P Mézières

F Desrichard

D Vanderhaeghe

M Paulin

Harmonics Virtual Lights: fast projection of luminance field on spherical harmonics for efficient rendering

Keywords: spherical harmonics, global illumination, real-time CCS Concepts, Computing methodologies → Rendering, Rasterization, Real-time simulation

Figure 1: (a) Harmonics Virtual Lights (HVLs) can render global illumination with arbitrary BRDF at no extra cost, while for example VPLs have an additional cost to use numerical material. (b) HVLs do not produce the classic artifacts of (c) the Virtual Point Lights methods.

Introduction

Fast and high-quality rendering of 3D environments has numerous applications: real-time rendering allows seamless interactions in video games and virtual reality applications, while interactive rendering is used by content creators to assess the look of a scene in seconds, and progressively refine it before moving on to offline rendering. These applications require very detailed 3D geometry

• An efficient projection of spherical lights contributions to SH.

• The harmonics virtual light (HVL) model, that imposes no limitation on the materials. • Two heuristics to efficiently estimate the HVLs radii.

As previous many-lights approaches, HVLs follow a two steps pipeline: The first step distributes secondary lights onto objects surfaces from each primary lights; the second step evaluates secondary lights and combines their contributions to obtain the final image (Sec. 3). HVL evaluation is based on Spherical Harmonics (SH) to solve the rendering equation (Sec. 4). Our formulation benefits from Zonal Harmonics (ZH) efficient projection of spherical lights on the SH basis (Sec. 4.2). Thanks to this projection, our spherical harmonics lighting framework handles hundreds to thousands of lights, with a full spherical harmonics convolution in O(n 2 ) where n is the number of SH bands.

Our approach uses reflective shadow maps [DS05] to distribute HVLs in the 3D scene while their contributions are computed using SH (Sec. 5). We propose two heuristics to manage the HVLs radii as they have a crucial role in the final image quality (Sec. 5.3). Finally, we analyze the results produced by HVLs and compare to state of the art VPL/VSL/VSGL (Sec. 6). When using circularly symmetric BRDFs, as we do when comparing to VSGL, we benefit from the HVLs projection on ZH (becoming, in this case, O(n)) (Sec. 6.3). HVLs handle any kind of materials, measured or analytic, and exhibit fewer artifacts than VPLs while being computationally more efficient than VSLs.

Related Work

Spherical harmonics lighting. Ramamoorthi and Hanrahan [START_REF] Ramamoorthi R | An efficient representation for irradiance environment maps[END_REF] propose to use SH to efficiently compute and store illuminance environment maps; Sloan et al. [SKS02] extend this principle to store complex luminous transfer functions, and Kautz et al. [START_REF] Kautz | Fast, arbitrary BRDF shading for low-frequency lighting using spherical harmonics[END_REF] further develop the method to handle arbitrary BRDFs. In order to remain computationally efficient, these methods rely on fixed scene parameters, such as the view point, the lights parameters or the geometry of the scene. To mitigate this last limitation, and to be able to render dynamic scenes in real-time, all these methods compute SH shading only on mesh vertices and linearly interpolate the resulting color at each shading point. The fixed light constraint could also be removed when light sources are modeled as SH-projected environment map. In this case, instead of computing the SH projection on the fly, it can be obtained by rotating the SH coefficients of the environment map. This enforces the need of an efficient rotation algorithm for SH coefficients. Even with effective derivations to apply the rotation as proposed by Nowrouzezahrai et al. [START_REF] Nowrouzezahrai | Sparse zonal harmonic factorization for efficient SH rotation[END_REF], heavy computation is necessary on high bands. In our approach, we avoid this costly step by integrating the rotation into the SH projection [START_REF] Sloan | Local, deformable precomputed radiance transfer[END_REF].

Wang and Ramamoorthi [START_REF] Ramamoorthi R | Analytic spherical harmonic coefficients for polygonal area lights[END_REF] extend the principle of rotation proposed by Nowrouzezahrai et al. [START_REF] Nowrouzezahrai | Sparse zonal harmonic factorization for efficient SH rotation[END_REF] to efficiently project polygonal domains on SH. They reduce the integration of a polygonal light to the integration of its contours; in turn, contour integration fits the integration of ZH, allowing real-time performances. Wu et al. [START_REF] Wu | Analytic spherical harmonic gradients for real-time rendering with many polygonal area lights[END_REF] extends this by computing the SH coefficients and their gradients, in the case of polygonal sources, on a 3D grid, thus allowing Hermite interpolation of the SH coefficients at each shaded point instead of computing them explicitly. We propose a simpler mathematical framework where integration on ZH is straightforward (Sec. 4.2) when dealing with spherical lights.

Virtual lights. We refer the reader to recent states of the art [RDGK12, DKH * 14] for a general introduction on point-based global illumination and many-lights rendering. We focus here on previous work directly related to our contributions. The seminal work of Keller [Kel97] introduces the concept of point-based global illumination. The main idea is to approximate global illumination from its discretization on the surface of the scene using virtual lights. Virtual point lights (VPLs) are one of the most common ways to represent those virtual lights. Reflective shadow maps (RSM) [DS05] rely on rasterization to efficiently distribute the VPLs on the scene, placing them at the first bounce from the light. An alternative on recent hardware is to dispatch virtual lights with ray tracing, as proposed by Lin and Yuksel [START_REF] Yuksel | Real-Time Rendering with Lighting Grid Hierarchy[END_REF].

VPLs suffer from two main artifacts. First, if there are not enough virtual lights, flickering will appear in dynamic scenes. Second, and more troublesome, spike artifacts could appear as lighting submitted to COMPUTER GRAPHICS Forum (5/2022). For each primary light of the scene, direct lighting is computed using SH framework. Indirect lighting starts with the distribution of HVLs from primary lights, followed by the gathering of HVLs contributions at each pixel. This pipeline allows using parametric like measured BRDF at the same cost.

evaluation depends on the inverse of the squared distance to the VPL. When the shaded point is close to the VPL, this term tends towards infinity and cause strong light spikes in the image. This problem occurs also in the presence of glossy materials: when the view aligns with the reflection of one VPL and the VPLs density is not sufficient, the reflection of the VPL is visible. The naive way to overcome this problem is to clamp the VPL contribution, and to lessen the specular appearance of glossy materials. Hašan et al. [START_REF] Hašan | Virtual Spherical Lights for Many-Light Rendering of Glossy Scenes[END_REF] introduced virtual spherical lights (VSL) to robustly address this problem. To do so, they extend the integration domain from a point to a disk centered at the virtual light position. The contribution of light is averaged over the disk, drastically diminishing artifacts. Alternatively, Tokuyoshi [START_REF] Tokuyoshi | Virtual Spherical Gaussian Lights for Realtime Glossy Indirect Illumination[END_REF] proposes virtual spherical gaussian lights (VSGL) to approximate the contribution of a set of VPLs, smoothing lighting variation. In contrast of VSGL, we consider lights individually; our idea is to distribute spherical light sources (HVL) instead of point light sources. Each HVL accounts for more information than simple VPL, in the spirit of Rich-VPL [START_REF] Simon | Rich-VPLs for Improving the Versatility of Many-Light Methods[END_REF].

HVL Lighting Pipeline Overview

Our approach being orthogonal to direct lighting computation, we focus on indirect lighting in the following. The HVLs rendering pipeline (Fig. 2) is built over the SH projection of the BRDFs as unified material representation. This representation is precomputed once for all for each material. Our two passes indirect lighting pipeline is similar to previous many-lights approaches. For each frame, the first pass distributes HVLs according to primary lights; it stores the SH coefficients of the reflected luminance field of each HVL in an HVLs cache. The second pass gathers the contributions of the HVLs from the cache by computing the convolution between light emitted by HVLs and the material at the shaded point location.

