Marc Blanchard
email: marc.blanchard@impmc.upmc.fr

Jannick Ingrin

Etienne Balan

Istvan Kovacs

Anthony C Withers

István Kovács

Effect of iron and trivalent cations on OH defects in olivine

Keywords: olivine, OH-defect, iron, chromium, aluminum, IR spectroscopy, ab initio calculations, DFT

come   L'archive ouverte pluridisciplinaire

INTRODUCTION

The estimate of the amount of hydrogen stored in the olivine of the lithospheric and asthenospheric mantle (i.e., down to 410 km deep) is a key issue for understanding the internal cycle of this element. Attempts to constrain the hydrogen concentration in olivine from experimental solubility measurements may have been so far insufficient to accurately address this question (e.g., [START_REF] Bai | Substantial hydrogen solubility in olivine and implications for water storage in the mantle[END_REF][START_REF] Kohlstedt | Solubity of water in the a, b, and g phases of (Mg,Fe) 2 SiO 4[END_REF][START_REF] Lemaire | The effect of silica activity on the incorporation mechanism of water in synthetic forsterite: a polarised infrared spectroscopic study[END_REF][START_REF] Zhao | Solubility of hydrogen in olivine: dependence on temperature and iron content[END_REF][START_REF] Smyth | Olivine hydration in the deep upper mantle: Effects of temperature and silica activity[END_REF]Grant et al. 2007a;[START_REF] Litasov | Temperature dependence and mechanism of hydrogen incorporation in olivine at 12.5-14.0 GPa[END_REF][START_REF] Brown | Recent developments in the methods and applications of the bond valence model[END_REF][START_REF] Withers | Influence of temperature, composition, silica activity and oxygen fugacity on the H 2 O storage capacity of olivine at 8 GPa[END_REF][START_REF] Bali | Pressure and temperature dependence of H solubility in forsterite: An implication to water activity in the Earth interior[END_REF][START_REF] Otsuka | Control of the water fugacity at high pressures and temperatures: Applications to the incorporation mechanisms of water in olivine[END_REF][START_REF] Withers | The effect of Fe on olivine H 2 O storage capacity: Consequences for H 2 O in the Martian mantle[END_REF][START_REF] Férot | Water storage capacity in olivine and pyroxene to 14 GPa: Implications for the water content of the Earth's upper mantle and nature of seismic discontinuities[END_REF][START_REF] Kovács | An experimental study of water in Nominally Anhydrous Minerals in the upper mantle near the water-saturated solidus[END_REF][START_REF] Gaetani | Hydration of mantle olivine under variable water and oxygen fugacity conditions[END_REF][START_REF] Demouchy | Distribution and transport of hydrogen in the lithospheric mantle: A review[END_REF]. The main reason for this possible inaccuracy lies in the fact that the incorporation of hydrogen into olivine is controlled by many mechanisms that are not clearly identified in most experimental studies. The evaluation and efficiency of different experimental approaches are strongly dependent on the correct identification of OH-defects. Without this knowledge, the risk of mixing the respective contributions of various defects and incorporation reactions that control their solubility is high. This identification is essential to ensure that the incorporation mechanisms reproduced in the laboratory are the same as those observed in natural samples, and thus to determine the dominant incorporation mechanisms (e.g., [START_REF] Mosenfelder | Hydrogen incorporation in olivine from 2-12 GPa[END_REF][START_REF] Gaetani | Hydration of mantle olivine under variable water and oxygen fugacity conditions[END_REF].

Early solubility models in olivine were based on the assumption that the solubility is controlled by a single defect composed of two protons in an octahedral Mg vacancy (e.g., [START_REF] Kohlstedt | Solubity of water in the a, b, and g phases of (Mg,Fe) 2 SiO 4[END_REF][START_REF] Zhao | Solubility of hydrogen in olivine: dependence on temperature and iron content[END_REF][START_REF] Mosenfelder | Hydrogen incorporation in olivine from 2-12 GPa[END_REF][START_REF] Bali | Pressure and temperature dependence of H solubility in forsterite: An implication to water activity in the Earth interior[END_REF].

As evidenced by experiments performed under varying silica activities the protonation of Mg vacancies leads to broad infrared absorption bands in the range 3150-3250 cm -1 , while the protonation of Si vacancies produces narrow infrared bands above 3480 cm -1 (e.g., [START_REF] Lemaire | The effect of silica activity on the incorporation mechanism of water in synthetic forsterite: a polarised infrared spectroscopic study[END_REF][START_REF] Berry | Fingerprinting the water site in mantle olivine[END_REF][START_REF] Kovács | Sitespecific infrared OH absorption coefficients for water substitution into olivine[END_REF]. Bond valence method [START_REF] Donnay | How to recognize O 2-, OH -, and H 2 O in crystal structures determined by X-rays[END_REF][START_REF] Brown | Bond-valence parameters obtained from a systematic analysis of the inorganic crystal structure database[END_REF] provides a simple explanation for this observation. In olivine, each O atom forms interatomic bonds with one Si 4+ atom and three Mg 2+ atoms, compensating for 1 and 1/3 valence units (v.u.), respectively. In octahedral Mg 2+ and tetrahedral Si 4+ vacancies, the deficit in valence compensation of the O atoms (i.e. residual valence) will be close to -1/3 or -1, respectively. Considering that the O-H bond valence regularly decreases as a function of O-H distance [START_REF] Brown | Recent developments in the methods and applications of the bond valence model[END_REF], charge and valence compensation requirements lead to longer O-H bonds associated with Mg vacancies than with Si vacancies. Consistently, the OH stretching mode will vibrate at a higher frequency for protonated Si vacancies than for protonated Mg vacancies. [START_REF] Blanchard | Infrared signatures of OH-defects in wadsleyite: A first-principles study[END_REF] applied successfully the bond valence analysis to wadsleyite, in order to identify the most favorable sites for protonation and to rationalize the OH infrared signatures. In the olivine case, this general picture has been confirmed and refined by atomistic modeling approaches [START_REF] Haiber | Structure and dynamics of protonated Mg 2 SiO 4 : An ab-initio molecular dynamics study[END_REF][START_REF] Brodholt | An ab initio study of hydrogen in forsterite and a possible mechanism for hydrolytic weakening[END_REF][START_REF] Braithwaite | A theoretical study of the energetics and IR frequencies of hydroxyl defects in forsterite[END_REF][START_REF] Walker | Computer modelling of the energetics and vibrational properties of hydroxyl groups in α-and β-Mg 2 SiO 4[END_REF][START_REF] Walker | Three water sites in upper mantle olivine and the role of titanium in the water weakening mechanism[END_REF][START_REF] Shaw | Vibrational dynamics of H + -substituted forsterite: A first-principles molecular dynamics study[END_REF][START_REF] Balan | Theoretical infrared spectrum of OH-defects in forsterite[END_REF]2014;[START_REF] Umemoto | A first-principles investigation of hydrous defects and IR frequencies in forsterite: The case for Si vacancies[END_REF]Crépisson et al. 2014a;2014b;[START_REF] Ingrin | Identification of hydrogen defects linked to boron substitution in synthetic forsterite and natural olivine[END_REF]).

