Tristan Delory
email: delory.tristan@gmail.com

Josselin Le Bel

Sylvie Lariven

Nathan Peiffer-Smadja

François-Xavier Lescure

Elisabeth Bouvet

Pauline Jeanmougin

Florence Tubach

Pierre-Yves Boëlle

Pierre-Yves Boelle

Computerized decision support system (CDSS) use for surveillance of antimicrobial resistance in urinary tract infections in primary care

à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

INTRODUCTION

A majority of countries worldwide have national action plans (NAPs) for the prevention of antimicrobial resistance (AMR). [START_REF]Antimicrobial resistance and primary care[END_REF] Surveillance of AMR is essential at every stage of the NAPs, from initial description to monitoring effects, and subsequently inform clinical guidelines for antimicrobial use (AMU). Routine surveillance of AMR often relies on samples collected in hospitals for individual patient diagnosis with data contributed by hospital laboratories. [START_REF] Chin | Antimicrobial resistance surveillance in urinary tract infections in primary care[END_REF][START_REF] Stelling | Integrating Escherichia coli Antimicrobial Susceptibility Data from Multiple Surveillance Programs[END_REF] These data may therefore not be representative of the resistance level in the general population, and inappropriate for recommendations at the community level. [START_REF] Stelling | Integrating Escherichia coli Antimicrobial Susceptibility Data from Multiple Surveillance Programs[END_REF][START_REF] Tornimbene | WHO Global Antimicrobial Resistance Surveillance System early implementation 2016-17[END_REF] Improving AMR surveillance in primary care would be more relevant, and is now recognized as an objective of interest.

2,5,6

Urinary tract infections (UTI) are clinical situations where hospital-based surveillance is likely to lead to overestimate AMR, and to the inappropriate choices of antimicrobial therapy for community-acquired infections. [START_REF] Chin | Antimicrobial resistance surveillance in urinary tract infections in primary care[END_REF][START_REF] Gupta | International Clinical Practice Guidelines for the Treatment of Acute Uncomplicated Cystitis and Pyelonephritis in Women: A 2010 Update by the Infectious Diseases Society of America and the European Society for Microbiology and Infectious Diseases[END_REF] Indeed, hospital-based surveillance often reports for patients having fail initial empirical therapy, with risks factors for antimicrobial resistance, complications or recurrence. Urinalysis collected among these patients can also bias the reporting of resistance because of the wider range of bacterial species involved in their UTI than in uncomplicated infections. [START_REF] Chin | Antimicrobial resistance surveillance in urinary tract infections in primary care[END_REF] Yet the available AMR surveillance data from the European Antimicrobial Resistance Surveillance System network (EARS-NET) only reports hospital-based data aggregated over blood, and cerebrospinal fluid samples irrespective of the underlying pathology (urinary tract infections, pneumonia, wound infections, ...).

More relevant data is available from the French (MedQual) surveillance network for communityacquired UTI in biological laboratories, but cannot be stratified by infection type or patient's characteristics.

8-10

Joint information on resistance level by type of UTI may however be readily obtained using the case description submitted by practitioners to an online computerized decision support system (CDSS) for antimicrobial prescribing. [START_REF] Laka | Can evidence-based decision support tools transform antibiotic management? A systematic review and meta-analyses[END_REF] In those, detailed information on the type of UTI and microbiology is input at the point of care to assist clinical decision-making and improve antimicrobial prescription. It has the potential to reduce the likelihood of recall bias related to surveillance based on the retrospective collection of cases.

We hypothesized that data submitted to Antibioclica French online guideline-based CDSS for antimicrobial prescribing extensively used in primary care (http://www.antibioclic.com)would allow describing resistance level by infection type in community-acquired UTI due to E. coli.

Here, we report the susceptibility profile for key antibiotics by type of UTI involving E. coli from 2017 to 2020. We then compare it to that obtained by the MedQual French surveillance system for communityacquired UTI, and by EARS-NET for invasive infections.

MATERIAL AND METHODS

Objectives

We aimed to highlight the added value of online computerized decision support systems (CDSS) for antimicrobial prescribing in primary care to inform the surveillance of antimicrobial resistance in community-acquired UTIs involving E. coli.

Study design

We conducted a cross-sectional analysis of Antibioclic data, prospectively collected from November 2017 (week 47) to September 2020 (week 37).

12

Description of the CDSS extension for UTI

Antibioclic was developed by academics and released in October 2011. Its access and use are free of charge. It relies on a Task-Network Model (TNM) to translate national guidelines into an easy-to-use system described elsewhere. [START_REF] Delory | A computerized decision support system (CDSS) for antibiotic prescription in primary care-Antibioclic: implementation, adoption and sustainable use in the era of extended antimicrobial resistance[END_REF] An academic steering committee monitors official updates of national guidelines for each pathology/infectious disease.

In late 2017, we extended Antibioclic with a module for patient-specific recommendations of antimicrobial therapy for UTI. Access to this module was possible upon registration. The UTI targeted by the system included asymptomatic bacteriuria in pregnant women, cystitis (in children, uncomplicated and complicated in adults), pyelonephritis (in children, uncomplicated and complicated in adults), and male UTI. Users could input characteristics of patients, results of urine culture (when available), and exposure to fluoroquinolone within the last 6 months to individualize the proposition for antimicrobial therapy. In all cases, users were free to follow or not the CDSS proposition for antimicrobial therapy. Previous cross-sectional surveys showed that 96% of users reported CDSS assistance during the last consultation. Antibioclic was systematically used for initiation of an antibiotic course by 24% of users, and 93% reported having followed the CDSS recommendation for the latest prescription. Most GPs were comfortable using the CDSS in front of a patient.

12

Data

We defined a query for urinary tract infection (Q-UTI) as a query performed to the CDSS for the antimicrobial therapy of a UTI. . When urinalysis was not performed or registered for managing infection, the Q-UTI was considered as not documented. Antimicrobial resistance profile of Q-UTI was established by primary care laboratories working with physician using the CDSS. Susceptibility testing result was reported by physician using the CDSS, according to guidelines from the French microbiology society ("Comité de l'Antibiogramme de la Société Française de Microbiologie", CA-SFM) aligned on the European Committee on Antimicrobial Susceptibility Testing (EUCAST).

15

We collected the 2017 to 2019 data on E. coli resistance to key antibiotics (amoxicillin, thirdgeneration cephalosporin -3CG, fluoroquinolones -FQ, and aminoglycosides) from the EARS-NET for invasive infections and the French MedQual network for primary care urine cultures (last data available for both networks) 7-10

. EARS-NET reports aggregated resistance issued from blood and cerebrospinal fluid, regardless of the underlying pathology (urinary tract infections, pneumonia, wound infections…). [START_REF]Antimicrobial resistance in the EU/EEA (EARS-Net) -Annual Epidemiological Report 2019[END_REF] EARS-NET for France relied on three networks cumulating a maximum of 59 health institutions laboratories over surveyed period: 23 from teaching hospitals, 30 general hospitals, 3 military hospitals, and 3 private hospitals. Duplicates are eliminated, data aggregated and sent to EARS-NET for external quality assessment in collaboration with the United Kingdom National External Quality Assessment Service (NEQAS-EARS). [START_REF]External quality assessment of laboratory performance -European Antimicrobial Resistance Surveillance Network (EARS-Net)[END_REF] The representativeness for national population coverage of hospitals and population was ranging from 20% to 22% over study period. [START_REF]Antimicrobial resistance in the EU/EEA (EARS-Net) -Annual Epidemiological Report 2019[END_REF][START_REF]Observatoire National de l'Epidémiologie de la Résistance Bactérienne aux Antibiotiques (ONERBA)[END_REF] The MedQual network reports aggregated resistance issued from random urine culture performed in primary care, regardless of the underlying pathology and does not report on aminoglycosides.

