 0 with initial condition u(0) = u 0 and ∂ t u(0) = u 1 . Here ∆ h u(a) = d j=1

u(a + he j ) + u(a -he j ) -2u(a) h 2 , a ∈ hZ d , denotes the usual discrete Laplace operator which accounts for nearest neighbor interactions, with (e j ) 1≤j≤d the canonical basis on R d . We restrict our attention to the dimensional cases 1 ≤ d ≤ 3.

Nonlinear waves in lattices [START_REF] Kevrekidis | Non-linear waves in lattices: past, present, future[END_REF] has received a lot of interest since the seminal investigation of Fermi, Pasta and Ulam [START_REF] Fermi | Studies of nonlinear problems. I. Nonlin. Wave Motion, Proc. Summer Sem. Potsdam[END_REF] on the FPUT model alongside the development of soliton theory and integrable systems such as the Toda lattice [START_REF] Toda | Theory of nonlinear lattices[END_REF] or the Ablowitz-Laddik equation [START_REF] Ablowitz | Nonlinear differential-difference equations[END_REF]. Discrete Klein-Gordon equations also naturally arise in the physics literature in order to describe Fluxon dynamics in one dimension parallel array of Josephson junctions [START_REF] Ustinov | Fluxon dynamics in one-dimensional Josephson-junction arrays[END_REF], or as a model for local denaturation of DNA [START_REF] Peyrard | Statistical mechanics of a nonlinear model for DNA denaturation[END_REF]. Equation (DNLKG) enjoys the following energy conservation law (1)

E(t) := 1 2 ∥∂ t u∥ 2 L 2 h + 1 2 ∥∇ h u∥ 2 L 2 h + 1 2 ∥u∥ 2 L 2 h + 1 p + 1 ∥u∥ p+1 L p+1 h = E(0).
Our analysis will be performed on a particular set of parameters p and d satisfying (param)

® 1 < p for d = 1, 2, 1 < p < 3 for d = 3,
which will imply from energy conservation the uniform bound ∥(u,

∂ t u)∥ H 1 h ×L 2
h ≤ C d with respect both to the time t ≥ 0 and the size of the lattice h > 0, a feature that we will extensively use throughout this work. In particular, we will be interested in the limit h → 0 of equation (DNLKG), usually referred as the continuum limit. From this perspective, equation (DNLKG) can also be seen as a finite difference scheme for the numerical simulation of the well-known nonlinear Klein-Gordon equation (NLKG) ∂ 2 t ϕ -∆ϕ + ϕ + |ϕ| p-1 ϕ = 0, and one can reasonably ask in which framework and at which rate solutions of the discrete equation (DNLKG) converge to the ones of the continuous equation (NLKG). We briefly recall that equation (NLKG) is a fundamental model in mathematical physics and has been extensively studied in a large amount of literatures. It has been used as the equation of classical neutral scalar mesons, but also to study bosonic phases in massive stars in connection with Bose-Einstein condensation [START_REF] Megias | Nonlinear Klein-Gordon equation and the Bose-Einstein condensation[END_REF]. It also appears as a superfluid model to describe the creation and dynamics of quantized vortices in galaxies [START_REF] Mauser | On the rotating nonlinear Klein-Gordon equation: nonrelativistic limit and numerical methods[END_REF]. We finally mention its link with nonlinear Schrödinger equations in the non-relativistic regime [START_REF] Masmoudi | From nonlinear Klein-Gordon equation to a system of coupled nonlinear Schrödinger equations[END_REF][START_REF] Machihara | Nonrelativistic limit in the energy space for nonlinear Klein-Gordon equations[END_REF].

Other the past ten years, there have been many recent advances in the study of the continuum limit for dispersive equations since the work of Kirkpatrick, Lenzmann and Staffilani [START_REF] Kirkpatrick | On the continuum limit for discrete NLS with long-range lattice interactions[END_REF], where the authors show the L 2 weak convergence of solutions of the discrete nonlinear Schrödinger equation (DNLS) in the continuum limit. The L 2 strong convergence of such solutions were then achieved by Hong and Yang in [START_REF] Hong | Strong convergence for discrete nonlinear Schrödinger equations in the continuum limit[END_REF] alongside precise convergence rates in h, a result which was recently extended by Choi and Aceves [START_REF] Choi | Continuum limit of 2D fractional nonlinear Schrödinger equation[END_REF] to the fractional nonlinear Schrödinger equation. However, to the best of the author's knowledge, no results are known for the continuum limit of the discrete nonlinear Klein Gordon, which is the main purpose of this paper.

This work follows from the conference CJC-MA which held in CentraleSupelec in September 2023, during which the author presented his recent study on discrete nonlinear Schrödinger equations [START_REF] Chauleur | Growth of Sobolev norms and strong convergence for the discrete nonlinear Schrödinger equation[END_REF], and announced that the strategy developed in this paper can be used for other dispersive equations. Note that contrary to this prior work, no uniform dispersive properties such as Strichartz estimates are used throughout the forthcoming proof, and comments about this feature will be developed at the end of this paper.

This paper is organized as follows. In section 1, we give some notations for discrete functional analysis and we state our main result Theorem 1. Section 2 is devoted to the proof of uniform bounds on the growth of discrete Sobolev norms of solutions to (DNLKG), and Theorem 1 is then proven in section 3. We conclude this work with section 4, where we survey recent advances in nonlinear dispersive lattice equations and give perspectives.