In the Mg end-member forsterite, infrared spectra in the range of OH stretching vibrations can be quite complex, but three types of OH-defects dominate. The hydrogarnet-type defect consisting of four protons in a tetrahedral Si vacancy, i.e. € (4H) Si × using the Kröger-Vink notation [START_REF] Kröger | Relation between the concentrations of imperfections in crystalline solids[END_REF], may represent about 70% of the incorporation mode at high-pressure, with absorption bands identified at 3612, 3577 and 3566 cm -1 at room temperature [START_REF] Berry | Fingerprinting the water site in mantle olivine[END_REF][START_REF] Kovács | Sitespecific infrared OH absorption coefficients for water substitution into olivine[END_REF][START_REF] Balan | Theoretical infrared spectrum of OH-defects in forsterite[END_REF][START_REF] Umemoto | A first-principles investigation of hydrous defects and IR frequencies in forsterite: The case for Si vacancies[END_REF]Ingrin et al. 2013;Crépisson et al. 2014a). The defect constituted of two protons in an octahedral Mg vacancy, i.e.

€ (2H) Mg

× , which is however very minor (<5%), results in a broad band between 3150 and 3250 cm -1 [START_REF] Berry | Fingerprinting the water site in mantle olivine[END_REF][START_REF] Kovács | Sitespecific infrared OH absorption coefficients for water substitution into olivine[END_REF][START_REF] Balan | Theoretical infrared spectrum of OH-defects in forsterite[END_REF][START_REF] Umemoto | A first-principles investigation of hydrous defects and IR frequencies in forsterite: The case for Si vacancies[END_REF]Ingrin et al. 2013;Crépisson et al. 2014a). A defect characterized by a broad band at 3550 cm -1 and whose contribution in synthetic forsterite samples would approach 25% (Ingrin et al. 2013) may correspond to an interstitial OH [START_REF] Balan | Contribution of interstitial OH groups to the incorporation of water in forsterite[END_REF]. In presence of iron (olivine ~ Fo90), two types of additional OH stretching bands can be observed. The first band located at 3599 cm -1 , is polarized parallel to the X direction and is significantly broader than the bands of the € (4H) Si × defect [START_REF] Kohlstedt | Solubity of water in the a, b, and g phases of (Mg,Fe) 2 SiO 4[END_REF][START_REF] Smyth | Olivine hydration in the deep upper mantle: Effects of temperature and silica activity[END_REF][START_REF] Litasov | Temperature dependence and mechanism of hydrogen incorporation in olivine at 12.5-14.0 GPa[END_REF][START_REF] Otsuka | Control of the water fugacity at high pressures and temperatures: Applications to the incorporation mechanisms of water in olivine[END_REF][START_REF] Withers | The effect of Fe on olivine H 2 O storage capacity: Consequences for H 2 O in the Martian mantle[END_REF][START_REF] Férot | Water storage capacity in olivine and pyroxene to 14 GPa: Implications for the water content of the Earth's upper mantle and nature of seismic discontinuities[END_REF]. Its contribution in synthetic samples can be up to 25% of the total OH concentration (with ~ 50% for the € (4H) Si × defect and 25% for the defect related to the band to 3550 cm -1 ). The second type of bands, between 3310 and 3380 cm -1 , is mostly observed when natural samples are used as starting material in experiments [START_REF] Bai | Effects of chemical environment on the solubility and incorporation mechanism for hydrogen in olivine[END_REF][START_REF] Zhao | Solubility of hydrogen in olivine: dependence on temperature and iron content[END_REF]Grant et al. 2007a;[START_REF] Kovács | An experimental study of water in Nominally Anhydrous Minerals in the upper mantle near the water-saturated solidus[END_REF][START_REF] Férot | Water storage capacity in olivine and pyroxene to 14 GPa: Implications for the water content of the Earth's upper mantle and nature of seismic discontinuities[END_REF][START_REF] Gaetani | Hydration of mantle olivine under variable water and oxygen fugacity conditions[END_REF][START_REF] Yang | Effect of oxygen fugacity on OH dissolution in olivine under peridotitesaturated conditions: An experimental study at 1.5-7 GPa and 1100-1300°C[END_REF]. [START_REF] Berry | The infrared signature of water associated with trivalent cations in olivine[END_REF], from synthesis of forsterite samples doped with trace amounts of trivalent elements, suggested that these bands were associated with defects involving hydrogen and a trivalent cation, such as Fe 3+ , Cr 3+ and Al 3+ . Regarding the band at 3599 cm -1 , no assumption has yet actually been proposed. All the above defects occur in natural mantle olivine, with one additional defect resulting in a doublet of bands at 3525 and 3572 cm -1 . It corresponds to a partially protonated tetrahedral vacancy coupled to the substitution of Mg 2+ by Ti 4+ , i.e. [START_REF] Berry | The infrared signature of water associated with trivalent cations in olivine[END_REF][START_REF] Balan | Theoretical infrared spectrum of OH-defects in forsterite[END_REF][START_REF] Umemoto | A first-principles investigation of hydrous defects and IR frequencies in forsterite: The case for Si vacancies[END_REF].

€ [(Ti) Mg •• (2H ʹ ʹ ) Si ] × (
We investigate here the effect of iron and trivalent cations on OH-defects in olivine. We performed an in situ study of OH infrared stretching bands at -194°C and +25°C on two Fe-bearing olivine single crystals, one synthetic and one natural. These spectroscopic measurements are coupled with the theoretical investigation of the structural and vibrational properties of Fe-related OH-defects using the density functional theory. OH-defects in only the Mg end-member olivine have so far been investigated using first-principles calculations. The explicit modeling of the infrared signature of these OH-defects allows untangling the effect of Fe 2+ , Fe 3+ , Al 3+ and Cr 3+ on the population of OH-defects. This study, we believe, represents one step forward in the understanding of hydrogen incorporation mechanisms in mantle olivines.

SAMPLES AND METHODS

Samples description

Three samples have been investigated here. The single crystal of composition Fo91 Hole, New Mexico (Grant et al. 2007b), and oriented in the XY and XZ planes using the signature of the polarized FTIR spectra in the Si-O overtones region (see for instance, [START_REF] Lemaire | The effect of silica activity on the incorporation mechanism of water in synthetic forsterite: a polarised infrared spectroscopic study[END_REF]). The composition and petrologic characteristics of the xenolith are reported in Grant et al. (2007b).