MedQual relied on 610 to 1016 private practice laboratories in all 13 regions of France during survey period, with 18% to 25% representativeness of private practice laboratories, and population. Regional resistance levels for fluoroquinolones, and 3CG in E. coli are only available for year 2019. Results of susceptibility tests are monthly collected in the MedQual database centre for validation and analysis.

8-10

Statistical analysis

We restricted the analysis to Q-UTI performed by primary care users, involving E. coli and regarding cystitis, pyelonephritis in adults except for pregnant women, and male UTI. We first described the characteristics of patients by type of UTI. Then we computed the 95% confidence interval (95%CI) for the percentage of resistance to amoxicillin, 3CG, FQ, and aminoglycosides in E. coli, in data issued from our CDSS-extension. We compared the resistance level to the one issued from MedQual and EARS-NET, using crude prevalence ratio and the chi-squared test. All tests were two-tailed and the level of significance was set at 5%. Analysis was performed on R, version 4.0.1 (R Foundation for Statistical Computing, Vienna, Austria).

Ethics, policies, and funding

Antibioclic is edited and administered by a not-for-profit organization which is not linked to any pharmaceuticals companies, neither for the contents of the CDSS nor for funding. The steering committee members are volunteers and conflicts of interest of members are disclosed on the website.

The funding used to develop the CDSS-extension was obtained from a competitive call of Paris area health authorities. None of the collected data are shared with private companies. The confidentiality policy is fulfilling with European General Data Protection Regulation. The study has been approved by the ethics committee of the CNGE (N° 16051997).

RESULTS

CDSS registered users

During the three years of study, 3,494 medical doctors registered to the CDSS-extension, of which 2,996 (86%) were general practitioners (GPs), and 2,622 (75%) were from the Ile-de-France area.

Users were 52 years old in median [IQR, 40 to 61], and 1,861 (53%) were women. Most were working in group practices or health centers (2,256 -65%). Compared to national data, GPs characteristics were similar for age, with a higher rate of females (53% versus 48%) and GPs-trainer (29% versus 8%). 17,18 Two-third users (2,385 -68%) reported using the previous version of the CDSS (before 2017) and consulting the CDSS in 40% [IQR, 15 to 70] of cases in which they initiated an antibiotic therapy.

UTI due to E.coli in CDSS-extension

The registered users submitted 43,591 Q-UTI to the system during the study period, with a median of

Resistance to key antibiotics

Among the 10,192 E. coli strains described in the Q-UTI, resistance to amoxicillin was present in 4,208 (41.3%; 95%CI, 40.3 to 42.2%), to fluoroquinolones in 1,691 (16.6%; 95%CI, 15.9 to 17.3%), to 3CG in 681 (6.6%; 95%CI, 6.1 to 7.0%), and to aminoglycoside in 578 (5.7%; 95%CI, 5.2 to 6.1%).

Overall, cross-resistance to 3CG and fluoroquinolones was present in less than 10% of Q-UTI. The resistance increased in complicated upper UTIs, reaching ~20% for fluoroquinolones in complicated pyelonephritis and male UTI (Figure 1).

Comparison with surveillance networks for antimicrobial resistance

The resistance levels to the antibiotics were stable over the years within our CDSS and established surveillance systems (Cochran-Armitage tests, p-values >0.050). Figure 1 shows the resistance level of studied antibiotics by type of UTI within our CDSS, and in other surveillance systems.

Amoxicillin

The overall resistance to amoxicillin in E. coli identified in our system (41.3%) was lower than that reported in MedQual (42.7%, prevalence ratio = 0.93 (95%CI, 0.96 to 0.98), p-value =0.004), and in EARS-NET (55.2%, prevalence ratio = 0.75 (95%CI, 0.74 to 0.76), p-value <0.001).

Fluoroquinolones

For fluoroquinolones, overall resistance (16.6%) was higher than in MedQual (12.0%, prevalence ratio = 1.38 (95%CI 1.38 to 1.39), p-value <0.001) and EARS-NET (15.8%, prevalence ratio = 1.05 (95%CI 1.05 to 1.06), p-value = 0.041). This higher resistance for fluoroquinolones was found in all types of UTIs but uncomplicated cystitis, and ranged from 14.3% to 20.4%. The prevalence ratios ranged between 0.91 and 1.70.

Third generation cephalosporins

For 3CG, all types of UTI had higher resistance rate than in MedQual (6.6% versus 3.5%, prevalence ratio = 1.90 (95%CI, 1.90 to 1.91), p-value <0.001). It ranged from 4.8% to 10% and corresponded to prevalence ratios of 1.37 to 2.86. Conversely, resistance to 3CG was lower than that reported by EARS-NET (6.5% versus 9.5%, prevalence ratio = 0.68 (95%CI, 0.68 to 0.69), p-value <0.001).

Amynoglycosides

Overall, resistance to aminoglycosides was lower in our system than in EARS-NET (5.7% versus 7.1%, prevalence ratio = 0.80 (95%CI, 0.79 to 0.80), p-value <0.001). Most significant variation were for uncomplicated cystitis (4.4%, p-value <0.001) and pyelonephritis (4.5%, p-value <0.001), while it was similar to EARS-NET for other UTIs (Figure 1). MedQual was not reporting resistance to aminoglycosides.

DISCUSSION

Community-acquired UTI involving E. coli submitted to our CDSS showed a gradient of resistance from uncomplicated cystitis to complicated pyelonephritis and male UTI. Antimicrobial resistance was higher than that derived from random urine cultures but close to EARS-NET for invasive infections.

We found a concerning rate of resistance to fluoroquinolones in complicated pyelonephritis and male UTI, around 20%.

Gradient of resistance

The existence of a gradient of resistance in E. coli, suggests that the location (lower versus upper) and the type (uncomplicated versus complicated) of UTI could be used as a proxy for levels of resistance.

Resistance is likely to occur in upper complicated UTIs. [START_REF] Brosh-Nissimov | Risk analysis of antimicrobial resistance in outpatient urinary tract infections of young healthy adults[END_REF][START_REF] Wagenlehner | Epidemiology, definition and treatment of complicated urinary tract infections[END_REF][START_REF] Vihta | Trends over time in Escherichia coli bloodstream infections, urinary tract infections, and antibiotic susceptibilities in Oxfordshire, UK, 1998-2016: a study of electronic health records[END_REF][START_REF] Bryce | Comparison of risk factors for, and prevalence of, antibiotic resistance in contaminating and pathogenic urinary Escherichia coli in children in primary care: prospective cohort study[END_REF] These parameters could inform the choice of empirical therapies in primary care and accelerate prescription of more potent antimicrobial therapy. This is of interest, considering that in elderly patients experiencing UTI in primary care, a deferred antimicrobial therapy increases bloodstream infection rate and all-cause mortality.

