Héber H Arcolezi
email: heber.hwangarcolezi@univ-fcomte.fr

Jean-François Couchot
email: jean-francois.couchot@univ-fcomte.fr

Bechara Al Bouna
email: bechara.albouna@ua.edu.lb

Xiaokui Xiao
email: xkxiao@nus.edu.sg

Longitudinal collection and analysis of mobile phone data with local differential privacy ⋆

Keywords: Local differential privacy, Call detail records, Mobility analytics, Multi-dimensional data, Mobile phone data

Longitudinal studies of human mobility could allow an understanding of human behavior on a vast scale. Mobile phone data call detail records (CDRs) have emerged as a prospective data source for such an important task. Nevertheless, there are significant risks when it comes to collecting this type of data, as human mobility has proven to be quite unique. Because CDRs are produced through the connection of mobile phones with mobile network operators' (MNOs) antennas, it means that users cannot sanitize their data. Once MNOs intend to use such a data source for human mobility analysis, data protection authorities such as the CNIL (in France) recommends that data be sanitized on the fly instead of collecting raw data and publishing private output at the end of the analysis. Local differential privacy (LDP) mechanisms are currently applied during the process of data collection to preserve the privacy of users. In this paper, we propose an efficient privacy-preserving LDP-based methodology to collect and analyze multi-dimensional data longitudinally through mobile connections. In our proposal, rather than regarding users as unique IDs, we propose a generic scenario where one directly collects users' sensitive data with LDP. The intuition behind this is collecting generic values, which can be generated by many users (e.g., gender), allowing a longitudinal study. As we show in the results, our methodology is very appropriate for this scenario, achieving accurate frequency estimation in a multi-dimensional setting while respecting some major recommendations of data protection authorities such as the GDPR and CNIL.

Introduction

Currently, with the increasing of massive data generated by mobile phones, the acquisition of these data has attracted considerable attention. When users make a call, send SMS, or connect to the internet, a call detail record (CDR) is generated with information on users' ID, the antennas that handled the communication service (coarse level location), and the duration and type of communication, for example. CDRs are stored by mobile network operators (MNOs) for billing and legal purposes, which implies an offline, archived, and constant update of the data without changing nor deleting old records. In other words, CDRs are of easy access and, therefore, have become one of the most used data for research [START_REF] Blondel | A survey of results on mobile phone datasets analysis[END_REF][START_REF] Jacques | Mobile phone metadata for development[END_REF][START_REF] Dujardin | Mobile phone data for urban climate change adaptation: Reviewing applications, opportunities and key challenges[END_REF], e.g., on human mobility.

In addition to CDRs, MNOs store subscription data from clients such as gender, date of birth (age), and invoice address. Such a combination of personal data makes mobile phone CDRs a rich source of information [START_REF] Blondel | A survey of results on mobile phone datasets analysis[END_REF], which could allow research progress and improve individuals' life. For instance, CDRs can be used to model human mobility for tourism [START_REF] Heerschap | Innovation of tourism statistics through the use of new big data sources[END_REF], to improve urban planning, and to help governmental decisions, which could be in the short-term, e.g., response to natural disasters [START_REF] Lu | Predictability of population displacement after the 2010 haiti earthquake[END_REF], the spread of new diseases/pandemics [START_REF] Oliver | Mobile phone data for informing public health actions across the COVID-19 pandemic life cycle[END_REF][START_REF] Wesolowski | Commentary: Containing the ebola outbreak -the potential and challenge of mobile network data[END_REF][START_REF] Pollina | European mobile operators share data for coronavirus fight[END_REF] like the ongoing COVID-19 outbreak [START_REF] Wang | A novel coronavirus outbreak of global health concern[END_REF]. Or to the long-term, to building new hospitals, schools, and improving transportation systems [START_REF] De Montjoye | On the privacy-conscientious use of mobile phone data[END_REF][START_REF] Jacques | Mobile phone metadata for development[END_REF][START_REF]Orange-Business-Services: Flux vision: real time statistics on mobility patterns[END_REF]. CDRs are also the type of data that we focus on in this paper, which will be used equivalently when mentioning mobile phone data.

Context of the problem

However, mobility data are quite sensitive as human mobility has proven to be highly unique and predictable [START_REF] De Montjoye | Unique in the crowd: The privacy bounds of human mobility[END_REF]. If users can be tracked away by their presence or location, in some cases the users' home/work addresses, their religion, and habits can be disclosed. Additionally, even though MNOs have the right and duty to store CDRs, according to some privacy legislation, such as the GDPR (General Data Protection Regulation) [START_REF]reform of EU data protection rules[END_REF], it does not mean MNOs have the right to use those data for other purposes. Therefore, once MNOs intend to use such a data source for human mobility analysis, these data must be properly sanitized. Therefore, it is vital to improving privacy-preserving techniques to collect mobile phone data [START_REF] De Montjoye | On the privacy-conscientious use of mobile phone data[END_REF][START_REF] Zang | Anonymization of location data does not work[END_REF].

For instance, one could think of a straightforward solution to publishing mobility analysis according to all CDRs collected in a given time interval (e.g., a day) using k -anonymity [START_REF] Sweeney | k-anonymity: A model for protecting privacy[END_REF] or differential privacy (DP) [START_REF] Dwork | Differential privacy[END_REF][START_REF] Dwork | The algorithmic foundations of differential privacy[END_REF], which are two well-known privacy models. On the one hand, k -anonymity assumes that a trusted curator holds users' raw data and relies on hiding each released record in a crowd of k -1 other similar ones. However, k -anonymity might not be sufficient to guarantee users' privacy [START_REF] Zang | Anonymization of location data does not work[END_REF] since it does not offer strong guarantees and may be vulnerable to intersecting and/or homogeneity attacks, for example. On the other hand, DP assumes that a trusted curator holds the raw data from users and adds noise to output private queries. By 'trusted', we mean that curators do not misuse or leak private information from individuals. However, this assumption does not always hold in real-life. To address non-trusted services in DP, authors in [START_REF] Kasiviswanathan | What can we learn privately?[END_REF] introduced the concept of local differential privacy (LDP), which proposes to sanitize each individual's data independently during the process of data collection.

Indeed, DP-or k -anonymity-based approaches normally require the entire dataset of raw CDRs, which is not in accordance with recommendations of data protection authorities such as the CNIL (National Commission on Informatics and Liberty, in English) [8], in France, which requires that data be sanitized on the fly. More specifically, according to CNIL and GDPR, there are some important recommendations to be respected once MNOs aims to collect CDRbased data for analyzing human mobility. These recommendations are briefly described in the following: (i) CDRs are produced through the connection of mobile phones with carrier networks (e.g., receiving or making calls). This means that users cannot sanitize their data via a built-in application, for example. Hence, all sanitization procedures must be done on the fly instead of collecting raw data and publishing private output at the end of the analysis. (ii) MNOs cannot store or work with data containing users' unique identifiers (IDs) or a hashed version of it as they are still unique IDs. For instance, if one can detect the same hash(ID) for many days, it violates the privacy of this user as s/he can be easily tracked away. And (iii), as a longitudinal study, users can generate multiple data points (e.g., they can receive/make calls every day for a month). In the literature, this problem is referred to as continuous observation [START_REF] Erlingsson | Rappor: Randomized aggregatable privacypreserving ordinal response[END_REF][START_REF] Ding | Collecting telemetry data privately[END_REF], and it must be addressed to avoid 'averaging' attacks.

Purpose and contributions

In summary, we describe the targeted problem of this work as follows. How can MNOs, which store CDRs for billing purposes, also collect longitudinal and multidimensional data based on mobile connections to publish high-utility analysis of human mobility? To this end, the privacy-preserving methodology must comply with the three (i)-(iii) aforementioned recommendations according to the GDPR and CNIL.

We describe our system model in the following. The first entity, namely users, refers to n clients U = {u 1 , u 2 , ..., u n } of the MNO. The second entity is the MNOs themselves, which legally store the signature data of their clients (date of birth, gender, invoice address, ...) and billing data (CDRs) into a data server. In order to avoid data breaches and to be compliant with privacy legislation such as the GDPR, these data must be stored in a secure environment. Therefore, in the data privacy context, when users connect to the MNO's antennas, there is a need for an efficient approach for privately 'exporting' (collecting) data for high-utility mobility analytics.