Infrared analysis

IR spectra were acquired with a Bruker Hyperion 3000 FTIR-microscope coupled to a Bruker Vertex 70 spectrometer equipped with a liquid-N 2 -cooled MCT detector in the laboratory of Infrared and Raman Spectrochemistry (LASIR, Université Lille 1). A spot size of 160 × 160 µm 2 was used, 256 scans were accumulated per spectrum with a resolution of 1 cm -1 to 4 cm -1 . Polarized spectra were recorded with a wire grid polarizer on a KRS-5 substrate. A Linkam FTIR600 heating-cooling stage with ZnSe windows dedicated to infrared measurements was used. Band frequency was analyzed through decomposition of spectra using Gaussian functions in the "Peakfit" software.

First-principles calculations

Calculations were performed within the density functional theory framework, using the theoretical approach and parameters described in [START_REF] Balan | Theoretical infrared spectrum of OH-defects in forsterite[END_REF]2014), Crépisson et al. (2014a;;2014b), and[START_REF] Ingrin | Identification of hydrogen defects linked to boron substitution in synthetic forsterite and natural olivine[END_REF] for the study of OH-defects in forsterite.

The ionic core of iron, aluminum and chromium were described by the pseudopotentials Fe.pbe-nd-rrkjus.UPF, Al.pbe-rrkj.UPF and Cr.pbe-sp-van.UPF from http://www.quantum-espresso.org/. Spin-polarized calculations were conducted using the generalized gradient approximation (GGA) to the exchange-correlation functional with the PBE parameterization [START_REF] Perdew | Generalized Gradient Approximation Made Simple[END_REF]. The electronic wave-functions and the charge density were expanded in plane-waves with 80 and 480 Ry cut-offs, respectively.

The Brillouin zone was sampled at a single k-point with coordinates (-0.5, -0.46, -0.4) in 2π/a units. In order to prevent spurious interactions between the periodic images of the defect, structure relaxations were done on a 2×1×2 supercell of forsterite (112 atoms)

using the PWscf code of the Quantum Espresso package [START_REF] Giannozzi | Quantum ESPRESSO: a modular and open-source software project for quantum simulations of materials[END_REF] http://www.quantum-espresso.org). The theoretical relaxed primitive orthorhombic-cell parameters of anhydrous forsterite are a = 4.78 Å, b = 10.28 Å, and c = 6.01 Å (Pbnm space group), in good agreement with experimental values [START_REF] Fujino | X-ray determination of electron distributions in forsterite, fayalite and tephroite[END_REF]. These relaxed cell parameters were kept constant during the relaxation of OH-bearing supercell.

During this step, no symmetry constraint was applied to the atomic positions and the forces on atoms were minimized to less than 10 -4 Ry/a.u. The OH-stretching vibrational frequencies were calculated at the Brillouin zone center (Γ point), using the linear response theory [START_REF] Baroni | Phonons and related crystal properties from density-functional perturbation theory[END_REF] as implemented in the PHonon code [START_REF] Giannozzi | Quantum ESPRESSO: a modular and open-source software project for quantum simulations of materials[END_REF]; http://www.quantum-espresso.org) and following the approach previously used by [START_REF] Balan | Theoretical infrared spectrum of OH-defects in forsterite[END_REF]2014), Crépisson et al. (2014a;2014b), and[START_REF] Ingrin | Identification of hydrogen defects linked to boron substitution in synthetic forsterite and natural olivine[END_REF].

This approach provides calculated wavenumbers that are within 1.5 % of the measured ones for the OH stretching vibrations (i.e. < 50 cm -1 ). This approach is very sensitive to the strength of hydrogen bonds, giving very accurate relative positions of infrared absorption bands. The relative positions of the bands combined with their intensities and pleochroisms allow their reliable assignment to associated OH-defects by comparison of theoretical and measured infrared spectra.

RESULTS AND DISCUSSION

Infrared spectrum of iron-bearing olivine

Low-temperature measurements allow a better resolution of every contribution to the infrared spectrum. As shown in Fig. 1 and Table 1, the infrared spectrum above 3500 cm -1 of synthetic Mg end-member olivine is mainly composed of three bands at 3615, 3582 and 3568 cm -1 corresponding to the hydrogarnet-type defect, € (4H) Si × plus a side band at 3566 cm -1 , which corresponds to the broad band strongly polarized along the Y direction observed at room temperature at 3550 cm -1 [START_REF] Balan | Theoretical infrared spectrum of OH-defects in forsterite[END_REF]Ingrin et al. 2013). In the synthetic Fe-bearing olivine, additional bands are observed. A broad band reported at 3599 cm -1 at room temperature and polarized along the X direction [START_REF] Kohlstedt | Solubity of water in the a, b, and g phases of (Mg,Fe) 2 SiO 4[END_REF][START_REF] Smyth | Olivine hydration in the deep upper mantle: Effects of temperature and silica activity[END_REF][START_REF] Litasov | Temperature dependence and mechanism of hydrogen incorporation in olivine at 12.5-14.0 GPa[END_REF][START_REF] Otsuka | Control of the water fugacity at high pressures and temperatures: Applications to the incorporation mechanisms of water in olivine[END_REF][START_REF] Withers | The effect of Fe on olivine H 2 O storage capacity: Consequences for H 2 O in the Martian mantle[END_REF][START_REF] Férot | Water storage capacity in olivine and pyroxene to 14 GPa: Implications for the water content of the Earth's upper mantle and nature of seismic discontinuities[END_REF], splits at -194°C into two separate bands at 3606 and 3599 cm -1 both mainly polarized along X (Fig. 1). At least three additional bands are also observed in the range 3520 -3560 cm -1 : At room temperature, along Y they are partly masked by the broad band at 3550 cm -1 , but it is possible to notice the presence of at least two extra bands around 3549 and 3538 cm -1 in the spectrum polarized perpendicularly to the Y direction (Fig. 1). At -194°C, four distinct bands are clearly visible. The strongest at 3560 and 3551 cm -1 are mainly polarized along Y while the ones at 3543 and 3528 cm -1 share polarization between Y and the direction perpendicular to Y (Fig. 1). The additional bands, summed over the two polarized spectra, constitute roughly 40% of the total area of the OH bands.