23

Resistance to fluoroquinolones and 3CG

Consistent with surveillance data and the literature, resistance to fluoroquinolones and 3CG increased from uncomplicated cystitis to complicated upper UTIs . The high frequency of resistance to fluoroquinolones in complicated upper UTIs (~20%) raises concerns regarding the empirical use of oral fluoroquinolones for managing these infections in primary care [START_REF] Brosh-Nissimov | Risk analysis of antimicrobial resistance in outpatient urinary tract infections of young healthy adults[END_REF][START_REF] Stapleton | Escherichia coli Resistance to Fluoroquinolones in Community-Acquired Uncomplicated Urinary Tract Infection in Women: a Systematic Review[END_REF] . It highlights that resistance level in clinically relevant infection in primary-care may be close to that observed in hospital settings.

Primary care driven data issued from CDSS could inform stakeholders for monitoring the effect of NAPs on AMR, and developing guidelines on AMU in community-acquired UTI. [START_REF]Antimicrobial resistance and primary care[END_REF][START_REF] Chin | Antimicrobial resistance surveillance in urinary tract infections in primary care[END_REF][START_REF] Stelling | Integrating Escherichia coli Antimicrobial Susceptibility Data from Multiple Surveillance Programs[END_REF][START_REF] Gupta | International Clinical Practice Guidelines for the Treatment of Acute Uncomplicated Cystitis and Pyelonephritis in Women: A 2010 Update by the Infectious Diseases Society of America and the European Society for Microbiology and Infectious Diseases[END_REF] Indeed, injectable 3CG and oral fluoroquinolones are often both recommended as first-line antibiotics in uncomplicated and complicated upper UTIs. [START_REF] Gupta | International Clinical Practice Guidelines for the Treatment of Acute Uncomplicated Cystitis and Pyelonephritis in Women: A 2010 Update by the Infectious Diseases Society of America and the European Society for Microbiology and Infectious Diseases[END_REF]13,[START_REF] Caron | Practice guidelines for the management of adult community-acquired urinary tract infections[END_REF] The preferential use of injectable 3CG over oral fluoroquinolones is recommended whenever the resistance to fluoroquinolones reaches 10% or higher. [START_REF] Gupta | International Clinical Practice Guidelines for the Treatment of Acute Uncomplicated Cystitis and Pyelonephritis in Women: A 2010 Update by the Infectious Diseases Society of America and the European Society for Microbiology and Infectious Diseases[END_REF]13,[START_REF] Caron | Practice guidelines for the management of adult community-acquired urinary tract infections[END_REF] Such guidelines are developed in a hospital-based perspective where physicians are aware of the local resistance rate, and have access to susceptibility testing. They may be not suitable for primary care, where GPs can be unaware of national and local resistance rates, and lack access to point-of-care susceptibility testing. [START_REF] Lecky | Infectious Disease and Primary Care Research-What English General Practitioners Say They Need[END_REF] One may then suggest that dual recommendations can mislead GPs towards the prescription of an oral antibiotic over an infused antibiotic. Reducing the FQ/3CG ratio in primary care is thereby unlikely, as illustrated by the high use of oral fluoroquinolones for UTI in primary care.

30,31

Limits to comparisons between surveillance systems

The rate of empirical antimicrobial prescriptions was lower (60% versus 97%) than in a recent French survey enrolling women with a similar rate of documented UTI. [START_REF] Rossignol | Incidence of urinary tract infections and antibiotic resistance in the outpatient setting: a cross-sectional study[END_REF] GPs may indeed consult the CDSS less frequently in infections without urine culture, as the guidelines are simpler than when a documentation is available. This preferential use of the platform for challenging situations could overestimate resistance in our system. The sampling properties of the surveillance systems used are ill characterized, and the differences in sampling methods across surveillance systems can bias resistance estimates and comparisons. [START_REF]Antimicrobial resistance and primary care[END_REF][START_REF] Chin | Antimicrobial resistance surveillance in urinary tract infections in primary care[END_REF][START_REF] Stelling | Integrating Escherichia coli Antimicrobial Susceptibility Data from Multiple Surveillance Programs[END_REF][START_REF] Gupta | International Clinical Practice Guidelines for the Treatment of Acute Uncomplicated Cystitis and Pyelonephritis in Women: A 2010 Update by the Infectious Diseases Society of America and the European Society for Microbiology and Infectious Diseases[END_REF][START_REF] Kandil | Trends in Antibiotic Resistance in Urologic Practice[END_REF] It is acknowledged that in EARS-NET, underreporting of susceptible isolates can occur for blood cultures, resulting in an overestimation of resistance. [START_REF]External quality assessment of laboratory performance -European Antimicrobial Resistance Surveillance Network (EARS-Net)[END_REF] Also, UTIs are not specifically targeted in EARS-NET, while in France the urinary tract is the most frequent portal of entry for bloodstream infection. EARS-NET may represent a worst-case scenario for resistance in the community. Its use may reduce the likelihood of misinforming guidelines on AMU in primary care, but data like we provide are more relevant. [START_REF] Robineau | Management and outcome of bloodstream infections: a prospective survey in 121 French hospitals (SPA-BACT survey)[END_REF] Looking at Q-UTI submitted to our CDSS allows describing the nature and frequencies of UTIs seen in general practice, where the prescription is required. In our system, Q-UTI are submitted by participating GPs prospectively, which limits recall bias. It jointly described the pathology and the germs, providing more details than in two other systems. Despite differences in sampling, the resistance levels were in the range observed between random urine cultures, and invasive infections. [START_REF]Antimicrobial resistance in the EU/EEA (EARS-Net) -Annual Epidemiological Report 2019[END_REF][START_REF]Observatoire National de l'Epidémiologie de la Résistance Bactérienne aux Antibiotiques (ONERBA)[END_REF][START_REF] Primo | Surveillance de la résistance bactérienne aux antibiotiques en soins de ville et en établissements pour personnes âgées dépendantes[END_REF][START_REF] Primo | Surveillance de la résistance bactérienne aux antibiotiques en soins de ville et en établissements pour personnes âgées dépendantes[END_REF] The comparison of resistance levels between networks is also hampered by the differences in periods for data collection, with older data for MedQual and EARS-NET when our estimates are nearly real-time. The resistance levels to the antibiotics were stable over the years within our system and established surveillance systems.

Combined with the slow change in antimicrobial resistance in France, this support that recent changes are unlikely to explain the differences between these data sources. [START_REF]Antimicrobial resistance in the EU/EEA (EARS-Net) -Annual Epidemiological Report 2019[END_REF][START_REF]Observatoire National de l'Epidémiologie de la Résistance Bactérienne aux Antibiotiques (ONERBA)[END_REF][START_REF] Primo | Surveillance de la résistance bactérienne aux antibiotiques en soins de ville et en établissements pour personnes âgées dépendantes[END_REF][START_REF] Primo | Surveillance de la résistance bactérienne aux antibiotiques en soins de ville et en établissements pour personnes âgées dépendantes[END_REF] Finally, most users of the CDSS were concentrated in the "Ile-de-France" area, where antibiotic consumption is larger than in France as a whole: 23.8 defined-daily doses per 1000-inhabitants in Ile-de-France versus 22.5 for the rest of the country in 2018 for primary care. [START_REF] Cavalié | Evolution of antibiotics consumption in primary care in France, from 2009 to[END_REF] However, 2019 resistance data from the national program for surveillance of antimicrobial resistance in primary care shows that resistance levels in our system falls in the range observed among E. coli at regional level; from 6.8% to 15.3% for fluoroquinolones (11.0% in "Ile-de-France"), and from 2.4% to 5.8% for 3CG (5.3% in "Ile-de-France").

situation.