Discrete framework and main result

We denote respectively by L p (hZ d ), for 1 ≤ p < ∞, and L ∞ (hZ d ) (or sometimes more compactly L p h and L ∞ h in mathematical mode) the discrete Lebesgue spaces induced by the norms

∥g∥ p L p h = h d a∈hZ d |g(a)| p and ∥g∥ L ∞ h = sup a∈hZ d |g(a)|.
One can also define the forward discrete gradient

∇ + h,j g(a) = g(a + he j ) -g(a) h , ∇ + h = Ä ∇ + h,1 , . . . , ∇ + h,d ä ⊤
for any a ∈ hZ d , as well as the discrete gradient

∇ h,j g(a) = g(a + he j ) -g(a -he j ) h , ∇ h = (∇ h,1 , . . . , ∇ h,d ) ⊤ .
The discrete Fourier transform of a function g ∈ L 2 (hZ d ) and its inversion formula are given by

g(ξ) = h d a∈hZ d g(a)e -ia•ξ and g(a) = 1 (2π) d T d h g(ξ)e ia•ξ dξ for ξ ∈ T d h = R d / 2π h Z
H s h = 1 (2π) d T d h Ñ 1 + 4 h 2 d j=1 sin Å hξ j 2 ã 2 é s | u(ξ)| 2 dξ.
In order to compare discrete and continuous functions, we need to define a projection operator on the grid and an interpolation operator to lift a discrete function on the continuous space. We denote the mean projection

π h φ(a) = 1 h d a+[-h 2 , h 2 [ d φ(x)dx
for all a ∈ hZ d . We also define the Shannon interpolation of a function u : L 2 (hZ d ) → C by

S h u := F -1 Ä 1 T d h u ä ,
which allows to extend a discrete function into a real function whose Fourier transform is compactly supported in T d h , and where F defined by

Ff (ξ) = R d f (x)e -ix•ξ dx
for all ξ ∈ R d denotes the usual Fourier transform on R d . We now state our main result:

Theorem 1. Let s ∈ N * with (p, d) satisfying (param). Let ϕ ∈ C(R; H s+2 (R d )) be the unique solution of (NLKG) with initial condition (ϕ 0 , ϕ 1 ) ∈ H s+2 (R d ) × H s+1 (R d )
, and let u be the unique solution of (DNLKG) with initial condition (u 0 , u 1 ) = (π h ϕ 0 , π h ϕ 1 ). Then

∥S h u(t) -ϕ(t)∥ H s (R d ) ≤ Che B(1+t) (p-1) ∥S h u 0 -ϕ 0 ∥ H s (R d ) ,
where B and C are constants depending on d, p, s and ∥(ϕ 0 , ϕ 1 )∥ H s+2 (R d )×H s+1 (R d ) .

Growth of discrete Sobolev norms

In this section we adapt the strategy of Pampu [START_REF] Pampu | On the growth of the Sobolev norms for the nonlinear Klein-Gordon equation[END_REF] to infer upper bounds on the growth in time of Sobolev norms for the nonlinear Klein-Gordon equation to our discrete setting. This proof relies on the use of modified energies, a strategy that have proved useful in various contexts and which have very little dependence on the underlying geometry of the problem, making it very appealing from the discrete point of view. Note that this strategy was already used by the author for the discrete nonlinear Schrödinger [START_REF] Chauleur | Growth of Sobolev norms and strong convergence for the discrete nonlinear Schrödinger equation[END_REF], inspired by the work of Planchon, Tzvetkov and Visciglia [START_REF] Planchon | On the growth of Sobolev norms for NLS on 2-and 3dimensional manifolds[END_REF].

Let T > 0, and (u,

∂ t u) ∈ C([0, T ] ; H 2 h × H 1 h ) be the solution of equation (DNLKG) with initial condition (u 0 , u 1 ) ∈ H 2 h × H 1 h .
We give all the following proves in dimension d = 2 with 1 < p < ∞, but the same arguments work in the three dimensional case d = 3 (which is actually performed in [START_REF] Pampu | On the growth of the Sobolev norms for the nonlinear Klein-Gordon equation[END_REF]) with nonlinearity 1 < p < 3 relying on the Sobolev embedding H 1 h ⊂ L q h for all 1 ≤ q ≤ 6. Note also that the proof is a bit simpler in the case d = 1, as we have

H 1 h ⊂ L ∞ h .
In view of equation (DNLKG) and conservation of energy (1) alongside discrete Sobolev embeddings, we see that

∂ 2 t u ∈ C([0, T ] ; L 2 h ) and that (2) ∥∂ 2 t u -∆u∥ L 2 h ≤ C where C = C(d, E(0)) > 0. We now define the modified energy (3) E(t) := 1 2 Ä ∥∂ 2 t u(t)∥ 2 L 2 h + ∥∇ + h ∂ t u(t)∥ 2 L 2 h + ∥∂ t u(t)∥ 2 L 2 h ä for all t ∈ [0, T ].
In particular differentiating with respect to time we infer that

d dt E(t) = -⟨∂ t (|u| p-1 u), ∂ 2 t u⟩ h .
Now integrating in time between 0 and T , we get by Hölder's inequality that