The light emitted by HVL is the result of the reconstruction of the HVL reflected luminance field in the direction of the shaded point. Thus, HVLs are anisotropic spherical lights whose emission intensity depends on the direction ω j , the incident direction on the receiving shaded point. Fig. 3 shows a typical one-bounce light path evaluated by our technique. The final image is then computed as the sum of direct and indirect contributions from each primary lights.

We formulate the indirect lighting Lo(x, ωo), leaving the shaded point x in the direction ωo as

Lo(x, ωo) = ∑ s∈S ∑ j∈Hs L j,o (x, ωo, ω j ) ( 1
)
where S is the set of primary lights, Hs the set of HVLs generated from light s, ω j the direction from x to the HVL j and L j,o (x, ωo, ω j ) its luminance contribution. According to the rendering equation [START_REF] Kajiya | The Rendering Equation[END_REF], this contribution is expressed as

L j,o (x, ωo, ω j ) = Ω L j (x, ω i ) F(x, ω i , ωo) dω i (2)
where F = cos(θ i ) fs(x, ω i , ωo) is the reflectance, fs being the BRDF, and L j (x, ω i ) is the incoming luminance at x emitted by the HVL j. As this luminance is only perceived in the solid angle subtended by the HVL, the integral domain is reduced to this solid angle Q j . We approximate this equation by considering that the HVL emission is constant over the solid angle.

L j,o (x, ωo, ω j ) ≈ L j (x, ω j )

Q j F(x, ω i , ωo) dω i (3)
This approximation allows us to propose a computationally efficient projection of spherical lights contributions to SH (Sec. 4.2) and to quickly compute lighting contribution for each HVL (Sec. 5.1).

We rely on the number of bands for spherical harmonics evaluation as a trade-off parameter between accuracy and speed. To reach interactive performance, we typically use 0-5 bands to evaluate HVLs emission and 0-10 bands for the SH convolution on shaded points. This allows to represent low-frequency luminance field for HVLs and medium-frequency BRDF for the shaded point. Our approach scales well regarding high band limit and is able to render thousands of HVLs on 0-20 bands in a few seconds.

Lighting with Spherical Harmonics

The computational challenge in Eq. 2 and 3 is the evaluation of the integral term, which is a motivation for using the SH framework. Considering Eq. 2, when computing L j,o (x, ωo) and fixing both x and ωo, we evaluate the integral of a product of two spherical functions of ω i . Using spherical harmonics, this integral reduces to a dot product between vectors of coefficients dependent on x and ωo. For conciseness, we omit x and ωo in this section.

Spherical Harmonics Review

Let's rewrite Eq. 2 in terms of spherical harmonics. We note L and F the projection of L and F on the real spherical harmonics basis. The dot product L • F is defined by:

Ω L(ω i ) F(ω i ) dω i = L • F (4)
To obtain the coefficients L m l (resp. F m l ) of the vector L (resp. F), we project the original functions on the SH basis {Y m l (ω)} which is indexed by order l and degree m. As shown in Fig. 4, successive orders l ≥ 0 correspond to an increasing of the frequency bands, in which degrees span -l ≤ m ≤ l. Projection to and reconstruction from SH of the spherical function S(ω) (i.e. L or F) obey the following equations: In practice, SH coefficients are bands limited to l = N and the reconstruction becomes an approximation with fixed maximum frequency. In this case, the integral of Eq. 2 reduces to a sum of (N + 1) 2 terms, allowing for an efficient evaluation of the equation.

S m l = Ω S(ω)Y m l (ω) dω (5) S(ω) = +∞ ∑ l=0 l ∑ m=-l S m l Y m l (ω) ≈ N ∑ l=0 l ∑ m=-l S m l Y m l (ω) (6)

Using spherical coordinates, real SH Y m

l are expressed as

Y m l (θ, φ) =        √ 2K |m| l P |m| l (cos θ) sin(|m|φ) m < 0 K 0 l P 0 l (cos θ) m = 0 √ 2K m l P m l (cos θ) cos(mφ) m > 0 ( 7
)
where P m l denotes the associated Legendre polynomial, and K m l is a normalizing factor:

K m l = 2l + 1 4π (l -m)! (l + m)! (8)

Computing Luminance and Material Coefficients

To compute the vector L at a shaded point x, we need to project the incoming luminance field L(ω i ) on the SH basis. As stated by Eq. 3 we consider the luminance emitted constant over the solid angle subtended by the light source.

SH projection of simple light primitive

The luminance contribution of a simple light source, such as point light, spot, or directional light, corresponds to a Dirac distribution. Thus, the computation of the projection amounts to evaluate the SH in the Dirac direction and scaling by the light source's intensity.

Efficient SH projection of spherical light The projection of a spherical light is more expensive. Our framework aims at handling thousands of them, since HVL secondary lights correspond to spherical lights. Zonal Harmonics offers an efficient projection and reconstruction algorithm for spherical lights.

For the hemisphere around a shaded point, the solid angle Q subtended by the light source is a spherical cap (Fig. 5). Considering the incident luminance as constant, and equal to 1, over Q and 0 elsewhere, the projection on SH of the incident luminance function simplifies to:

L m l = Q Y m l (ω) dω (9)
submitted to COMPUTER GRAPHICS Forum (5/2022).

Let ω light be the direction from the shaded point to the center of the spherical light. Q induces a circularly symmetric luminance field around ω light . Considering the shading frame with ω light as zaxis, the computation of Zonal Harmonics boils down to the computation of Ll coefficients, since the other coefficients are null.

Ll = K l Q P l (ω light • ω) dω ( 10
)
where K l = K 0 l and P l = P 0 l . Using spherical coordinates, this equation becomes

Ll = K l a θ=0 2π φ=0 P l (cos(θ)) sin(θ) dφ dθ ( 11
)
where a is the half-angle subtended by the spherical light source (Fig. 5). Integrating on φ, we obtain

Ll = 2πK l a θ=0 P l (cos(θ)) sin(θ) dθ (12)
As detailed in Appendix A, the value of this integral is

a θ=0 P l (cos(θ)) sin(θ) dθ = -P l+1 (α) + P l-1 (α) 2l + 1 ( 13
)
where α = cos(a). By re-injecting this into Eq. 12, the computation of the zonal harmonics coefficients for a spherical light in the coordinates frame aligned with the emission direction only requires evaluating Legendre polynomials and by simplifying, we obtain

Ll =      π 2l + 1 (P l-1 (α) -P l+1 (α)) if l ̸ = 0 √ π(1 -α) otherwise (14)
The SH coefficients are then obtained by rotating the ZH coefficients as proposed by Sloan et al. [START_REF] Sloan | Local, deformable precomputed radiance transfer[END_REF]:

L m l = 4π 2l + 1 Y m l (ω light ) Ll (15)
As shown Fig. 6, beyond 5 SH bands, computing the ZH coefficients Ll using the closed form derived by Sloan [START_REF]Stupid Spherical Harmonics (SH) Tricks[END_REF] exhibits more arithmetic operations than our general recurrence (Eq. 14). To evaluate the Y m l basis function, we use the work of Sloan [Slo13].

BRDF coefficients To compute BRDF coefficients, we use the approach proposed by Kautz et al. [START_REF] Kautz | Fast, arbitrary BRDF shading for low-frequency lighting using spherical harmonics[END_REF]. A BRDF is a function of the two directions ω i and ωo, yielding a 4-dimensional function.

When evaluating F, the direction ωo is fixed; hence the BRDF evaluation corresponds to a 2-dimensional function projected on SH.

In a pre-processing step, we tabulate SH coefficients according to discrete samples of the direction ωo = (θo, φo).

