Antoine Boutet
email: antoine.boutet@liris.cnrs.fr

Sonia Ben Mokhtar
email: sonia.benmokhtar@liris.cnrs.fr

Vincent Primault
email: vincent.primault@liris.cnrs.fr

Uniqueness Assessment of Human Mobility on Multi-Sensor Datasets

The widespread adoption of handheld devices (e.g., smartphones, tablets) makes mobility traces of users broadly available to third party services. These traces are collected by means of various sensors embedded in the users' devices, including GPS, WiFi and GSM. We study in this paper the mobility of 300 users over a period up to 31 months from the perspective of the above three types of data and with a focus on two cities, i.e., Lausanne (Switzerland) and Lyon (France). We found that users' mobility traces, no matter if they are collected using GPS, WiFi or GSM antennas, are highly unique. We show that on average only four spatio-temporal points from the WiFi, GSM and GPS traces are enough to uniquely identify 94% of the individuals, on both datasets. In addition, we show that using the temporal dimension (i.e., whether users move or are in a meaningful location such as their home or their working place) drastically improves the capacity to uniquely identify them compared to when only exploiting the spatial dimension (by 14% on average). In some cases, using the temporal dimension alone can represent a better mobility footprint than the spatial dimension to discriminate users. We further conduct a de-anonymisation attack to assess how mobility traces can be re-identified, and show that almost all users can be de-anonymised with a high success rate. Finally, we apply different location privacy protection mechanisms (LPPMs), including spatial filtering, temporal cloaking, adding spatial noise to mobility data, or using generalisation, and analyse the impact of these mechanisms on both the uniqueness of users' mobility traces and the outcome of the de-anonymisation attack. We show that spatially obfuscating mobility data is not enough to protect users, and that classical LPPMs are not able to protect users against a de-anonymisation attack. We finally conclude this paper by drawing some insights towards future spatio-temporal LPPMs.

Introduction

The large adoption of mobile devices with embedded geolocation capabilities makes it possible to track the movements of a large number of individuals during their daily life. These mobility traces have a huge commercial value [START_REF] Henttu | Geospatial Services: A $1.6 Trillion Growth Engine for the U.S. Economy[END_REF] and consequently raise increasing interest from the one hand and open the door to increasing threats on the other hand. These traces can be collected using various sensors embedded in users' handheld devices. While the Global Positioning System (GPS) is largely exploited to identify the location of users due to its high precision, the WiFi and the GSM can also be leveraged to track individuals' mobility [START_REF] Gramaglia | Hiding Mobile Traffic Fingerprints with GLOVE[END_REF]. Indeed, MAC addresses of WiFi access points or identifiers of GSM antennas users are associated to can be easily mapped to GPS coordinates using public repositories (e.g., WiGLE1 or Google2 ).

Following the seminal work by De Montjoye and al. [START_REF] De Montjoye | Unique in the crowd: The privacy bounds of human mobility[END_REF] that analysed user mobility traces inferred from call logs, we present in this paper a similar study performed on user mobility traces coming from three other types of data, namely GPS, WiFi and GSM traces. Specifically, we used two datasets comprising 200 and 100 users spanning over 31 and 15 months, respectively. Our results show that on average only four random spatial and spatio-temporal points from the WiFi, the GSM and the GPS data collections are enough to uniquely identify 94% of the individuals with the two datasets. Moreover, we show that considering temporal-only mobility traces (i.e, whether users are moving or inside meaningful locations such as their home or work place) can represent a mobility footprint able to highly discriminate between individuals (i.e., uniquely identify up to 84% of the individuals). In addition, we show that the temporal information improves the capacity to uniquely identify individuals by 14% on average compared to only considering spatial information. Furthermore, by analysing the degree of uniqueness of individual users, we show that the latter is heterogeneous (i.e., some users have more discriminative mobility patterns than others). We also compared the uniqueness given by two different models and we show that the probabilistic uniqueness assessment proposed by De Montjoye and al. [START_REF] De Montjoye | Unique in the crowd: The privacy bounds of human mobility[END_REF] gives an upper bound of the uniqueness compared to the deterministic assessment proposed by Zang and Bolot [START_REF] Zang | Anonymization of location data does not work: A large-scale measurement study[END_REF]. Finally, we analyse the impact of applying classical location privacy protection mechanisms (LPPMs), namely spatial filtering, temporal cloaking, spatial noise addition providing -differential privacy properties, and generalization ensuring k-anonymity, on the uniqueness of mobility traces. We show that obfuscating only the spatial dimension of mobility data is not enough to reduce the uniqueness of users.

Measuring the uniqueness does not mean reidentification of users.

Indeed, pseudo-anonymised mobility traces themselves do not disclose the identity of a user. However, using external knowledge can lead to infer the identity of users [START_REF] Mayer | Evaluating the privacy properties of telephone metadata[END_REF][START_REF] Cecaj | Reidentification of anonymized cdr datasets using social network data[END_REF][START_REF]Robust de-anonymization of large sparse datasets[END_REF]. Instead of analysing the re-identification of users which requires external knowledge, we analysis here how users can be de-anonymised from their mobility traces. To achieve that, we also conduct a de-anonymisation attack [START_REF] Gambs | De-anonymization attack on geolocated data[END_REF] trying to associate each individual inside a training set of mobility traces to its anonymous counterpart inside a testing set. We show using our datasets that geolocated data can be almost fully de-anonymised. Furthermore, we show that applying LPPMs based on noise or generalization on mobility traces fail to protect users against this de-anonymisation attack.

In this paper, we seek to answering several questions such as: is the uniqueness of mobility traces from GSM, GPS, and WiFi similar to the one observed on previous studies? ; are the temporal and the spatial dimensions similarly discriminating? ; does the uniquess vary from one user to another? ; do all uniqueness assessment models provide similar results? ; what is the impact of LPPMs on the uniqueness of individuals? ; do LPPMs efficiently protect users against a de-anonymisation attack? We hope that the observations we make while answering these questions can lead to the development of more effective LPPMs in the future. To summarise, the takeaways of this study are:

• User mobility traces extracted from GPS, WiFi and GSM data are highly unique, which generalises the results of the study performed in [START_REF] De Montjoye | Unique in the crowd: The privacy bounds of human mobility[END_REF] on call logs.

• Temporal data is as discriminative as spatial data in human mobility traces, which shall be considered in the development of future LPPMs.

• The uniqueness degree of mobility traces is user dependent while most existing LPPMs are statically configured for all users. Consequently personalisation shall thus be introduced in future LPPMs.

• Applying mechanisms to reduce the uniqueness of mobility traces drastically impacts the utility of the data, which comforts previous study [START_REF] Zang | Anonymization of location data does not work: A large-scale measurement study[END_REF][START_REF] Gramaglia | Hiding Mobile Traffic Fingerprints with GLOVE[END_REF].

• Probabilistic uniqueness assessment based on the methodology proposed De Montjoye and al. [START_REF] De Montjoye | Unique in the crowd: The privacy bounds of human mobility[END_REF] gives an upper bound of the uniqueness compared to a deterministic approach proposed by Zang and Bolot [START_REF] Zang | Anonymization of location data does not work: A large-scale measurement study[END_REF].

• Depending on the nature of the LPPMs, obfuscating the data collection, the results in term of uniqueness can be very different.

• Applying a de-anonymisation attack leads to reidentify users with a high success rate, even if the raw data is obfuscated by classical LPPMs.

The remaining of this paper is organised as follow. Section 2 presents background and related works. Section 3 and 4 then describe the methodology and the evaluation, respectively. Finally, Section 5 discusses and concludes this paper.

Background

The idea of finding criteria for uniquely identifying users is not new. In criminal investigations, finding seven points of minutiae in a fingerprint is commonly used to uniquely identify an individual and provide matching evidence. In computer science, the research community has investigated various types of user traces that may act as digital fingerprints such as the personalised configurations of mobile devices [START_REF] Andreas | Fingerprinting mobile devices using personalized configurations[END_REF] or Web browsers [START_REF] Eckersley | How unique is your web browser?[END_REF], the logs of in-car sensors [START_REF] Enev | Automobile driver fingerprinting[END_REF], or the writing style of users on the Web [START_REF] Rebekah | Blogs, twitter feeds, and reddit comments: Cross-domain authorship attribution[END_REF]. Recently, the uniqueness of human mobility traces has been extensively analysed by De Montjoye and al. [START_REF] De Montjoye | Unique in the crowd: The privacy bounds of human mobility[END_REF]. In this paper, the authors analysed mobility traces coming from the call logs of 1.5M users at the scale of a country. Their results show that only four random spatiotemporal points were enough to uniquely identify 95% of the individuals of the dataset. In this paper we run a complementary study by using mobility traces coming from three different data sources, i.e., GPS, WiFi and GSM logs.

Zang and Bolot [START_REF] Zang | Anonymization of location data does not work: A large-scale measurement study[END_REF], also show that mobility patterns of users often make them unique within a large population but with another model to assess the uniqueness. Instead of using a set of random mobility patterns for each user to quantify the uniqueness (i.e. probabilistic approach followed by De Montjoye and al. [START_REF] De Montjoye | Unique in the crowd: The privacy bounds of human mobility[END_REF]), these authors used a deterministic approach which evaluates the uniqueness of the mobility pattern composed of the most frequently visited locations by the associated user. In this paper, we compared both models and show that the probabilistic one gives an upper bound of the uniqueness compared to the deterministic one.