The three main bands observed in the Mg end-member forsterite (3615, 3582 and 3568 cm -1 ) are also present at the same wavenumbers but are broader in the Fe-bearing olivine Fo91. Nevertheless it is still possible to isolate the contribution of the band at 3568 cm -1 polarized along the Z direction from the band at 3567 cm -1 polarized along the Y direction in the spectra at -194°C (see vertical line in Fig. 1; the band at 3567 cm -1 corresponds to the band observed at 3566 cm -1 in forsterite and which results from the shift of the broad band observed at 3550 cm -1 at room temperature).

In the same frequency region, the natural olivine KHL8306 from Kilbourne Hole displays a different infrared signature (Fig. 2) characterized at low temperature by two bands at 3529 and 3576 cm -1 , mainly polarized along the X direction and assigned to the Berry et al. 2005; 2007; Balan et al. 2011).

"titanoclinohumite" defect, € [(Ti) M1 •• (2H ʹ ʹ ) Si ] × (
At lower frequency, the same sample displays a doublet of bands at 3332 cm -1 mainly polarized along the Z direction and 3356 cm -1 with its main contribution along the X direction. Two weak bands at 3313 and 3390 cm -1 , mainly polarized along the Z direction, accompany this doublet. Such features are frequently observed when natural samples are used as starting material in experiments (Bai andKohlstedt 1993, Zhao et al. 2004;Grant et al. 2007a;[START_REF] Férot | Water storage capacity in olivine and pyroxene to 14 GPa: Implications for the water content of the Earth's upper mantle and nature of seismic discontinuities[END_REF][START_REF] Gaetani | Hydration of mantle olivine under variable water and oxygen fugacity conditions[END_REF]. All OH absorption bands mentioned here exhibit a similar temperature evolution with a moderate frequency lowering when temperature increases (< 7 cm -1 between -194°C and 25°C).

Effect of Fe 2+ on protonated Si and Mg vacancies

In a defect-free olivine, calculations indicate only a small preference (35 meV corresponding to 3.4 kJ/mol) for Fe 2+ to occupy M1 sites against M2 sites. This energy difference implies that at temperatures relevant to the upper mantle (~1227°C), around 57% of Fe 2+ will be in M1 sites. This result is in complete agreement with the nuclear magnetic resonance study of [START_REF] Mccarty | Transition metal cation site preferences in forsterite (Mg 2 SiO 4 ) determined from paramagnetically shifted NMR resonances[END_REF] concluding that Fe 2+ occupies M1 and M2 roughly equally. Therefore no initial assumption was made regarding the location of Fe 2+ around the OH-defects.

All possible configurations with one Fe 2+ as a first neighbor around the

€ (4H) Si ×
defect have been investigated. Protons were initially set up in the configuration Si_3 of [START_REF] Balan | Theoretical infrared spectrum of OH-defects in forsterite[END_REF], which was found to be the most stable in forsterite as well as the one

showing the best agreement with experimental spectra. The corresponding infrared signature is reported in Fig. 3. Calculations suggest that the most favorable location for Fe 2+ is the M1 site sharing a corner with the Si vacancy, followed by the M2 site also sharing a corner with the vacancy with a total energy 43 meV (4.1 kJ/mol) higher (Table 2). This new cationic environment affects the OH-defect as highlighted by the variation of its infrared signature (Fig. 3). The corresponding structural and vibrational properties are reported in Table 2. Considering this energy difference and the fact that for

€ [(4H) Si × (Fe) M1corner ×
] × , two equivalent configurations exist relative to the mirror plane crossing the silicate tetrahedron, we expect the occurrence of three times more

€ [(4H) Si × (Fe) M1corner × ] × defects than € [(4H) Si × (Fe) M2corner × ]
× defects, at temperatures relevant to the upper mantle. The OH stretching mode at 3591 cm -1 in forsterite is shifted to 3573 and 3559 cm -1 when Fe 2+ is in M1 and M2, respectively. This mode polarized along the X direction corresponds to the in-phase stretching of the four OH groups, with a larger displacement of the proton of the O1H group. The mode at 3572 cm -1 in forsterite is shifted down to 3556 cm -1 when Fe 2+ is in M1 site but remains at the same frequency when Fe 2+ is in M2 site. In this mode, the O2H group vibrates out-of-phase relative to the three other OH groups and with the largest amplitude. A moderate change in geometry may affect the OH coupling pattern, significantly impacting the IR intensities. This may explain why only three absorption bands are observed experimentally in forsterite out of the four bands predicted theoretically (i.e., the band calculated at 3572 cm -1 is not observed). It is reasonable to assign the band at 3606 cm -1 observed in Fe-bearing olivine with a polarization along the X direction (Fig. 1, Table 1) to the most intense band calculated at 3573 cm -1 and therefore to the presence of Fe 2+ in a M1 site next to the hydrogarnet-type defect. The band at 3599 cm -1 can be assigned to the most intense band of the defect associated with Fe 2+ in the M2 site calculated at 3559 cm -1 . The two lowest bands of these hydrogarnet-type defects are also shifted to lower frequencies in presence of iron. The mode at 3520 cm -1 in forsterite remains polarized along the Z direction while the mode at 3540 cm -1 shows some variations in the XY plane. Most of the bands observed at 3560, 3551, 3543 and 3528 cm -1 can be assigned to the lower-frequency bands associated with Fe 2+ in M1 and M2 sites calculated at 3530, 3518 cm -1 and 3519, 3510 cm -1 , respectively. They have the correct polarizations. However it cannot be ruled out that the intense band observed at low temperature at 3560 cm -1 (parallel to the Y direction) could be equivalent to the band observed at 3566 cm -1 in forsterite (Fig. 1), which become at room temperature the broad band at 3550 cm -1 strongly polarized along the Y direction (absorption band assigned to an interstitial OH, Ingrin et al. 2013, Balan et al. 2014). The presence of a nearby Fe 2+ would explain the simultaneous occurrence of these two bands and their frequency shift. In addition, the binding energies between Fe 2+