Tab[θo, φo] = Fω o (16)
where Fω o is the SH coefficient vector of F computed for the output direction ωo. We created a database of materials projected on spherical harmonics from the MERL database [MPBM03] and the database produced by Dupuy and Jakob [START_REF] Dupuy | An adaptive parameterization for efficient material acquisition and rendering[END_REF] with a sampling step of one degree for θ and φ. With such uniform sampling, a material has 90 × 360 samples of Fω o and accessing the coefficients requires a constant time array lookup. The one degree step allows capturing subtle material variations. Other sampling and reconstruction strategies might be used but are out of scope of this is compared with the analytic Sloan's method [START_REF]Stupid Spherical Harmonics (SH) Tricks[END_REF]. Number of operations calculated assumes that the recurrence loop is unrolled to avoid operations corresponding to constants for each ZH bands (e.g. π/(2l + 1) counts as one multiplication for each band.)

paper. Appendix C lists the materials we used for the results shown in this paper.

As an optimization compared to the approach of Kautz et al. [START_REF] Kautz | Fast, arbitrary BRDF shading for low-frequency lighting using spherical harmonics[END_REF], we store isotropic material in a one-dimensional array. Isotropic materials depend on the ∆φ = |φ i -φo| rather than the actual values of φ i and φo. Hence, by using the isotropic parametrization of

F F iso (θo, θ i , ∆φ) = F(θo, 0, θ i , ∆φ) (17)
we drop the explicit dependence on φo and only discretize θo. This way, the storage of isotropic material drops down to 90 samples.

Tab iso [θo] = Fω o with ωo = (θo, 0)

F is precomputed relative to its own frame, in order to apply the convolution, L is first expressed in the same frame by rotating ω light (Eq. 15). This frame change avoids specific SH rotation, such as the zxzxz rotation [START_REF] Kautz | Fast, arbitrary BRDF shading for low-frequency lighting using spherical harmonics[END_REF].

As state Eq. 2, F accounts for the cosine term, i.e. cos(θ i ) fs(x, ω i , ωo), HVL evaluation needs the projection of the BRDF only (Sec. 5.1). Hence, SH BRDF projection without cosine term, denoted F ′ , is also precomputed and stored analogously.

Practical SH evaluation drops high frequencies due to band limit. Band limiting typically produces ringing artifacts. To mitigate these artifacts, SH coefficients are multiplied with a sinc windowing function [START_REF]Stupid Spherical Harmonics (SH) Tricks[END_REF].

Harmonics Virtual Light (HVL)

We define a HVL as a spherical light. Light's emitted luminance is stored as SH coefficients whose contribution is efficiently evaluated using the projection defined Sec. 4.2. Our real-time experimentation handles only simple light primitives as primary lights. Then, their incident luminance field at HVL location is a dirac and HVL only need to store a reference to the projected BRDF, rather submitted to COMPUTER GRAPHICS Forum (5/2022). than the SH coefficients of the luminance field. The HVL emission according to the outgoing direction corresponds to the referenced BRDF, reconstructed and scaled on the fly.

HVL Luminance Contribution

The luminance contribution of each HVL corresponds to the computation of Eq. 3. This equation is expressed as

L j,o (x, ωo, ω j ) ≈ L j (x, ω j )L • Fω o ,x (19)
where L corresponds to the coefficients vector of Eq. 15. The incoming luminance at x emitted by the j-th HVL is defined as

L j (x, ω j ) = Φ j (F ′ ω l ,y •Y (-ω j ))G j (-ω j ) (20)
where y and ω l are respectively defined as the position of the HVL and its direction to primary light (Fig. 7). Φ j is the power of the HVL, corresponding to the power of the primary light divided by the number of HVL. The dot product corresponds to the reconstruction of the emission function towards the shaded point (Eq. 6). Isotropic HVL reconstruction only use band 0 coefficient and skip SH evaluation.

The geometric factor G j (-ω j ) corrects the energy taking into account the HVL light source spherical shape:

G j (-ω j ) = 1 πr 2 j max(0, n j • -ω j )H(nx, ω j ) (21)
where n j is the normal of the j-th HVL, r j its radius, πr 2 j is an approximation of the surface area. The dot product corrects the energy according to the surface orientation. The factor H represents the proportion of the HVL that lies in the shading hemisphere, it corresponds to the intersection of two spherical caps where an approximation is given by Oat [OS07]. We derive the equation to our case, where the spherical cap is the hemisphere oriented by nx, the normal at point x:

H(nx, ω j ) = S ā -min(max(cos -1 (nx • ω j ), a), ā) 2a ( 22
)
where a is the half-angle subtended by the spherical light source, ā = a + π 2 , a = a -π 2 and S(x) = 3x 2 -2x 3 is the Smoothstep function. H could also be computed with the exact equation given in [OS07]. Since Monte-Carlo integration explicitly evaluates the clamped cosines, the VSL approach does not need to use such a corrective term.

When evaluating the HVL emission (Eq. 20), we use the BRDF projection F ′ , without the cosine term cos(θ i ) which is integrated into the geometric factor (Eq. 21). This ensures that, when using low-frequency reconstruction (i.e. a few SH bands), the cosine is not over-smoothed and then, the energy is preserved.

The visibility term, although not present in the equations for the sake of clarity, is approximated by the visibility of the center of the HVL, as the VSL approach does.

Distribution and Caching

We use a cache to store each HVL data: emission function, position, normal, BRDF index. To fill the cache, our implementation follow the principle of Reflective Shadow Maps [DS05]: the scene is rendered from each primary light and each rendered fragment stores HVL data in a set of 2D GPU textures. The BDRF index corresponds to the index in the precomputed material SH coefficients set. This set is stored as 2D textures, one per material.

The memory requirement of the HVL cache spans from 16KB for 400 HVLs to 400KB for 10 thousands HVLs. We thus focus the discussion on the storage cost for materials. For an isotropic material, 90 directions are sampled; using 10 harmonic bands and 32-bit float RGB coefficients, one material represents 108kB. For instance, the required memory to use 200 different materials is 21MB. On the other hand, in the presence of anisotropic materials, the storage for one material is 360 times larger and raise to 388MB for one material.

Radius Heuristics

The radius of an HVL is an important parameter that impacts the rendered image quality. Intuitively, if HVLs do not sufficiently cover the scene, the rendered image exhibits the same kind of artifacts as VPLs. But if HVL radius is too large, high frequency shading details will be lost as the HVLs contributions will overlap. Hence, we have to adapt HVLs radius so that there is the right amount of overlapping.

The HVL overlapping is directly linked to the HVL radius with regard to HVL density. As done in VSL [START_REF] Hašan | Virtual Spherical Lights for Many-Light Rendering of Glossy Scenes[END_REF], we define each HVL radius based on an estimation of local HVL density. Instead of searching for the closest neighbors, as proposed for VSL, we propose two dynamic heuristics relying on HVL cache sampling to gather the HVL locations. Our first heuristic estimates the radius of an HVL from an approximation of the HVLs local density by sampling the HVL's 8-connected neighbors from the HVL cache:

r 1 = ∑ n wn ∥p -pn∥ ∑ n wn , wn = 1 |d -dn| + ε (23)
where r 1 is the radius of the HVL, d the HVL distance to its related primary light, p denotes the position in world space coordinates and ∑ n sums over the 8-connected neighbors of the HVL, pn and dn being neighbor's position and distance. This heuristic averages the distance of a HVL to its neighbors so that it overlap them and thus avoid spike artifacts. We weight the contribution of neighbors by the difference of distances from HVLs to light to avoid too large overlapping because of the scene geometry, such as the hole formed by the rabbit's ears in Fig. 8. A small ε value is added to avoid a division by 0, should two HVLs distances to light be the same.

submitted to COMPUTER GRAPHICS Forum (5/2022). This first heuristic is based on the neighborhood of the HVL, making it expensive to compute. We propose a second heuristic, more suitable for real-time scenarios, independent of the HVL neighborhood by considering the FOV angle λ used to generate a square RSM instead. First, we approximate the angle γ formed by two diagonally adjacent HVLs by considering that the two HVLs are at the same distance of the light.