E(T ) -E(0) ≤ T 0 hZ d |u| p-1 |∂ t u||∂ 2 t u| ≤ T 0 ∥u p-1 ∥ L 2(2+η) η h ∥∂ t u∥ L 2+η h ∥∂ 2 t u∥ L 2 h
for any small η > 0 yet to be fixed. Then from interpolation in discrete Lebesgue spaces alongside discrete Sobolev embedding H 1 h ⊂ L q h for all q > 1, we get that

E(T ) -E(0) ≤ T 0 ∥u∥ p-1 L 2(2+η)(p-1) η h ∥∂ t u∥ 2-η 2 2+η L 2 h ∥∂ t u∥ η(η+1) 2+η L 1+ 1 η h ∥∂ 2 t u∥ L 2 h ≲ T ∥∂ t u∥ η(η+1) 2+η L ∞ T H 1 h ∥∂ 2 t u∥ L ∞ T L 2 h ,
so denoting ε = 2η(η + 1)/(2 + η) > 0 as small as needed, we infer in view of ( 3) that ( 4)

E(T ) -E(0) ≲ T sup t∈[0,T ] E(t) 1+ε 2 .
This last equation will be useful to prove the following bound on the growth of the

H 2 h × H 1 h -norm of (u, ∂ t u), using the equivalence between the H 2 h × H 1 h norm of (u, ∂ t u) and E(t). Proposition 1. Let (u, ∂ t u) be solution to (DNLKG) with (u 0 , u 1 ) ∈ H 2 h × H 1 h , then for all ε > 0, sup t∈[0,T ] ∥(u, ∂ t u)(t)∥ H 2 h ×H 1 h ≲        (1 + T ) if d = 1, (1 + T ) 1 1-ε if d = 2, (1 + T ) 2 3-p if d = 3.
Proof. As before, we restrain the proof to the two-dimensional case d = 2, the cases d = 1 and d = 3 (with 1 < p < 3) being proven similarly. Let first write that thanks to equation ( 2),

E(t) ≤ ∥∂ 2 t u(t) -∆u(t)∥ 2 L 2 h + ∥(u, ∂ t u)(t)∥ 2 H 2 h ×H 1 h ≤ C + ∥(u, ∂ t u)(t)∥ 2 H 2 h ×H 1 h .
On the other hand, for all τ ∈ (0, 1) and small η > 0, we infer thanks to equation (4) that

∥(u, ∂ t u)(τ )∥ 2 H 2 h ×H 1 h ≲ ∥(u, ∂ t u)(τ )∥ 2 H 1 h ×L 2 h + ∥∆ h u(τ )∥ 2 L 2 h + ∥∇ + h ∂ t u(τ )∥ 2 L 2 h ≤ C + 2∥∂ t u(τ ) -∆u(τ )∥ 2 L 2 h + 2E(τ ) ≤ C + 2E(0) + Cτ sup t∈[0,τ ] E(t) 1+ε 2 ≤ C + 2∥(u, ∂ t u)(0)∥ 2 H 2 h ×H 1 h + Cτ sup t∈[0,τ ] ∥(u, ∂ t u)(t)∥ 1+ε H 2 h ×H 1 h ,
where the constants C and C are independents of τ . In particular, for 0 < τ ≤ τ 0 small enough such that Cτ 0 < 1, we get from previous estimate that

sup t∈[0,τ0] ∥(u, ∂ t u)(t)∥ 2 H 2 h ×H 1 h ≤ 2∥(u, ∂ t u)(0)∥ 2 H 2 h ×H 1 h + C, which gives that ∥(u, ∂ t u)(τ 0 )∥ 2 H 2 h ×H 1 h ≤ 2∥(u, ∂ t u)(0)∥ 2 H 2 h ×H 1 h + C Ä 1 + ∥(u(0), ∂ t u(0))∥ 2 H 2 h ×H 1 h ä 1+ε 2 .
We know remark that denoting

α n = 1 + ∥(u, ∂ t u)(nτ 0 )∥ 2 H 2 h ×H 1 h , the sequence (α n ) n≥0 satisfies that α n+1 ≤ 2α n + Cα 1-1-η 2 n
, which leads by induction that α n ≤ Cn

2 1-ε , or rewriting in terms of (u, ∂ t u) that sup t∈[0,T ] ∥(u, ∂ t u)(t)∥ H 2 h ×H 1 h ≤ C(1 + T ) 1 1-ε which ends the proof for d = 2. □
To estimate higher discrete Sobolev norms H k+1 h × H k h for k ≥ 2, one can define the higher modified energies

E k (t) := 1 2 Ä ∥∂ k+1 t u(t)∥ 2 L 2 h + ∥∇ + h ∂ k t u(t)∥ 2 L 2 h + ∥∂ k t u(t)∥ 2 L 2 h ä which enjoys the same way that d dt E k (t) = -⟨∂ k t (|u| p-1 u), ∂ k+1 t u⟩ h .
However, as in proof of [29, Proposition 5], one can show by induction on k that for any dimension

1 ≤ d ≤ 3 (with 1 < p < 3 if d = 3), E k (T ) -E k (0) ≲ T sup t∈[0,T ] E k (t) 1 2 ,
which is a better estimate than equation ( 4) and leads to the following result:

Proposition 2. Let (u, ∂ t u) be solution to (DNLKG) with (u 0 , u 1 ) ∈ H k+1 h × H k h for k ≥ 2, then sup t∈[0,T ] ∥(u, ∂ t u)(t)∥ H k+1 h ×H k h ≲ (1 + T ).
Proof. The proof follows the exact same lines as the one given through [START_REF] Pampu | On the growth of the Sobolev norms for the nonlinear Klein-Gordon equation[END_REF]Section 4] as no dispsersive estimates are used throughout the proof. □

Strong convergence in the continuum limit

From Duhamel's formula, denoting

K h (t) = sin(t √ 1-∆ h ) √ 1-∆ h and Kh (t) = cos(t √ 1 -∆ h ), we write u(t) = Kh (t)u 0 -K h (t)u 1 - t 0 K h (t -τ ) |u| p-1 u (τ )dτ
for any u solution of (DNLKG), and analogous formulas hold for K(t), K(t) and ϕ(t) solution of (NLKG) following the notations from [START_REF] Ginibre | The global Cauchy problem for the nonlinear Klein-Gordon equation[END_REF][START_REF]The global Cauchy problem for the nonlinear Klein-Gordon equation. II[END_REF]. We will decompose our analysis on the following integrals ( 5)

∥S h u(t) -ϕ(t)∥ H s (R d ) ≤ ∥S h Kh (t)u 0 -K(t)ϕ 0 ∥ H s (R d ) + ∥S h K h (t)u 1 -K(t)ϕ 0 ∥ H s (R d ) + t 0 (S h K h (t) -K(t)S h ) |u| p-1 u (τ ) H s (R d ) dτ + t 0 S h |u| p-1 u (τ ) - Ä |S h u| p-1 S h u ä (τ ) H s (R d ) dτ + t 0 Ä |S h u| p-1 S h u ä (τ ) -|ϕ| p-1 ϕ (τ ) H s (R d ) dτ =: J 1 (t) + J 2 (t) + J 3 (t) + J 4 (t) + J 5 (t).
3.1. The linear flow. It is quite direct (see for instance [START_REF] Hong | Strong convergence for discrete nonlinear Schrödinger equations in the continuum limit[END_REF]Lemma 5.1]) that for φ ∈ H s (R d ), ∥π h φ∥ H s h ≲ ∥φ∥ H s , which is known as the boundedness property of the discretization π h . We now deal with the error made by consequently projecting then interpolating a function φ, as it may not be explicitly written in the literature.

Lemma 1. Let s ≥ 0 and φ ∈ L 2 (R d ), then for all ξ ∈ T d h , ' π h φ(ξ) = Fφ(ξ) d j=1 sinc Å hξ j 2 ã .
Proof. From inverse Fourier transform property we compute that for all a ∈ hZ d ,

π h φ(a) = 1 (2πh) d a+[-h 2 , h 2 [ d R d e ix•ξ Fφ(ξ)dξdx = 1 (2π) d R d e ia•ξ Fφ(ξ) d j=1 sinc (hξ j /2) dξ.
On the other hand we know that

Π h f (a) = 1 (2π) d T d h e ia•ξ ' Π h f (ξ)dξ,
which gives the result. □

Estimates on J 1 and J 2 will be a direct consequence of the following statement:

Proposition 3. Let u 0 = π h ϕ 0 and u 1 = π h φ 1 , then for all s ≥ 0, ∥S h Kh (t)u 0 -K(t)ϕ 0 ∥ H s ≤ Ch(1+t)∥ϕ 0 ∥ H s+2 and ∥S h K h (t)u 1 -K(t)ϕ 1 ∥ H s ≤ Ch(1+t)∥ϕ 1 ∥ H s+2 .
Proof. We focus on the first estimate, as the second one can be proved similarly. We write that

∥S h Kh (t)u 0 -K(t)ϕ 0 ∥ H s ≤ ∥S h Kh (t)u 0 -K(t)S h u 0 ∥ H s + ∥ K(t)(S h u 0 -ϕ 0 )∥ H s =: I 1 (t) + I 2 (t).
As cos and √ 1 + • are 1-Lipschitz and as | 4

h 2 d j=1 sin(hξ j /2) 2 -|ξ| 2 | ≲ h 2 ξ 4 for ξ ∈ T d h , I 1 (t) 2 = T d h (1 + |ξ| 2 ) s cos Ñ t à 1 + 4 h 2 d j=1 sin Å hξ j 2 ã 2 é -cos(t » 1 + |ξ| 2 ) 2 | u 0 (ξ)| 2 dξ ≲ t 2 h 2 |ξ|≤ π √ h (1 + |ξ| 2 ) s |ξ| 4 | u 0 (ξ)| 2 dξ + T d h ∩ ¶ |ξ|> π √ h © (1 + |ξ| 2 ) s+2 (1 + |ξ| 2 ) 2 | u 0 (ξ)| 2 dξ ≲ t 2 h 2 |ξ|≤ π √ h (1 + |ξ| 2 ) s+2 | u 0 (ξ)| 2 dξ + h 2 T d h ∩ ¶ |ξ|> π √ h © (1 + |ξ| 2 ) s+2 | u 0 (ξ)| 2 dξ,
which gives the first bound as