Without loss of generality, we assume that all the data MNOs will extract from this data server, for publishing human mobility analysis, is categorical. That is, in this paper, we aim to address the aforementioned problem as a general frequency estimation in categorical data. The reason behind this is the collection of generic values on a population through mobile connections in a given time interval to produce flows and mobility indicators based on socio-demographic data (e.g., such as in [START_REF] Arcolezi | Mobility modeling through mobile data: generating an optimized and open dataset respecting privacy[END_REF][START_REF]Orange-Business-Services: Flux vision: real time statistics on mobility patterns[END_REF]). Indeed, multi-dimensional human mobility analyses would provide more insights into people's mobility behavior by attribute values (e.g., gender, origin, age-ranges). For instance, local authorities and/or organizations could take advantage of such knowledge to identify strategies to propose better decision-making solutions to society, e.g., the spread of diseases, urban planning, natural disasters, and so on [START_REF] Dujardin | Mobile phone data for urban climate change adaptation: Reviewing applications, opportunities and key challenges[END_REF][START_REF] Rhoads | Measuring and mitigating behavioural segregation using call detail records[END_REF][START_REF] Kishore | Flying, phones and flu: Anonymized call records suggest that keflavik international airport introduced pandemic H1N1 into iceland in 2009[END_REF][START_REF] Wesolowski | Commentary: Containing the ebola outbreak -the potential and challenge of mobile network data[END_REF][START_REF] Oliver | Mobile phone data for informing public health actions across the COVID-19 pandemic life cycle[END_REF][START_REF] Pollina | European mobile operators share data for coronavirus fight[END_REF][START_REF] Lu | Predictability of population displacement after the 2010 haiti earthquake[END_REF].

Therefore, in this paper, we introduce an LDP-based privacy-preserving methodology to sanitize each CDR-based data on the fly. The main reason behind our choice to use the local model is because neither MNOs nor 'trusted curators' (e.g., researchers) can analyze human mobility through raw CDRs data, according to privacy legislation such as the GDPR and CNIL (in France). Fig. 1 illustrates an overview of our system model, which includes our proposed LDPbased methodology as a solution to collecting data through mobile connections.

Each time a user makes a call, or sends SMS, or connects to the internet, a CDR is generated and is stored offline for billing and legal purposes in a secure data server. Notice that the secure environment is also responsible for applying the LDP sanitization to all users' data with ǫ-LDP, where ǫ is a public parameter, before sending them to a sanitized data server. Therefore, the sanitized data server can store and aggregate this data for producing statistics through frequency estimation, which depends on the LDP algorithm and public parameter ǫ. In this scenario, both users and MNOs are safeguarded as no raw data will be collected for the purpose of human mobility analysis. On the one hand, ǫ-LDP values are robust to post-processing and can be stored and shared with 'trusted' curators for studying human mobility. However, ǫ-LDP values must not be regarded as unique identifiers. In a worst-case scenario, if one can detect a unique ǫ-LDP value for many days, it would violate the privacy of this user as s/he could be easily tracked away. In this case, we propose to use the generalized randomized response (GRR) [START_REF] Wang | Locally differentially private frequent itemset mining[END_REF][START_REF] Wang | Locally differentially private protocols for frequency estimation[END_REF][START_REF] Kairouz | Discrete distribution estimation under local privacy[END_REF] LDP mechanism, which corresponds to the situation where no particular encoding is chosen. In other words, with GRR, ǫ-LDP private reports are generic to many users (e.g., feminine or masculine, for the gender attribute), which could have been generated by any user u 1 or u 2 and, therefore, allowing a longitudinal collection of data. To summarize, this paper makes the following contributions:

-We introduce an LDP-based privacy-preserving methodology to sanitize multi-dimensional CDR-based data on the fly for two longitudinal data collection scenarios:

I Frequency estimates: In this case, MNOs initialize a single server to collect sanitized data for each time interval. This allows MNOs to publish the frequency of users per d attributes. For example, the frequency of users in a given city and day per gender, location (antenna coverage areas), age-ranges, and so on. II Cumulative frequency estimates: In addition to point 1., MNOs can privately extend the analysis to include users data on different sanitized data servers. This would allow MNOs to estimate the number of users at the intersection or union of different time intervals. In this paper, we only focus on this scenario as the Frequency estimates scenario is already part of the latter.

-We extended the analytical analysis of GRR for multi-dimensional studies where we prove that sending only r = 1 attribute out of d possible ones provides much higher utility. -We present extensive experiments with a 7-days, multi-dimensional, and realworld mobility dataset (CDR-driven) from [START_REF] Arcolezi | Mobility modeling through mobile data: generating an optimized and open dataset respecting privacy[END_REF] to validate our proposals.

Roadmap. The remainder of this paper is organized as follows. In Section 2 we review related work. In Section 3, we briefly describe the privacy notions that we are considering, i.e., LDP and the GRR mechanism with its extension for multidimensional data. Next, we explain our proposed methodology in Section 4. In Section 5, we present our results and its discussions. Last, in Section 6 we present the concluding remarks and future directions.

Related Work

Numerous previous [START_REF] Kishore | Flying, phones and flu: Anonymized call records suggest that keflavik international airport introduced pandemic H1N1 into iceland in 2009[END_REF][START_REF] Lu | Predictability of population displacement after the 2010 haiti earthquake[END_REF][START_REF] Wesolowski | Commentary: Containing the ebola outbreak -the potential and challenge of mobile network data[END_REF][START_REF] Heerschap | Innovation of tourism statistics through the use of new big data sources[END_REF] and current studies [START_REF] Dujardin | Mobile phone data for urban climate change adaptation: Reviewing applications, opportunities and key challenges[END_REF][START_REF] Oliver | Mobile phone data for informing public health actions across the COVID-19 pandemic life cycle[END_REF][START_REF] Pollina | European mobile operators share data for coronavirus fight[END_REF][START_REF] Rhoads | Measuring and mitigating behavioural segregation using call detail records[END_REF][START_REF]Orange-Business-Services: Flux vision: real time statistics on mobility patterns[END_REF] have shown the validity and benefits of mobility studies based on CDRs. Although eventbased (i.e., data are only available when using the MNOs' services) and with coarse location (i.e., antennas that handled the service), CDRs are a real marker of human presence. Such a data source has been proven as a prominent way to analyze large-scale human mobility due to the high penetration rates of cell phones and low collection costs [START_REF] Blondel | A survey of results on mobile phone datasets analysis[END_REF][START_REF] Jacques | Mobile phone metadata for development[END_REF][START_REF] Dujardin | Mobile phone data for urban climate change adaptation: Reviewing applications, opportunities and key challenges[END_REF]. Regarding human mobility, some studies have shown that humans follow particular patterns with a high probability of predictability. This motivates, even more, a conscientious use of mobile phone data for allowing research progress, which could benefit individuals and society [START_REF] De Montjoye | Unique in the crowd: The privacy bounds of human mobility[END_REF][START_REF] De Montjoye | On the privacy-conscientious use of mobile phone data[END_REF]. Indeed, in recent contexts, Oliver et al. [START_REF] Oliver | Mobile phone data for informing public health actions across the COVID-19 pandemic life cycle[END_REF] highlight the importance of mobile phone data like CDRs for fighting the current COVID-19 pandemic [START_REF] Wang | A novel coronavirus outbreak of global health concern[END_REF], and [START_REF] Dujardin | Mobile phone data for urban climate change adaptation: Reviewing applications, opportunities and key challenges[END_REF] review and discuss applications, opportunities, and some key challenges to use CDRs for urban climate change adaption.

Concerning CDRs sanitization, the authors in [START_REF] Acs | A case study: Privacy preserving release of spatiotemporal density in paris[END_REF] describe a differentially private scheme to release the spatio-temporal density of Paris regions using CDRs of about 2 million users over one week. The authors propose data pre-processing techniques such as sub-sampling and clustering, which aims at enhancing the utility of the DP mechanism. Zang and Bolot [START_REF] Zang | Anonymization of location data does not work[END_REF] have performed extensive experiments showing that the anonymization of location data from CDRs using k -anonymity leads to privacy risks. Mir et al. [START_REF] Mir | DP-WHERE: Differentially private modeling of human mobility[END_REF] extended a framework namely WHERE and proposed DP-WHERE, which produces synthetic CDRs to model mobility patterns of metropolitan populations respecting DP guarantees. In [START_REF] Alaggan | Sanitization of call detail records via differentially-private bloom filters[END_REF], the authors applied a DP mechanism namely BLIP (Bloom-than-fLIP) on a CDRs dataset. Each BLIP stores the users' ID, and in the end, each bit is flipped with a given probability to guarantee DP for each user. Afterward, in [START_REF] Alaggan | Privacy-preserving wi-fi analytics[END_REF], authors proposed an upgraded version of BLIP namely Pan-Private BLIP (PP-BLIP), which guarantees privacy protection to the internal state while the BLIP is being built as well as to its output. The authors applied PP-BLIP to human mobility modeling via wi-fi connections while highlighting its extension to CDR-based data.