γ = √ 2 λ √ M ( 24
)
where M is the total number of HVLs and √ 2 is the length of the diagonal. Starting from this, we approximate the distance between those HVLs, and hence the radius r 2 of an HVL, by considering a right triangle between the primary light and the two HVLs, where the right angle is at the HVL whose radius is sought.

r 2 = d tan(γ) ( 25
)
where d is the distance of the light of the HVL and k is the same user-specified constant as for r 1 . To avoid any trigonometric function evaluation, as γ is close from 0, we approximate the tan function by its Taylor series tan(x) ≈ x + x 3 /3. The heuristic becomes

r 2 ≈ d γ + γ 3 3 ( 26
)
The approximation of Eq. 25 by Eq. 26 is accurate. Indeed, in order to have an error of less than 0.01 for the evaluation of the function tan from its Taylor series, calculus hints that we must have γ ≲ 0.58 and thus λ/ √ M ≲ 0.2. So, for a spotlight of half-angle 45 • , √ M ≳ 3.92, means that we need at least 16 HVLs for precise evaluation of the tan function. For a spotlight of half-angle 90 HVLs required in practice (i.e. at least a few hundreds). As shown in Fig. 8, these heuristics allow having HVLs that overlap well, and thus covers the directly illuminated scene geometry, without having one HVL that swallow another one, which would reduce the impact of the number of HVLs. However, the balance remains fragile and artifacts may still appear, especially when the depth distribution of HVLs is heterogeneous because holes may appear in the coverage.

To this end, and as in VSL, a user specified factor should be used to scale the computed radii. In our experiments, we obtained good results by setting this factor between 1 and 2.

Results

We implemented our prototype using OpenGL / GLSL 4.5 on an Intel Xeon 2.10 GHz processor and a RTX 2080 graphics card. We did not take into account the HVLs visibility in our renderings. ing due to the use of SH, thus providing smooth and artifact-free results (Fig. 10).

Experimental results

The HVL count has a linear impact on the computational cost, each HVL contribution being independent of the others. Increasing the SH band limit has a quadratic cost with respect to the band limit as the number of SH coefficients is equal to the square of the bands number. Table 1 confirms these trends. Thus, the computation time for HVLs is predictable, but is greatly impacted by the number of SH bands. Furthermore, if low-frequency BRDF are used, increasing the band limit will have no impact on the final picture quality. Using an adaptive band limit might keep the computational cost minimal but might also increase code divergence in the shader evaluation of the SH projection.

Comparison with VPL, VSL and path-traced reference

To fairly compare HVL, VPL and VSL, we only use microfacet based BRDF (Fig. 10 and11). Indeed, if VPL/VSL computation time might be greatly impacted by the use of measured and SH encoded BRDF, our HVL method is agnostic to the used BRDF model and performs similarly on parametric or measured BRDF. In our comparison, we use the GGX microfacet distribution and evaluate the Fresnel reflectance using the exact term. We used material from MERL database, fitted on GGX by the work of Ribardièreet al. [START_REF] Ribardière | STD: Student's t-Distribution of Slopes for Microfacet Based BSDFs[END_REF]. The three methods are compared to pathtraced references, rendered using pbrt-v3 [PJH16], using three metrics: RMSE, PSNR and SSIM. Table 2 shows timings and error metric for the three methods. Fig. 10a, 10b and 10d are computed using the same budget of virtual lights. To avoid a visual comparison bias, virtual lights are placed at the exact same locations for all three methods. Our method avoids the classical VPLs artifacts but is more computationally expensive. Using 25 samples per virtual light, VSL is even more expensive while still exhibiting noise. Aiming at interactive rendering, VSLs must use low sample count and results on noisy pictures (Fig. 10e). To remove this noise, particularly visible on the bunny's feet, the number of samples must be at least tripled, with a similar increase on the computation time (Fig. 10d).

With the same computation time budget, VPLs still exhibit artifacts despite using more virtual lights, whereas HVLs produce a smoother but artifact-free result (Fig. 10a and10c). VSLs produce a noisy result as only a low number of samples might be used (Fig. 10e). Thus, HVLs are an interesting alternative to produce a fast low-frequency global lighting and gradually raise the final image in frequency. Fig. 11a and 11b are computed given a time budget of 500ms. VPLs still exhibit artifacts despite the big number of virtual lights, while HVLs give a smooth result.

Light leaks artifacts may appear in some situations due to a combination of several factors (orange and red circles in Fig. 10 and11). Inaccurate visibility estimation is one of these factors when using virtual lights. The red circles show a light leak due to this visibility problem for VPLs due to sources located on the background. These artifacts are not related to the VPLs themselves but to the limitations of our implementation. For HVL and VSL (orange circles), the spherical nature of the sources is the main cause of artifacts, due here to sources located near Suzanne. The spherical nature of the sources generate an overestimation of the actual lit area. This is especially problematic when using a few sources, since smaller is the number of sources, larger is their radius. Finally, the frequency band limit resulting from the SH order for HVL smooths out these artifacts.

As shown by these experiments, HVLs always give a smooth but biased result, whatever the number of virtual lights or the time budget given. This robustness of our method is its biggest advantage for interactive lighting design. Note that while VPLs are less appropriate for interactive usages due to the high-variance estimation of indirect lighting with small number of VPLs, they define an unbiased estimator of indirect lighting. Hence, running simulation using VPL for a long enough time will always give a better result than HVL.

Comparison with VSGL

We use our own implementation of a simplified version of VSGL [START_REF] Tokuyoshi | Virtual Spherical Gaussian Lights for Realtime Glossy Indirect Illumination[END_REF], based on publicly available faster VSGL code [START_REF] Tokuyoshi | Fast Indirect Illumination Using Two Virtual Spherical Gaussian Lights[END_REF]. This allows us to produce a fair comparison between both methods, but without importance or interleaved sampling. We setup a scene similar to the one used in the VSGL paper (Fig. 12) thanks to the data provided by the authors.Our method benefits from faster computation time thanks to the ZH expansion, thereby limiting convolution to materials with a circularly symmetric specular lobe which is fair compared to VSGL, being itself limited to BRDF with a single lobe. To summarize our implementation:

• The ZH projection for the light is done using our proposal (Eq. 14). where n is the number of SH bands. The weakening factor cos θ i is taken out of the integral (Eq. 2) and calculated with the direction of the HVL center as input direction.

• The HVLs directional emission is computed by evaluating a GGX BRDF.

VSGL method approximates a set of nearby virtual light relying on RSM, as it is the most efficient method to quickly access a VPL and its neighbors, and taking advantage of RSM mipmaping. Our HVL method extends VSL and only relies on RSM to sample the position of the virtual lights. HVL are then less dependent on RSM, thus more flexible than VSGL. As shown in Fig. 12, HVL and VSGL exhibit similar results without any spikes.

For a fair comparison, both methods are restricted to single-lobe BRDF only. Our VSGL implementation defines one VSGL per pixel group; HVL are restricted to single-lobe BRDF when using the ZH acceleration method. Moreover, this ZH acceleration makes the HVL method much more competitive than the full SH method (40ms for 15 SH bands).

For the scene shown Fig. 12, to catch the strong specular reflection on the ground, we use 400 HVLs on 15 ZH bands. For the same time budget, we can have 529 VSGLs. On scenes with less specular effects, HVLs will require fewer bands, and therefore become cheaper to evaluate. This is shown in the supplemental materials, where the comparison between both methods is pushed a little further.

Limitations and Future Work

Primary light As shown in Sec. 5.1, our HVLs framework only considers primary light primitives from which incident direction is a Dirac. In order to manage area lights, the process of computing HVLs luminance contribution should be adapted. The SH coefficients of the incident luminance field due to the area light are to be stored on each HVL. Once the receiving shaded point is known, the SH coefficients for the emission of each HVL are computed according to the shaded point. The convolution of this emission function with the HVL incident luminance field will then result in the incident luminance field at the shaded point. Due to this additional convolution, the computation time of the method will increase.