and the hydrogarnet-type defect, which is defined as the energy of the reaction leading the two defects to associate, were estimated to be -7 and -12 meV for Fe 2+ in M1 and M2 sites, respectively. This suggests that there is almost no energy gain to combine the Effect of Fe 2+ on protonated Mg vacancies is expected in the range 3100-3300 cm - 1 of the infrared spectrum. Two bands polarized along the Z direction are often recorded at ~3160 cm -1 and 3220-3260 cm -1 in both Fe-free and Fe-bearing olivine samples. These two bands do not always occur simultaneously, their relative intensities vary, and a broadening seems to accompany the presence of iron (e.g., [START_REF] Lemaire | The effect of silica activity on the incorporation mechanism of water in synthetic forsterite: a polarised infrared spectroscopic study[END_REF][START_REF] Withers | The effect of Fe on olivine H 2 O storage capacity: Consequences for H 2 O in the Martian mantle[END_REF][START_REF] Schmädicke | Olivine from spinel peridotite xenoliths: Hydroxyl incorporation and mineral composition[END_REF]. Previous calculations have shown that the full protonation of a M1 vacancy is responsible for one of the two bands, presumably the one observed at 3160 cm -1 in the Mg end-member (e.g., [START_REF] Balan | Theoretical infrared spectrum of OH-defects in forsterite[END_REF]. At the vicinity of this OH-defect, Fe 2+ enters the M1 site sharing an edge with the vacancy or the M2 site sharing a corner with the vacancy (Fig. 4). The two configurations have nearly the same probability of occurrence (3 meV of energy difference). The presence of Fe 2+ decouples the two OH vibrational modes (Fig. 4 and Table 2), leading to a band splitting of 40-54 cm -1 depending on the models. OH groups remain aligned along the Z direction. While it is likely that the presence of iron may explain the broadening of the band related to the defect (2H) X M1 , it cannot explain the two distinct bands that are also observed in Fe-free olivines. It is sometimes found in the literature that these two bands correspond to the protonation of M1 and M2 vacancies [START_REF] Lemaire | The effect of silica activity on the incorporation mechanism of water in synthetic forsterite: a polarised infrared spectroscopic study[END_REF]). This has already been investigated by atomistic calculations (e.g., [START_REF] Walker | Computer modelling of the energetics and vibrational properties of hydroxyl groups in α-and β-Mg 2 SiO 4[END_REF] From this energy difference and the comparison of calculated and measured pleochroisms, it is therefore possible to rule out the involvement of a simple protonated M2 vacancy for potential hydrogen substitutions. Finally as shown in Crépisson et al. (2014a), the partial protonation of a M1 vacancy is not a satisfactory explanation of the second absorption band around 3220 cm -1 .

OH-defects involving trivalent cations

In a defect-free olivine, our calculations suggest that Fe 3+ will preferentially occupy M2 rather than M1 sites. The energy difference of 173 meV (16.7 kJ/mol) would indicate a proportion of ~80% of Fe 3+ in M2 sites at ~1227°C. However, the presence of Mg vacancies in the vicinity of Fe 3+ , with the structural relaxation associated, will decrease significantly this energy difference. This is evidenced by the investigation of the defects composed of a proton in a Mg vacancy, the charge of which is compensated by the substitution Mg 2+ -Fe 3+ in a neighboring M site, i.e.

€ [(Fe) M • (1H ʹ ) M ] × .
This mechanism is the one proposed by [START_REF] Berry | The infrared signature of water associated with trivalent cations in olivine[END_REF] for explaining the infrared absorption bands observed between 3300 and 3400 cm -1 . The three most favorable configurations of this defect and the corresponding infrared signatures are shown in the upper part of Figs. 5 and 6. Even in close proximity of Fe 3+ , the protonation of M1 vacancies is energetically preferred to the protonation of M2 vacancies (energy difference of ~ 860 meV, i.e. 83 kJ/mol). In the most stable configuration, Fe 3+ is in the M2 site sharing an edge with the M1 vacancy where the O3 atom is protonated, leading to a band at 3388 cm -1 with the strongest contribution along the X direction. The second configuration has the Fe 3+ in the M2 site sharing a corner with the vacancy. The O2 atom is protonated, which results in a band at 3245 cm -1 polarized along the Z direction. In the third configuration, Fe 3+ now occupies an M1 site. The proton is still bound to the O2 atom, leading again to a band mainly polarized along the Z direction but at a wavenumber of 3374 cm -1 . The two highest bands could very well explain the bands that we observe at 3355 and 3329 cm -1 (3356 and 3332 cm -1 at low temperature) in Kilbourne Hole olivine (Fig. 2). Their relative positions and pleochroisms are in good agreement. The band calculated for the second configuration (i.e., 3245 cm -1 ) is not observed in the Kilbourne Hole sample.

However, the small energy differences calculated between the three configurations (Table 2) would suggest their coexistence at mantle temperatures with proportions around 30-40 % each, which means that the doublet at 3355-3329 cm -1 should be correlated with a band at 3220 cm -1 . This is not the case in most of the natural samples of olivine.

Considering now the trivalent cation Al 3+ , the most stable configuration

€ [(Al) M2edge • (1H ʹ ) M1 ]
× is the same as with Fe 3+ (Fig. 6). The corresponding absorption band is only shifted by 2 cm -1 . The second most stable configuration with Al 3+

€

[(Al) M1edge • (1H ʹ ) M1 ]
× A is the same as the third configuration described for Fe 3+ . The change of the cation nature shifts the band by ~10 cm -1 while the polarization remains identical. The fact that the defects related to Fe 3+ and Al 3+ give rise to very similar absorption bands with the two bands of Al 3+ much closer in frequencies than the bands associated to Fe 3+ (1 cm -1 for Al 3+ ; 14 cm -1 for Fe 3+ ) is in full agreement with the observations of Berry et al. (2007; 6 cm -1 for Al 3+ ; 19 cm -1 for Fe 3+ ). Finally, the third most favorable defect with Al 3+

€ [(Al) M1edge

• (1H ʹ ) M1 ] × B only differs from the second one by the protonation that occurs on the O3 atom instead of the O2 atom. The corresponding theoretical band is located at 3401 cm -1 and is polarized along the X direction. [START_REF] Tollan | Frozen melt-rock reaction in a peridotite xenolith from sub-arc mantle recorded by diffusion of trace elements and water in olivine[END_REF] studied the olivine of an arc mantle peridotite by coupling infrared spectroscopy and chemical analysis, and found that the incorporation of water in olivine is controlled by its Cr 3+ and Fe 3+ contents. We have then investigated defects similar to the previous ones but with Cr 3+ instead of Fe 3+ , i.e.

€ [(Cr) M

• (1H ʹ ) M ] × . Two configurations were found close in energy, the others being significantly less stable (> 97 meV). In both, Cr 3+ occupies the M1 site sharing an edge with the protonated M1 vacancy (Fig. 6). In the first configuration, the O2 is protonated giving rise to a band at 3366 cm -1 polarized along the Z direction, while in the second configuration the protonation occurs in O3 and corresponds to a band at 3406 cm -1 (Fig. 5). Cr 3+ -bearing defects thus display infrared signatures comparable with the ones of Fe 3+ and Al 3+ in terms of pleochroism but with a larger gap in frequencies between the two bands (40 cm - 1 ). These results fully support the interpretation of [START_REF] Tollan | Frozen melt-rock reaction in a peridotite xenolith from sub-arc mantle recorded by diffusion of trace elements and water in olivine[END_REF] that the bands they observed at 3358 and 3323 cm -1 are associated with Cr 3+ while the bands around 3353 and 3328 cm -1 are associated with Fe 3+ .