∥u 0 ∥ H s+2 h ≲ ∥ϕ 0 ∥ H s+2 . Now note that from Lemma 1, ∥S h • π h φ -φ∥ 2 H s = T d h 1 + |ξ| 2 s ' π h f (ξ) -Ff (ξ) 2 dξ + R d \T d h 1 + |ξ| 2 s |Ff (ξ)| 2 dξ ≲ T d h 1 + |ξ| 2 s |Ff (ξ)| 2 d j=1 sinc (hξ j /2) -1 2 dξ + R d \T d h 1 + |ξ| 2 s+2 (1 + |ξ| 2 ) 2 |Ff (ξ)| 2 dξ ≲ h 4 T d h 1 + |ξ| 2 s |ξ| 4 |Ff (ξ)| 2 dξ + h 4 R d \T d h 1 + |ξ| 2 s+2 |Fφ(ξ)| 2 dξ, as | d j=1 sinc(hξ j /2) -1| ≲ h 2 |ξ| 2 so for I 2 we directly get that I 2 (t) ≤ ∥S h u 0 -ϕ 0 ∥ H s ≲ h 2 ∥ϕ 0 ∥ H s+2 ,
which gives the result as h ≤ 1. □ 3.2. Linear flow on the nonlinearity. To estimate J 3 , we temporary denote F = |u(τ )| p-1 u(τ ), so that

J 3 (t) ≤ t 0 (∥S h K h (τ )(F -π h S h F )∥ H s + ∥(S h K h (τ )π h -K(τ ))S h F ∥ H s ) dτ =: I 3 (t) + I 4 (t).
A bound on I 4 can be directly derived using Proposition 3, so that

I 4 (t) ≲ h t 0 (1 + τ )∥F ∥ H s+2 h dτ ≲ h t 0 (1 + τ )∥u∥ p H s+2 h dτ as s + 2 > d/2 since 1 ≤ d ≤ 3.
On the other hand, as ∥S h φ∥ H s ≲ ∥φ∥ H s h (see [6, Lemma 5]),

I 3 (t) ≲ t 0 ∥K h (τ )(F -π h S h F )∥ H s h dτ ≲ t 0 ∥F -π h S h F ∥ H s h dτ,
and from Lemma 1 we know that ÷ π h S h u(ξ) = u(ξ) d j=1 sinc(hξ j /2) so by Jensen inequality

I 3 (t) 2 ≲ 1 (2π) d t 0 T d h Ñ 1 + 4 h 2 d j=1 sin Å hξ j 2 ã 2 é s " F (ξ) 2 1 - d j=1 sinc(hξ j /2) 2 dξdτ ≲ h 4 t 0 ∥F ∥ 2 H s+2 h dτ ≲ h 4 t 0 ∥u∥ 2p H s+2 h dτ.
as

|ξ| 2 ≤ π 2 4 d j=1 4 h 2 sin(hξ j /2) 2 for all ξ ∈ T d h .
Combining the bounds on I 3 and I 4 , we get that (6)

J 3 (t) ≲ h t 0 (1 + τ )∥u(τ )∥ p H s+2 h dτ ≲ h(1 + t) (p+1)
using Proposition 2 since s ∈ N * so s + 2 ≥ 3.

Aliasing and Gronwall argument.

A straightforward bound on J 4 can be derive the exact same way as in [6, Section 5.2], which relies on the bilinear estimate satisfies by the Shannon interpolation [6, Proposition 6] stating that for f , g ∈ H δ (hZ d ) with δ > d 2 and for 0 ≤ s ≤ δ, we have

∥S h (f g) -S h f S h g∥ H s ≲ h δ-s ∥S h f ∥ H δ ∥S h g∥ H δ .
This directly gives in our setting (using Proposition 2) that ( 7)

J 4 (t) ≲ h 2 t 0 ∥S h u(τ )∥ p H s+2 dτ ≲ h 2 t 0 ∥u(τ )∥ p H s+2 h dτ ≲ h 2 (1 + t) 2 .
Turning now to J 5 , using the well-known identity

|f | p-1 f -|g| p-1 g ≲ p (|f | + |g|) p-1
|f -g| we can write that for all τ ∈ (0, t),

Ä |S h u| p-1 S h u ä (τ ) -|ψ| p-1 ψ (τ ) H s ≲ Ä ∥S h u(τ )∥ p-1 H s+2 + ∥ϕ(τ )∥ p-1 H s+2 ä ∥S h u(τ ) -ϕ(τ )∥ H s as s + 2 > d/2, so (8) J 4 (t) ≲ t 0 (1 + τ ) (p-1) ∥S h u(τ ) -ϕ(τ )∥ H s dτ.
Using respectively the bounds on J 1 and J 2 from Proposition 3, as well as the ones on J 3 (6), on J 4 (7) and on J 5 [START_REF] Choi | Periodic fractional discrete nonlinear Schrödinger equation and modulational instability[END_REF] in estimate ( 5), we get the result of Theorem 1 by Gronwall lemma. Note that the polynomial terms (1 + t) α for any α > 0 can absorbed by the exponentially growing term e B(1+t) (p-1) taking a larger constant B > 0.

Decay estimates for discrete wave equations

One may wonder if it would be possible to obtain continuum limit properties such has Theorem 1 for more general cases, for instance in the cubic case p = 3 in the three-dimensional case d = 3, which appears as a limiting case in Proposition 1. In order to follow the proof of [START_REF] Pampu | On the growth of the Sobolev norms for the nonlinear Klein-Gordon equation[END_REF], this would require the use of Strichartz estimates so one can trade space regularity for time integrability in Hölder's inequality application to estimate equation ( 4). It is now a standard argument since the work of Keel and Tao [START_REF] Keel | Endpoint Strichartz estimates[END_REF] that Strichartz estimates are deduced from a bounded L 2 -estimate of the associated linear semi-group (usually derived from conservation laws) alongside a time decay estimate of the L ∞ -norm of such linear flow. In fact, the derivation of decay estimates for discrete dispersive equations has drawn some attention through the last decades, and we survey some of these results in a unified framework.