Finally, previous studies [START_REF] Zang | Anonymization of location data does not work: A large-scale measurement study[END_REF][START_REF] De Montjoye | Unique in the crowd: The privacy bounds of human mobility[END_REF][START_REF] Gramaglia | On the anonymizability of mobile traffic datasets[END_REF][START_REF] Gramaglia | Hiding Mobile Traffic Fingerprints with GLOVE[END_REF] show that reducing the uniqueness requires severe reductions of the spatiotemporal granularity which limits the usability of the data. In this paper, we confirm this observation with data from other sensors.

Uniqueness does not mean re-identification, since pseudonymity is used to avoid revealing the real identity of users (i.e., only mobility traces of users do not disclose their identity). However pseudonymity alone is not enough to guarantee anonymity [START_REF] Bettini | Protecting privacy against location-based personal identification[END_REF]. Furthermore, inferring user identity may become possible by leveraging external knowledge. Using crowdsourcing or a crossdatabase methodology, recent works have demonstrated the re-identification risks from smartphone metadata [START_REF] Mayer | Evaluating the privacy properties of telephone metadata[END_REF], social network data [START_REF] Cecaj | Reidentification of anonymized cdr datasets using social network data[END_REF], or movie databases [START_REF]Robust de-anonymization of large sparse datasets[END_REF]. To address the challenge of location privacy, many LPPMs have been recently proposed in the literature [START_REF] Acs | A Case Study: Privacy Preserving Release of Spatio-temporal Density in Paris[END_REF][START_REF] Andrés | Geo-indistinguishability: Differential Privacy for Location-based Systems[END_REF][START_REF] Primault | Time Distortion Anonymization for the Publication of Mobility Data with High Utility[END_REF][START_REF] Fawaz | Location privacy protection for smartphone users[END_REF]. These LPPMs apply different schemes to obfuscate the location information of users. The two most adopted privacy guarantees provided by LPPMs are kanonymity [START_REF] Sweeney | k-Anonymity: A model for protecting privacy[END_REF] and -differential privacy [START_REF] Dwork | Differential Privacy: A Survey of Results[END_REF]. While the former hides each user within a cloaking area containing at least k -1 other users, the latter disturbs mobility traces in such a way that it theoretically bounds the impact of the presence or absence of a single element of the dataset. For instance, [START_REF] Mokbel | The New Casper: Query Processing for Location Services Without Compromising Privacy[END_REF] describes a protection mechanism providing k-anonymity by relying on a centralised anonymisation proxy. In this protocol, the proxy receives all queries from the user, generates a cloaking area for each of them before sending the obfuscated query to a location-based service (LBS). Then the proxy extracts a more precise answer from the response coming from the LBS, before returning the results to the user. In [START_REF] Ghinita | PRIVE: Anonymous Location-based Queries in Distributed Mobile Systems[END_REF], the authors removed the dependency to a trusted proxy by presenting a fully distributed protection mechanism dynamically building cloaking areas of at least k users during their mobility. To ensure k-anonymity, many approaches have been proposed to build cloaking areas including generalization and suppression [START_REF]Achieving k-anonymity privacy protection using generalization and suppression[END_REF], condensation [START_REF] Aggarwal | A Condensation Approach to Privacy Preserving Data Mining[END_REF] or space translation [START_REF] Abul | Never walk alone: Uncertainty for anonymity in moving objects databases[END_REF]. For instance, Wait 4 Me [START_REF] Abul | Never walk alone: Uncertainty for anonymity in moving objects databases[END_REF] (W4M for short) ensures k-anonymity by transforming the GPS coordinates of a moving object to a cylindrical volume representing the trajectory of this object, where the radius δ of the cylinder represents the possible location imprecision (i.e., we do not know exactly where the object is located within the cylinder). In this context, k-anonymity is guaranteed if k objects move within the same cylinder. Geo-Indistinguishability (GEO-I) [START_REF] Andrés | Geo-indistinguishability: Differential Privacy for Location-based Systems[END_REF] was proposed as a generalisation of differential privacy applied to mobility data. The guarantee can be enforced by adding calibrated noise drawn from a two-dimensional Laplace distribution. GEO-I has been successfully applied in an online context when a user is querying an LBS in real-time, and in an offline context when an entire dataset gathering the mobility traces of a set of users has to be protected before to be released. The practical impact of GEO-I has been studied in [START_REF] Primault | Adaptive Location Privacy with ALP[END_REF]. Authors analyse the effect of this LPPM on various location privacy attacks. They show that by adapting the algorithms to the underlying LPPM, it is possible to decrease or counteract most of its effects.

While several LPPMs have been proposed in the literature, their impact on the uniqueness of mobility traces have not been evaluated. In addition, a better understanding of the characteristics of mobility fingerprints can lead to improve LPPMs. For instance, most of the above LPPMs focus on obfuscating the spatial dimension while neglecting the temporal one [START_REF] Andrés | Geo-indistinguishability: Differential Privacy for Location-based Systems[END_REF]. Furthermore, most of them are static and do not evolve according to the considered user. In this paper, we highlight these limitations in numbers.

To infer the identity of a particular individual behind a set of mobility traces, Gambs and all [START_REF] Gambs | De-anonymization attack on geolocated data[END_REF] proposed a deanonymisation attack. This attack is based on two phases, the first one is used to build a Mobility Markov Chain model on a training set which is used in the second one to re-identify users in a testing set. Freudiger and all [START_REF] Freudiger | Evaluating the privacy risk of location-based services[END_REF] also try to re-identify users of geolocated datasets. In this study, the pair of POIs home/work is inferred and used as pseudo-identifier to de-anonymise users. As far as we know, no previous works analyse the impact of GEO-I and W4M on de-anonymisation attack. In this paper, we implement such an attack and analyse the impact of classical LPPMs on its outcome.

Methodology

This section starts with the presentation of the considered datasets and the methodology to extract mobility traces from these data collections. We then describe how the uniqueness is quantified. Finally we present the considered de-anonymisation attack and the LPPMs used to protect the data.

Datasets

This work was performed using the PRIVAMOV and the Mobile Data Challenge (MDC) mobile phone datasets.

Both datasets contain data about users during their daily life, captured through different modalities (i.e., communication, location, motion, application usage, etc.). Table 1 displays information on these datasets and the mobilitybased data collections considered in this work. More precisely, the considered data collections gather information from the GSM, the WiFi, and the GPS sensors. The PRIVAMOV dataset involves 100 students and staff from various campuses in the city of Lyon [START_REF]Priva'mov project[END_REF] equipped with smartphones running a data collection software. The data collection took place from October 2014 to January 2016. The MDC dataset involves around 200 volunteers [START_REF] Laurila | From big smartphone data to worldwide research: The mobile data challenge[END_REF][START_REF] Kiukkonen | Towards rich mobile phone datasets: Lau-sanne data collection campaign[END_REF]. The data collection took place from October 2009 to March 2011 in the Lake Geneva region, Switzerland.

No filtering scheme was applied on the raw data contained in the PRIVAMOV dataset. However, a privacy protection scheme based on k-anonymity has been performed on the raw data before releasing the MDC dataset. This concerns all the location data including the information from the GPS, the WiFi, and the GSM sensors. Unfortunately, as described in [START_REF] Laurila | From big smartphone data to worldwide research: The mobile data challenge[END_REF], this privacy preserving operation includes many manual operations which are difficult to fully understand and reproduce. Yet, as shown later in Section 3.2, the impact of these manipulations are noticeable through different data distributions.

Mobility trace extraction

From the GSM, WiFi and GPS data collections, we extracted and built mobility traces. Each mobility trace is a list of spatio-temporal points belonging to a given user. The temporal component is the time of an interaction (the Table 2: Human mobility traces are built using GSM antennas and WiFi access points users encounter, and extracted POI for the whole datasets and a restricted subarea.

temporal resolution is by default of one hour) and the spatial component depends on the data collection. For instance, for mobility traces coming from the GSM data collection (noted T gsm ), the spatial component of each point corresponds to the identifier of the GSM antenna to which the user is connected. Further, for mobility traces coming from the WiFi data collection (noted T wif i ) the spatial component corresponds to the MAC address of the WiFi access point. Finally, for mobility traces coming from the GPS data collection (noted T gps ), we extracted Points of Interest (POIs) from each trace, assigned an identifier to each unique POI inside the whole dataset and used this identifier as the spatial component. This means that for GPS traces, we only have points if the user is inside a POI.

To compute points of interest, we used a methodology similar to [START_REF] Zheng | Learning transportation mode from raw gps data for geographic applications on the web[END_REF]. The idea behind this method is to identify restricted areas where users stay more than a specific duration. More precisely, POIs can be extracted using a simple spatio-temporal clustering algorithm parametrised with a maximum POI diameter d and a minimum stay time t. This POIs extraction is done in two clustering steps, the first one identifies POIs for each user and the second one assigns identifiers to unique POIs, thus allowing to identify POIs shared by several users. In this paper, by default, we use a diameter of 250 meters (d = 250) and a stay time of 30 minutes (t = 30). For instance, Figure 1 Mobility traces do not contain duplicate entries at a given time resolution. For instance, if a user stays at the same location during one hour, even if the data collection software collects multiple records stating that its smartphone is associated to the same WiFi access point during this time slot, only one entry will be present in her mobility traces T wif i at this given time. Conversely, if a user moves and gets connected to different WiFi networks, the resulting mobility trace T wif i will contain several entries (i.e., one per WiFi access point associated to her smartphone). As a consequence, the number of points at a given hour reflects if the user is static (i.e., one point) or mobile (i.e., multiple points).