Conclusion

We presented data on E. coli resistance to antibiotics collected in primary care using a CDSS for antimicrobial prescription. respectively. The following abbreviations are used: "Cys-uc" for uncomplicated cystitis; "Cys-c" for complicated cystitis; "Pyelo-uc" for uncomplicated pyelonephritis; "Pyelo-c" for complicated pyelonephritis; and "Male-UTI" for male urinary tract infection.

  389 ‡ Chi-squared comparison of patients' characteristics among uncomplicated cystitis (reference class) to other 390 types of UTI: complicated cystitis, uncomplicated pyelonephritis, complicated pyelonephritis, and male UTI.

  391

Figure 1 :

 1 Figure 1: Resistance rate to amoxicillin, third-generation cephalosporin, fluoroquinolones, and aminoglycosides, in E. coli, by type of UTI in CDSS-extension and compared to MedQual and EARS-NET data.

  This can inform in real-time on the ecology and surveillance of E.coli resistance in community-acquired UTI. Such data could be embedded in existing surveillance systems. They underline the risk of empirical use of fluoroquinolones in complicated upper UTIs and suggest a preferential use of 3CG in such settings. The future linkage between diagnosis, resistance, and prescription is needed to better describe and inform antimicrobial use through individualized guidelines for the prescription.

	Patients' characteristics	Cystitis Uncomplicated Complicated	†	Pyelonephritis Uncomplicated Complicated	†	Male UTI	p-value	‡
		N = 1,919	N = 2,255		N = 2,352	N = 440		N = 3,226
	Age ≥ 65 years	539 (28.1%)	1,796 (79.6%)	304 (12.9%)	275 (62.5%)		1,152 (35.7%)	<0.001
	Living in nursing home	23 (1.2%)	140 (6.2%)		12 (0.5%)	35 (8.0%)		46 (1.4%)	<0.001
	Repeated UTI	176 (9.2%)	346 (15.3%)		113 (4.8%)	42 (9.5%)		154 (4.8%)	<0.001
	Antibiotic intake within 3 months	445 (23.2%)	730 (32.4%)		302 (12.8%)	95 (21.6%)		509 (15.8%)	<0.001
	Fluoroquinolones within 6 months	347 (18.1%)	568 (25.2%)		424 (18.0%)	139 (31.6%)		845 (26.2%)	<0.001
	Traveled abroad within 12 months	30 (1.6%)	31 (1.4%)		54 (2.3%)	10 (2.3%)		82 (2.5%)	0.016
	Hospitalization within 12 months	87 (2.3%)	372 (9.1%)		53 (1.9%)	57 (10.1%)		366 (7.2%)	<0.001
	† Excluding infections in pregnant women.

avenue de l'hôpital, 74370 Epagny-Metz-Tessy, France.

Table 1: Patient's characteristics by type of UTI.

Acknowledgment: This work was selected to be presented at the 30th European Congress on Clinical Microbiology and Infectious Diseases (ECCMID) -2020. It is registered in the 30th ECCMID 2020, abstract book, under the number 3319.

We thank all the users for their positive feedback and their participation in the CDSS development. We thank Gunther Groenewege for his help in ergonomics design. We thank the ANTIBIOCLIC+ study group (alphabetical order): Emilie Ferrat, Jean Gaschignard, Nathan Moreau, Raphaël Lepeule, Philippe Lesprit, Louise Rossignol, and Cécile Souty. We also thank the Paris Diderot University, the SPILF, the CNGE, the CMG, the Regional Health Authorities of Ile-de-France (ARS Ile-de-France), as well as the Health Insurance Agency of Ile-de-France (DRSM Ile-de-France) for their active collaboration.

Funding:

The CDSS-extension (Antibioclic+) was funded by a grant from the Regional Health Authorities of Ile-de-France (ARS Ile-de-France) obtained in 2016.

Conflict of interest: None to declare.

Access to data:

Academic researchers can access the data for 12 months after the publication of results. Transfer to countries outside of the EU is not allowed. A formal request had to be sent to the corresponding author.

Author's contribution:


Michael Zock
email: michael.zock@lif.univ-mrs.fr

Guy Lapalme
email: lapalme@iro.umontreal.ca

Mehdi Yousfi-Monod

Learn to speak like normal people do: the case of object descriptions

Successful communication requires loads of various knowledge including peoples' habits to express their thoughts. We deal here with the description of objects composing a scene. This is called 'reference generation', a task very frequently performed in language production. The skill of language production requires at least two kinds of competencies: one dealing with the mapping of concepts to forms (linguistic competency), the other dealing with the choice of the various resources (communicative competency). Messages can be expressed in many ways and at various levels: lexical, grammatical, morphological, etc. Since different means tend to produce different effects, students have to learn when to use which. This kind of knowledge, commonly called 'pragmatic knowledge' or 'communicative competency', can rarely be formalized as solid rules. It is largely based on experience. People learn on the basis of correlations, that is they realize that changes of the situation may reflect in language: different inputs (ideas, objects of a scene) yielding different outputs, i.e. linguistic forms. We present here a setting that allows for this kind of learning. It is a web-based application that generates a scene and various descriptions of its components. Users can change the scene and watch how these choices affect (or not) the linguistic form. The descriptions are produced in two languages (English and French), and they are rated in terms of communicative adequacy. This should allow students not only to learn how to produce correct sentences, but also help them to realize which one of them is, communicatively speaking, the most adequate form.

Introduction

We live in a world surrounded by objects that we can see, touch, smell or use, and to which we can refer via our body (eyes, gestures) or via language. In order to allow others to 'see' the objects we have in mind, we can point at them or describe them in linguistic terms. Being one of the first things children learn (Matthews et al., 1997) generation of referring expressions (GRE) seems to be a simple task, yet it can be quite complex, and there are various reasons for this.

While the objects we talk about hardly ever change during our conversation, the linguistic means used for describing them do. In fact, they vary considerably. One may use a basic-level word (dog) or a more specific term (spaniel), or one may switch from a relational description (the dog on the lawn) to the object's role (shepherd dog). One may also use a proper noun (Fido) or simply a pointer (pronoun), etc. Imagine a scene containing a 'dog' and a 'cat', the goal being to talk about the 'dog'. entity type size color e 1 cat small white e 2 dog big black

In this particular case, only the type (dog) needs to be mentionned. Actually, in theory any of the following expressions would do: (1) it, (2) the Doberman, (3) the dog. All forms are correct, but not all of them suit equally well the situation. Expression (1) is underspecified and appropriate only under very specific circumstances: high saliency, second mention, etc. ( 2) is overspecified, as it provides more information than needed for identifying the intended object. The third example, is a minimal description. Using a basic level term (dog) suits most situations.

It should be noted though that minimal descriptions are not always used. People often produce descriptions more specific than needed (Pechman, 1989). Actually, this extra information may be warranted. For example, in the scene described above, it would be more appropriate to use the word 'Doberman' (specific term) than the more general term 'dog'. While the latter allows recognition of the indended referent, it does not convey the possibly important information that the object referred to is potentially dangerous.