Notice that the aforementioned works provide a means to model human mobility through CDRs. However, when using DP, these works collect raw data and sanitize it in the end. Secondly, using BLIP or PP-BLIP would require an unbounded privacy budget as each Bloom Filter (e.g., per day) uses ǫ-DP. By the sequential composition theorem [START_REF] Dwork | The algorithmic foundations of differential privacy[END_REF][START_REF] Zhu | Differential Privacy and Applications[END_REF], it is clear that these methods do not allow a long-term analysis. Last, these approaches collect users' ID or a hashed version of it and do not allow collecting other data rather than the presence of users itself. In this paper, we introduce a way to address these concerns with LDP, which allows a longitudinal collection of data with high privacy guarantees to each user. The local DP model has received considerable attention in both academia [START_REF] Wang | Collecting and analyzing multidimensional data with local differential privacy[END_REF][START_REF] Nguyên | Collecting and analyzing data from smart device users with local differential privacy[END_REF][START_REF] Kasiviswanathan | What can we learn privately?[END_REF][START_REF] Wang | Locally differentially private protocols for frequency estimation[END_REF][START_REF] Wang | Locally differentially private frequent itemset mining[END_REF][START_REF] Alvim | Invited paper: Local differential privacy on metric spaces: Optimizing the trade-off with utility[END_REF][START_REF] Fernandes | Utility-preserving privacy mechanisms for counting queries[END_REF] and practical deployment [START_REF] Erlingsson | Rappor: Randomized aggregatable privacypreserving ordinal response[END_REF][START_REF] Ding | Collecting telemetry data privately[END_REF] since it does not rely on sharing raw data anymore, which has a clear connection to the concept of randomized response [START_REF] Warner | Randomized response: A survey technique for eliminating evasive answer bias[END_REF]. We refer the interested reader to the survey work on LDP from Xiong et al. [START_REF] Xiong | A comprehensive survey on local differential privacy[END_REF] for more insights about this approach.

Background

In this section, we briefly present the privacy concepts considered in this work, i.e., local differential privacy (Subsection 3.1). Further, we describe the generalized randomized response LDP mechanism (Subsection 3.2), and its extension to a multi-dimensional setting based on random sampling (Subsection 3.3).

Local differential privacy (LDP)

The centralized DP outlined in the introduction assumes trusted data collectors. By 'trusted', it means that they do not steal or leak private information from individuals. However, this assumption does not always hold in real-life. To address non-trusted services, local differential privacy [START_REF] Kasiviswanathan | What can we learn privately?[END_REF] was proposed to preserve users' privacy in the process of data collection. Rather than trusting in a trusted curator to have the raw data and sanitize it to output queries, LDP allows users to sanitize their data before sending it to the data collector server. A randomized algorithm A is said to provide ǫ-local differential privacy if, for any two input values v 1 , v 2 ∈ Domain(A) and any possible output y of A:

Pr[A(v 1 ) = y] ≤ e ǫ • Pr[A(v 2 ) = y]. (1)
Intuitively, ǫ-LDP guarantees that an attacker can not distinguish whether the true value is v1 or v2 (input) with high confidence (controlled by ǫ) irrespective of the background knowledge one has. That is because both have approximately the same probability to generate the same sanitized output.

Generalized randomized response (GRR)

Randomized response (RR) was proposed by Warner [START_REF] Warner | Randomized response: A survey technique for eliminating evasive answer bias[END_REF] in 1965 to collect statistics on sensitive topics while guaranteeing the survey respondents with strong deniability. The RR model was designed for binary attributes (v = 2 values). Further, an LDP mechanism was introduced as a general version of the RR technique to be used for v ≥ 2 values. This LDP mechanism is referred to as k -RR in [START_REF] Kairouz | Discrete distribution estimation under local privacy[END_REF], as GRR in [START_REF] Wang | Locally differentially private frequent itemset mining[END_REF], and direct encoding protocol in [START_REF] Wang | Locally differentially private protocols for frequency estimation[END_REF]. In this paper, we refer to this LDP mechanism as GRR.

Let V = {v 1 , v 2 , ..., v j } be a set of j values of the personal data in consideration (e.g., age ranges) and ǫ be the privacy budget. Given a value v i , GRR(v i ) outputs the true value v i with probability p = e ǫ e ǫ +j-1 , and any other value v k for k = i with probability q = 1-p j-1 = 1 e ǫ +j-1 , where j = |V |. A statistical-based (SB) approach for estimating the number of times T that a value v i occurs for i ∈ [1, j], is computed as:

T (v i ) = N i -nq p -q , ( 2
)
where N i is the number of times the value v i has been reported and n is the total number of users. Wang et al. [START_REF] Wang | Locally differentially private frequent itemset mining[END_REF][START_REF] Wang | Locally differentially private protocols for frequency estimation[END_REF] proved that this estimator is unbiased and its variance is computed as:

Var[ TGRR (i)] = n • e ǫ + j -2 (e ǫ -1) 2 , (3)
where [START_REF] Wang | Locally differentially private frequent itemset mining[END_REF][START_REF] Wang | Locally differentially private protocols for frequency estimation[END_REF] remark that this variance is linear in n and j. That is, if an attribute has too many values the accuracy of using GRR decreases. Indeed, as j increases the probability p of reporting the true value decreases. Moreover, in [START_REF] Wang | Locally differentially private protocols for frequency estimation[END_REF], the authors have proven that if j < 3e ǫ + 2, the GRR mechanism presents higher utility in comparison with many other state-of-the-art LDP mechanisms, e.g., Basic One-time RAPPOR [START_REF] Erlingsson | Rappor: Randomized aggregatable privacypreserving ordinal response[END_REF] and optimized unary encoding [START_REF] Wang | Locally differentially private protocols for frequency estimation[END_REF] (OUE).

Collecting multi-dimensional data with GRR

There are few works for collecting multi-dimensional data with LDP based on random sampling [START_REF] Wang | Collecting and analyzing multidimensional data with local differential privacy[END_REF][START_REF] Nguyên | Collecting and analyzing data from smart device users with local differential privacy[END_REF][START_REF] Wang | Locally differentially private protocols for frequency estimation[END_REF], which mainly focused on numerical data [START_REF] Xiong | A comprehensive survey on local differential privacy[END_REF]. This technique reduces both dimensionality and communication costs, which will also be the focus of this paper by extending the analysis to the GRR mechanism. Suppose there are d ≥ 2 attributes, n users, and a privacy budget ǫ > 0. A naive solution is splitting the privacy budget (M1 ), i.e., assigning ǫ/d for each attribute. The other solution is based on randomly sampling (without replacement) only r attribute(s) out of d possible ones (M2 ), i.e., assigning ǫ/r per attribute. Notice that both solutions satisfy ǫ-LDP according to the sequential composition theorem [START_REF] Dwork | The algorithmic foundations of differential privacy[END_REF][START_REF] Zhu | Differential Privacy and Applications[END_REF].

As the number of users n differs (n and rn/d) in the two solutions, we normalize the estimator T in Eq. ( 2) to the range 0 to 1. The GRR variance in Eq. ( 3) is now described as V ar[ TGRR (i)/n] = 1 n • e ǫ +j-2 (e ǫ -1) 2 . For the first case (M1 ), the GRR variance is Var 1 = 1 n • e ǫ/d +j-2 (e ǫ/d -1) 2 and for the second case (M2 ), the GRR variance is Var 2 = d nr • e ǫ/r +j-2 (e ǫ/r -1) 2 . The objective is finding r, which minimizes Var 2 and guarantees that Var 2 < Var 1 .

Following the work in [START_REF] Wang | Collecting and analyzing multidimensional data with local differential privacy[END_REF], we multiply Var 2 by ǫ. Next, let x = r/ǫ be the independent variable and Var 2 rewritten as y = 1

x • e 1/x (e 1/x -1) 2 be the dependent one; d/n and j -2 are omitted as they are simply summing or multiplication factors. Since y is an increasing function, i.e., y increases as the x value increases, we then have a minimum and optimal when r = 1. The remaining question is if

Var 1 -Var 2 > 0. Since Var 1 -Var 2 = 1 n e ǫ/d (e ǫ/d -1) 2 - d • e ǫ (e ǫ -1) 2 , (4)
omitting j -2, it has been proven in [START_REF] Wang | Locally differentially private protocols for frequency estimation[END_REF] that Var 1 -Var 2 is always positive, and hence, the proof ends.