HVLs visiblity

The HVLs visibility could be approximated by taking into account only their center and using shadow maps (or imperfect shadow map [RGK * 08]), as done in VSL or VSGL methods [START_REF] Hašan | Virtual Spherical Lights for Many-Light Rendering of Glossy Scenes[END_REF][START_REF] Tokuyoshi | Virtual Spherical Gaussian Lights for Realtime Glossy Indirect Illumination[END_REF]. This approximation is only valid when HVLs radii are small. For large HVLs, visibility management is more complex. It might be interesting to project the visibility on SH, as done by Ren et al. [RWS * 06], but this will require to evaluate an SH triple product (V • L • F) instead of only a double product (Eq. 4). The extra cost of visibility projection and SH triple product would prevent to reach interactive rendering time. Indeed, unlike like the SH double product, the triple product does not reduce to a dot product of vectors.

Efficient shading Our prototype implementation only uses a simple light gathering to compute HVLs contributions at each pixel, in which each pixel gets the contribution of all HVLs. This has a strong impact on the computation time when using numerous HVLs. For a better efficiency, a shaded point must ideally consider only HVLs that will have an influence on itself. As our proposal is orthogonal to any virtual lights gathering method, Lightcuts [WFA * 05], ManyLoDs [START_REF] Holländer | ManyLoDs: Parallel many-view level-of-detail selection for real-time global illumination[END_REF], or clustered shading method, could be implemented over the HVLs set. As shown for the VSGL method [START_REF] Tokuyoshi | Virtual Spherical Gaussian Lights for Realtime Glossy Indirect Illumination[END_REF], the shading time can be reduced by using interleaved sampling [KH01]. HVLs are band limited by construction, thus, they do not generate arbitrary high frequencies. This property is particulary useful in interleaved sampling method to define a proper sampling strategy.

Flickering Techniques dealing with efficient shading such as RSM clustering [PKD12] allow reducing the flickering problem that might appear on dynamic scenes. In our implementation, we do not apply normal filtering, temporal coherency management nor any filtering method, thus flickering becomes visible. As HVLs inherit properties of VPLs, any method resolving flickering for VPLs Hemispherical bases Although spherical in shape, HVLs only emit light in a hemisphere. While the current implementation accounts for this using the geometric term, we thought about using the hemispherical basis proposed by Gautron et al. [START_REF] Gautron | A novel hemispherical basis for accurate and efficient rendering[END_REF]. Nevertheless, this requires to correctly adapt several computations to this basis, such as the integration of Legendre polynomials or the efficient evaluation of harmonics. Unfortunately, the tricks proposed by Sloan [Slo13] to efficiently evaluate spherical harmonics do not apply directly to hemispherical harmonics. Alternatively, the derivations could be adapted to a more recent basis, such as the Hbasis of Habel et al. [START_REF] Habel R | Efficient irradiance normal mapping[END_REF].

Soft angular kernels In our proposal, as for VSLs, we consider that the emission is constant on the solid angle subtended by the spherical light. If VSLs rely on this hypothesis for efficient uniform sampling for Monte-Carlo integration, we use this to derive an analytical solution for HVL (Eq. 9). However, the solid angle boundary corresponds to an infinite frequency in the emission function that produces ringing artifacts in the SH approximation. To limit these ringing artifacts, one can add a soft angular kernel in Eq. 12. However, finding an analytical and efficient solution with an arbitrary kernel is challenging but should improve the final result.

Anisotropic materials As presented in Sec. 4.2, we use an equiangular parametrization of the input direction to project materials on SH. If this memory efficient parametrization scales well for isotropic materials, the memory cost for anisotropic ones quickly become prohibitive (Sec. 5.2). Investigating the parabolic parametrization proposed by Kautz et al. [START_REF] Kautz | Fast, arbitrary BRDF shading for low-frequency lighting using spherical harmonics[END_REF] should help to reduce this memory cost. Indeed, using their 128 × 128 parabolic map would reduce the cost of one anisotropic material on 10 SH bands from 388MB to 20MB. Doing so, it must be first demonstrated that the resolution will be sufficient to capture the full behavior of the material according to the number of SH bands.

Conclusion

We have presented harmonics virtual lights, a new model to capture and render indirect lighting in dynamic scenes with arbitrary materials. Our HVLs are spherical, secondary lights distributed on the surfaces of the scene after one bounce from the primary lights. When viewed from a shaded point, their circularly symmetric profile allows efficient projection of incoming luminance on the basis of zonal harmonics. Using a fast rotation formula, we align the incoming luminance field with any reflectance function encoded on spherical harmonics, and perform shading with realistic materials as a simple dot product. Thanks to our radius heuristics, each HVL radius is determined to cover the scene as well as possible, thus avoiding VPLs artifacts.

Our results show that, in comparison to virtual point lights, a much lower HVLs count can be used to obtain images of similar quality. Moreover, the rendered images do not suffer artifacts such as unbounded contributions around the virtual lights, or undesirable reflections on glossy materials. Our method is able to render one-bounce indirect illumination at interactive frame rates in fully dynamic scenes; the two hyperparameters, HVLs count and band limit, can be further tuned to achieve real-time rendering.

Figure 2 :

 2 Figure2: Overview of the HVLs rendering pipeline. The inputs are a 3D scene with dynamic objects and lights, along with precomputed BRDF spherical harmonics coefficients. For each primary light of the scene, direct lighting is computed using SH framework. Indirect lighting starts with the distribution of HVLs from primary lights, followed by the gathering of HVLs contributions at each pixel. This pipeline allows using parametric like measured BRDF at the same cost.

Figure 3 :

 3 Figure 3: Indirect lighting evaluation for one shaded point and one HVL. The HVL, in purple, uses a low-frequency approximation of the light emission corresponding to the first bounce of light emitted by the primary light. It's contribution to the shaded point at x is evaluated by projecting the HVL luminance onto SH and then convoluting with the BRDF at the shaded point's location. The HVL emission is computed as constant over its subtended solid angle.

Figure 4 :

 4 Figure 4: Representation of the first spherical harmonics base functions. Lobes are colored according to their sign, with positive values in red and negative in green. The sub-basis of zonal harmonics for which m = 0 is outlined in the middle.

Figure 5 :

 5 Figure 5: Geometric setup of an HVL luminance contribution. (a) The HVL in blue projects to a spherical cap Q on the unit sphere centered at the shading point x. (b) 2D cut showing the HVL radius r, the distance d with the HVL, and the half-angle a of the cap.

Figure 6 :

 6 Figure 6: Number of arithmetic operations needed to compute the vector of ZH coefficients up to a certain band. Our method (Eq. 14)is compared with the analytic Sloan's method[START_REF]Stupid Spherical Harmonics (SH) Tricks[END_REF]. Number of operations calculated assumes that the recurrence loop is unrolled to avoid operations corresponding to constants for each ZH bands (e.g. π/(2l + 1) counts as one multiplication for each band.)

Figure 7 :

 7 Figure 7: Notations for a light path, y is an HVL and x a shaded point.

Figure 8 :

 8 Figure 8: HVLs coverage. Each colored circle corresponds to one HVL. From left to right: HVLs coverage with 400 and 100 HVLs; resulting image with 400 HVLs and then 100 HVLs. From top to bottom: fixed radius of 0.25, heuristic 1, heuristic 2 respectively.

Fig. 9

 9 Fig.9illustrates how materials change the rendered image through the use of HVLs. Our method applies a low-pass filter on the light-

Figure 10 :

 10 Figure 10: Comparison between HVL, VPL, VSL and path-tracing. (a) uses 5 SH bands for convolution on shaded point, 3 bands for the emission function and 400 HVLs, (b) and (c) are resp. render with 400 and 1928 VPLs. (d) and (e) are render resp. with 400 and 256 VSLs and 25 and 9 importance samples of the shaded point's BRDF. HVLs and VSLs use heuristic r 2 . (f) is a path-traced reference. Images are rendered at 1280x1024. The red circles show an artifact due to VPLs on the background and resulting from the lack of visibility management for secondary lights in our implementation. The orange circles highlight an overestimation of the indirect lighting due to the spherical nature of the HVL and VSL.submitted to COMPUTER GRAPHICS Forum (5/2022).