To evaluate separately the impact of the spatial and the temporal information, we also build spatial only and temporal only mobility traces. The spatial mobility traces for one user contains only the set of GSM antenna identifiers, WiFi access point's MAC addresses, or POI identifiers for traces from the GSM, WiFi and GPS data collections, respectively. The temporal mobility traces, in turn, are built to reflect when a user is moving or static. To achieve that, the temporal mobility trace of a user contains a set of times (i.e., hours) where this user has met at least 3 WiFi access points or 3 GSM antennas for WiFi and GSM data collections, respectively. For POI-based temporal mobility traces, the set contains the times when a user is inside a POI.

Lastly, we also built mobility traces gathering only spatio-temporal points contained in a restricted sub-area. We consider the Lyon area for the PRIVAMOV dataset and Lausanne area for the MDC dataset excluding suburbs in both cases. Table 2 shows the number of unique GSM antennas, WiFi access points and POIs found inside each dataset, while Figure 2 depicts the methodology to build the mobility traces from the raw data collections.

To deeper analyse the resulting mobility traces, Figure 3 shows various Complementary Cumulative Distribution Function (CCDF, defined as P (X > x)) for both datasets. Figures 3a-3c-3e-3g show the number of unique GSM antennas, WiFi access points and POIs per user. Figures 3b-3d-3f-3h depict the number of unique users identified per GSM antenna, WiFi access point and POI. These tail distributions show that most of GSM antennas, WiFi access points and POIs have been visited only by one user. For instance, 75% of the PRIVAMOV WiFi access points have been seen by only one user. Conversely, mobility traces of most of the users are composed of several GSM antennas, WiFi access points and POIs. Interestingly, fewer MDC users have a small number of POIs, GSM antennas and WiFi access points than PRIVAMOV users. This difference is certainly due to the privacy protection scheme applied on the MDC dataset compared to the PRIVAMOV one. Finally, these figures show that users have been attached to more WiFi access points than GSM antennas, and the number of POIs is lower than the two others.

Uniqueness assessment

To quantify the uniqueness, we use the same methodology as presented in [START_REF] De Montjoye | Unique in the crowd: The privacy bounds of human mobility[END_REF]. More precisely, as previously described, datasets contain for each user three mobility traces T gps , T wif i , T gsm . These traces list the spatiotemporal points containing respectively the identifiers of POIs that the user has visited, MAC addresses of WiFi access points and identifiers of GSM antennas that the user was connected to, associated with the time of the interaction. For each mobility trace T , we evaluate the uniqueness of a given sub-trace I p of p randomly chosen spatiotemporal points. A sub-trace I p is said to be unique if only one user has I p ∈ T . To measure this uniqueness, we performed a brute force search of users who have the p points composing I p in their mobility trace T . The size of this set of users sharing the same I p , noted k, characterizes the uniqueness of the sub-trace I p . If k = 1, the sub-trace is unique. The uniqueness of traces is estimated as the percentage of 2500 random sub-traces that are unique given the p points composing them. We use the same methodology to evaluate the uniqueness of spatial or temporal only mobility traces. In this case, the sub-trace I p contains spatial or temporal points, respectively. As reported in Section 3.2, we consider both no restriction for the chosen p points and specific sub-areas focusing on denser urban areas. Additionally, we also consider the case where the sub-trace I p contains multi-sensor information and gathers spatial points from the GPS, WiFi, and the GSM data collections at once.

Finally, we also consider the deterministic model proposed in [START_REF] Zang | Anonymization of location data does not work: A large-scale measurement study[END_REF] to quantify uniqueness. In this model, the sub-trace I p of a user is composed of the most frequent points (i.e., POIs, WiFi access points, and GSM antennas) that the user has visited the most frequently.

De-anonymisation attack

We also implement and conduct a de-annonymization attack similar to the one proposed by Gambs and all [START_REF] Gambs | De-anonymization attack on geolocated data[END_REF]. This attack aims at inferring the identity of a particular individual behind a set of mobility traces. More precisely, Then, to re-identify a user, we measure the cosine similarity distance between all T op n sets and the considered testing set. The re-identification is considered successful if only one user has the greatest similarity distance, otherwise the considered testing set is not associated to a particular user as the confidence of the mapping is not entirely undoubted. The outcome of the attack is measured through the precision and the recall metrics according to the value of n. Let us define U the set of users, M (n) the set of users re-identified through the de-annonymization attack, and C(n) the set of users correctly re-identified. Precision and recall are then defined as follow:

P recision(n) = |C(n)| |M (n)| , Recall(n) = |C(n)| |U |
The precision quantifies the accuracy of the reidentification while the recall assesses its completeness.

Location Privacy Protection Mechanisms (LPPM)

Lastly, we also quantify the impact of different LPPMs on the uniqueness and the outcome of the de-anonymisation attack on the resulting obfuscated mobility traces of users.

We considered four different LPPMs, a naive spatial filter-based mechanism, a temporal cloaking, an obfuscation mechanism providing -differential privacy properties (i.e., Geo-Indistinguishability), and an obfuscation mechanism enforcing k-anonymity (i.e., Wait 4 Me).

Spatial Filtering

We consider here a mechanism that filters out the identifiers of POIs, GSM antennas or WiFi access points that have been only visited by f different users or less.

Temporal Cloaking

In this mechanism, we replace timestamps by a coarser grain temporal information. To achieve that, we vary the temporal resolution of the mobility traces from 1 hour up to 1 month.

Geo-Indistinguishability

GEO-I [START_REF] Andrés | Geo-indistinguishability: Differential Privacy for Location-based Systems[END_REF] ensures -differential privacy by adding a calibrated noise drawn from a two-dimensional Laplace distribution. This LPPM takes a parameter names (expressed in meters -1 ) determining the amount of noise to add (the smaller the value of , the higher the amount of noise added to the raw data). As reported in [START_REF]Location guard[END_REF], we consider three values of : 0.01, 0.004, and 0.001, defining a low, medium, and high noise injection, respectively. As this LPPM obfuscates GPS coordinates, we apply this mechanism only on POI-based mobility traces.

Wait 4 Me

W4M [START_REF] Abul | Anonymization of moving objects databases by clustering and perturbation[END_REF] ensures k-anonymity by transforming the GPS coordinates of a moving object to a cylindrical volume of radius δ representing the possible location imprecision of this object. To achieve that, W4M can temporally and spatially move input records of raw mobility traces, as well as insert and delete records. We configure W4M with the following parameters: δ = 200 meters (i.e., the uncertainty), k = 2 (i.e., the anonymity level), M ax T rash = 10% of the dataset's size (i.e., the global maximum trash size), and max radius = 1000 meters (i.e., the initial maximum radius used in clustering). This means that at any time, any two traces in the protected dataset are in a cylinder that has a 200 meters diameter. To comply with the usage restriction [START_REF] Abul | Anonymization of moving objects databases by clustering and perturbation[END_REF] (i.e., only 10,000 GPS records per user), we prepared a specific PRIVAMOV dataset containing only one record every minute and where records are randomly removed for users that exceeds this limit (i.e. 22 users over 92). As W4M obfuscates GPS coordinates, we only applied this mechanism on POI-based mobility traces.

Experimental Evaluation

This section exhaustively evaluates the uniqueness of mobility traces before analysing the impact of different loca- 6: PRIVAMOV: Uniqueness assessment from the probabilistic model [START_REF] De Montjoye | Unique in the crowd: The privacy bounds of human mobility[END_REF] gives an upper bound of the uniqueness compared to the deterministic approach [START_REF] Zang | Anonymization of location data does not work: A large-scale measurement study[END_REF]. tion privacy-preserving mechanisms and the outcome of the previously defined de-anonymisation attack.

Quantifying Uniqueness

We quantify the uniqueness of mobility traces built from the GPS, WiFi, and GSM data collections. Figures 4 and5 depict for the PRIVAMOV and the MDC datasets respectively the probability to be unique according to the number of points in the considered mobility trace. The evaluation reports results for spatial, temporal, and spatiotemporal traces, and for both the global dataset and a subarea excluding the suburbs of the respective cities.

As shown in these figures, the results for spatiotemporal mobility traces from GSM, WiFi, and GPS report a strong uniqueness. More precisely, four spatiotemporal points are enough to identify between 89% and 99% of the users, depending on the mobility traces. This high uniqueness is the result of combining the temporal and the spatial mobility information of users, which are discriminative enough to uniquely identify them.

Furthermore, results show the high importance of the temporal information for uniquely identifying individuals. For instance, in the PRIVAMOV dataset, using the temporal information provides almost the same uniqueness as leveraging the spatial information for WiFi-based mobility traces and a better uniqueness for mobility traces extracted from the GSM data collection (83% against 74% with 4 points). These temporal traces reflect the time when a user moves or when he is inside a POI. Results show that this temporal information can also provide an important mobility footprint, which is sufficient to uniquely identify a large proportion of users. This temporal information is however not efficient for mobility traces extracted from POIs for the PRIVAMOV dataset. This means that the temporal information reflecting when a user moves provides a better fingerprint than the information reflecting when this user is inside a POI such as home or work place. Indeed, a user spends more time in a POI during the day than time moving, making this information more unique. For the MDC dataset, the temporal traces provides a 10% lower uniqueness than the spatial traces for GSM-based mobility traces while providing on average a 45% lower uniqueness for mobility traces extracted from WiFi and GPS data collections. Furthermore, results show that in the considered sub-areas, the temporal 7: Using a multi-sensor fingerprints does not improve the uniqueness compared to using a fingerprint from one sensor. traces provide a better uniqueness than the spatial traces for mobility traces based on the GSM and the WiFi respectively on both datasets.