As we can see, speakers have quite a few options. Yet, if this diversity of (conceptual and linguistic) means offers the speaker much freedom, it also puts pressure on him. He has to choose, and has to know when to use what resource. Since different forms yield different effects, the speaker has to learn not only how to refer to a given object -i.e. what information to provide to single out an object among others, and how to pack this information into words-but also when to use each specific resource: noun vs. pronoun; specific term vs. more general term. This implies that the speaker becomes sensitive to the listener -What does she know? What is she interested in? What is currently on her mind?-or otherwise he is likely to produce misleading cues. Clearly, linguistic knowledge is insufficient, we also need knowledge concerning language use (pragmatic) and peoples' information processing habits and needs. This kind of information will not be found in grammars or in textbooks, it is generally acquired by observing language in use.

While there are different referential acts, we will confine ourselves here only to one of them: descriptions of object mentionned for the first time. We will show how an object description may vary as a function of a set of alternatives. [START_REF] Olson | Language and Thought: Aspects of a Cognitive Theory of Semantics[END_REF] has shown that object descriptions are context sensitive, that is, the way an object is described depends on the objects from which it must be discriminated. To check his intuition, he carried out a small experiment composed of a set of simple geometrical elements. Keeping the same reference object, he asked his subjects to verbalize the scene in varied contexts. The results showed that the same 'flat, round, white object' was described quite differently as "the white one, the round one, or the round white one" depending on the similarities between the target object and the elements of the alternatives (i.e. contrast set or surroundings elements) from which it needed to be discriminated. As one can see in Figure 1, two features are sufficient to ensure unambiguous reference: 'color', 'shape' or their combination. We will show in the remainder of this paper how the notion of microworld -a scene whose description varies as a function of the changes of a set of parameters: the object to be described, the viewpoint, the context, i.e. the other objects composing the scene, objects from which it must be discriminated,-could be used to support foreign language learning, in particular, the acquisition of language use (communicative competency). Just as linguistic knowledge (the knowledge of words and rules) does not guarantee fluency (or, fluent speaking), does the skill of speaking guarantee successful communication. This latter requires not only the ability to convey what one wants to say, but also the ability to choose the right resources (content and linguistic form) at the right moment, that is, in agreement with the circumstances (context, goal), so that the listener can decode properly the message and its communicative goal. In other words, it is not enough to dump some message on the receiver to make communication happen. The speaker has to learn to move from his egocentric point of view -(What is his concern? What does he want to say?),-to the listener's position, to be able to see things also from her perspective. What does s/he know? What is on her mind? What does she believe in or care for? We will try to achieve this for a very small domain of language: the province of reference.

The importance of context for message encoding

If mastering a language requires the learning of a skill (speaking, listening, etc.), i.e. procedural knowledge, it also requires the learning of a set of rules (declarative knowledge). Of course, this latter can be achieved in various ways, via explicit learning or by observation (our approach), etc. While this latter is the natural approach, it has a shortcoming: it is not systematic, hence we may have to wait a long time before encountering again a similar situation in which a given expression appeared for the first time. This is where a micro-world approach might be useful.

While systematic variations are certainly not part of nature's manifestations, certain kind of rules can probably best be observed (and possibly learned) in closely controlled experiments/settings. Put differently, a lot of knowledge is acquired on the basis of regular changes or co-variation between an input and an output. Since this regularity or systematicity does not occur in nature, while it would be good for learning, one should allow for it. In addition one should visualize the determining factors (the links between an input and output) and allow the user to control the inputs.

We now describe the principles and the implementation of a web-based application, called WebREG, to help a speaker learn how to generate expressions that refer properly, i.e. unambiguously and, given the circumstances (context), adequately to concrete entities occuring in a given scene.

A solution: production of distinguishing descriptions

According to (Dale 1992:1) a referring expression (RE) designates an entity in the real (or imaginary) world. This work deals with such expressions and complies with the following characteristics (Dale & Reiter 1995):

• They are expressed as noun phrases rather than pronouns or other linguistic means;

• They refer to physical objects rather than to abstract entities; • They are meant to allow the hearer identify an object rather than satisfy any other communicative goal.

So, following Dale & Reiter, we try to achieve a referential communicative goal by generating a distinguishing description of the target entity. This description applies to the target but not to any other object present in the scene and seen by the hearer (context set). This set, minus the target, is called the 'contrast set' or 'potential distractors'.

To distinguish the target from the potential competitors, we use features, i.e. properties (size, color, …) and relational terms (left of, in front, …). The object type (chair, sofa, fan, …) is special and mandatory for generation because it serves as the head of the noun phrase. Properties and relations are represented as attribute-value pairs. On the language side they are realized as adjectives or prepositional phrases modifying the noun phrase. For example, the object 'chair' with the property (color: red) and the relation (right of, desk) might be realized as the 'red chair to the right of the desk'. The goal of referring expression generation is thus to select a set of pairs that distinguish the target from the rest (potential alternatives, i.e. competitors).

In order to determine which RE to block, we interpret the Gricean Maxims [START_REF] Grice | Logic and conversation[END_REF]) in this context as follows:

• Quality: a RE must be a precise description of the target;

• Quantity: a RE should contain enough information to allow the hearer to identify the target, but not more; • Relevance: a RE should only mention features necessary to allow the distinction of the target from the contrast set; • Manner: a RE should be as short as possible.

The interpretation of these maxims depends on the application goal and the context and will be discussed after the presentation of our application in the next section.

A web application for learning referring expressions

WebREG is a web-based application that presents several types of bilingual (French and English) RE generation activities. It can be accessed on-line at:

http://www.iro.umontreal.ca/~lapalme/WebREG The user interface (see Figure 2) shows a 2D graphic scene composed of a small set of entities represented as pictures. Entities have properties and entities can be related to each other. The entities, properties and their pictorial representation have been taken from the 'TUNA referring expression corpus' (van [START_REF] Van Deemter | Building a semantically transparent corpus for the generation of referring expressions[END_REF]). Depending on the activity, the scene's configuration, -i.e. the choice of the entity to be expressed, the set of competing entities, their position and properties-are chosen by the program or the learner. WebREG can generate in French or English one or several REs for a given target . The user interface is currently only in English.

Entities, properties and relations

The TUNA corpus contains entities for furniture: chair, desk, fan and sofa. We added in our application a box to allow for the use of such objects. In addition we used some of the properties of TUNA like: size (small or large), color (red, black, brown, gray, green or blue) and orientation (from the front / back, turned to the left and to the right). Note, that not all properties apply to all objects. Boxes are always big, from the front and colored red, green or blue.

Entities are placed on a 2D plane and are referred to with respect to the other objects composing the scene. To allow for this we use the following properties and relations: Properties:

• absolute positioning: top left/right corner, bottom left/right corner;

• relative positioning: bottommost, topmost, leftmost, rightmost. Relations:

• positioning: left of, right of, over, under;

• containment: in, contains.

Activities

We vary the learning methods in order to motivate the learner to create a RE. WebREG offers currently three types of activities. They all focus on insightful learning, i.e. competency.

Practice (How to characterize or express an object ? Figure 2)

The learner or the program create a scene by choosing some objects, placing them on a 2D plane and deciding on a target. The machine will then produce ten REs in decreasing order of relevance, the order being controlled via an algorithm described in section 4 (Reference generation). It should be noted though, that learning the principles underlying the generation of referring expressions is much harder than, say, learning the rules for generating plural nouns in English. While a single change at the input (one vs. several) may yield various changes at the output (1 car/horse vs. 2 cars/horses), neither of them has an impact on the communicative level. This is quite different from the case of referring expressions where the change of a grammatical resource (say, pronoun rather than a definite noun phrases) may considerably affect the scope, i.e. the interpretation of meaning and the ease of processing.