Other OH-defects involving Fe 3+ were explored. A Si 4+ tetrahedral vacancy could be charge balanced by one Fe 3+ and one H + , i.e.

€

(Fe +1H) Si × . In the most stable geometry, the proton is bound to an O3 oxygen and points towards another O3 oxygen (Fig. S3).

The corresponding infrared absorption band is calculated at 3140 cm -1 with a polarization in the XY plane. No infrared band shows this polarization in synthetic or natural olivine samples. The presence of such a defect can thus be ruled out. This is in agreement with the fact that Mössbauer spectroscopy showed that Fe 3+ occupies predominantly octahedral sites in olivine [START_REF] Mccammon | Oxidation state of iron in hydrous mantle phases: Implications for subduction and mantle oxygen fugacity[END_REF]). On the model of the "titanoclinohumite" defect, one could also propose a defect composed of a partially protonated Si vacancy compensated by one Fe 3+ in a neighboring M site, i.e.

€ [(Fe) M • (3H ʹ ) Si ] × .
In the most stable configuration, Fe 3+ occupies a M1 site sharing an edge with the tetrahedral vacancy (Fig. S4). This defect is characterized by three OH stretching bands. The two bands at 3474 and 3544 cm -1 are very similar to the infrared signature of the "titanoclinohumite" defect [START_REF] Balan | Theoretical infrared spectrum of OH-defects in forsterite[END_REF]. The additional band is at much lower wavenumber, 3255 cm -1 , with the main contribution parallel to the X direction. Like for the previous defect, such a band in this frequency region is never observed in olivine, ruling out the presence of this defect.

As shown in Fig. 2, the main doublet involving trivalent cations is accompanied by two weak bands at 3310 and 3384 cm -1 (25°C). Although observed in some synthetic as well as natural samples, the band at 3384 cm -1 is not systematically present when the three others are present. [START_REF] Berry | The infrared signature of water associated with trivalent cations in olivine[END_REF] do not observe such a band in their doped forsterite crystals. Conversely, the presence of the band at 3310 cm -1 polarized mainly along Z is systematic and the position of this band shifts with the nature of the trivalent cation, i.e. 3310 cm -1 for Fe 3+ , 3306 cm -1 for Cr 3+ , 3322 cm -1 for Al 3+ [START_REF] Berry | The infrared signature of water associated with trivalent cations in olivine[END_REF]).

The most stable OH-defects shown here cannot account for these bands and their origin remains an unsolved question.

Absorption coefficients

The quantification of the OH concentration using infrared spectroscopy relies on the knowledge of absorption coefficients. In order to get the most reliable results possible, one must use only the absorption coefficients derived from experimental calibrations because systematic discrepancies related to modeling approximations are expected. The computed absorption coefficients are, however, very useful in order to establish the expected trends of the absorption properties with the wavenumber of the OH stretching bands, with the nature of the OH-defects, or with the nature of minerals investigated. Figure 7 shows that the theoretical absorption coefficients of the OH-defects considered here define a trend consistent with the values of the OH-defects previously investigated in forsterite [START_REF] Balan | Theoretical infrared spectrum of OH-defects in forsterite[END_REF]2014;Crépisson et al. 2014a;2014b;Ingrin et al. 2014). This trend is almost parallel to the theoretical general correlation determined for OH groups in hydrous and anhydrous minerals [START_REF] Balan | Theoretical infrared absorption coefficient of OH groups in minerals[END_REF]), but downshifted.

This suggests first that an olivine-specific calibration is recommended over general calibrations in order to get more accurate OH concentrations, which is consistent with previous studies (e.g., [START_REF] Bell | Hydroxide in olivine: a quantitative determination of the absolute amount and calibration of the IR spectrum[END_REF][START_REF] Rossman | Analytical methods for measuring water in nominally anhydrous minerals[END_REF][START_REF] Withers | Calibration of infrared spectroscopy by elastic recoil detection analysis of H in synthetic olivine[END_REF]. Second, calculations indicate that for infrared bands around 3600 cm -1 , the olivine-specific absorption coefficient should be ~ 50% smaller than the value derived from a general correlation, while for bands around 3200 cm -1 this downshift should be of ~25%. These predictions are consistent with the observation that absorption coefficients in olivine tend to be smaller than those derived from general wavenumber-dependent calibrations [START_REF] Bell | Hydroxide in olivine: a quantitative determination of the absolute amount and calibration of the IR spectrum[END_REF][START_REF] Aubaud | Calibration of the infrared molar absorption coefficients for H in olivine, clinopyroxene and rhyolitic glass by elastic recoil detection analysis[END_REF][START_REF] Kovács | Sitespecific infrared OH absorption coefficients for water substitution into olivine[END_REF][START_REF] Withers | Calibration of infrared spectroscopy by elastic recoil detection analysis of H in synthetic olivine[END_REF]). Furthermore, these results underline that it is of primary importance to untangle the contribution of different substitution mechanisms in olivine in order to infer the actual hydrogen concentration.

IMPLICATIONS

The assignment of OH bands motivated by theoretical considerations that allow prediction of the most probable configurations confirm, once again, that

€ (2H) Mg × defects
play a minor role compared to € (4H) Si × and others in the water solubility of olivine at high pressure [START_REF] Balan | Theoretical infrared spectrum of OH-defects in forsterite[END_REF][START_REF] Umemoto | A first-principles investigation of hydrous defects and IR frequencies in forsterite: The case for Si vacancies[END_REF]Ingrin et al. 2013). A recent NMR study performed on a forsterite sample synthesized at 12 GPa reached the same conclusion [START_REF] Xue | Hydrogen incorporation mechanisms in forsterite: 1 H NMR measurement and first-principles calculation[END_REF]. Despite the increasing number of spectroscopic and molecular dynamic studies showing that

€ (2H) Mg ×
is not a dominant defect in olivine, several studies continue to assert the opposite (e.g., [START_REF] Karato | Theory of isotope diffusion in a material with multiple species and its implications for hydrogen-enhanced electrical conductivity in olivine[END_REF][START_REF] Karato | Some notes on hydrogen-related point defects and their role in the isotopic exchange and electrical conductivity in olivine[END_REF][START_REF] Dai | High and highly anisotropic electrical conductivity of the asthenosphere due to hydrogen diffusion in olivine[END_REF], even though such interpretations are not supported by their spectroscopic data.