Interesting enough, the uniqueness evaluation of mobility traces extracted from POIs for the PRIVAMOV dataset shows that the spatial only mobility patterns are more unique than the spatio-temporal ones (89% against 86% with 4 points). This is mainly due to the particularly low uniqueness provided by the temporal information in mobility traces from POIs in this dataset.

Moreover, results for the MDC dataset report a slightly smaller uniqueness than in the PRIVAMOV dataset. In addition, the uniqueness of spatial only mobility traces from the Lausanne area reflects that an anonymisation mechanism has been applied on the raw data before the release of the dataset (shown also by the shape of the CCDF Figure 3g where most of the users have been associated to many different WiFi access points).

Additionally, we show that considering a sub-area slightly reduces the uniqueness. Indeed, focusing on the mobility of users in a limited and dense urban sub-area excludes isolated points that could be unique to users and may lead to easily identify them (e.g. a weekend in a family home).

We also evaluate the uniqueness of multi-sensor mobility traces instead of considering only information from the same sensor. Specifically, we build multi-sensor spatial only mobility traces mixing information from the GPS, the WiFi, and the GSM sensors. These multi-sensor mobility traces gather the same quantity of information from each data collection, as a consequence the number of points of these traces is a multiple of three. Figure 8: PRIVAMOV: the uniqueness of users from spatial mobility traces is highly heterogeneous over users while the temporal information drastically increases the uniqueness compared to only considering the spatial information.

pares for both datasets the probability of uniqueness of these multi-sensor mobility traces against mobility traces from the GPS, the WiFi, and the GSM sensor only with the same number of points (i.e. multiple of three). Results show that mixing information from each sensor does not improve the uniqueness compared to the data collection which provides the best uniqueness (i.e., the POI-based mobility traces in our case). However, using information from multiple sensors avoids to know a priori which sensor provides the best uniqueness.

Finally, we compared the uniqueness measured by the probabilistic model proposed in [START_REF] De Montjoye | Unique in the crowd: The privacy bounds of human mobility[END_REF] and the deterministic model proposed in [START_REF] Zang | Anonymization of location data does not work: A large-scale measurement study[END_REF]. As described in Section 3.3, the former uses random mobility traces while the letter uses mobility traces composed of the top n points the most frequently visited by users. Figure 6 depicts for the PRIVAMOV dataset the probability to be unique from both models for mobility traces from the GSM, WiFi, and POIs. Results show that the uniqueness measured from the model using the most visited spatial points (i.e., Global Top and Lyon Top) is the lowest (up to 40% less). Indeed, as shown in the CCDF Figure 3g, a majority of WiFi access points, POIs, and GSM antenna have been uniquely visited by one user. As a consequence, randombased mobility traces are more likely to include points with a strong uniqueness than mobility traces based on the most frequently visited points.

Variability of the Uniqueness

Depending on their mobility traces, all users do not have the same level of uniqueness. To highlight the variability of the uniqueness over the population of users, Figure 8 depicts the CCDF of the average uniqueness of users. Results show that the uniqueness of users from the GSM and the WiFi spatial only data collections are almost uniformly distributed in [0 : 1] while this uniqueness is stronger and distributed only on [0.5 : 1] for mobility traces built from POIs. These distributions reflects the large variability of the uniqueness of the spatial only mobility traces of users. Contrastingly, uniqueness from spatio-temporal information has less variability where most of the users are highly unique. This result also clearly demonstrates that the temporal dimension drastically increases the uniqueness of users compared to only considering spatial information.

Impact of POIs Extraction Parameters

The POIs extraction performed from the GPS data collection has an impact on the POI-based mobility traces as shown in Figure 1, especially the considered diameter and the stay time. Shortly, a longer considered stay time reduces the number of identified POIs by filtering locations where the user did not stay long enough, while a larger diameter reduces also the number of identified POIs by aggregating small POIs in larger POIs. To assess the impact of these parameters, Figure 9 (i.e., parameter t) used to extract POIs has a direct correlation to the uniqueness (Figure 9b), a larger t increases the uniqueness. Indeed, a larger t reduces the number of POIs in the resulting mobility traces, and consequently decreases the probability to find other users sharing the same POIs. However, while the spatial resolution (i.e., parameter d) impacts the uniqueness, there is no direct correlation with d (Figure 9a).

Impact of Spatial Filtering

As shown by the CCDF in Section 3.2, many GSM antennas, WiFi access points and POIs have been visited only by one user. Obviously, the unique nature of this information leads to improve the capacity to uniquely identify users. To quantify the impact of spatial components (i.e., GSM antennas, WiFi access points, or POIs) only visited by few users, we evaluate the uniqueness when these points are filtered from the mobility traces of users. Figure 10 reports the uniqueness of WiFi-based mobility traces of 2 and 4 spatial and spatio-temporal points from the MDC dataset when spatial points only visited by at most 3 and 5 users have been removed. Results show that this naive spatial filtering scheme drastically reduces the uniqueness for spatial mobility traces. Indeed, this naive filtering scheme tends to remove the too unique spatial information. However, as this filtering scheme only removes spatial information, the impact on the uniqueness for spatio-temporal mobility traces is less important.

Impact of Temporal Cloaking

Temporal cloaking reduces the temporal resolution of the mobility traces. Reducing the temporal resolution means aggregating spatial information in larger time units and thus reducing the information provided by the mobility traces. As a consequence, with a less precise timescale, users are more likely to share common spatial points with others at the same time slot. Figure 11 reports the uniqueness of mobility traces of 2 and 4 spatio-temporal points based on the WiFi data collection of the MDC dataset with a varying temporal resolution, from 1 hour to 1 month. This figures also reports the uniqueness when the temporal resolution includes the whole dataset (noted all in the figure) which means that all temporal information are removed and only the spatial information is used. Predictably, results show that a smaller temporal resolution reduces the uniqueness. This decrease is however very small. Indeed, the uniqueness only slightly reduces from 1 hour to 7 days regardless the number of spatiotemporals points. As the uniqueness of spatio-temporal mobility traces leverages information from both the temporal and the spatial information of users, reducing only the temporal information is not enough to counterbalance the spatial information. This observation supports results of previous studies [START_REF] Zang | Anonymization of location data does not work: A large-scale measurement study[END_REF][START_REF] De Montjoye | Unique in the crowd: The privacy bounds of human mobility[END_REF][START_REF] Gramaglia | On the anonymizability of mobile traffic datasets[END_REF][START_REF] Gramaglia | Hiding Mobile Traffic Fingerprints with GLOVE[END_REF] showing that reducing the uniqueness through generalization requires a very coarsegrained information which drastically reduces the utility of the protected data.

Impact of GEO-I

As described in Section 3.5, GEO-I obfuscates the spatial information of users with noise injection in the GPS coordinates. The level of noise is controlled by an parameter, the smaller , the noisier the obfuscation. This noise applied on the original dataset drastically impacts the POI extraction in the obfuscated data. Indeed, this noise injected in the GPS coordinates reduces the probability to have long enough data points in the same diameter to identify a POI. In the MDC dataset for instance, users have on average 28.9 POIs with an = 0.01 while this number of POIs decreases to 19.8 and 4.7 with values equal to 0.004 and 0.001, respectively. Figure 12 shows the uniqueness of the spatial information according to different values of for the MDC dataset. Results show that the more obfuscated the mobility traces, the more unique they are. This result is mainly due to the decreasing number of POIs in the mobility traces when the obfuscation is enhanced, and thus reduces the probability to find other users sharing the same POIs. Interesting enough, using GEO-I with a low obfuscation (i.e., = 0.01) provides almost the same uniqueness as exploiting the original mobility traces.

Impact of W4M

As described in Section 3.5, W4M obfuscates the spatial and the temporal information to provide k-anonymity by ensuring that k users are within the same cylinder. Con- trary to GEO-I, the spatial and temporal data manipulation of W4M does not impact the POI extraction. In the considered PRIVAMOV dataset, users have on average 19.9 POIs without obfuscation while this number of POIs increases to 21.7 when W4M is applied on the mobility traces. Figure 13 depicts the probability of uniqueness of both the spatial and spatio-temporal data collections with and without obfuscation from W4M for the PRIVA-MOV dataset. Results show in both cases (i.e., for spatial and spatio-temporal data collections) that applying this obfuscation scheme greatly decreases the uniqueness (down to 32% and 67% for the spatial and the spatiotemporal, respectively). This decrease is a direct result of the k-anonymity scheme of W4M which aims to avoid uniqueness by ensuring that each POI is shared by at least k users.

De-anonymisation attack

As described Section 3.4, we implemented a deanonymisation attack to re-identity users from a training to a testing set built from the spatial only data collection. Figure 14 depicts for both datasets the precision and the recall for a varying size of background knowledge preserved for each user from the training set (i.e., the number of identifiers the most visited). Results show that the de-anonymisation attack can re-identify users with a high success rate. Using as background knowledge the most visited POIs provides up to almost a perfect precision for 80% and 98% of the users for PRIVAMOV and MDC dataset, respectively. Using background information from the WiFi and the GSM reduces the precision by 20% on average and the recall by 10% and 30% for PRIVA-MOV and MDC dataset, respectively. While the precision tends to decrease according to the size of the background knowledge, the recall inversely tends to increase. Indeed, as the size of the background information increases, identifying users from their mobility habits from the training set become easier (i.e., a better recall) but the fault positives also increase (i.e., a smaller precision). Similar results are observed when the attack is performed on geolocated data restricted to a city (Figures 14c,14d, 14g and 14h). Compared to using the data in the whole dataset, the precision provided by the WiFi and GSM data collections are slightly better while the recall is 20% lower. Interesting enough, for the MDC dataset restricted to Lausanne, both the precision and the recall provided by the GSM information are very low (i.e., around 20% regardless the size of the background knowledge). These low values are certainly due to the privacy preserving scheme applied on the raw data before releasing the dataset.