To check the validity of this last statement let us see what happens if you vary the linguistic means [in/definite description ("a/the + N"), pronouns (its), ...] used to refer to some concepts. Suppose the concepts were POPULATION and PLACE, that they are part of a message called B, i.e. -[LEAVE (POPULATION, PLACE)],-which is preceded by A and followed by C. In this case we could have any of the following realisations (A) X--town was a blooming city. Yet, when hooligans started to invade the place, (B), [i.e. any of the occurrences (a-e) here below]. (C) The place was not livable any more.

(a) the place was abandoned by (its/the population)/them. (b) the city was abandoned by its/the population. (c) it was abandoned by its/the population. (d) its/the population abandoned the city. (e) its/the population abandoned it.

While all the candidate sentences in (a -e) are basically well-formed, each one has a specific effect, and not all of them are equally felicitous. Some are ruled out by virtue of poor textual choices -(e.g., in (a) "the place" is suboptimal, since it immediately repeats a word),-others because of highlighting the wrong element, or because of wrong assignment of the informational status (given-new) of some element (e.g., in (d) "the city" is marked as 'minimal' new information, while actually it is known, i.e. old information). Probably the best option here is (c) since this preserves the given-new distribution appropriately, without introducing potentially ambiguous pronouns.

Finding the target (

Where is the target? Figure 3)

The system generates randomly a scene and selects a target. While not highlighting the target, it displays a description of it (in this particular case: 'the fan facing to the left') inviting the user to find the object described by the RE (here, 'the small red fan at the lower left side of the scene'). Learners tend to make typical mistakes. This being so, one can imagine scenarios with typical confusion sets, i.e. frequently confused items are presented together as contrastive sets. This kind of strategy is frequently used in other areas of language learning like spelling or pronunciation.

Decide on the correct RE (Which referring expression is correct? Figure 4)

The system generates randomly a scene, selects a target and shows it to the user. In addition it generates REs for all objects of the scene, inviting the user to find the RE corresponding to the target. The user can change the language at any moment and the system will generate accordingly the RE in the chosen language. This kind of learning can be seen as a combination of the preceding two exercices : learning by observing correlations and learning based on contrast sets.

RE generation from an algorithmic point of view

RE generation involves finding a set of property-value and relation-value pairs to designate the target unambiguously. As our scenes are composed of only a small set of entities and relations, we decided to select an algorithm that tries all possible solutions up to a certain limit to remain in line with psycholinguistic constraints and the Gricean maxims.

The algorithm is based on a branch and bound algorithm that guarantees the production of an unambiguous RE for a given target [START_REF] Krahmer | Graph-based generation of referring expressions[END_REF]. It determines a single optimal RE for a scene and a target. This strategy is perfectly fine in cases where the goal is the production of a single expression, but our problem is slightly different. Depending on the activity we want to offer the learner more than one RE. In addition we would like to have a finer control concerning the target's interpretation (possible ambiguity) and the resources used in order to refer to an object.

Hence, we modified the algorithm to keep the N-best subgraphs according to the cost function which roughly corresponds to their number of arcs. Yousfi-Monod (2010) presents the changes made to the original algorithm in order to produce more natural sounding descriptions in the case of many similar objects or when the referring expressions tend to become too long. The N-best subgraphs are used to generate N REs using a generic noun phrase pattern comprising a determiner, a noun, adjectives and prepositional phrases which are themselves composed of a preposition and a noun phrase. The graph is recursively traversed starting from the vertex corresponding to the target. The type property is converted to a noun, the others to adjectives and relations map to prepositions.

A specialized lexicon has been built for entities, properties and relations. It contains the necessary morphological information in order to allow for adequate processing of gender and number in English and French.

When being in the practice mode, WebREG presents many realizations for the target. Currently they are shown in the order in which they are generated by the algorithm described above. However, one could well sort them according to other criteria like: number of words, or types of properties and relations, etc.

WebREG is a client-server web application. The client side is executed in the web browser via a Javascript -(we use the jQuery framework to deal with the specifics of each browser)-to modify the HTML and CSS to change the position, size and color of the objects. The Javascript code generates the scene and deals with the users' actions. It communicates the modification of the scene to the server that deals with the generation of REs, and it keeps track of the learners' progress.

Perspectives

This prototype opens new possibilities: the current properties are quite generic and can be applied to all entities. Adding new ones implies not only that we have to deal with them at the algorithmic level, but also at the interface level, i.e. how to make them natural, i.e. easy at the user interface. Other types of activities could be added such as:

• Re-create the input: the system creates a scene, identifies a target and generates a RE. Yet, rather than showing the initial input (scene) the system shows a modified version of it asking the learner to change it to comply with the produced RE. • Create the correct RE: pointing at a component element of a scene (target object) the system presents a list of words to be used by the user (via drag and drop) to create the appropriate RE. • Select the most natural RE: since objects can be described in many ways, the user should be allowed to select the one seeming to be the most natural one to him or her. The system could track these answers and determine human preference criteria (relative or absolute positioning, adjective vs. propositional groups, …) which could be used later on for prioritizing REs. In this case, it would be the system that learns, not the user. This would also validate the intuitions we embedded in the system and our interpretation of the Gricean maxims. It would be interesting to allow for several targets rather than just one to parameterize the difficulty of exercises.

Of all the proposed activities, the last one is probably the most interesting one, as it gives researchers a means to collect natural data to design then their algorithms accordingly. Of course, this makes only sense if the sentences proposed by the system contain natural sounding forms. Still, this looks like a very promising strategy, as we are still not in a position to guarantee that the chosen means (linguistic resources) allow both well-formedness and sucessfull communication. This being so, it may be wise to listen to the user asking them for feedback concerning the naturalness of a given expression produced under certain (well controlled) constraints.

Conclusion

This work is, to our knowledge, the first one to use the generation of REs as a task for learning a new language. As stressed at the beginning, learning a language is more than just learning to produce grammatically correct forms. As anything can be expressed via various means (lexical, grammatical, ...), one also needs to learn when to use what specific resource. And in this respect REs are an interesting application, as even native speakers do occasionally make 'mistakes', not at the linguistic level, but at the pragmatic side.

We have extensively drawn on features of the TUNA challenge [START_REF] Gatt | The TUNA-REG challenge 2009 : Overview and evaluation results[END_REF]). For example, the selection of discriminating features is based on an algorithm that was very successful within this context. We adapted this algorithm to be able to produce various acceptable forms for a given target while being able to address in an efficient and useful way for the learner some of the inherent ambiguities of the target. It would be interesting now to confront our system with the real world and test it with language learners. To this end we will certainly revise the icons used, and more importantly, see what kind of principles could be used to produce expressions that are not only grammatically correct, but also natural, i.e. corresponding to the forms used by 'normal' people, that is, a majority.

Fig. 1 .

 1 Fig. 1.. Relationship between some intended object, a context and the linguistic form

Fig. 2 .

 2 Fig. 2. Training mode of WebREG: the scene is on the left, the centre contains the toolbox and to the right is the list of proposed REs for the current target pointed out by the white arrow.

Fig. 3 .

 3 Fig. 3. Target mode of WebREG: the learner must click on the entity she thinks the RE is referring to. In the top right corner we see the number of attempts and the percentage of correct answers.