In this multi-dimensional setting (M2 ), one can see our solution as applying the GRR mechanism only once in d times (1/d) and reporting nothing 1 -1/d times. In short, Alg. 1 shows the pseudocode of using GRR for multi-dimensional data collection, which will be referred to as GRR-M2 for the rest of this paper. Given the set A = {A 1 , ..., A d } of all d attributes and a tuple t = [v 1 , ..., v d ] with the user's true values, the GRR-M2 algorithm returns a tuple t * = r, GRR(v r ) , i.e., with the sampled attribute r and its ǫ-LDP value. Notice that, to ensure (strengthen) users' privacy over time, each user must always report the same unique attribute r. On the server-side, the SB estimator in Eq.( 2) to the number of times T that a value v i occurs for i ∈ [1, j] has to be scaled d times.

Algorithm 1 GRR for multi-dimensional data collection (GRR-M2 )

LDP-Based Privacy-Preserving Longitudinal Data Collection Through Mobile Connections

In this section, according to the system overview in Fig. 1, we detail our LDPbased solution (Subsection 4.1) regarding the Cumulative frequency estimates scenario outlined in the introduction and its limitations (Subsection 4.2). Notice that the Frequency estimates scenario of collecting data only per single time intervals is part of the Cumulative frequency estimates scenario, and one can intuitively simplify some steps to apply only it.

Proposed methodology

Fig. 2 illustrates the overview of our methodology applied to collect users' data for days and union of days in a flow chart. Without loss of generality, we present our methodology for days, but it can be extended to any timestamp one desires as users' LDP data are generic to many users by using the GRR mechanism.

1. Initialization. According to the left side of Fig. 2, the secure-server defines the privacy guarantee ǫ, which is uniform for all users. Let N b be the whole period of analysis (e.g., total number of days), the MNOs' sanitized data server initializes N b(N b + 1)/2 empty databases. For instance, if N b = 3 one will have

set db = {D 1 , D 2 , D 2 ∪ D 1 , D 3 , D 3 ∪ D 2 , D 3 ∪ D 2 ∪ D 1 }.
2. LDP-based sanitization on the fly. The MNOs' secure-server is responsible to applying the LDP-based sanitization model on the fly (cf. Fig. 1). This process uses our GRR-M2 solution (Alg. 1). Because LDP is applied on the secure server of MNOs, there are a few issues to be taken into account.

To ensure and strengthen privacy over time using GRR-M2, users must always report the same unique attribute r. To solve this issue, we suggest that MNOs generate a random seed that will be associated with each user for a cryptographically secure pseudorandom number generator. Thanks to this, the same memoized and sanitized B ′ can always be assigned for each user, according to the same and unique sampled attribute r. Indeed, if different values B ′ were to be sent in each day, in the long-term, attackers who Fig. 2: Overview of our LDP-based privacy-preserving methodology to collecting data through mobile connections for days and union of days.

can isolate reports from a single user could infer with high confidence the true sensitive value by averaging attacks [START_REF] Erlingsson | Rappor: Randomized aggregatable privacypreserving ordinal response[END_REF][START_REF] Ding | Collecting telemetry data privately[END_REF]. Also, in the real world, it is noteworthy noticing that in a given time interval between ts ini to ts end , the same user can generate multiple connections to MNOs' antennas. This de-duplication issue can be simply solved by the MNO's secure-server via Bloom filters [START_REF] Broder | Network applications of bloom filters: A survey[END_REF], for example.

3. Private data collection. Each time a user connects to MNO's antennas, a CDR is generated, which contains the user's identifier (ID) and timestamp (actual day -AD), for example. CDRs are stored offline in a data server, which contains subscription data of users such as gender, date of birth, origin (invoice address), for example. Hence, without loss of generality, each user

u i (1 ≤ i ≤ n) has a discrete-encoded tuple record t = [v 1 , v 2 , ..., v d ], which contains d categorical attributes A = {A 1 , A 2 , ..., A d }.
Therefore, the MNO's secure-server consistently uses the memoized sanitized data B ′ of users to send for storage according to the users' list of databases list db . That is, by knowing the days this user "was present" (by CDRs), it allows calculating list db , which is a list of databases (days and union of days) to store the private report of the user. We later explain in an example how to calculate list db .

4. Generating statistics. At the end of the analysis period, the MNO's sanitized data server should have N b(N b + 1)/2 databases with only ǫ-LDP reports. On the one hand, MNOs can publish an accurate mobility scenario according to the number of reports (B ′ ) in each sanitized database. The latter represents the exact number of users present per day and union of days. Last, for each sanitized database, one can estimate the frequency of this population for all d attributes using the SB estimator in Eq. ( 2), which has to be scaled d times.

Example to calculate list of databases. To calculate the list db for each user, consider the right side of Fig. 2, which has data for N b = 3 days. First, let Actual Day AD = 1 (the first day of analysis). So, user ID = 1 is detected by the secure-server and his

list db = {D 1 , D 2 ∪ D 1 , D 3 ∪ D 2 ∪ D 1 }.
The reason behind this is that if this user does not appear anymore, we have considered his data in the whole analysis. Next, let AD = 2. For the same user ID = 1, the secureserver knows he was present in both two days, hence, his

list db = {D 2 , D 3 ∪ D 2 }
as the previous day his data was already stored in

D 2 ∪ D 1 and D 3 ∪ D 2 ∪ D 1 .
And, for the user ID = 2, her

list db = {D 2 , D 2 ∪ D 1 , D 3 ∪ D 2 , D 3 ∪ D 2 ∪ D 1 }
to guarantee her data is considered in each past union and future ones in the case she does not show up anymore. Without loss of generality the same procedure is applied in AD = 3.

Limitations

The first key limitation we see in our methodology is the storage factor, which is specifically related to the Cumulative frequency estimates scenario, i.e., collecting users' data per day and union of days. For instance, MNOs need to initialize N b(N b + 1)/2 empty databases where if one wishes to analyze an enhanced detailed scenario, it grows up very fast (i.e., with at least an N b 2 /2 factor). However, this scenario is only intended in special mobility analytics cases, e.g., tourism events, natural disasters, following up spread of diseases, etc. In addition, there is high power for computation and powerful tools to deal with big data nowadays. One way to smooth this problem in, e.g., daily scenarios, is to exclude the stored data after retrieving statistics. Further, there is an important loss of information by not calculating the intersection of users through days. That is, we propose to compute the number of users per union of days as it may have very few users per intersection. The latter would not produce accurate frequency estimations due to the LDP formulation, which is data-hungry. At first glance, one can surely compute the pair-wise intersection for any two days in the analysis period using |A∩B| = |A|+|B|-|A∪B|. One possibility of solving the whole problem is to use the methodology from [START_REF] Arcolezi | Mobility modeling through mobile data: generating an optimized and open dataset respecting privacy[END_REF], which models our proposed mobility scenario (days and union of days) as a linear program to find a solution for all intersections. Besides, for the case where one can have sufficient data samples per pair-, triple-, ..., and N b-wise intersections, one can easily extend our methodology for such a case. However, the storage factor is even bigger as MNOs would have to initialize 2 N b -1 empty databases (all combinations of days).

Last, the memoization step of always reporting the same sanitized value for the unique sampled attribute can be effective to the cases where the true client's data does not vary (static) [START_REF] Erlingsson | Rappor: Randomized aggregatable privacypreserving ordinal response[END_REF][START_REF] Ding | Collecting telemetry data privately[END_REF]. On the other hand, a measured attribute such as location is dynamic. As highlighted in the literature [START_REF] De Montjoye | Unique in the crowd: The privacy bounds of human mobility[END_REF], humans mobility is very predictable, which means that they follow well-defined patterns, e.g., alternating between l1 (home), l2 (work), and l3 (e.g., hobby). Yet, in our privacy-preserving architecture (Fig. 1), the collected/stored sanitized data are 'uncorrelated' from users, as no ID will be stored. Therefore, under the worstcase scenario where attackers can isolate reports from a single user whose random dimension is location, they could learn the l = 3 memoized ǫ-LDP values. But, they can hardly (controlled by ǫ-LDP) identify these real locations thanks to memoization.