These results are consistent with the observations done through the uniqueness assessment of Section 4.1: the uniqueness drives the effectiveness of the de-anonymisation attack (i.e., the more unique, the more effective is the attack). Indeed, the POI-based spatial only mobility traces are the more sensitive to the deanonymisation attack compared to the ones from the WiFi and GSM data collections (Figure 14), which also provide the stronger uniqueness (Figures 4 and5). Moreover, the de-anonymisation attack is slightly less effective for the MDC dataset than for the PRIVAMOV dataset. Similarly, the MDC dataset reports a slightly smaller uniqueness than in the PRIVAMOV dataset. Lastly, considering smaller and denser sub-area (resp.) reduces the effectiveness of the attack, and reduces the uniqueness (resp.).

To fully understand the impact of LPPMs, we also conduct the de-anonymisation attack on the obfuscated data. Figure 15 reports the precision and the recall of the de-anonymisation attack for the PRIVAMOV dataset performed on both un-obfuscated and obfuscated data from GEO-I and W4M. Results for W4M (Figure 15a and15b) show that excepting for n < 3 where the precision of obfuscated data is higher than the un-ofuscated data, the precision tends to decrease according to n, the number of most visited points. However, slightly more users are identified (i.e., a better recall) with un-obfuscated data. Results for GEO-I (Figure 15c and15d), show that the pre- cision is similar with and without obfuscation and close to 1. The recall, in turn, slightly decreases according to the level of the obfuscation but remains high (i.e., > 0.8 from n = 2).

Discussions and conclusions

This paper reports an extensive experimental evaluation of the uniqueness of mobility traces of users collected through different sensors (i.e., GPS, GSM, and WiFi). We show that these mobilty traces are highly unique: on average only four statio-temporal points are enough to uniquely identify on average 94% of the individuals. Moreover, we assess the uniqueness of the spatial-only (i.e., where users move) and the temporal-only (i.e., time when users move or are in POIs) information related to the mobility traces. Although the temporal information does not identify users as much as the spatial information on average, results show that the temporal footprint is enough to uniquely identify a large proportion of users and drastically improve the uniqueness when it is combined the spatial information. We also highlight the heterogeneous nature of the uniqueness over the popula-tion of users as the mobility traces of some users are more unique than others. In addition, we compared two different models to quantify the uniqueness and show that the probabilistic model proposed in [START_REF] De Montjoye | Unique in the crowd: The privacy bounds of human mobility[END_REF] provides an upper bound compared to the deterministic model proposed in [START_REF] Zang | Anonymization of location data does not work: A large-scale measurement study[END_REF]. Furthermore, similarly to previous studies, we show that reducing the uniqueness through generalisation requires a very coarse-grained information which drastically limits the utility of the data. Lastly, we show that a de-anonymisation attack re-identifying anonymous users using only a limited background information on the mobility habit of users provides a very high success rate, even if the raw data are obfuscated by classical LPPMs.

Besides, we evaluated the impact of different LPPMs on the uniqueness and show that obfuscation of GPS coordinates from GEO-I and W4M leads to opposite results. The obfuscation from GEO-I tends to decreases the number of extracted POIs. This side effect of fewer extracted POIs results in increasing the uniqueness. In contrast, the obfuscation scheme of W4M based on k-anonymity meets the expectations by greatly reducing the uniqueness.

We hope that the observations done in this paper can lead to the development of more effective LPPMs in the future. In particular, as most of the existing LPPMs are static (i.e., they apply the same level of obfuscation to all users) and focus their obfuscation on the spatial dimension, possible improvements may be the development of an adaptive LPPM that dynamically adapts the obfuscation simultaneously time and space with the respect of the considered user.

  illustrates the POIs of users for the PRIVAMOV dataset in the Lyon sub-area for t = 30 minutes (a) and t = 20 minutes (b). Obviously, a shorter temporal resolution gives more POIs. Darker spots represent areas where more users generate and share common traces, and consequently less unique traces. We assessed the impact of both spatial and temporal resolutions in the POI extraction (pa-(a) d=30 minutes (b) d=20 minutes

Figure 1 :

 1 Figure 1: Points of interest (POI) identify specific locations where a user stays in the same place longer than a specific delay d. These figures show the POIs of users across the Lyon area according to a delay considered to identify POIs of 30 and 20 minutes for figures (a) and (b), respectively. A shorter d provides more POIs.

Figure 2 :

 2 Figure 2: Methodology to build the mobility traces from the GSM, GPS, and WiFi data collections.

Figure 3 :

 3 Figure3: The tail distributions (i.e., Complementary Cumulative Distribution Function defined as P (X > x)) of the number of different GSM antennas, WiFi access points, and POI per user (Figures3a-3c-3e-3g) ; and the number of unique users per GSM antenna, WiFi access point, and POI (Figures3b-3d-3f-3h) for both a restricted sub-area (i.e., Lyon for Privamov and Lausanne for MDC) and for the whole dataset.

Figure 4 :Figure 5 :

 45 Figure 4: PRIVAMOV: Four spatio-temporal points are enough to uniquely identify 94% of the individuals. Focusing the analysis on restricted urban area reduces slightly the uniqueness.

Figure

  Figure6: PRIVAMOV: Uniqueness assessment from the probabilistic model[START_REF] De Montjoye | Unique in the crowd: The privacy bounds of human mobility[END_REF] gives an upper bound of the uniqueness compared to the deterministic approach[START_REF] Zang | Anonymization of location data does not work: A large-scale measurement study[END_REF].

Figure

  Figure7: Using a multi-sensor fingerprints does not improve the uniqueness compared to using a fingerprint from one sensor.

Figure 7

 7

Figure 9 :

 9 Figure 9: MDC -POI extraction: Only the temporal resolution used to build POI is directly correlated to the uniqueness.

Figure 10 :

 10 Figure 10: MDC -WiFi: A naive spatial filtering scheme removing too unique spatial information drastically decreases the uniqueness.

Figure 11 :

 11 Figure 11: MDC -WiFi: Reducing the temporal resolution only slightly decreases the uniqueness.

Figure 12 :

 12 Figure12: MDC -POI: The impact of GEO-I on the POI extraction on obfuscated data (i.e., the noise injection drastically reduces the number of POI) affects the uniqueness, the more noisy, the more unique.

Figure 13 :

 13 Figure 13: PRIVAMOV -POI: The impact of W4M on the POI extraction affects the uniqueness, the more noisy, the more unique.

Figure 14 :

 14 Figure 14: De-anonymisation attack re-identifies a large population of users with a high precision.

  Figure 15: GEO-I and W4M fail to protect users against a de-anonymisation attack.

Table 1 :

 1 Our uniqueness study uses the PRIVAMOV and the Mobile Data Challenge (MDC) mobile phone datasets with data collections captured through different sensors.

	Dataset	Users	Period	Sensor	#Records
			10/2014	WiFi	25,655,480
	PRIVAMOV	100	-	GSM	8,076,512
			01/2016	GPS	156,041,576
			10/2009	WiFi	53,432,599
	MDC	200	-	GSM	50,895,615
			03/2011	GPS	11,077,061

WiGLE: Wireless Network Mapping, http://wigle.net

Google Maps Geolocation API: https://developers. google.com/maps/


Léo Agélas

Finite time blow up of complex solutions of the conserved Kuramoto-Sivashinsky equation in R d , d ≥ 1

Keywords: Blow up, Surface growth, conserved Kuramoto-Sivashinsky

We consider complex-valued solutions of the conserved Kuramoto-Sivashinsky equation which describes the coarsening of an unstable solid surface that conserves mass and that is parity symmetric. This equation arises in different aspects of surface growth. Up to now, the problem of existence and smoothness of global solutions of such equations remained open in R d , d ≥ 1. In this article, we answer partially to this question. We prove the finite time blow up of complex-valued solutions associated to a class of large initial data, more precisely, we show that there is complex-valued initial data that exists in every Besov space (and hence in every Lebesgue and Sobolev space), such that after a finite time, the complex-valued solution is in no Besov space (and hence in no Lebesgue or Sobolev space).

Introduction

In this paper, we consider the conserved Kuramoto-Sivashinsky (cKS) equation described by the following partial differential equation,

∂ t v + ∆ 2 v + ∆|∇v| 2 = 0 (1) with initial condition v(0) = v 0 (2)
on R d with solutions vanishing at infinity as |x| → ∞ or on the d-dimensional torus T d ≡ R d /(2πZ) d , with periodic boundary conditions and in this case we require in addition that v 0 is a periodic scalar function of period 2π with zero mean value, that is T d v 0 (x) dx = 0.

as a model for the boundaries of terraces in the epitaxy of Silicon [START_REF] Frisch | Effect of step stiffness and diffusion anisotropy on the meandering of a growing vicinal surface[END_REF]. It also describes the growth of an amorphous thin film by physical vapor deposition [START_REF] Raible | Amorphous thin film growth: Minimal deposition equation[END_REF] and [START_REF] Raible | Amorphous thin film growth: theory compared with experiment[END_REF]-in this case, conserved dynamics are obtained by transforming to a frame that translates upward with constant velocity.