Fig. 4 .

 4 Fig.4. The learner must click on the RE on the right corresponding to the target pointed at by the arrow. If ever the user made a mistake, the system displays the right answer in green (both the RE and the object), while highlighting in red the RE selected by user and the corresponding entity.


Stéphanie Anceau
email: stephanie.anceau@cea.fr

Pierre Bleuet
email: pierre.bleuet@cea.fr

Jessy Clédière
email: jessy.clediere@cea.fr

Laurent Maingault
email: laurent.maingault@cea.fr

Jean-Luc Rainard
email: jean-luc.rainard@cea.fr

Rémi Tucoulou
email: remi.tucoulou@esrf.fr

Nanofocalized X-Ray Beam To Reprogram Secure Circuits

Keywords: X-ray, Flash, EEPROM, RAM, circuit edit, MOS Stuck-At

Synchrotron X-ray nano-beamlines is investigated as a tool to perturb microcontroller circuits. This technique is used to target the Flash, EEPROM and RAM memory of a circuit. The obtained results are very promising and show that it is possible to corrupt a single transistor in a semi-permanent state. A simple heat treatment can remove the induce effect, thus making the corruption reversible. A concrete attack on a code stored in Flash is demonstrated.

Introduction

Hardware security labs and the need to corrupt the processing of recent circuits lead to a constant research of new perturbations means. The possibility to use visible and IR light was revealed by Skorobogatov and Anderson [START_REF] Skorobogatov | Optical Fault Induction Attacks[END_REF]. The physical phenomenon have been studied and explained in the failure analysis community [START_REF] Habing | The Use of Lasers to Simulate Radiation-Induced Transients in Semiconductor Devices and Circuits[END_REF][START_REF] Henley | Logic failure analysis of CMOS VLSI using a laser probe[END_REF][START_REF] Burns | Reliability/design assessment by internal-node timing-margin analysis using laser photocurrent injection[END_REF][START_REF] Hériveaux | Electrical Modeling of the Effect of Photoelectric Laser Fault Injection on Bulk CMOS Design[END_REF]. Laser light can be synchronized and focalized in order to induce transient faults. In the security evaluation practice, these faults may give powerful results. Electromagnetic radiation perturbation give a new breach for circuit corruption [START_REF] Poucheret | Local and Direct EM Injection of Power Into CMOS Integrated Circuits. Fault Diagnosis and Tolerance in Cryptography[END_REF][START_REF] Quisquatter | Eddy current for magnetic analysis with active sensor[END_REF][START_REF] Schmidt | Optical and EM Fault-Attacks on CRT-based RSA : Concrete Results[END_REF]. This mean may not be as versatile as light but can give also very interesting results. The access to the circuit is less restrictive, a depackaging is not necessarily required.

In order to continue to investigate the wavelength spectrum of perturbation, it is propose here to give a glance to X-ray possibilities. X-ray interaction with electronic circuits have been analyzed in the past [START_REF] Micheloni | Inside NAND Flash Memories[END_REF][START_REF] Oldham | Total Ionizing Dose Effects in MOS Oxides and Devices[END_REF][START_REF] Oldham | Advances in Solid State Electronics and Technology (ASSET) Series[END_REF][START_REF] Gerardin | Radiation Effects in Flash Memories[END_REF], but the usage for security evaluation has been mainly restricted to die and package imaging, and mentionned as a perturbation mean but without practical results.

Focalization on a specific area of the device under test may be seen as the key point of a perturbation technique. The ultimate challenge may be the focalization down to a single transistor on an aggressive technology node. Synchrotron equipment enable to achieve this goal with X-ray radiation.

The setup of the equipment, the physics of the X-ray interaction with MOS transistors, the possibility to use fluorescence techniques is detailed in the next section 2. Experimental results are given on an ATMEGA1284P circuit in section 3 for RAM, Flash and EEPROM memory block. A concrete attack on this circuit is given in section 4 for Flash, thus demonstrating the possibility to permanently modify an application code. The conclusion section will outline all the potential to use X-ray in the security testing domain.

2 Synchrotron X-ray radiation

X-ray interaction

Two kinds of X-Ray interaction mechanisms in CMOS circuitry are of interest in our experiments:

charge trappings in insulating layers, inducing V t shifts in MOS transistors, which will be used later in this paper for RAM attacks, effects on electron storage in floating gates, which will be used for EEPROM and Flash attacks.

These effects have been extensively studied, especially for aerospace applications [START_REF] Micheloni | Inside NAND Flash Memories[END_REF][START_REF] Oldham | Total Ionizing Dose Effects in MOS Oxides and Devices[END_REF][START_REF] Oldham | Advances in Solid State Electronics and Technology (ASSET) Series[END_REF][START_REF] Gerardin | Radiation Effects in Flash Memories[END_REF][START_REF] Ma | Ionizing radiation effects in MOS devices and circuits[END_REF][START_REF] Shaneyfelt | Field dependence of interface trap buildup in polysilicon and metal gate MOS devices[END_REF][START_REF] Caywood | Radiation-induced soft errors and floating gate memories[END_REF][START_REF] Snyder | Radiation response of floating gate EEPROM memory cells[END_REF][START_REF] Mcnulty | Charge removal from FGMOS floating gates[END_REF][START_REF] Cellere | Ionizing radiation effects on floating gates[END_REF][START_REF] Cellere | A model for TID effects on floating gatememory cells[END_REF][START_REF] Cellere | Charge loss after 60Co irradiation of flash arrays[END_REF][START_REF] Wang | Total ionizing dose effects on flash-based field programmable gate array[END_REF][START_REF] Wang | Biased-irradiation characteristics of the floating gate switch in FPGA[END_REF][START_REF] Cellere | Total ionizing dose effects in NOR and NAND flash memories[END_REF][START_REF] Nguyen | Total ionizing dose effects on Flash memories[END_REF]. So in this paper we will just give a short summary of the most important results.

Charge trapping Due to the high energy of X-rays, ionization induces electronhole pairs creation in the oxide layer 4 . These electron-hole pairs are separated by the electric field applied to the grid: high mobility electrons are eliminated through the grid, while lower mobility holes move inside the oxide towards the transistor channel. Arriving at the Si/SiO2 interface, holes can be trapped into defect sites which are numerous at this interface. This positive charge accumulated near the transistor channel results in a shift of I D (V GS ) curves to lower gate voltages (see Fig. 2). From an electrical point of view :

-NMOS will become more easily conductive, even permanently conductive, -PMOS will become less easily conductive, even permanently blocked. This is a TID (Total Ionizing dose) effect : the more the device is irradiated, the more holes are trapped and curves shifted (Fig. 2). Notice also that trapped charges can be eliminated by heat annealing : heating treatment can restore normal behaviour of irradiated devices. So these faults can be viewed as "semipermanent faults" : "permanent" as its effect remains after irradiation have ceased, and "semi" because annealing can restore a normal behaviour. Fig. 2. Effect of dose level increasing (1 to 4) on NMOS device (extracted from [START_REF]ESA Radiation design Handbook Draft[END_REF]).

Effects on floating gates Floating gates are used in non volatile memories, such as EEPROM and Flash memories. A charge storage element (floating gate) is placed between the silicon bulk and the control gate (normal transistor gate). By changing the amount of electrons and holes in the floating gate the threshold voltage of the transistor can be altered. The state with positive or no charges in the floating gate is the erased state whereas a negative charges present in the floating gate is the programmed state of the cell.