Figure 11 :

 11 Figure 11: Comparison of HVL and VPL at same time using same resolution and same heuristic for HVL as the figure above. (a) is rendered with 1500 HVLs and uses 9 SH bands for convolution and 3 SH bands for the emission of HVLs. (b) is rendered with 10000 VPLs.

Figure 12 :

 12 Figure 12: Comparison with 900 VPL, 529 VSGL and 400 HVL, generated at equal time. Images are rendered at 1600×900. The HVL cache resolution is 322 2 pixels, and 14 2 pixels for one VSGL. The contribution of HVLs is on 15 SH bands. In this rendering, HVL are limited to circularly symmetric specular lobe to compute lighting only on ZH. Insets show VPL spike artifacts and VSGL or HVL robustness to those artifacts. See additional material for more comparisons and implementation details.

Table 1 :

 1 • , we need at least 64 HVLs. These requirements are far below the number of Timings (ms) for indirect lighting gathering from various HVLs numbers and SH bands for convolution on shaded points. The emission function for each HVL is computed with 3 bands.

	Direct lighting only Direct lighting only		HVLs indirect illumination HVLs indirect illumination
	Scene	HVL		Convolution band limit
		number	3	5	7	9
		64	6.6	7.8	10.3	18.6
	Teaser Fig. 1(a)	196	19.8	23.5	30.4	56.1
		400	41.0	48.6	62.7	115.3

Figure

9

: Global illumination using HVLs with different measured materials. In our framework, materials can be changed dynamically without affecting rendering time. In the bottom row, only the materials applied to the chairs and the table are modified between the three pictures.

  • The BRDF convolution uses the PRT framework proposed by Sloan et al. [SKS02] and adapted to our use case, i.e.

							where the
	luminance and specular lobe of the BRDF are both circularly
	symmetric functions:
	-The diffuse contribution is computed using the work of
			Parameters		Timings	Error metrics
	Figures	lights	VSL SH	distrib.*	indirect	rmse psnr ssim
				samp. bands		light
		10b 400	-	-	0.59	13 0.054 25.20 0.977
	VPL	10c 1928 -	-	0.59	61 0.088 21.10 0.981
		11b 10k	-	-	2.44	500 0.040 27.91 0.984
	VSL	10d 400 25	-	0.59	254 0.043 27.24 0.974
		10e 256	9	-	0.59	63 0.043 27.26 0.972
	HVL	10a 400 11a 1.5k	--	5 9	0.38 1.6	61 0.039 28.01 0.980 500 0.039 28.24 0.983
			* cache size is 1024 2 pixels (bold=2048 2 )

Table 2 :

 2 Timings (ms) and error metrics (path-tracing used as reference) detail for Fig.10 and 11. RSM for HVLs are cheaper because fewer data are manipulated (see Sec. 5.2 for details).

	submitted to COMPUTER GRAPHICS Forum (5/2022).

submitted to COMPUTER GRAPHICS Forum (5/2022).

Acknowledgements

This project was partially funded by the CaLiTrOp project from French National Research Agency (ANR-16-CE33-0026).

Bunny and Dragon taken from the Stanford 3D Scanning Repository. Breakfast Room, Conference Room, Crytek Sponza, Dabrovic Sponza and Teapot taken from the McGuire Computer Graphics Archive. Suzanne taken from blender foundation.

Appendix A: Legendre Polynomials Integration

We search for a closed form to the integral of Legendre polynomials over a spherical cap of angle a: . This matrix can be replaced by a 2 × 2 matrix when using a circularly symmetric emission function which can be projected on ZH, instead of SH, by orienting the projection according to the direction of emission function.

Illuminance can be evaluated according to the direction of the emission lobe ω l . If we note z = ω l • n, illuminance is computed as

Hence, we can write

Appendix C: Materials used from MERL/RGL database

(1) alum-bronze, (2) alumina-oxide, (3) aluminium, (4) beige-fabric, (5) blue-acrylic, (6) blue-fabric, (7) blue-rubber, (8) goldmetallic-paint, (9) gold-paint, (10) green-plastic, (11) red-fabric2, (12) redphenolic, (13) red-specular-plastic, (


Elena Planas
email: eplanash@uoc.edu

Salvador Martínez
email: salvador.martinez@imt-atlantique.fr

Marco Brambilla
email: marco.brambilla@polimi.it

Jordi Cabot
email: jordi.cabot@icrea.cat

Towards Access Control Models for Conversational User Interfaces

Conversational User Interfaces (CUIs), such as chatbots, are becoming a common component of many software systems and they are evolving in many directions (including advanced features, often powered by AI-based components). However, less attention has been paid to their security aspects, such as access-control, which may pose a clear risk. In this paper, we apply Model-Driven techniques to define more secure CUIs. In particular, we propose a framework to integrate an Access-Control protocol into the CUI specification and implementation through a set of policy rules described using a Domain-Specific Language (DSL) integrated with the core CUI language.

Introduction

Nowadays, user interfaces that allow fluid and natural communication between humans and machines are gaining popularity [START_REF] Klopfenstein | The rise of bots: A survey of conversational interfaces, patterns, and paradigms[END_REF]. Many of these interfaces, commonly referred as Conversational User Interfaces (CUIs), are becoming complex software artifacts themselves, for instance, through AI-enhanced software components that enable the adoption of Natural Language Processing (NLP) features.

CUIs are being increasingly adopted in various domains such as e-commerce, customer service, eHealth or to support internal enterprise processes, among others. Many of these scenarios are susceptible to arise security risks of both the user and the system. For instance, we may need to add security when we need:

-To disable potential queries depending on the user (e.g. a bot for a Hu-man Resource Intranet must be careful not to disclose private data, such as salaries, unless the request comes from an authorized person). -To execute different behaviours depending on the user. For instance, a CUI embedded into an e-learning system will provide different answers depending on the user who queries the marks (teacher or student). -To provide different information precision for the same query depending on the user privileges. For instance, a weather or financial CUI may provide a more detailed answer to paying users.

Several works [START_REF] Gondaliya | SLA as a mechanism to manage risks related to chatbot services[END_REF][START_REF] Lai | A banking chatbot security control procedure for protecting user data security and privacy[END_REF][START_REF] Roca | Álvaro Alesanco: Microservice chatbot architecture for chronic patient support[END_REF] emphasize the importance of considering security, and especially access-control as highlighted in the above scenarios, in the CUI definition though no concrete solution is proposed.

In this line, this work proposes to enrich CUI definitions with access-control primitives to enable the definition of more secure CUIs. Our solution is based on the use of model-driven techniques to raise the abstraction level at which the CUIs (and the access-control extensions) are defined. This facilitates the generation of such secure CUIs on top of different development platforms. In particular, we extend our generic CUI language [START_REF] Planas | Towards a model-driven approach for multiexperience AI-based user interfaces[END_REF] with new access-control modeling primitives adapted to the CUI domain and show how this extended models can be enforced as part of a policy evaluation component. As an example, we discuss such implementation on top of the Xatkit open source framework [START_REF] Daniel | Xatkit: A multimodal low-code chatbot development framework[END_REF].

The rest of the paper is structured as follows: Section 2 provides the background about CUIs and access-control; Section 3 describes the framework we propose to provide model-based access-control for CUIs; Section 4 summarizes the related work; and finally Section 5 concludes.

Background

Conversational User Interfaces (CUIs) aim to emulate a conversation with a real human. The most relevant examples of CUIs are the chatbots and voicebots. A bot wraps a CUI as a key component but complements it with a behavior specification that defines how the bot should react to a given user request. The conversation capabilities of a bot are usually designed as a set of intents, where each intent represents a possible user's goal. The bot awaits for its CUI frontend to match the user's input text (called utterance) with one of the intents the bot implements. The matching phase may rely on external Intent Recognition Providers (e.g. DialogFlow, Amazon Lex, Watson Assistant). When there is a match, the bot back-end executes the required behaviour, optionally calling external services; and finally, the bot produces a response that it is returned to the user. For non-trivial bots, the behaviour is modeled using a kind of state-machine expressing the valid interaction flows between the users and the bot.