For simplicity of presentation, we consider the rescaled version (1) with a dimensional length-scales. Sometimes the equation is considered with a linear instability +∆v , which leads to the formation of hills, and the Kuramoto-Shivashinky-type nonlinearity -|∇v| 2 leading to a saturation in the coarsening of hills (see [START_REF] Linz | Amorphous thin film growth: modeling and pattern formation[END_REF][START_REF] Raible | Amorphous thin film growth: theory compared with experiment[END_REF]). Both terms are neglected here. They are lower order terms not important for questions regarding regularity and blow up. Furthermore, the equation is usually perturbed by space-time white noise referred as η (see for instance [START_REF] Linz | Amorphous thin film growth: modeling and pattern formation[END_REF][START_REF] Raible | Amorphous thin film growth: theory compared with experiment[END_REF][START_REF] Raible | Amorphous thin film growth: Minimal deposition equation[END_REF]), which we also neglect here, although many results do hold for the stochastic PDE also (see [START_REF] Blömker | Markovianity and ergodicity for a surface growth PDE[END_REF]).

Previous work shows that numerical simulations based on (1) can be well fitted to experimental data, and that (1) adequately describes the phenomena of coarsening and roughening that are characteristic for the growth of corresponding surfaces on intermediate time scales [START_REF] Linz | Amorphous thin film growth: modeling and pattern formation[END_REF][START_REF] Raible | Amorphous thin film growth: theory compared with experiment[END_REF][START_REF] Stein | Amorphous molecular beam epitaxy: global solutions and absorbing sets[END_REF]. In particular, the characteristic statistical measures of the surface morphology such as the correlation length and the surface roughness calculated from the cKS model show very good agreement with available experimental data and, therefore, support the validity of this modeling approach (see [START_REF] Linz | Amorphous thin film growth: modeling and pattern formation[END_REF] for more details).

Nevertheless, without the existence of a unique solution there is no hope of guaranteeing that a numerical approximation is really an approximation in any meaningful sense, since it is not clear what is being approximated.

Thus, a crucial open problem for the cKS equation ( 1) is the fact that existence and uniqueness of global solutions is not known (see [START_REF] Blömker | Local existence and uniqueness in the largest critical space for a surface growth model[END_REF][START_REF] Blömker | Regularity and blow up in a surface growth model[END_REF]) even in the one dimensional case (see [START_REF] Blömker | Regularity and blow up in a surface growth model[END_REF] and references therein).

For the one dimensional case, existence of global weak solutions on bounded domains has been established in [START_REF] Blömker | Thin-film-growth models: roughness and correlation functions[END_REF][START_REF] Stein | Amorphous molecular beam epitaxy: global solutions and absorbing sets[END_REF]. The key point of the construction of global weak solutions lies on a L 2 -energy-type estimate deriving from the fact that, in this case, the nonlinearity in ( 1) is orthogonal to the solution itself in the sense of L 2 . For the two-dimensional case, the situation seems even worse, as the existence of global weak solutions could only be established in H -1 using the non-standard energy 2π 0 e v(x) dx (see [START_REF] Winkler | Global solutions in higher dimensions to a fourth order parabolic equation modeling epitaxial thin film growth[END_REF]). However, up to now, the question of global regularity for the cKS equation ( 1) is still open (see [START_REF] Blömker | Regularity and blow up in a surface growth model[END_REF][START_REF] Blömker | Local existence and uniqueness in the largest critical space for a surface growth model[END_REF] and references therein). Only existence, uniqueness and regularity of local solutions or global strong solutions with smallness condition on the initial data have been established in [START_REF] Blömker | Thin-Film-Growth-Models: On local solutions[END_REF][START_REF] Stein | Amorphous molecular beam epitaxy: global solutions and absorbing sets[END_REF] with initial values in W 1,q with q ≥ 2 for d = 1 and W 1,4 for d = 1, 2, 3 and later improved in [START_REF] Blömker | Regularity and blow up in a surface growth model[END_REF][START_REF] Blömker | Local existence and uniqueness in the largest critical space for a surface growth model[END_REF] for initial values in the critical Hilbert space H d/2 or in a critical space of BMO-type. The main difficulties for treating problem (1) are caused by the nonlinearity term ∆|∇v| 2 and the lack of a maximum principle. Due to its nonlinear parts, there are more difficulties in establishing the existence of global strong solutions. Then in [START_REF] Blömker | Rigorous Numerical Verification of Uniqueness and Smoothness in a Surface Growth Model[END_REF], numerical methods have been proposed for proving numerically ex-istence, uniqueness and smoothness of global solutions of [START_REF] Agélas | Global regularity of solutions of equation modeling epitaxy thin film growth in R d , d = 1, 2[END_REF].

As in [START_REF] Li | Blow ups of complex solutions of the 3d-Navier-Stokes system and renormalization group method[END_REF], in this paper, we omit the condition that v is the Fourier transform of a real-valued solution v of (1) in the d-dimensional space and consider it in the space of all possible complex-valued functions.

In this situation, we answer to the existence and smoothness problem for the cKS equation ( 1) by showing that for sufficiently large initial data, we get complex-valued solutions which blow up in finite time. More precisely, by borrowing the arguments used in [START_REF] Montgomery-Smith | Finite time blow up for a Navier-Stokes like equation[END_REF], in our Theorem 3.1 combined with Corollary 3.1, we show that there is complex-valued initial data that exists in every Triebel-Lizorkin or Besov space (and hence in every Lebesgue and Sobolev space), such that after a finite time, the solution is in no Triebel-Lizorkin or Besov space (and hence in no Lebesgue or Sobolev space). This finite time blow up result may suggest as it was shown in [START_REF] Agélas | Global regularity of solutions of equation modeling epitaxy thin film growth in R d , d = 1, 2[END_REF], that a better taking into account of the main physical phenomena and a better approximation of terms related to them in the surface growth mathematical model can help to get existence and uniqueness of global strong solutions for such equations as the ones modeling epitaxy thin film growth. The paper is organized as follows: In section 1, we give some notations. In section 2, we introduce the Banach spaces as the Hilbert spaces H s , Lebesgue spaces L p and Besov spaces B s p,q . In section 3, we prove our Theorem 3.1 with our Corollary 3.1. If we set u = -v and u 0 = -v 0 , we notice that u satisfies the following equivalent Equation to (1):

∂ t u + ∆ 2 u -∆|∇u| 2 = 0, (3)
with initial condition

u(0) = u 0 . (4)
Then, without loss of generality, in what follows, we will consider Equation (3) rather than (1).

Some notations

For any x ∈ R d , we denote by {x} + the vector having for components the values max{x m , 0} for 1 ≤ m ≤ d. We denote by | • | the modulus of a complex number. We denote by • , the euclidean norm on C d defined for all x ∈ C d by

x =   1≤m≤d |x m | 2   1 2
. We denote by • ∞ , the infinity norm on

C d defined for all x ∈ C d by x ∞ = max 1≤m≤d |x m |. For x ∈ C d and r > 0, let B r (x) = {y ∈ C d : y -x ∞ ≤ r}.
Notice, here that the ball of C d is defined with the norm • ∞ and not with the euclidean norm of C d as it is usually the case. This change is made in order to deal with the periodic case also.

For any a ∈ R and r > 0, we denote with the same notation B r (a) the ball B r (A) where

A ∈ R d is such that for all 1 ≤ m ≤ d, A m = a.
For any x ∈ R d and y ∈ R d , we say that x ≤ y (resp.

x ≥ y) if for all 1 ≤ m ≤ d, x m ≤ y m (resp. x m ≥ y m ). For any x ∈ R d and a ∈ R, we say that x ≤ a (resp. x ≥ a) if for all 1 ≤ m ≤ d, x m ≤ a (resp. x m ≥ a).
For any function f defined on R d × R + , for any t ≥ 0, for a simplicity in the notation, we denote by f (t) the function x -→ f (x, t) defined on R d . Given an absolutely integrable function f ∈ L 1 (R d ), we define the Fourier transform f : R d -→ C by the formula,

f (ξ) = R d e -ix•ξ f (x) dx,
and extend it to tempered distributions. For a function f which is periodic with period 1, and thus representable as a function on the torus T d , we define the discrete Fourier transform f : Z d -→ C by the formula,

f (k) = T d e -ix•k f (x) dx,
when f is absolutely integrable on T d , and extend this to more general distributions on T d .

Some Banach spaces

We denote by S (R d ) the class of complex-valued tempered Schwartz functions on R d and by S (T d ) the space of complex-valued infinitely differentiable functions on T d . Its dual space S ′ (R d ) (resp. S ′ (T d )) is called the space of distributions. In particular, we recall the following two facts ( [START_REF] Schmeisser | Topics in Fourier analysis and function spaces, Math-ematik und ihre Anwendungen in Physik und Technik[END_REF])

• Any function f ∈ S (T d ) can be represented as f (x) = k∈Z d a k e ik•x for any x ∈ R d with (a k ) k∈Z d scalars such that sup k∈Z d (1 + |k|) m |a k | < ∞ for any m ∈ N.

In this case one has

a k = f (k) for each k ∈ Z d .
• Any function g ∈ S ′ (T d ) can be represented as

g(x) = k∈Z d a k e ik•x for any x ∈ R d (5)
with (a k ) k∈Z d scalars such that sup

k∈Z d (1 + |k|) -m |a k | < ∞ for some m ∈ N.
In this case one has a k = g(k) for each k ∈ Z d .