Dispersive estimates on lattices. Consider a discrete dispersion relation of the form

ω h (ξ) = Ñ m 2 + 4 h 2 d j=1 sin Å hξ j 2 ã 2 é α 2 associated to the linear flow U h (t) = exp(-it(m 2 -∆ h ) α 2
). This covers several interesting models: • The case m = 0 and α = 1 corresponds to the discrete wave equation.

• The case m = 0 and α = 2 corresponds to the discrete Schrödinger equation.

• The case m = 1 and α = 1 corresponds to the discrete Klein-Gordon equation. The evolution of an initial state φ of discrete Fourier transform η under the linear flow U h (t) is given by the oscillatory integral [START_REF] Choi | Continuum limit of 2D fractional nonlinear Schrödinger equation[END_REF] I(t, a, η) =

T d h e i(a•ξ-tω h (ξ)) η(ξ)dξ.
for any a ∈ hZ d . In the case of the Schrödinger flow, as performed in the seminal work of Stefanov and Kevrekidis [START_REF] Stefanov | Asymptotic behaviour of small solutions for the discrete nonlinear Schrödinger and Klein-Gordon equations[END_REF], one can separate variables in order to reduce the problem to the d = 1 case, and an application of the well-known Van der Corput lemma gives that (10)

∥e it∆ h φ∥ L ∞ (hZ d ) ≤ C |th| d 3 ∥φ∥ L 1 (hZ d )
for any initial data φ ∈ L 1 (hZ d ), which is proven to be sharp [START_REF] Ignat | Fully discrete schemes for the Schrödinger equation. Dispersive properties[END_REF]. Such a dispersive estimate has to be compared with the usual decay in t -d 2 in the continuous free case on R d . It displays a weaker dispersion estimate than the continuous case, a pathological behavior induced by critical points and a lack of convexity of the symbol of the discrete operator ∆ h .

From now on we fix h = 1 to introduce the forthcoming results, and we denote ℓ ∞ (Z d ) := L ∞ (hZ d ) in order to match the notations of these papers. One-dimensional decay of the discrete Klein-Gordon flow was also derived in [START_REF] Stefanov | Asymptotic behaviour of small solutions for the discrete nonlinear Schrödinger and Klein-Gordon equations[END_REF] from the same techniques, which can be written as

∥e -it √ 1-∆ h φ∥ ℓ ∞ (Z) ≲ 1 |t| 1 3 ∥φ∥ L 1 (Z) .
However, wave dispersion relations (for α ̸ = 2) fail to have this separation-of-variables property, leading to more involved analysis as dimension increases. Back in 1998, Schultz proved in his breakthrough work [START_REF] Schultz | The wave equation on the lattice in two and three dimensions[END_REF] that for the discrete wave equation in dimensions d = 2, 3,

∥e -it √ -∆ h ∥ ℓ ∞ (Z 2 ) ≤ C(1 + |t|) -2 3 , ∥e -it √ -∆ h ∥ ℓ ∞ (Z 3 ) ≤ C(1 + |t|) -7 6 ,
where C = C(η) > 0, a result that have only been very recently extended to the fourth dimensional case d = 4 in [START_REF] Bi | The wave equation on lattices and oscillatory integrals[END_REF] which states the sharp bound

∥e -it √ -∆ h ∥ ℓ ∞ (Z 4 ) ≤ C(1 + |t|) -3 2 log(2 + |t|),
where the proof relies on the analysis of Newton polyhedra. For the discrete Klein-Gordon equation, Borovyk and Goldberg proved in [START_REF] Borovyk | The Klein-Gordon equation on Z 2 and the quantum harmonic lattice[END_REF] that in dimension d = 2,

∥e -it √ 1-∆ h ∥ ℓ ∞ (Z 2 ) ≤ C(1 + |t|) -3 4 ,
a result which was extended a few years later by Cuenin and Ikromov [START_REF] Cuenin | Sharp time decay estimates for the discrete Klein-Gordon equation[END_REF] ∥e

-it √ 1-∆ h ∥ ℓ ∞ (Z 3 ) ≤ C(1 + |t|) -7 6 , ∥e -it √ 1-∆ h ∥ ℓ ∞ (Z 4 ) ≤ C(1 + |t|) -3 2 log(2 + |t|),
so that in dimension 3 and 4 the discrete Klein-Gordon and wave equations share the same decay rates, whereas in the two-dimensional setting d = 2 the dispersion of the wave flow is a bit slower than the one of the Klein-Gordon equation. For higher dimensions d ≥ 5, the Klein-Gordon flow is conjectured in [START_REF] Cuenin | Sharp time decay estimates for the discrete Klein-Gordon equation[END_REF] to decay as

∥e -it √ 1-∆ h ∥ ℓ ∞ (Z d ) ≤ C(1 + |t|) -2d+1 6 log(2 + |t|) d-4 ,
whereas the wave flow is conjectured in [START_REF] Bi | The wave equation on lattices and oscillatory integrals[END_REF] to behave like