Results and Discussion

In this section, we report the results obtained by applying our proposed methodology in a real-world open dataset (Subsection 5.1) and its discussions (Subsection 5.2). The codes we developed and used for all experiments are available in a Github repository1 .

Dataset. This is a longitudinal and multi-dimensional dataset of VHs [START_REF] Arcolezi | Mobility modeling through mobile data: generating an optimized and open dataset respecting privacy[END_REF] resulted by inferring several statistics of human mobility; as stated by the authors, statistics were generated through sanitized mobile connections (CDR-driven). We excluded the data from 'Foreign tourist' users regarding the 'Visitor category' attribute. Hence, our filtered dataset aggregates a population of 87, 098 French users per seven days with approximately 26, 700 unique users on average per day. There are d = 6 attributes we are interested in, which are described in the following. Gender is masculine or feminine. Age has 7 age ranges. GeoLife has 12 socio-professional categories. Region has 22 regions in France that users are billed. Sleeping Area represents 11 areas that users spent the night (location). And, Visit Duration has 10 time-ranges in which visitors were detected each day. The two last attributes are measured ones where Sleeping Area is static and Visit Duration is dynamic.

Evaluation and metrics. We vary the total privacy budget ǫ in the range [0.5, 1, 2, 3, 4, 5, 6] to evaluate the privacy-utility trade-off. We use the root mean square error (RMSE) metric to measure our results. Fig. 3: Average RMSE and accuracy (y-axis) VS privacy budget ǫ (x-axis) analysis for our GRR-M2 solution and the GRR-M1 naive one.

Comparing methodologies. We consider for evaluation the following approaches:

-Our GRR-M2 solution of using GRR in a multi-dimensional setting, which samples a unique attribute r and assigns the whole privacy budget ǫ to it; -A naive solution of using GRR in a multi-dimensional setting, which splits the privacy budget among d attribute, i.e., ǫ/d (GRR-M1 ).

Cumulative frequency estimates results

Fig. 3 illustrates the average RMSE values (y-axis) varying the privacy budget ǫ (x-axis) regarding all databases in set db for our GRR-M2 solution and the GRR-M1 naive one (left-side); and, the corresponding accuracy= 1 -RM SE, which is rather intuitive of how much privacy budget to use for achieving a given "accuracy" (right-side). In more detail, Fig. 4 illustrates for both methods the RMSE results (y-axis) according to the privacy budget ǫ for each day and union of days (x-axis), e.g., '321' refers to D 3 ∪ D 2 ∪ D 1 . Without loss of generality, we excluded ǫ = 0.5 in Fig. 4 to improve the visibility of the other curves. Finally, for the sake of illustration, Fig. 5 exhibits the frequency estimation results for a single day (D 7 ) and for the union of all days (D 7 ∪ D 6 ∪ ... ∪ D 1 ) using our GRR-M2 and ǫ = 1.

Discussion

As one can notice in the results, our LDP-based methodology can be well applied to the longitudinal collection and analysis of multi-dimensional data for human mobility modeling. It is worthy noticing that we selected the GRR mechanism because the set of possible values in a given attribute is kept at j. If one-hotencoding is used as in the Basic One-time RAPPOR mechanism [START_REF] Erlingsson | Rappor: Randomized aggregatable privacypreserving ordinal response[END_REF] or OUE [START_REF] Wang | Locally differentially private protocols for frequency estimation[END_REF], each bit can be either 0 or 1, which means that the set of possible reports for an attribute with j values has now 2 j possibilities. This is highly important to take Combination of days

GRR-M1 =1 =2 =3 =4 =5 =6
Fig. 4: RMSE (y-axis) analysis varying the privacy budget ǫ considering each combination of days (x-axis). Notice that these are discrete values. However, curves are drawn to ease interpretation.

into account, as, for a longitudinal collection of data as we proposed, one has to try to ensure that ǫ-LDP values are not indirect unique identifiers. Moreover, high-utility mobility indicators can be achieved by generalizing attributes to a well-defined set of values. That is, aiming to respect j < 3e ǫ + 2 or at least not being too far, as GRRs' utility, depends on [START_REF] Wang | Locally differentially private protocols for frequency estimation[END_REF].

Overall, our GRR-M2 consistently and considerably outperforms the baseline GRR-M1. In Fig. 4, except for ǫ = 1, our GRR-M2 curves are under even to the best one of GRR-M1 using the highest privacy budget ǫ = 6. As also highlighted in the literature [START_REF] Wang | Collecting and analyzing multidimensional data with local differential privacy[END_REF][START_REF] Nguyên | Collecting and analyzing data from smart device users with local differential privacy[END_REF][START_REF] Wang | Locally differentially private protocols for frequency estimation[END_REF], privacy budget splitting is sub-optimal, which leads to higher estimation error. Indeed, in a multi-dimensional setting, the combination of privacy budget splitting and high numbers of values j in a given attribute (e.g., Region with 22 values) leads to lower data utility even for high privacy regimes. On the other hand, our GRR-M2 solution based on random sampling uses the whole privacy budget to a single attribute, and this problem is, hence, minimized. However, there is also an error provided by the sampling technique, which is reduced by correctly choosing the number of attributes r < d as we did for GRR in Subsection 3.3.

More precisely, our GRR-M2 solution presents an 'accuracy' over 94% for any privacy budget tested. In Fig. 3, with ǫ = 1 that is considered a good privacyutility trade-off, while our GRR-M2 already approaches 98% of 'accuracy', the GRR-M1 can only get this close when ǫ ≥ 3 approximately. Additionally, in Figs. 4 and5, it is noteworthy that the RMSE decreases as the data size increases. This is due to the LDP setting, which requires a big amount of data to guarantee a good balance of noise (data-hungry). In our case, single days (e.g., D 7 ) have less data points comparing to the union of all days (e.g., D 7 ∪ D 6 ∪ ... ∪ D 1 ), and hence they are generally the peak-values in Fig. 4. However, these peak values are smoothed using our GRR-M2, which induce less error by sampling a single attribute for each user. Fig. 5: Comparison between real and estimated frequencies for a single day and to the union of all days using our GRR-M2 solution and ǫ = 1.

Finally, our proposed LDP-based methodology satisfies the three (i)-(iii) recommendations of data protection authorities, described in Subsection 1.1. For instance, the MNOs' secure-server applies an LDP mechanism to sanitize all data on the fly (i) while storing no users' ID (ii). Furthermore, ǫ-LDP private reports are not (indirect) unique IDs, i.e., they are generic values, which could have been generated by any user u 1 or u 2 and, thus, allowing a longitudinal collection of data (iii). Besides, each time users connect, they will always report the same r = 1 attribute out of d possible ones. That is, even though users appear all days in the analysis (in this dataset ∼ 0.2% of users), they will never report the remaining d -1 attributes, which were not directly sampled. And last, our solution also safeguards MNOs as the sanitized data server (cf. Fig. 1) will not collect raw or pseudonymized CDRs, for the purpose of human mobility analysis, but, rather, ǫ-LDP values that are robust to post-processing.

Conclusion

This work investigates the problem of longitudinally collecting and analyzing human mobility data through mobile connections. Following some major recommendations from data authorities such as the GDPR and CNIL (in France), we proposed an LDP-based privacy-preserving methodology for collecting data, on the fly, through mobile connections while providing high privacy guarantees for users. More precisely, such a privacy-preserving methodology would allow MNOs to use and/or share the sanitized data, as LDP is robust to post-processing, for publishing mobility indicators while protecting the privacy of their clients. To this end, we extended the analysis of a state-of-the-art LDP protocol named GRR [START_REF] Wang | Locally differentially private frequent itemset mining[END_REF][START_REF] Wang | Locally differentially private protocols for frequency estimation[END_REF][START_REF] Kairouz | Discrete distribution estimation under local privacy[END_REF] for multi-dimensional studies, referred to as GRR-M2 in this paper.

As shown in the results, the proposed LDP-based methodology using our GRR-M2 solution is capable of collecting and calculating accurate multidimensional frequency estimates (cf. Fig. 5, for example) for human mobility modeling. Indeed, in the mobility scenario we propose, the number of users per day and union of days is exactly the number of ǫ-LDP collected reports. For future work, we suggest and intend the following directions: to experimentally validate our proposed methodology using actual data from an MNO; to investigate inference attacks to check whether individuals who report dynamic attributes, such as location, are more endangered than others who report, e.g., gender; and, to design LDP mechanisms for this longitudinal and multi-dimensional task considering both numerical and categorical data.