Some Sobolev spaces

For s ∈ R, we define the Sobolev norm f H s (R d ) of a tempered distribution

f : R d -→ C by, f H s (R d ) = R d (1 + |ξ| 2 ) s | f (ξ)| 2 dξ 1 2
, and then we denote by H s (R d ) the space of tempered distributions with finite H s (R d ) norm, which matches when s is a non negative integer with the classical Sobolev space H k (R d ), k ∈ N. For s > -1 2 , we also define the homogeneous Sobolev norm,

f Ḣs (R d ) = R d |ξ| 2s | f (ξ)| 2 dξ 1 2
, and then we denote by Ḣs (R d ) the space of tempered distributions with finite Ḣs (R d ) norm. Similarly, on the torus T d and s ∈ R, we define the Sobolev norm

f H s (T d ) of a tempered distribution f : T d -→ C by, f H s (T d ) =   k∈Z d (1 + |k| 2 ) s | f (k)| 2   1 2
, and then we denote by H s (T d ) the space of tempered distributions with finite H s (T d ) norm. On the torus T d , for s > - 1 2 , we also define the homogeneous Sobolev norm,

f Ḣs (T d ) =   k∈Z d |k| 2s | f (k)| 2   1 2
, and then we denote by Ḣs (T d ) the space of tempered distributions with finite Ḣs (T d ) norm.

For any p ≥ 1, we denote by L p (R d ) the space of functions f : R d -→ C such that the norm,

f L p (R d ) := R d |f (x)| p dx 1 p < +∞.
For any p ≥ 1, we denote by L p (Z d ) the space of functions f : Z d -→ C such that the norm,

f L p (Z d ) :=   k∈Z d |f (k)| p   1 p < +∞.

Besov spaces

We introduce the usual dyadic unity partition of Littlewood-Paley decomposition (see [START_REF] Bergh | Interpolation Spaces, An Introduction[END_REF][START_REF] Cannone | Harmonic Analysis Tools for Solving the Incompressible Navier-Stokes Equations[END_REF][START_REF] Chemin | Perfect Incompressible Fluids[END_REF][START_REF] Triebel | Theory of Function Spaces, Geest & Portig[END_REF] for more details). To this end, we take an arbitrary realvalued radial function ϕ in S (R d ) whose Fourier transform ϕ is non-negative and is such that,

supp ϕ ⊂ B 1 (3/2) and ϕ(ξ) ≥ 1 2 for ξ ∈ B 1 2 (3/2),
and define ϕ j (x) = 2 jd ϕ(2 j x) so that ϕ j (ξ) = ϕ(2 -j ξ) for j ∈ Z. We may assume,

∀ξ ∈ R d \{0}, j∈Z ϕ j (ξ) = 1.
For any f ∈ S ′ (R d ) or S ′ (T d ), we denote by ∆ j f , j ∈ Z, the function,

∆ j f := ϕ j ⋆ f. If f ∈ S ′ (R d ),
we notice that for all x ∈ R d and for all j ∈ Z,

∆ j f (x) = F -1 ( ϕ j f )(x) = R d ϕ j (ξ) f (ξ)e iξ•x dξ. (6)
If f ∈ S ′ (T d ), using [START_REF] Blömker | Thin-film-growth models: roughness and correlation functions[END_REF] we notice that for all x ∈ R d and for all j ∈ Z,

∆ j f (x) = k∈Z d ϕ j (k) f (k)e ik•x . (7)
Then a tempered distribution f belongs to the homogeneous Besov space Ḃs p,q (R d ) (resp. Ḃs p,q (T d )) modulo polynomials if and only if

f Ḃs p,q (R d ) < ∞ (resp. f Ḃs p,q (T d ) < ∞) where for Ω d = R d or T d , f Ḃs p,q (Ω d ) :=            j∈Z 2 jsq ∆ j f q L p (R d )   1 q if q < ∞ sup j∈Z 2 js ∆ j f L p (R d ) elsewhere, (8)
and f = j∈Z ∆ j f ∈ S ′ /P m where P m is the space of polynomials of degree ≤ m and m = [s -d p ], the integer part of s -d p .

Blow up of complex-valued solutions of the cKS equation

We We set A = ∆ 2 . In either R d or T d , we let e -tA for t > 0 be the usual biharmonic heat semigroup associated to the biharmonic heat equation w t + Aw = 0 (see [START_REF] Gazzola | Some new properties of biharmonic heat kernels[END_REF], for an explicite form of its solution on R d ).

Then, we start with the definition of mild solutions of cKS Equation ( 3) obtained from Kato's semigroup approach [START_REF] Kato | Strong L p -solutions of the Navier-Stokes equation in R m , with applications to weak solutions[END_REF].

Definition 3.0.1. We say that u is a mild solution of cKS Equation (3

) if u is a solution to the equation u = G(u) where G : C([0, T ], X) → C([0, T ], X),
with X being a space of complex-valued tempered distributions on R d : for a.e t ∈ [0, T ]

G(u)(t) = e -tA u 0 + t 0 e -(t-s)A ∆|∇u(s)| 2 ds. ( 9
)
The Kato's semigroup approach used to find a fixed point of G is to show that G is a contraction mapping on C([0, T ], X) or on some subset of C([0, T ], X). It turns out that the natural spaces in which to consider solutions are of the form C([0, T ], X), where X is a scale-invariant space (we call scale-invariant space, any Banach space X satisfying f (λ•) X = f X for all λ > 0): for instance the homogenenous Sobolev space Ḣ d 2 , Besov spaces Ḃ d p p,∞ for p < ∞ or the BMO-type spaces introduced in [START_REF] Blömker | Local existence and uniqueness in the largest critical space for a surface growth model[END_REF]. In fact, it can be shown (arguing similarly as in Frazier, Jawerth and Weiss in [START_REF] Frazier | Littlewood-Paley theory and the study of function spaces[END_REF]) that all scale-invariant spaces of distributions, that also contain all Schwartz functions, are contained in the Besov space Ḃ0 ∞,∞ . The main ingredient of the proof of the existence of blowing-up solutions as in [START_REF] Montgomery-Smith | Finite time blow up for a Navier-Stokes like equation[END_REF] consists in noticing that if the initial data has a positive Fourier transform, then that positivity is preserved for the solution at all further times. One can then use the Duhamel formulation of the solution and deduce a lower bound for the Fourier transform that blows up in finite time. Proof. To get the proof, we adapt the construction of [START_REF] Montgomery-Smith | Finite time blow up for a Navier-Stokes like equation[END_REF] to our case. We set w n = w 2 n with n ∈ N. We observe that w n+1 = w 2 n and then w n+1 = w n ⋆ w n . Since w is non-negative, has L 1 norm equal to 1 and is supported in

B 1 2 ( 3 2 ) ∩ F d = {ξ ∈ F d : 1 ≤ ξ ≤ 2}
, then by using an induction argument, we deduce that for all n ∈ N, w n is also non-negative, has L 1 norm equal to 1 and is supported in {ξ ∈ F d : 2 n ≤ ξ ≤ 2 n+1 }. Let t ≥ 0. We will show now by induction that the proposition P(n) = { u(t) ≥ A 2 n α n (t) w n } is true for all n ∈ N, where {α n } n∈N is the sequence of functions defined for all s ≥ 0 by α n (s) = 2

u = G(u) (10)
where G(u) is given by ( 9), then after taking the Fourier transform of Equation ( 10), we deduce that for all ξ ∈ F d , u(ξ, t) = e -t|ξ| 4 u 0 (ξ) -

We notice that ∇u(ξ, s) = iξ u(ξ, s). Since u(•, s) is supported in F d + , then we get ∇u(ξ, s) = i{ξ} + u(ξ, s) and therefore

-i ∇u(ξ, s) = {ξ} + u(ξ, s). (12)
Since u(•, s) is non-negative, from [START_REF] Furioli | On the uniqueness in L 3 (R 3 ) of mild solutions for the Navier-Stokes equations[END_REF] we get -i ∇u(ξ, s) ≥ 0 and therefore we deduce, ( ∇u ⋆ ∇u)(ξ, s) = -((-i ∇u) ⋆ (-i ∇u))(ξ, s) ≤ 0.