Access-control [START_REF] Sandhu | Access Control: Principle and Practice[END_REF] is a mechanism aimed at assuring that the resources within a given software system are available only to authorized parties, thus granting Confidentiality and Integrity properties on resources. Basically, accesscontrol consists of assigning subjects (e.g., system users) the permission to perform actions (e.g., read, write, connect) on resources (e.g., files, services). Access-control policies are a pervasive mechanism in current information systems, and may be specified according to many different models and languages, such as Mandatory Access-Control (MAC) [2], Discretionary Access-Control (DAC) [2], Attribute-Based Access-Control [START_REF] Hu | Guide to attribute based access control (abac) definition and considerations[END_REF], and Role-based Access-Control (RBAC) [START_REF] Sandhu | The NIST Model for Role-Based Access Control: Towards a Unified Standard[END_REF]. In this work we focus on RBAC, where permissions are not directly assigned to users (which would be time-consuming and error-prone in large systems with many users), but granted to roles. Then, users are assigned to one or more roles, thus acquiring the respective permissions. To ease the adminis-tration of RBAC security policies, roles may be organized in hierarchies where permissions are inherited and possibly added to the more specific roles.

3 Access-control framework for CUIs

Policy specification

The authorization policy is expressed via a policy language. To this end, in this paper we propose to extend a generic CUI language [START_REF] Planas | Towards a model-driven approach for multiexperience AI-based user interfaces[END_REF] with new modeling primitives adding access-control semantics to CUIs. As any DSL, this extended access-control-CUI DSL is defined through two main components [START_REF] Kleppe | Software Language Engineering: Creating Domain-Specific Languages Using Metamodels[END_REF]: (i) an abstract syntax (metamodel) which specifies the language concepts and their relationships, and (ii) a concrete syntax which provides a specific (textual or graphical) representation to specify models conforming to the abstract syntax.

Fig. 2 depicts our proposal for the language metamodel, combining all the RBAC basic concepts with CUIs specific elements. In the following, we detail its main concepts.

CUI metamodel. The CUI-specific metamodel part (coloured in grey in Fig. 2) is a simplified version from the metamodel previously defined by the authors in [START_REF] Planas | Towards a model-driven approach for multiexperience AI-based user interfaces[END_REF] and describes the set of concepts used for modeling the intent definitions of a bot and its execution logic. The main elements of this metamodel are:

Intents. The metaclass Intent represents the possible user's goals when interacting with the CUI. Intents, which are a specific type of Event (as bot interactions can also be triggered by external events), can optionally have Parameter s which allow defining specific characteristics of the Intent. On the other hand, intents can be triggered using several devices.

States. Following the state-machine formalism, this metaclass models a particular behavioral state in which the bot stays until a new intent triggers a transition to another state.

Transitions. The metaclass Transition represents the potential bot changes from one state to another. We distinguish two types of Transitions: Automatic-Transitions (triggered automatically) and GuardedTransitions (triggered when a specific guard holds). A GuardedTransition may be triggered by one or more Events and include a Constraint to be satisfied for the transition to occur. This allows a fine-grained control over the firing of the Transition.

RBAC metamodel. The RBAC metamodel part is an extended version of the RBAC standard mentioned in Section 2 to adapt it to CUIs. This is done through the definition of a set of permissions which specify which roles are allowed to perform a specific action (a match to an intent or a transition navigation to a state) on a resource (intent, transition, or state). Its main elements are:

Resources. The metaclass Resource represents the objects that can be accessed within the CUI and that we may want to protect. In the context of CUIs, resources are basically of three types: Intents, Transitions, and States. Protecting intents will allow hiding part of the CUI's intents to specific roles. This may be necessary, for instance, to prevent specific users from accessing some intents. On the other hand, protecting transitions and states will allow, once an intent has been matched, to execute different behaviors depending on the role who triggered the intent. This may be useful, for instance, to provide different answers for an intent depending on the role of the user.

Subjects. The metaclass Subject represents the active entities which interact with the CUI. Following a RBAC approach, we define two kinds of subjects: User s and Roles, where users get roles assigned and role inheritance is supported.

Actions. The metaclass Action represents the access to the resources that may be performed by the subjects of the CUI. In this context, we consider the possible actions performed by subjects are Matchings (to an intent) and TransitionNavigations (to a state of the state machine). The latter enables a more fine-grained control to the potential user interaction when needed.

Permissions. The metaclass Permission represents the right to perform a given action (a match or a transition navigation) on a given resource (an intent, transition or state) granted to a specific role (corresponding to a CUI user).

Constraints. The metaclass Constraint restricts the permission to execute the corresponding action only when certain conditions hold. The metaclass Role-BasedConstraint, which extends the original RBAC standard model combining a concept from the ABAC model, represents specific context-based constraints (such as geographic location or the used device) to restrict the permissions.

Concrete syntax.

In order to complete the definition of our DSL, we could provide a textual concrete syntax, a graphical one or a combination. We show an example of a textual syntax in Section 3.3.

Policy evaluation and enforcement

Given an RBAC policy, our framework needs to combine a number of runtime components to enforce it. The recommendation in the implementation of modern policy frameworks is separating the infrastructure logic from the application logic by using a reference monitor architecture [START_REF]Information technology -Open Systems Interconnection -Security frameworks for open systems: Access control framework[END_REF]. This architecture consists in two basic components: a Policy Enforcement Point (PEP) and a Policy Decision Point (PDP). Every access action requested by an user is intercepted by the PEP that, in turn, forwards it to the PDP to yield an access decision.

Our framework follows this architecture. As Fig. 1 shows, access requests to the bot resources (intents, transitions and states) are intercepted. These requests are then forwarded to the PDP, which reads the policy rules to resolve the access. The access decision yielded by the PDP is returned to the bot through the PEP.

Proof of concept

In order to show the feasibility of our approach, we discuss in this section a prototype implementation of our framework on top of the Xatkit framework [START_REF] Daniel | Xatkit: A multimodal low-code chatbot development framework[END_REF] and illustrate it with a simple weather chatbot example 5 .

We have first added the textual concrete syntax extensions needed to model the new CUI metaclasses as part of a Xatkit specification. Listing 1.1 shows a snippet of the authorization policy specification which describes that the intent Get Historical Weather can be only matched by registered users. To simplify the definition of more complex CUIs we could provide default permission configurations (i.e. enabling or disabling access unless explicitly stated otherwise) and define GRANT ALL level permissions (i.e. authorization to match all available intents). Proper parsing of these textual syntactic sugar shortcuts would be translated into equivalent metamodel instantiations. We have then implemented the policy evaluation and enforcement. There are several possible strategies to this end, also depending on whether the chatbot designer has internal access to the chatbot engine.

When modifying the execution logic of the chatbot engine is possible, we could embed the security checks as part of the engine itself. These checks would be added as standard elements of the chatbot execution logic and be implicitly verified upon every single intent matching or transition navigation request. But in most scenarios, chatbot designers will not have this option as most chatbot platforms are not open source or are hidden behind an API offered to deploy the bot and interact with the engine. In these cases, access-control must be explicitly added to the individual chatbot logic. Authorization verification becomes now explicit but, on the other hand, it can be easily added on top of many more chatbot engines. This is the strategy shown in Listing 1.2. In this example, we show how the transition from an initial Awaiting input state to the Print historical weather state will only be triggered when the user utterance matches the Get Historical Weather intent above and the user is authorized to match such intent. . when ( i n t e n t I s ( G e t H i s t o r i c a l W e a t h e r I n t e n t ) 3

. and ( c -> p o l i c y R u l e s . c h e c k P e r m i s s i o n ( u s e r . g e t R o l e ( ) . getName ( ) , 4

" matching " , " G e t H i s t o r i c a l W e a t h e r I n t e n t " ) ) ) . moveTo ( p r i n t H i s t o r i c a l W e a t h e r )

Listing 1.2. Policy Enforcement Point (PEP) implementation.