∥e -it √ ∆ h ∥ ℓ ∞ (Z d ) ≤ C(1 + |t|) -2d+1 6 .
4.2. Uniform Strichartz estimates for the discrete Klein-Gordon equation. Decay estimates of Section 4.1 are inherently not uniform with respect to the mesh size h > 0, making them a priori useless in the study of the continuum limits of such discrete systems as h → 0. Several works of Ignat and Zuazua for the discrete Schrödinger equation [START_REF] Ignat | Numerical dispersive schemes for the nonlinear Schrödinger equation[END_REF][START_REF]Convergence rates for dispersive approximation schemes to nonlinear Schrödinger equations[END_REF] and Audiard [START_REF] Audiard | Dispersive schemes for the critical Korteweg-de Vries equation[END_REF] for the discrete critical Korteweg-de Vries use Fourier filtering methods alongside two-grid algorithm in order to remove the bad behavior frequencies from the discrete operator ∆ h . This strategy allows to recover modified Strichartz estimates which are uniform with respect to h, that can be described as follows in the Schrödinger setting: denote by Π h the piecewise linear extension operator 4hZ d ) and h > 0, and for any set of Schrödinger admissible pairs

Π h : L 2 (4hZ d ) → L 2 (hZ d ), then one recovers that ∥e it∆ h Π h φ 4h ∥ L q t (R;L r (hZ d )) ≤ C(d, r)∥ Π h φ 4h ∥ L 2 (hZ d ) for all φ 4h ∈ L 2 (
2 q + d r = d 2 , 2 ≤ q, r ≤ ∞, (q, r, d) ̸ = (2, ∞, 2).
Such kind of strategy was also used by Killip Ouyang Visan and Wu [START_REF] Killip | Continuum limit for the Ablowitz-Ladik system[END_REF] in the study of the continuum limit of the Ablowitz-Ladik model, where frequency-localized Strichartz estimates [START_REF] Killip | Continuum limit for the Ablowitz-Ladik system[END_REF]Proposition 4.3] were also derived in order to infer compactness on low-regularity discrete solutions.

Another approach was recently considered by Hong and Yang in [START_REF]Uniform Strichartz estimates on the lattice[END_REF], where the authors showed that such h-dependence in equation ( 10) can be removed paying fractional derivatives on the right hand side of Strichartz estimates, which compensates the lattice resonances. The proof relies on harmonic analysis tools such as Littlewood-Paley inequality, Calderon-Zygmund theory and the Hörmander-Mikhlin theorem adapted on the discrete setting. This implies a uniform Strichartz estimate of the form [START_REF] Fermi | Studies of nonlinear problems. I. Nonlin. Wave Motion, Proc. Summer Sem. Potsdam[END_REF] ∥e it∆ h φ∥ L q t (R;L r h ) ≲ ∥φ∥

H 1 q h
for any set of discrete Schrödinger-admissible pairs (q, r) satisfying ( 12)

3 q + d r = d 2 , 2 ≤ q, r ≤ ∞, (q, r, d) ̸ = (2, ∞, 3).
Note that this kind of discrete Strichartz estimates with loss were also recently proved by Choi and Aceves [START_REF] Choi | Continuum limit of 2D fractional nonlinear Schrödinger equation[END_REF] for fractional-type discrete Schrödinger equations in the two-dimensional case, and are of course reminiscent of the situation occurring on compact manifolds like in the seminal work of Burq Gérard and Tzevtkov [START_REF] Burq | Strichartz inequalities and the nonlinear Schrödinger equation on compact manifolds[END_REF].

To the best of the author's knowledge, no such techniques have yet been used in order to derive uniform Strichartz estimates for the multidimensional discrete Klein-Gordon equation. In the following we elaborate on this point. Making the change of variables [START_REF]The global Cauchy problem for the nonlinear Klein-Gordon equation. II[END_REF] ξ 9), one is reduce to estimate the oscillatory integral

→ ξ ′ h , τ = t h , v = a hτ in (
J Φv,ζ := R d e iτ Φv(ξ) ζ(ξ)dξ for any v ∈ R d in the limit τ → ∞, where ζ ∈ C ∞ c (R d ) and Φ v (ξ) = v • ξ -γ h (ξ) with γ h (ξ) = Ã h 2 + 2 d j=1 cos(ξ j )
denoting the dispersion relation. Note that in the two-dimensional case, on the lattice Z 2 (with h = 1), the work [START_REF] Borovyk | The Klein-Gordon equation on Z 2 and the quantum harmonic lattice[END_REF] provide a decay rate in τ -3 4 for |J Φv,ζ |. However, at the limit h → 0 we observe that γ h tends to the dispersion relation of the discrete wave equation, which would suggest a slower decay rate in τ -2 3 of the oscillatory integral in view of [START_REF] Schultz | The wave equation on the lattice in two and three dimensions[END_REF]. Comments on this pathological behavior are also given in [4, Section 2.2], but not from a continuum limit perspective, and we suggest the following conjecture:

Conjecture 1. For any ζ ∈ C ∞ c (R d ), sup v∈R d |J Φv,ζ | ≤ C(ζ)(1 + |τ |) -2 3 .
Assuming Conjecture 1, one can derive uniform Strichartz estimates for (DNLKG) for d = 2 the following way. Let ψ : R d → [0, 1] be a smooth even compactly supported function such that ψ = 1

for ξ ∈ [-π, π] d and ψ = 0 for ξ ∈ R d \ [-2π, 2π] d . Let η(ξ) := ψ(|ξ|) -ψ(2|ξ|).
We then define for dyadic integers N ∈ 2 Z the Littlewood-Paley projections given by