Therefore, from [START_REF] Frazier | Littlewood-Paley theory and the study of function spaces[END_REF], we get u(ξ, t) ≥ e -t|ξ| 4 u 0 (ξ) which gives us u(ξ, t) ≥ 2 7 Ae -t|ξ| 4 w(ξ) and then u(ξ, t) ≥ 2 7 Ae -2 4 d 2 t w(ξ) since |ξ| ≤ √ d ξ ∞ and w is supported in {ξ ∈ F d : 1 ≤ ξ ≤ 2}. Hence, we get that the proposition P(0) is true. Let us assume that the proposition P(n) is true for a given n ∈ N. Then, let us show that P(n + 1) will be also true. From [START_REF] Frazier | Littlewood-Paley theory and the study of function spaces[END_REF], since u 0 = 2 7 A w ≥ 0, we have,

u(ξ, t) ≥ - t 0 e -(t-s)|ξ| 4 |ξ| 2 ( ∇u ⋆ ∇u)(ξ, s) ds. (14)
Since P(n) is true, then from (12), we get -i ∇u(ξ, s)

≥ {ξ} + A 2 n α n (s) w n (ξ). Since w n is supported in {ξ ∈ F d : 2 n ≤ ξ ≤ 2 n+1 }, then we get -i ∇u(ξ, s) ≥ 2 n A 2 n α n (s) w n (
ξ) ≥ 0 (which means that each component of the vector is greater than 2 n A 2 n α n (s) w n (ξ) ≥ 0) and therefore we deduce,

( ∇u ⋆ ∇u)(ξ, s) = -((-i ∇u) ⋆ (-i ∇u))(ξ, s) ≤ -d(2 n A 2 n α n (s)) 2 ( w n ⋆ w n )(ξ) = -d(2 n A 2 n α n (s)) 2 w n+1 (ξ). (15)
Using [START_REF] Kato | Strong L p -solutions of the Navier-Stokes equation in R m , with applications to weak solutions[END_REF], from ( 14), we deduce

u(ξ, t) ≥ t 0 e -(t-s)|ξ| 4 |ξ| 2 d(2 n A 2 n α n (s)) 2 w n+1 (ξ) ds. (16)
Since

w n+1 is supported in {ξ ∈ F d : 2 n+1 ≤ ξ ≤ 2 n+2 }, then we get 2 2(n+1) d ≤ |ξ| 2 ≤ 2 2(n+2) d, hence from (16) we get, u(ξ, t) ≥ d 2 2 4n+2 A 2 n+1 w n+1 (ξ) t 0 e -(t-s)2 4(n+2) d 2 α n (s) 2 ds = 2 14 d 2 2 4n+2 A 2 n+1 w n+1 (ξ) t 0 e -(t-s)2 4(n+2) d 2 e -2 n+5 d 2 s 1 {tn≤s≤t} ds ≥ 2 14 d 2 2 4n+2 A 2 n+1 w n+1 (ξ)e -2 n+5 d 2 t 1 {t≥tn} t tn e -(t-s)2 4(n+2) d 2 ds = 2 8 A 2 n+1 w n+1 (
ξ)e -2 n+5 d 2 t 1 {t≥tn} (1 -e -2 4(n+2) d 2 (t-tn) ).

However, for all t ≥ t n+1 , we have 1 -e -2 = A 2 n+1 w n+1 (ξ)α n+1 (t).

Then, we deduce that the proposition P(n + 1) is true. Therefore, we deduce that for all n ∈ N, for all ξ ∈ F d , u(ξ, t) ≥ A 2 n w n (ξ)α n (t). [START_REF] Li | Blow ups of complex solutions of the 3d-Navier-Stokes system and renormalization group method[END_REF] Thanks to [START_REF] Li | Blow ups of complex solutions of the 3d-Navier-Stokes system and renormalization group method[END_REF], we have for all j ∈ N, for all ξ ∈ F d , ϕ j (ξ) u(ξ, T d ) ≥ A 2 j ϕ j (ξ) w j (ξ)α j (T d ).

From Section 2.2, we notice that ϕ j (ξ) ≥ 1 2 for all ξ ∈ {ζ ∈ F d : 2 j ≤ ζ ≤ 2 j+1 } which is the support of w j and moreover w j is non-negative, then we deduce that for all ξ ∈ F d , ϕ j (ξ) w j (ξ) ≥ 1 2 w j (ξ). Therefore, we infer that for all j ∈ N, for all ξ ∈ F d ,

ϕ j (ξ) u(ξ, T d ) ≥ 1 2 A 2 j w j (ξ)α j (T d ) ≥ 0. ( 18
)
Since for any j ∈ Z, ϕ j u ≥ 0 (thanks to ϕ ≥ 0 and u ≥ 0), then thanks to ( 6) and ( 7), we deduce that for all j ∈ Z, ∆ j u(0, T d ) = ∆ j u(T d ) L ∞ (R d ) . Moreover, we observe also that ∆ j u(0, T d ) = ϕ j u(T d ) L 1 (F d ) . Then for s ∈ R, we infer, Thanks to [START_REF] Montgomery-Smith | Finite time blow up for a Navier-Stokes like equation[END_REF], we infer,

u(T d ) Ḃs ∞,∞ (Ω d ) ≥ 1 2 sup j∈N 2 js A 2 j α j (T d ) w j L 1 (F d ) .
However, for any j ∈ N, w j L 1 (F d ) = 1 and since for all j ∈ N, T d > t j , we get α j (T d ) = 2 7 e -2 j+4 log(2)

  set Ω d = R d or Ω d = T d for the periodic case, F d = R d or F d = Z d for the periodic case. We set also F d + = (R + ) d or F d + = (Z + ) d for the periodic case.

Theorem 3 . 1 . 1 15d 2

 3112 Let d ∈ N * . Let w ∈ S (Ω d ) such that w is a real-valued function, w is non-negative, has L 1 norm equal to 1, and has support in B 1 2 ( 3 2 )∩ F d (so w is in every Triebel-Lizorkin or Besov space). Then if A > 2 16 15 , and if u is a mild solution to cKS Equation (3) whose Fourier transform is a non-negative real-valued function supported in F d + , with initial data u 0 = 2 7 Aw, then u(t) is not in any Triebel-Lizorkin or Besov space when t = T d := log(2 ).

2 n+1 j=1 2 - 1 15d 2 )

 2212 7 e -2 n+4 d 2 s 1 {s≥tn} with {t n } n∈N the sequence defined by t 0 = 0 and t n = log(2) d 4j for all n ≥ 1. Notice that the sequence {t n } n∈N is increasing and lim n→∞ t n = log(2 = T d which implies that for all n ∈ N, t n < T d . Let us show that the proposition P(n) is true for n = 0. Since

t 0 e

 0 -(t-s)|ξ| 4 |ξ| 2 ( ∇u ⋆ ∇u)(ξ, s) ds.

  d ) Ḃs ∞,∞ (Ω d ) := sup j∈Z 2 js ∆ j u(T d ) L ∞ (R d ) = sup j∈Z 2 js ϕ j u(T d ) L 1 (F d ) .

  4(n+2) d 2 (t-tn) ≥ 1 2 , since t n+1 -t n ≥ 155 log(2) d 2 2 -4(n+2). Then, we deduce,u(ξ, t) ≥ 2 7 A 2 n+1 w n+1 (ξ)e -2 n+5 d 2 t 1 {t≥tn+1}

The cKS equation models the step meandering instability on a surface characterized by the alternation of terraces with different properties[START_REF] Frisch | Effect of step stiffness and diffusion anisotropy on the meandering of a growing vicinal surface[END_REF]. It appeared Email address: leo.agelas@ifpen.fr (Léo Agélas)PreprintDecember 9, 2016

Acknowledgements

The author would like to thank Professor Dirk Blömker for his helpful discussions and suggestions.

= 2 7 (e -16 log(2) 15 ) 2 j . Then, we deduce that,

15

Therefore, we deduce that if A > e 16 log(2) 15

= 2 16 15 then u(T d ) Ḃs ∞,∞ (Ω d ) = ∞, which allows us to conclude the proof.

or X R the scale-invariant space of BMO-type introduced in [START_REF] Blömker | Local existence and uniqueness in the largest critical space for a surface growth model[END_REF] with value in C. Let w be as in Theorem 3.1 and let A > 2 16 15 . Then there is no mild solution u to the cKS Equation ( 3), with

Proof. Here, we use the same arguments as in [START_REF] Montgomery-Smith | Finite time blow up for a Navier-Stokes like equation[END_REF]. Notice that [START_REF] Blömker | Markovianity and ergodicity for a surface growth PDE[END_REF]. By the semigroup methods of [START_REF] Kato | Strong L p -solutions of the Navier-Stokes equation in R m , with applications to weak solutions[END_REF], we know from [START_REF] Blömker | Local existence and uniqueness in the largest critical space for a surface growth model[END_REF][START_REF] Blömker | Regularity and blow up in a surface growth model[END_REF] for which their result extends straight forward to complex-valued solutions, that there is a number ǫ > 0, depending only upon u(t) X d , such that for every

where on [t, t + ǫ], v is obtained as the fixed point of the iterated sequence {v (n) (• -t)} n∈N defined by v (0) = 0 and for all n ∈ N by

Then, after taking the Fourier transform of [START_REF] Raible | Amorphous thin film growth: Minimal deposition equation[END_REF], we obtain for all σ ∈ [0, ǫ] and

Thus, if u(t) is a non-negative real-valued function supported in F d + then from the equation ( 20) just above, by using an induction argument, we infer that for all n ∈ N, for all σ ∈ [0, ǫ], v (n) (σ) is also a non-negative real-valued function supported in F d + which implies that for all s ∈ [t, t + ǫ], v(s) is a non-negative real-valued function supported in F d + . Furthermore, by the uniqueness results similar as the ones obtained in [START_REF] Blömker | Regularity and blow up in a surface growth model[END_REF][START_REF] Furioli | On the uniqueness in L 3 (R 3 ) of mild solutions for the Navier-Stokes equations[END_REF][START_REF] Kato | Strong L p -solutions of the Navier-Stokes equation in R m , with applications to weak solutions[END_REF], we get that for all s ∈ [t, t + ǫ], u(s) = v(s). Therefore, we deduce that for every t ∈ [0, T d ], if u(t) is a nonnegative real-valued function supported in F d + then for all s ∈ [t, t + ǫ], u(s) is a non-negative real-valued function supported in F d + . Since u(0) = u 0 = 2 7 Aw and w is a non-negative real-valued function supported in F d + , then we infer that for all s ∈ [0, T d ], u(s) is a non-negative real-valued function supported in F d + . Then by Theorem 3.1, u(T d ) is not in any Triebel-Lizorkin space or Besov space, and hence in particular is not in X d , which concludes the proof.