It seems from [START_REF] Gerardin | Radiation Effects in Flash Memories[END_REF] that two different effects could occur :

a first effect very similar to the one which affects classical MOS transistors, resulting in a semi-permanent shift of I D (V GS ) curves : the cell is then semipermanently stuck in the erased state, but, additionally, it is likely that the photoemission of the carries in the floating gate get enough energy from the radiation to escape from this storage element potential. It is also possible that the positives charges created in the surrounding oxides are injected into the floating gate. The injected holes recombine with the stored electrons. The result is a decrease of the amount of electrons in the floating gate which induce the erasing of the memory cell.

If the first effect dominates, we will observe "stuck-at" faults of the cell, which cannot be programmed any more. But if the second effect dominates, the cell is not semi-permanently faulted, and can be reprogrammed as a normally erased cell.

We observed these two behaviors with different kinds of non volatile memories tested during our experiments.

Fluorescence for localization expliquer la fluorescence

It is not always possible to have GDS2 files in order to have an accurate localization of the perturbation to perform on a given circuit. Local reverse engeenering and the use of fluorescence technique on some materials give a good opportunity to get a perfect localization.

3 Experimental results Notice that inverter's PMOS (PI1, PI2 ) are "weak" transistors, in order to facilitate writing operations. The attack performed on the ESRF bench targets inverter's NMOS : for example, if NMOS NI2 is irradiated, this device will become conducting whatever the value applied to its grid. So inverter's output will be stuck at logical value 0, then cell value will always remain at 0, until a heat annealing restores normal behaviour of NI2. Notice that attacking NI1 transistor will symmetrically cause a stuck at logical value 1 fault of the cell.

Accurate location of transistors to be targeted was obtained using fluorescence cartography, allowing accurate localization of tungsten vias in the device. Superposition of fluorescence and SEM pictures (as in Fig. 4) shows location of RAM transistors and allows accurate focused irradiation of any individual transistors in a cell.

Experimental results are shown in Fig. 4:

background : SEM picture of etched RAM, showing transistors grids (metals are removed), coloured dots : superimposed result of fluorescence scanning, red and green rectangles : irradiated transistors, causing stuck at "1" (red) or stuck at "0" (green) faults, in yellow, addresses of corresponding RAM cells.

Flash

expliquer succintement le mapping mémoire de l'ATMEGA

EEPROM

résultats sur l'EEPROM

Comparison with laser attacks

Compared to laser induced faults, classically used in secured smart cards attacks, we have to notice that focused X-Ray gives totally different kinds of faults:

-X-ray faults are semi-permanent: fault effect remains after irradiation have ceased. Normal function can be restored by mean of heat annealing. -Laser faults are fugitive, present only during laser illumination.

-X-ray attacks can be used for "circuit editing" : by individual irradiation, NMOS can be made always conductive, whilst PMOS can be blocked. Functions or parts of a device can be modified, for example to deactivate security countermeasure or detectors. -X-ray attacks can also be used to modify non volatile memories programming, when laser attacks can only fault read or program operation results.

Concrete attack on Flash program

To illustrate the feasibility of circuit reprogramming, a full attack path is performed. In one ATMEGA1284P circuit, an authentification program is stored in Flash boot sector and wait, after start-up, for a four digits PIN sequence to be sent on UART0. Code analysis of the dumped assembly code [26] have shown that the authentification rely on a single statement at Flash address 0x0000015c: The Branch if Not Equal statement catch the 9999 erroneous presented PIN.

Modifying the brne op-code with a Branch if Equal (breq) op-code would allow to reverse the situation and make accept 9999 presented PIN and reject the solo genuine PIN. Thus an assailant not knowing the correct PIN will have a much better probablility to pass the authentification (9999 on 10000 instead of 1 on 10000 ). The comparison of brne and breq op-code (see table 1) show that to modify the assembly, a single bit reset is needed in Flash memory. This bit reset can be performed by X-ray lighting of the floating gate transistor storing the bit value. Not knowing the correct PIN, it is not possible to use safely the circuit: a well implemented PIN try counter limit the exhaustive search to a single PIN trial. Using the results obtained in 3.2, it is possible to transform the code stored in Flash in order to change the brne to breq at address 0x0000015c. The CPU adressing 16 bits Flash words, address 0x0000015c correspond to 0xae = 174 = 128 + 5 × 8 + 6. Thus, the targeted bit is stored on the second line, sixth strip and seventh column of the Flash memory block.

The circuit to attack is put in the bench and the X-ray beam is focalized once on the desired bit for 500 ms. First attempt led to success. After all, the circuit is permanently reprogrammed, and the PIN security can be bypass by choosing any incorrect PIN among the 9999 possibilities.

In order to perform such attack, let's note that the code analysis must take into account the error model. For Flash memory block, this error model is reset of chosen bit(s).

Conclusion

Focalized X-ray radiation turn out to be an efficient mean to corrupt the integrity of integrated circuit. It is possible to target a single MOS transistor in a circuit. A RAM cell can be stuck to a logical value 0 or 1 semi-permanently, a heat treatment can then remove the corruption. Flash and EEPROM cells can be reset by discharging the floating double gate. A real attack have been demonstrated on a Flash cell to modify the secure start-up sequence of a programmed circuit. Fluorescence technique give a very powerful opportunity to have a precise localization in the layout of the circuit in order to successfully target the desired transistor.

The results of this paper are obtained on an ATMEGA circuit with an ancient technology (350 nm). Ongoing experiments are giving similar results with up to date technology node: a microcontroller circuit in 45 nm and a NOR Flash in 110 nm has been tested. The focalization of the X-ray beam (50 nm) is not a restrictive parameter if the distance between two transistors is considered. A single transistor will still be targeted on future aggressive technology node.

Results have been given for RAM, Flash and EEPROM memory block. However, transistors in the logical part of a circuit can also be targeted. NMOS transistors can be stuck at logical value 1 and PMOS transistors to logical value 0. Although not tackle in this paper, this property give a new way to approach circuit edit technique and an alternative to Focused Ion Beam system. Considering the fact that it is not necessary to open the package of the circuit and that the size of the technology node is not a constraint, X-ray circuit edit could play an important role.

In the context of security application, X-ray technique give a lot of opportunities for attacking electronic circuit. Among them, let's note the possibility to cause permanent faults in cryptographic algorithm, deactivation of countermeasure, reprogramming of memories . . .

Fig. 1 .

 1 Fig. 1. The European Synchrotron (ESRF Grenoble).

3. 1 RAM

 1 RAM of the ATMega128 uses a classical 6 transistors cell, as shown in Fig.3. It comprises two cross coupled inverters (inverters NI2, PI2 and NI1, PI1 ), and of two access transistors (NA2, NA1 ) connecting inverters to the two bit lines. Access transistors grids are driven by the word line, allowing read and write operations.

Fig. 3 .

 3 Fig. 3. 6 transistors RAM cell.

Fig. 4 .

 4 Fig. 4. RAM faults.

Table 1 .

 1 Comparison of brne and breq op-code of ATMEGA circuit.

	Instruction hexadecimal binary code
	code
	brne .-84 0xf6b1	1111011010110001
	breq .-84 0xf2b1	1111001010110001

Let's note that low energy Infra-Red laser beam is unable to ionize oxide.