Fig. 1 :

 1 Fig. 1: Overview of our system model with an LDP-based privacy-preserving solution to sanitize users' data on the fly.

1 :

 1 Input : tuple t = [v1, ..., v d ], set A = {A1, ..., A d }, and ǫ. 2: Output : tuple t * = r, GRR(vr) . 3: r ← U nif orm({1, 2, ..., d}) 4: B ← t[r] = vr 5: b ← Bern (e ǫ /(e ǫ + |Ar| -1)) 6: if b = 1: 7: B ′ = vr 8: else: 9: B ′ ← U nif orm({Ar/vr}) 10: return : t * = r, B ′

Setup:

  Let N b = 7 days to be the whole analysis period, we then have N b(N b + 1)/2 = 28 databases considering each day and union of days combination asset db = {D 1 , ..., D 3 ∪ D 2 ∪ D 1 , ..., D 7 ∪ D 6 ∪ ... ∪ D 1 }.Notice that, at the same time, we can empirically evaluate the privacy-utility trade-off according to data size, i.e., each day has around 26, 700 unique users, while the last union of days D 7 ∪ D 6 ∪ ... ∪ D 1 has all 87, 098 users.

https://github.com/hharcolezi/ldp-protocols-mobility-cdrs

⋆ This work was supported by the Region of Bourgogne Franche-Comté CADRAN Project and by the EIPHI-BFC Graduate School (contract "ANR-17-EURE-0002").

The authors would also like to thank the Orange Application for Business team for their useful feedback and comments. Computations have been performed on the supercomputer facilities of "Mésocentre de Calcul de Franche-Comté".


Dr Marie-Ingrid Richard
email: mrichard@esrf.fr

Dr Thomas W Cornelius

Florian Lauraux

Dr Jean-Baptiste Molin

Christoph Kirchlechner

Dr Steven J Leake

Dr Jérôme Carnis

Tobias U Schülli

Ludovic Thilly

Olivier Thomas

Prof Ludovic Thilly

Prof Olivier Thomas

Variable-wavelength quick scanning nano-focused X-ray microscopy for in situ strain and tilt mapping

Keywords: structural microscopy, strain, lattice tilt, in situ, energy-scanning

Compression of micro-pillars is followed in situ by a quick nano-focused X-ray scanning microscopy technique combined with three-dimensional reciprocal space mapping. Compared to other attempts using X-ray nanobeams, it avoids any motion or vibration that would lead to a destruction of the sample. The technique consists of scanning both the energy of the incident nano-focused X-ray beam and the in-plane translations of the focusing optics along the X-ray beam. Here, we demonstrate the approach by imaging the strain and lattice orientation of Si micro-pillars and their pedestals during in situ compression. Varying the energy of the incident beam instead of rocking the sample and mapping the focusing optics instead of moving the sample supplies a vibration-free measurement of the reciprocal space maps without removal of the mechanical load. The maps of strain and lattice orientation are in good agreement with the ones recorded by ordinary rocking-curve scans. Variable-wavelength quick scanning X-ray microscopy opens the route for in situ strain and tilt mapping towards more diverse and complex materials environments, especially where sample manipulation is difficult.

Introduction

Strain and lattice distortions often dictate both performance and properties of materials. [1] A wide range of techniques have been developed to map strain and they can be divided into imaging and diffraction techniques. For example, in transmission electron microscopy (TEM), atomic resolution can be achieved by imaging atomic columns, which directly determines the local elastic strain from the observed lattice distortions. [2,3] However, it is more common for diffraction techniques to be used to measure the local elastic strain, where the Bragg law directly links the position of diffraction peaks to the lattice constants and is exploited with many different probes; X-ray, [4] neutron, [5] and electron diffraction. [2] Complex strain distributions require that the local strain is measured with high spatial resolution across the entire field-of-view. However, most of the time, the local strain is difficult to measure under real working conditions, in particular, at the nanoscale. Nano-focused Bragg (coherent) X-ray diffraction methods (see for example, Refs. [6][7][8][9][10][START_REF] Etzelstorfer | Synchrotron Radiation[END_REF] ) are often used at synchrotron sources to address this challenge. These techniques allow one to image the strain fields at the nanoscale non-destructively and under complex sample environments thanks to the high penetration of X-rays in matter. Focal spot sizes of a few hundred nanometers are routinely obtained nowadays, rendering it possible to study individual nanostructures.

In order to fully record the induced structural changes during operation (such as at high temperatures, pressures, electric or magnetic fields etc), it is necessary to measure in situ the complete three-dimensional (3D) intensity distribution of a Bragg reflection coming from the nanostructure under investigation. 3D reciprocal space maps (3D-RSMs) are generally recorded by rocking the sample on the order of one degree or more. The typical sphere of confusion of state-of-the-art diffractometers is of the order of 10 micrometers over a complete rotation. This may lead to parasitic displacements caused by e.g. the eccentricity error of the rotation axis that can be much larger than both the beamsize and the nanostructures, thus complicating the measurement of 3D-RSMs. Moreover, the presence of complex sample environments may limit the sample movement or access in angular space and make it necessary to reduce or avoid any vibrations induced by sample rotation. As an example, during in situ compression tests using a micro-compression device or an atomic force microscope [START_REF] Ren | [END_REF]13] to study the mechanical properties of single micro-and nanostructures, any movement of diffractometer motors must be avoided to prevent damaging the tip and/or nanostructure during loading. Therefore, a method of recording 3D-RSMs at different sample positions and without moving the sample is highly desirable. Alternatively, the X-ray energy can be varied in a pre-determined range, which allows for mapping reciprocal space in three dimensions when using a two-dimensional (2D) detector. Recent studies have successfully measured 3D-RSMs from crystals in this manner for a given sample position. [14][15][16][17] Here, we use this method not for one sample position only but during 2D direct space mapping by scanning the focusing optics, hence translating the focused beam on the sample surface, while keeping the sample itself fixed. This approach of scanning the focusing optics is similar to the Kirkpatrick-Baez (KB) scanning method demonstrated for in situ Laue microdiffraction studies. [18] This variablewavelength quick scanning Bragg X-ray microscopy technique thus allows to record scattering images of extended objects without moving any diffractometer motor. We will demonstrate that chromatic optics, namely Fresnel zone plates, can be successfully used for this purpose. They eliminate the need to rotate or translate the sample. 3D-RSMs are recorded by scanning the wavelength of the incident X-ray beam (as opposed to scanning the sample angle) at different direct space positions (y and z) of the sample (x being along the beam direction). The (y, z) maps are obtained by scanning the focusing optics, while keeping the sample fixed. This five-dimensional data set (3 reciprocal space coordinates and two dimensions in direct space) is processed and analysed using the X-ray strain orientation calculation software (XSOCS) [8] that we modified to take into account the variation of the X-ray energy. The resulting reciprocal space coordinates of the diffraction peak as well as the strain (resolution of 10 -5 ) [19] and lattice tilt are compared with the same map obtained by the classical approach of rocking the Bragg angle and scanning the sample. This capability enables new strain imaging studies in environments where samples cannot move and the details of nanoscale strain distribution and evolution remain difficult to follow.

Experimental method

The experiment was performed at the upgraded ID01 beamline of the European Synchrotron Radiation Facility (ESRF). Monochromatic X-rays of an energy of 8 keV (wavelength  of 1.54975 Å) are selected by a double crystal Si(111) monochromator. 3D-RSMs were recorded both by rocking scans and by scanning the energy of the incident X-ray beam. While in the former case, the sample was rotated by ± 0.1° (corresponding to 0.116 nm -1 in reciprocal space), the X-ray energy was varied in the latter case by ∆E = ± 24 eV in steps of 6 eV corresponding to a variation of ∆Q = ± 0.098 nm -1 . To remain on the maximum of the undulator emission peak and, thus maintaining the incident intensity constant, the undulator gap was adjusted at every energy step.