P N := F -1 η Å hξ N ã F.
Since ξ ∈ T d h , P N is a smooth projector onto the set π

-it √ 1-∆ h P N φ∥ L ∞ h = ∥K t,N,h * φ∥ L ∞ h ≤ ∥K t,N,h ∥ L ∞ h ∥φ∥ L 1
h by Young's inequality. Making the change of variable [START_REF]The global Cauchy problem for the nonlinear Klein-Gordon equation. II[END_REF] we get that K t,N,h (a) = h -d J Φv,η(•/N ) , so from Conjecture 1 we write that ∥U h (t)P N φ∥ 2

∥K t,N,h ∥ L ∞ h ≤ C(η(•/N )) h d |τ | -2 3 ≤ C Å N h ã d-
L q t (R;L r h ) é 1 2 ≲ Ñ N ≤1 ∥P N |∇ h | 4 3 ( 1 2 -1 r ) φ∥ 2 L 2 h é 1 2 ≲ ∥|∇ h | 4 3 ( 1 2 -1 r ) φ∥ L 2
h , which would finally provides in our case a uniform Strichartz estimate with loss of the form [START_REF] Hong | Finite difference scheme for two-dimensional periodic nonlinear Schrödinger equations[END_REF] ∥e -it √ 1-∆ h φ∥ L q t (R;L r (hZ 2 )) ≤ C(q, r)∥φ∥

H 2 q (hZ 2 )
in view of the admissible condition [START_REF] Ginibre | The global Cauchy problem for the nonlinear Klein-Gordon equation[END_REF]. Note that this estimate still give a gain of regularity compared to the trivial estimate induced by the Sobolev embedding H α (hZ 2 ) ⊂ L r (hZ 2 ) with α = 1 -2/r, which would imply a H 3 q (hZ d )-norm in the right hand side of estimate [START_REF] Hong | Finite difference scheme for two-dimensional periodic nonlinear Schrödinger equations[END_REF] in view of [START_REF] Ginibre | The global Cauchy problem for the nonlinear Klein-Gordon equation[END_REF].

To conclude this monograph, we point out that uniform discrete Strichartz with loss can also be derived on compact sets, which is in agreement with effective numerical simulations. Adapting the work of Vega [START_REF] Vega | Restriction theorems and the Schrödinger multiplier on the torus[END_REF] on the discrete setting, these kind of estimates were derived for the discrete Schrödinger flow on the discrete torus T 2 h in [START_REF] Hong | Finite difference scheme for two-dimensional periodic nonlinear Schrödinger equations[END_REF] or in a large box limit in dimension d = 2, 3 in [START_REF] Hong | On the continuum limit for the discrete nonlinear Schrödinger equation on a large finite cubic lattice[END_REF], and very recently for the discrete fractional Schrödinger equation on T h in [START_REF] Choi | Periodic fractional discrete nonlinear Schrödinger equation and modulational instability[END_REF]. Note that contrary to those on hZ d [START_REF] Hong | Strong convergence for discrete nonlinear Schrödinger equations in the continuum limit[END_REF], these discrete Strichartz on compact sets are not proved to be optimal or not yet.

2 Nh

 2 ≤ |ξ| ≤ 2π N h , and the (P N ) N resolves the identity N ≤1 P N = Id. Note that the sum has an upper bound as hξ = O d (1). Denoting K t,N,h (a) := I (t, a, η(h • /N )) , we infer that ∥e

  d and a ∈ hZ d , defining an isometry from L 2 (hZ d ) to L 2 (T d h ). One can also define discrete Sobolev spaces H s (hZ d ) (or H s h ) for any s ∈ R with the norm ∥g∥ 2

  Once such a bound has been obtained, it is then straightforward to derive the Strichartz estimates for the linear evolution by averaging in t and N ,see for instance[START_REF] Choi | Continuum limit of 2D fractional nonlinear Schrödinger equation[END_REF] Remark 3.4]. In fact, denoting U N = P N/2 +P N +P 2N , we can show that ( ‹ U N (t)) t∈R satisfies the hypothesis of [21, Theorem 1.2] which implies that ∥U h (t)P N φ∥ L q ∥P N φ∥ L 2 (hZ 2 ) ≃ ∥P N |∇ h |

						2
						3	|t| -2 3 ,
	which implies as d = 2 that
	∥e -it √	1-∆ h P N φ∥ L ∞ h ≤ C	Å N h	ã 4 3	|t| -2 3 ∥φ∥ L 1
	t (R;L r h ) ≲	h Å N	ã 4 3 ( 1 2 -1 r )		4 3 ( 1 2 -1

h for any φ ∈ L 1 (hZ 2 ) and N ≤ 1. h (t) = e -it √ 1-∆ h and defining as in [7, p.1127] ‹ U N (t) = P N U h Å N 2 t h 2 ã P N where P r ) φ∥ L 2 (hZ 2 ) .

Squaring on both side and summing over N ≤ 1, this gives that

∥U h (t)φ∥ L q t (R;L r h ) ≲ Ñ N ≤1

Acknowledgements. The author is supported by the Labex CEMPI (ANR-11-LABX-0007-01).