The occurrence of

€ (2H) Mg ×
as a dominant OH-defect is often proposed because of the linear dependence of the hydrogen solubility with water fugacity. Indeed solubility law of hydrogen can be expressed by:

€ C H = A f H 2 O n exp(- PΔV RT ) (1)
where C H is the concentration of hydrogen in the mineral, A a constant which essentially contains the entropy of reaction, € f H 2 O the water fugacity, n an exponent related to the hydrogen incorporation mechanism, and ∆V the volume change of the mineral due to the incorporation of hydrogen. An equation of this type is used to fit the experimental measurements, with the exponent n = 1. However the system is underdetermined. As

shown by [START_REF] Férot | Water storage capacity in olivine and pyroxene to 14 GPa: Implications for the water content of the Earth's upper mantle and nature of seismic discontinuities[END_REF] and Ingrin et al. (2013), several couples of (n, ∆V) equally fit the data. We show here that natural high-pressure olivines contain the following OH-defects in various proportions, each with its correspondent exponent n and different ∆V:

€ (4H) Si × (n = 2), € (OH ʹ ) i (n = 0.5), € [(Fe) M • (1H ʹ ) M ] × (n = 0.5), € (2H) Mg × (n = 1).
Therefore the actual solubility law related to the hydrogen incorporation mechanism would be a weighted sum of as many Eq. ( 1) as there are incorporation mechanisms.

Given the number of unknowns, such a complex equation would obviously fit the experimental data but would be hardly manageable as long as the volume changes ∆V are not accurately known for each incorporation mechanism. For simplicity, Eq. ( 1) can be used but the value of the exponent n cannot be taken as a robust indication of the From this detailed analysis of OH-defects, it is now possible to better interpret the results of previous experimental studies made from natural olivine rehydrated under pressure. For example, the study of hydrogen solubility in San Carlos olivine as a function of iron concentration [START_REF] Zhao | Solubility of hydrogen in olivine: dependence on temperature and iron content[END_REF]) actually shows the variation of OHdefects associated with Ti 4+ and Fe 3+ substitutions in the starting samples, more than a dependency in iron concentration. Their synthetic forsterite displays the typical bands associated with Al 3+ (3350, 3344 and 3322 cm -1 ) while the different annealed San Carlos olivine samples display the bands associated with Fe 3+ (3356 and 3329 cm -1 ) in addition to the "titanoclinohumite" defect (3573 and 3525 cm -1 ). The analysis of these spectra in terms of defects associated with minor elements was not possible at the time of their publication because these hydrogen incorporation mechanisms into olivine were still unknown.

CONCLUSION

A comparison of low-temperature infrared spectra of pure forsterite and Fe-doped forsterite clearly shows the appearance of several bands in the high-frequency part of the spectrum, the most pronounced being located at 3606 and 3599 cm defect) explains the presence of OH bands between 3310 and 3380 cm -1 . The frequency and pleochroism of the theoretical bands are consistent with those observed in natural olivine samples [START_REF] Berry | The infrared signature of water associated with trivalent cations in olivine[END_REF][START_REF] Tollan | Frozen melt-rock reaction in a peridotite xenolith from sub-arc mantle recorded by diffusion of trace elements and water in olivine[END_REF]this study). In particular, calculations confirm that the four bands commonly observed below 3400 cm -1 in natural olivine (a couple at 3329 and 3355 cm -1 and a couple at 3323 and 3358 cm -1 ) are due to the substitution of Mg 2+ by Fe 3+ and Cr 3+ , respectively (

€ [(Fe,Cr) M • (1H ʹ ) M1 ] × defect).
The preponderance of these trivalent defects with the defect

€ [(Ti) Mg •• (2H ʹ ʹ ) Si ] × in
natural olivine, as well as the identification of OH-defects linked to boron and fluorine (e.g., [START_REF] Sykes | Enhanced H and F incorporation in borian olivine[END_REF][START_REF] Ingrin | Identification of hydrogen defects linked to boron substitution in synthetic forsterite and natural olivine[END_REF]Crépisson et al. 2014b), clearly evidence the prominent role of trace elements on hydrogen incorporation in lithospheric olivine. The important role of impurities on the properties of olivine was already stated more than twenty years ago by [START_REF] Wanamaker | Electrical conductivity of San Carlos olivine along [100] under oxygen-pyroxene-buffered conditions and implications for defect equilibria[END_REF] for electrical conductivity: "Even under controlled oxygen fugacities, olivine crystals from different localities and geological environments as well as specimens from the same locality often exhibit variations in electrical conductivity [START_REF] Schock | Electrical conduction in olivine[END_REF] The vertical line is a guide for the eyes. Spectra of Fo91 were acquired with a 2 cm -1 resolution. 2). Vertical dashed lines mark the position of the two most intense bands observed in natural olivine from Kilbourne Hole (this study, Fig. 2).

Corresponding structural models are displayed in Fig. 6. (2014). The solid line corresponds to the general theoretical correlation determined by [START_REF] Balan | Theoretical infrared absorption coefficient of OH groups in minerals[END_REF]. The dashed line is a guide for the eye. [START_REF] Lemaire | The effect of silica activity on the incorporation mechanism of water in synthetic forsterite: a polarised infrared spectroscopic study[END_REF]. ** Polarization data from [START_REF] Withers | The effect of Fe on olivine H 2 O storage capacity: Consequences for H 2 O in the Martian mantle[END_REF] ? These bands are too broad and convoluted to be separated from others at room temperature. X, Y, Z correspond to the crystallographic directions [100], [010] and [001], respectively. ) General trend [START_REF] Balan | Theoretical infrared absorption coefficient of OH groups in minerals[END_REF]

TABLES

  × neutral species. Their mutual arrangement will be statistical. According to the typical iron concentration in natural or synthetic sample (~Fo90), the presence of more than one Fe 2+ around the protonated Si vacancy should occur with a probability around 20%, and explain the complexity of the olivine infrared spectra in this high-frequency range.

  ;[START_REF] Shaw | Vibrational dynamics of H + -substituted forsterite: A first-principles molecular dynamics study[END_REF][START_REF] Umemoto | A first-principles investigation of hydrous defects and IR frequencies in forsterite: The case for Si vacancies[END_REF] but the explicit modeling of the infrared signature was never made for the M2 vacancy. Of the eight starting configurations, the two most stable optimized geometries and the corresponding spectra are shown in Figs.S1 and S2. The configuration of lowest energy corresponds to the protonation of two O3 atoms belonging to an edge of the octahedral vacancy. The vibrations of these two O3H groups are coupled, leading to an intense band at 3265 cm -1 polarized in the XY plane and a smaller band at 3247 cm -1 polarized along the Z direction (Table2). In the second configuration, the two O3H groups are located on either side of the vacancy center. With two significantly different OH bond lengths, their motions are decoupled leading to an intense band at 3209 cm -1 polarized in the XY plane and a smaller band at 3488 cm -1 polarized in the XZ plane. None of these defects presents the pleochroism of the two bands observed experimentally. Furthermore, in excellent agreement with the calculations of[START_REF] Umemoto | A first-principles investigation of hydrous defects and IR frequencies in forsterite: The case for Si vacancies[END_REF], the defect€ (2H) M2× is 513 meV (49.5 kJ/mol) less stable than the defect € (2H) M1 × .