The X-rays were focused by a Fresnel zone plate (FZP) having a diameter of 300 µm and an outermost zone width of 60 nm. Unfocused radiation transmitted by the FZP was eliminated using a 60 µm wide (80 µm thick) Au central stop placed in front of the FZP, while higher diffraction orders were eliminated by a 50-µm diameter Pt/Ir order sorting aperture (OSA) positioned 20 mm upstream of the sample (see Figure 1). The FZP is a chromatic focusing optics, i.e. its focal length f varies as a function of the X-ray energy:

f(E)  E. At 8 keV, the focal length of the FZP is 116 mm. A set of slits located in front of the FZP were closed down to an aperture of 200 µm (vertically) and 60 µm (horizontally) corresponding to the coherent part of the X-ray beam at the ID01 beamline. The focal profile of the beam was characterised using a 2D ptychography approach on a test pattern featuring a 30-µm diameter gold Siemens star placed close to the focal position of the FZP. The gold structure and the complex-valued wavefront were retrieved simultaneously using the ptychography reconstruction code of the PyNX package. [20] Figure 2(a) -(c) display cuts of the retrieved experimental complex illumination. This leads to a Gaussian beam waist with focal spot sizes of 80 nm (vertical) and 280 nm (horizontal) with respective Rayleigh ranges of 0.15 mm (vertical) and 1.59 mm (horizontal). The experimental and simulated 1D illumination profiles are displayed in Figure 2(d). Despite the asymmetry of the experimental profile, which is probably caused by the optical aberrations of the FZP, both curves lead to the same focal depth of  0.33 mm (full width at half maximum of the peak size). Note that the focal depth is increased when reducing the illuminated area of the FZP. [21] Thus, the energy of the incident X-ray beam can be changed within a wider range without deteriorating the focal spot on the structure under investigation. Considering the depth of focus and linear chromaticity of the FZP, one can thus tolerate an energy variation of about 0.2 % (+/-16 eV) without significant beamsize variation in the vertical and of 1.3 % (+/-104 eV) for constant horizontal beamsize.

Free-standing Si [110]-oriented micro-pillars were fabricated on top of a Si wedge by focused ion beam (FIB) milling (inset of Figure 1). This geometry favours X-ray transmission thus facilitating the alignment of the nanostructure with respect to the nano-focused X-ray beam for in situ nano-focused quick X-ray microscopy. During the milling process, the ion beam current and acceleration voltage were successively reduced to limit eventual creation of lattice defects and/or surface amorphisation. During the last fabrication step when defining the pillar, ion beam currents of 24 pA as well as an ion energy of 30 keV were employed.

The sample was mounted on the load-cell of a custom-built micro-compression device, [22,23] which was installed on the hexapod (resolution of 100 nm) of the high precision diffractometer. A photograph of the experimental setup is shown in Figure 1. A flat diamond tip (d = 10 m) was used for in situ compression tests. An optical microscope was used to observe the sample and the tip from above, therefore allowing for accurate sample positioning at the center of rotation of the goniometer. The FZP was mounted on a piezoelectric stage (from Physik Instrumente) with a stroke of 100 m along x, y and z and an encoder resolution of 2 nm. This mounting facilitates laterally scanning the focusing optics (along the y and zdirections) and, hence the beam focus across an immobile sample, thus allowing for quick mapping without damaging the tip and/or the nanostructure under investigation.

The [110]-oriented Si pillars were mounted so that their axis was along the y-direction (see Figure 3). The (220) vertical planes were probed in a horizontal scattering geometry to get access to the axial strain of the Si pillars during their mechanical loading and unloading. The X-ray intensity around the 220 Si Bragg reflection of Bragg angle, B = 23.8°, was recorded using a 2D MAXIPIX [24] fast read-out photon counting (frame rates of up to 100 Hz full frame) detector of 516516 pixels and 55 m pixel size, mounted at a distance of 1.4 m from the sample. The acquisition is performed continuously or "on the fly", i.e. with a very low detector deadtime (290 s) and zero settling time for the motors.

Results and discussion

Figures 3(a-b) display two-dimensional direct space maps of the logarithmic integrated intensity measured at the 220 Si Bragg reflection for different surface areas (from large to small scale) centered around a Si micro-pillar (square section of 0.81 x 0.81 µm 2 and height of 2.26 m) at the top of a large cubic pedestal (10  10  10 m 3 ) on the top of a Si wedge. Note that the maps were recorded by scanning the focusing optics in the y-z plane, whilst the sample remained stationary. The pillar appears smaller in height as it has been rotated in the plane (along the out-of-plane axis, ) to be in Bragg condition. The scattered signal from the Si pedestal (see Figure 3(b)) shows heterogeneities indicating variations of strain and/or tilt of lattice planes.

The strain and lattice orientation of a pristine pillar (section of 0.92 µm x 0.92 µm and height of 2.82 m -similar to the one shown in Figure 3) and of its pedestal were measured using the conventional quick scanning technique by finely scanning the Bragg angle () at the energy of 8 keV (see Figures 4 and5).

A sample area of 5 m  5 m was mapped taking diffraction with the 2D detector every 100 nm for different in-plane incident angles (27.54° ≤  < 27.74°) with steps of 0.01°. The angular resolution depends on the diffractometer (typically 0.0005° at the ID01 beamline of ESRF) and the convergence of the incident beam. The latter was 0.01° in the diffraction plane in this experiment. This resulted in the collection of 20 (y, z) maps (for 20 incidence angles). The lateral spatial resolution (here, along y and z) is given by the beam size. The resolution in the orthogonal direction (here, x) depends on the beam penetration depth (i.e., energy and incident/exit angles of the X-ray beam and the studied material). The obtained detector frames at each spatial (y, z) position were then reconstructed into three-dimensional (3D) reciprocal space maps by converting the detector pixels and the angular coordinates into the reciprocal space coordinates, Qx, Qy and Qz. Figure 4 displays the reciprocal space coordinates of the scattering vector, Qx (a), Qy (b) and Qz (c). Figure 5 displays the maximum measured intensity (a) and the strain along the [220] direction, 220 (b). 220 is related to the variation of the d220 spacing of the atomic planes, and was retrieved for each position in direct space: 220 = (d220,meas -d220,ref)/d220,ref, where d220,ref is the reference d spacing of bulk Si. Interestingly, the top of the Si pillar exhibits compressive strain (220 < 0) of the vertical (220) planes. On the contrary, one topside of the Si pedestal shows tensile strain (220 > 0). Assuming that the mosaic spread was homogeneously distributed in all directions, the lattice tilt of the (220) Si planes was calculated from the peak position as  = arccos(Qy/Q220) (see Figure 5(f)) revealing a tilt of up to 0.07° at the base of the Si pillar while in the interior of the pedestal no tilt was observed.

Both the strain and the tilt of the (220) Si lattice planes in the Si pillar probably originate from the FIBmilling process.

The same sample area of 5 x 5 µm 2 was then mapped with the same spatial resolution as before but using the variable-wavelength quick scanning technique. The energy of the incident X-ray beam was varied in steps of 6 eV and the undulator gap was adjusted accordingly while keeping the rocking angle  fixed for each fast (y, z) map. This resulted in the collection of 9 (y, z) maps (for 9 energies from 7.976 keV to 8.024 keV). Figures 4 and5 display the results obtained using the variable-wavelength quick scanning technique. They are in excellent qualitative and quantitative (the same scale bars are used for the strain and tilt in Figure 5) agreements with the ones obtained using the conventional quick scanning technique.

The difference between the strain and tilt maps obtained by conventional and variable-wavelength quick scanning techniques can be estimated using the mean square error: 𝜀 𝑟 = ∑ (𝐼 𝑖,𝑗 1 -𝐼 𝑖,𝑗 2 ) 2 𝑖,𝑗 /𝑁, where 𝐼 𝑖,𝑗 1,2 are the different pixels of image 1 or 2, which corresponds to the strain or tilt map obtained using the two techniques and 𝑁 is the total number of pixels, respectively. The mean square errors for the strain and tilt maps between the two techniques are 𝜀 𝑟 = 1.4×10 -7 and 𝜀 𝑟 = 3.8×10 -5 °. These values can be compared with the averaged values of the strain and tilt: -4.1×10 -5 and 2.94×10 -2 °, respectively. This validates the variable-wavelength quick scanning X-ray microscopy approach.