Note that, even if access-control evaluation and enforcement is now explicit, it could still be automatically added to the concerned transitions. Given a security policy such as the one in Listing 1.1 and a plain chatbot definition, we could automatically instrument all relevant transitions with the proper access-control checks based on the policy definition.

Related Work

Several authors have expressed the need to secure chatbots, especially in critical domains such as banking [START_REF] Lai | A banking chatbot security control procedure for protecting user data security and privacy[END_REF] or health [START_REF] Roca | Álvaro Alesanco: Microservice chatbot architecture for chronic patient support[END_REF]. In the same line, [START_REF] Gondaliya | SLA as a mechanism to manage risks related to chatbot services[END_REF] even proposes chatbot providers to attach an SLA to their chatbots, including security aspects. Indeed, as pointed out in [START_REF] Bozic | Security testing for chatbots[END_REF][START_REF] Cabot | Testing challenges for nlp-intensive bots[END_REF][START_REF] Hasal | Chatbots: Security, privacy, data protection, and social aspects[END_REF][START_REF] Ye | Chatbot security and privacy in the age of personal assistants[END_REF], chatbots are concerned by (and should be tested against) a number of security concerns. While these works highlight the need to integrate security aspects, they do not propose concrete and actionable solutions. Even for industrial tools (like DialogFlow, Amazon Lex or Watson Assistant) access-control is focused on the management of the permissions to collaborate in the bot definition. At most, you can also define who can execute the bot, with no further fine-grained permission levels.

This limitation is shared by proposals focusing on chatbot definition languages, such as [START_REF] Daniel | Xatkit: A multimodal low-code chatbot development framework[END_REF][START_REF] Pérez-Soler | Model-driven chatbot development[END_REF][START_REF] Planas | Towards a model-driven approach for multiexperience AI-based user interfaces[END_REF], which do not include modeling primitives to define the access-control policies even if modeling of access-control policies is a subject with a long tradition in the MDE community [START_REF] Basin | A decade of model-driven security[END_REF], with some notable examples like SecureUML [START_REF] Lodderstedt | Secureuml: A uml-based modeling language for model-driven security[END_REF] which extends UML with an RBAC metamodel that serves as inspiration for our own proposal. To sum up, we believe ours is the first approach to integrate access-control as first-class citizen in a bot definition language.

Conclusions

In this paper we have proposed a new model-driven framework for enhancing the security of CUIs by integrating and adapting the semantics of the Role Based Access-Control (RBAC) protocol to Conversational User Interfaces (CUIs). In particular, we have extended a generic CUI metamodel with RBAC primitives that enable the definition of fine-grained access control policies for all key CUI elements (such as intents, states and transitions). We also provided a preliminary proof of concept to demonstrate the feasibility of our approach.

As further work we plan to enrich the framework with other access-control models and improve the validation and tool support of the approach. Moreover, we see this work is a first step towards the modeling of other security-related aspects for CUIs, such as DDoS, privacy, encryption, and so on.

Fig. 1

 1 Fig. 1 summarizes our framework to integrate access-control on CUIs, consisting of: (1) a design time component (RBAC Policy rules in the figure) to enable the specification of the bot authorization policy (see Sec. 3.1); and (2) a runtime component (PEP and PDP in the figure) in charge of evaluating and enforcing that policy upon the resource's access from users (see Sec. 3.2).

Fig. 1 .

 1 Fig. 1. Framework overview.

Fig. 2 .

 2 Fig. 2. Access-control CUIs metamodel.

9 A c t i o n matching 10 ) -> Allow Listing 1 . 1 .

 91011 e u n r e g i s t e r e d U s e r 3 R e s o u r c e G e t H i s t o r i c a l W e a t h e r I n t e n e r e g i s t e r e d U s e r 8 R e s o u r c e G e t H i s t o r i c a l W e a t h e r I n t e n t Policy example for a weather chatbot.

1 a w a i t i n g I n p u t 2

 2

https://github.com/elenaplanas/xatkit-RBACBot

This work has been partially funded by the Spanish government (LOCOSS project -PID2020-114615RB-I00 and BODI project -PDC2021-121404-I00).


diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

The project INSECT4CITY: assessment of benefits and risks of insect-based bioconversion for recycling bio-waste from urban and peri-urban areas

Erwan Engel, Christelle Planche, Rallou Thomopoulos, Catherine Macombe, Christina Nielsen-Leroux, Pascale Bazoche, Christophe Bressac, Armel Donkpegan, Bertrand Meda, Samir Mezdour, et al.

To cite this version:

Erwan The project INSECT4CITY: assessment of benefits and risks of insect-based bioconversion for recycling bio-waste from urban and peri-urban areas

INRAE, Marseille, France

Background/Objectives: In urban and peri-urban areas, where waste management is more than ever a major issue, insect farming may be an ecological way to recycle bio-waste in a circular bioeconomy approach. Indeed, some insect species such as Hermetia illucens can grow on many types of organic substrates and can convert them into valuable byproducts (1) . There may be a wide variety of insect bioconversion products since larvae are a natural source of micronutrients, amino acids and antimicrobial compounds. They are also rich in proteins which can be used for animal feed, in fats used for the production of biodiesel, in chitin used in various industries, and they produce a type of manure called frass that can be used as biofertilizer (2) . However, besides its ecological and nutritional benefits, risks of insectbased bioconversion should be identified and monitored. Indeed, some chemical contaminants may be found in insect farming environment, in their feeding substrates or can be produced during processing methods (3) . Moreover, microbiological contaminants may be found in the farming insect chain (4) . Therefore, it is necessary to assess the impact of these contaminants on insect survival and to determine their fate in the insect. It is also important to assess the environmental, social and economic impact of insect-based bioconversion and to determine the consumer acceptability of these new processes and products.

Methods: It is around this overall benefit-risk assessment that the project INSECT4CITY initiated in 2019 is focused, bringing together 8 research divisions of INRAE, the French National Research Institute for Agriculture, Food and the Environment. It addresses, upstream of the development of this sector with very high potential, all the questions that the general public, the legislator as well as the producers of insects can ask themselves about this means of recovering biowaste.

Results: N/A

Discussion / Conclusion: N/A

  Engel, Christelle Planche, Rallou Thomopoulos, Catherine Macombe, Christina Nielsen-Leroux, et al.. The project INSECT4CITY: assessment of benefits and risks of insect-based bioconversion for recycling bio-waste from urban and peri-urban areas. Proceedings of the Nutrition Society, 81 (SI), pp.E73, 2022, Proceedings of the Nutrition Society : Urban food policies for sustainable nutrition and health, 10.1017/s0029665122000969. hal-03685819

  Erwan Engel 1 , Christelle Planche 1 , Rallou Thomopoulos 2 , Catherine Macombe 2 , Christina Nielsen-Leroux 3 , Pascale Bazoche 4 , Christophe Bressac 5 , Armel Donkpegan 6 , Bertrand Meda 7 , Samir Mezdour 8 , Souhil Harchaoui 4 , Géraldine Boué 9 , Mustapha Berri 7 , Pascal Schlich 10 , Sandrine Skiba 11 , Isabelle Virlogeux-Payant 7 , Jean-Philippe Steyer 12 and Patrick Borel 13

	1 INRAE, Saint-Genès-Champanelle,
	2 INRAE, Montpellier,
	3 INRAE, Jouy-en-Josas,
	4 INRAE, Rennes,

5 CNRS, Tours, 6 INRAE, Villenave d'Ornon, 7 INRAE, Nouzilly, 8 INRAE, Massy, 9 INRAE, Nantes, 10 INRAE, Dijon, 11 INRAE, Saint-Pée-sur-Nivelle, 12 INRAE, Narbonne, and 13

Proceedings of the Nutrition Societyhttps://doi.org/10.1017/S0029665122000969 Published online by Cambridge University Press