The strain and tilt-sensitive imaging capability of this new quick scanning technique, which does not require any sample motion, was then employed during in situ mechanical loading, where the traditional rocking approach must not be used due to vibrations induced by moving diffractometer motors. Figures 6 (a,b) display the strain and lattice orientation fields of another Si pillar (shown in Figure 3 and different from Figure 5). Interestingly, its strain and lattice tilt are different from the ones shown for the pillar displayed in Figure 5. Different residual strain and lattice tilt are obtained from the FIB milling process from one pillar to the other. Figures 6 (c,d) display the strain and lattice orientation fields when the indenter is in contact with the Si pillar. Note that the same colorscale is used at the initial state (see Figures 6 (a,b)) and during contact (see Figures 6 (c,d)) for the strain and tilt, respectively. Small changes of the strain and tilt inside the Si pillar are observed when the tip is in contact with it. Figures 6(e-f) display the differences of strain and tilt between the contact and the initial state. It appears that the (200) planes at the top of the pillar are slightly compressed (∆220<0) and tilted when the tip is in contact. When the tip is in contact, only the variable-wavelength quick scanning X-ray microscopy approach can be used whereas the traditional rocking approach risks to breaking the pillar or the tip. Figure 7 displays the strain and lattice orientation fields of the Si pillar and the pedestal (shown in Figures 3 and6) before (a-b) and during loading (c-d), where a force of 0.9 mN was applied corresponding to a stress of 1.37 GPa. A compressive strain of -0.81% was expected considering the Si Young's modulus of 169 GPa along [110]. Because of elastic bending of the Si micro-pillar, this maximum strain value was outside of the scanned reciprocal space range (covering ∆Q = ± 0.123 nm -1 ); the Si pillar is thus not observed during loading. The in-situ variable-wavelength quick scanning map however evidences an inhomogeneous strain field in the Si pedestal with large compressive strain of up to -0.1 % just below the Si micro-pillar. This inhomogeneous compressive strain field results from the fact that the pillar is pushed into the Si pedestal, thus indenting it. Besides the strain, the maps show strong tilting of the Si (220) lattice planes in the pedestal ranging from -0.04 to +0.06° (compared to 0.02° in the pristine state). While negative lattice tilt values are revealed just below the Si nanopillar, this is compensated by a rotation of the lattice planes into the opposite direction about 2 µm below the top surface of the pedestal. Moreover, the rotation of the (220) planes spreads few micrometers away from the indented Si pillar.

Hence, as demonstrated in the present work, this new approach based on variable energy and on scanning the focal spot provides access both to the rotation of the crystalline lattice and to the strain field inside micro-and nanostructures under mechanical load offering new opportunities to study the mechanical behavior at small scales in situ. It calls for the development of precision mechanics for optics positioning in order to be able to move with high reproducibility the optics in three dimensions in order to adapt the focal distance to the X-ray energy and hence to overcome the limiting parameter of a narrow depth of field. By adapting the focal distance, monochromator and undulator gap, it is possible to enlarge the scanning energy range. With the improvement of compact and lightweight nano-optics with short focal lengths, this is likely to play an even more important role in the future. The very light weight of such optics however will likely make a precise positioning and scanning of these devices a standard option on nano-focused X-ray beamlines. Besides chromatic also achromatic focusing optics such as Kirkpatrick-Baez mirrors may be used. The installation of a hexapod underneath each mirror allows for translating them laterally and vertically and thus enables a two-dimensional displacement of the focused X-ray beam and, thus, the two-dimensional cartography of the sample. This kind of KB-scanning method has recently been demonstrated for Laue microdiffraction [18].

In comparison, among all the techniques to measure strain (for instance, spatially resolved Raman spectroscopy, [25,26] digital image correlation (DIC), [27] …), high-resolution electron backscatter diffraction (HR-EBSD) offers a strain and angular resolution of 10 -4 and 0.006°, respectively, for ex situ experiment. [28,29] But the sample must be compatible with the general requirements of electron microscopy. Interestingly, in situ TEM deformation and characterization have been successfully carried out. [30,31] In situ TEM is characterized by an excellent spatial resolution of 1 nm compared with 100 nm (beam size) for X-ray microscopy. However, the strain resolution (10 -3 [32] ) as well as the field of view (150 x 150 nm 2 for high-resolution (HR)-TEM [33] ) are several order of magnitude smaller than for X-ray microscopy (10 -5 [19] and 200 x 200 µm 2 ). Note that the strain resolution is 2.5x10 -4 in this work as we acquired (y, z) maps using a 2D detector each 6 eV step. The strain resolution can be improved by reducing the energy step size but at the expense of a longer measurement time. Furthermore, the TEM specimen preparation technique is often destructive so that the studied sample will not be in the same strain-state as the original "bulk" material. For HRTEM, lenses are not perfect, even in the age of aberration correction. There are therefore slight shifts between the image of the atomic lattice and its actual position. [34] Indeed, the position of neighboring atomic columns can even influence the apparent position of the atomic column of interest.

Conclusion

In summary, we introduced an in situ combination of mechanical loading and quick scanning nanofocused X-ray microscopy based on variable-wavelength three-dimensional reciprocal space mapping. This approach gave access to the tilt and strain distribution of Si micro-pillars during mechanical compression. The good agreement between results using rocking-curve-based and variable-wavelength quick scanning X-ray microscopy methods demonstrates that the latter preserves the strain and tiltsensitive imaging capabilities of the first one without the need for sample motion. The technique can also be used to evaluate the composition and thickness fluctuations of thin structures. [22,23] Despite the chromaticity of Fresnel zone plates, the energy of the incident X-ray beam can be scanned by several tens of electron-volt without deteriorating the focal spot on the sample. To increase the scannable energy range, i.e. to achieve a larger reciprocal space range, during variable-wavelength quick scanning X-ray microscopy, the position of the Fresnel zone plate along the beam can be adjusted matching the energydependent focal distance. This experimental technique paves the way to novel combinations of in situ strain measurements of poly-and single-crystalline structures in heavy and complex environments. The detector can be positioned very close to the sample to catch most of the reflections of the grains. The energy-tuning approach circumvents both the comparatively large sphere of confusion of diffractometers compared with nanostructures and vibrations induced by motors. As the technique provides microscopy images with 3D reciprocal space information with a spatial resolution given by the nanobeam size, it will definitely benefit from the development of novel lenses. Recently, a record resolution leading to a X-ray spot size of 8.4 nanometers by 6.8 nanometers has been achieved. [36] The quick scanning technique will also benefit from the increase of the brilliance of X-rays from the multiple upgrade projects currently being carried out or planned at several third-generation synchrotron sources.

Table of contents:

Variable-wavelength quick scanning X-ray microscopy is demonstrated to be a new in situ tool that provides access both to the rotation of the crystalline lattice and to the strain field inside micro-and nanostructures under mechanical load. It offers news opportunities to study the mechanical behavior at small scales in situ as well as in heavy and complex environments.

Keyword: structural microscopy, strain, lattice tilt, in situ, energy-scanning Marie-Ingrid Richard †, ‡, *, Thomas W. Cornelius † , Florian Lauraux † , Jean-Baptiste Molin § , Christoph Kirchlechner § , Steven J. Leake ‡ , Jérôme Carnis †, ‡ , Tobias U. Schülli ‡ , Ludovic Thilly ⊥ , Olivier Thomas †

Figure 1 .

 1 Figure 1. Experimental set-up showing (i) the load-cell with the sample and the diamond tip, (ii) the

Figure 2 .

 2 Figure 2. Experimental complex illumination in the direction of propagation, x and along y (a) and z (b).

1 (

 1 black curve) and simulated (red curve) illumination profile in the direction of propagation. The green curve corresponds to a gaussian fit of the simulated curve.

Figure 3 .

 3 Figure 3. Two-dimensional direct space maps of the logarithmic integrated intensity measured

Figure 4 .

 4 Figure 4. Reciprocal space coordinates of the scattering vector Qx (a, d), Qy (b, e) and Qz (c, f).

Figure 6 .

 6 Figure 6. Maps of the (a-c) strain (in %) along the [220] direction and of the (b-d) tilt of the

Figure 7 .

 7 Figure 7. Maps of the (a-c) strain (in %) along the [220] direction and of the (b-d) tilt of the

Acknowledgements

The authors gratefully acknowledge the financial support from the French National Research Agency through the project ANR12-BS04-0003 BiDuL and from the German Science Foundation through the project 316662945. This work partially pertains to the French Government program "Investissements d'Avenir" (LABEX INTERACTIFS, reference ANR-11-LABX-0017-01) and has been partially supported by "Nouvelle Aquitaine" Region and by European Structural and Investment Funds (ERDF reference: P-2016-BAFE-94/95). We acknowledge the European Synchrotron Facility for beamtime allocation and we would like to thank for assistance in using beamline ID01. We thank Guillaume Amiard for the help during FIB sessions and Vincent Favre-Nicolin (ESRF) for fruitful discussions.

Received: ((will be filled in by the editorial staff))

Revised: ((will be filled in by the editorial staff)) Published online: ((will be filled in by the editorial staff))

Supporting Information

Supporting Information is available from the Wiley Online Library or from the author.