FIGURE 2 .

 2 FIGURE 2. Polarized infrared spectra of single crystals [2] (X,Z) and [6] (X,Y) of the KHL8306 olivine (Fo91) at 25°C and -194°C. Spectra were acquired at 4 cm -1 and 1 cm -1

FIGURE 3 .

 3 FIGURE 3. Theoretical polarized infrared spectra of

FIGURE 4 .

 4 FIGURE 4. Theoretical polarized infrared spectra of

FIGURE 5 .

 5 FIGURE 5. Theoretical polarized infrared spectra of

FIGURE 6 .

 6 FIGURE 6. Structural models of

FIGURE 7 .

 7 FIGURE 7. Theoretical integrated molar absorption coefficients of OH stretching modes

  FIGURE 4.

  part of the OH vibrational spectrum, the presence of Fe 2+ in the vicinity of a doubly protonated Mg vacancy will increase the splitting of the vibrational modes and thus contribute to the broadening of the corresponding band.

	-1 at -194°C. The present theoretical study shows that the substitution of Mg 2+ by Fe 2+ in a neighboring octahedron of a hydrogarnet-type defect (i.e. € [(4H) Si × (Fe) M × ] × defect) sufficiently alters the frequency of the OH bands to explain the additional bands observed. Similarly, in the substitution of a Si 4+ by Fe 3+ (i.e. € (Fe +1H) Si × defect) or the combination of a Fe 3+ with a Si vacancy partially protonated (i.e. [(Fe) M • (3H ʹ ) Si ] × defect) cannot explain any of the observed OH bands. Conversely, substitution of trivalent elements (Fe 3+ , Al 3+ , Cr 3+ ) in € low-frequency With regard to Fe 3+ , calculations show that OH-defects resulting from the € octahedral site coupled to a M1 vacancy occupied by a H + (i.e. [(Fe,Al,Cr) M • (1H ʹ ) M1 ] ×

  The present study confirms for water analyze and consider in a new light the results of solubility experiments made from natural olivine rehydrated under pressure and to integrate the individual contribution of OH-defects.

	FIGURE CAPTIONS
	FIGURE 1. Unpolarized low-temperature infrared spectrum of a H-doped forsterite
	(Fo100 synthesized at 2 GPa, 1400-1275°C, green line, Lemaire et al. 2004; Ingrin et al.
	2014) compared with polarized spectra of a H-doped olivine Fo 91 synthesized at 6 GPa,
	1250°C (Withers et al. 2011). Red lines are for polarization // to Y and black lines for
	polarization perpendicular to Y with X and Z components. The new absorption bands
	compared with Mg end-member forsterite are at 3606, 3599, 3560, 3551 and 3543 cm -1 .

, presumably as a result of minor variations in trace element concentrations…"

Table 1 .

 1 Wavenumbers (in cm -1 ) and polarization of OH stretching bands (direction of the electric field) in the olivine investigated

	here (Figs. 1 and 2)
	Sample	Wavenumber at -194°C	Wavenumber at 25-27°C Shift	Polarization	Proposed
							assignment
	Synthetic olivine Fo100 *	3566	3550	-16	Y		(OH ʹ ) i
	Lemaire et al. 2004;	3568	3566	-2	Z		(4H) Si ×
	Ingrin et al. 2013, 2014	3582	3579	-3	X > Y		(4H) Si ×
	2 GPa, 1400-1275°C	3615	3613	-2	X	€	(4H) Si ×
	Synthetic olivine Fo91 M449 Withers et al. 2011	3528 3543 3551	? 3538? 3549?	? -5 -2	X, Z>Y X, Z>Y X,Y,Z	€ € €	[(4H) Si × (Fe) M2 × ] × [(4H) Si × (Fe) M2 × ] × [(4H) Si × (Fe) M1 × ] ×
	6 GPa, 1250°C	3560 3567 3568 3582 3599 3606 3615	? 3550 3566 3579 3598? 3600? 3613	-17 -2 -3 -1 -6 -2	Y € Y € Z € X > Y € X>>Z** X>>Z** X	€ € €	[(4H) Si × (Fe) M1 × ] × (OH ʹ ) i × (4H) Si × (4H) Si [(4H) Si × (Fe) M2 × ] × [(4H) Si × (Fe) M1 × ] × (4H) Si ×
	Natural olivine Fo91 KHL8306 Grant et al. 2007b	3313 3332 3356	3310 3329 3355	-3 -3 -1	€ Z >> X € Z >> X X > Z	€	n.d. [(Fe) M1 • (1H ʹ ) M1 ] ×

Table 2 .

 2 Theoretical properties of the investigated OH-defects modes involving a coupled motion of two or more OH groups.A and B allow to distinguish two defect configurations having the same Kröger-Vink notation.

		Defect		Relative energy	d(O-H) (Å)	OH-stretching	K int (L mol -1 cm -2 )	Contribution to total
				(meV)		wavenumber (cm -1 )		absorbance (%)
		[(4H) Si × (Fe) M1corner ×	] ×	0	O1-H 0.983	3572*	50420	40
					O2-H 0.985	3555*		26
					O3-H 0.984	3530*		16
					O3-H 0.984	3518*		18
	€	[(4H) Si × (Fe) M2corner ×	] ×	43	O1-H 0.983	3574*	45180	7
					O2-H 0.984	3559*		62
					O3-H 0.984	3519*		14
					O3-H 0.984	3510*		17
	€
		[(2H) M1 × (Fe) M1 × ] ×		0	O2-H 1.002	3237	185060	60
					O2-H 1.005	3184		40
		[(2H) M1 × (Fe) M2 × ] ×		3	O2-H 1.001	3252	158570	63
	€				O2-H 1.004	3213		37
	€	× A (2H) M2		0	O3-H 1.002 O3-H 1.002	3265* 3247*	198010	78 22
	€

*

Acknowledgements. The authors thank the guest editor and an anonymous referee for their helpful comments. This work was performed using HPC resources from GENCI-IDRIS (Grant 2016-i2016041519) and was supported by CNRS through a grant from the INSU 2015-PNP program, and NSERC discovery grant to ACW. IK is grateful for the financial support of the Bolyai Postdoctoral Fellowship program.


Marzieh Gheisari
email: marzieh.gheisari-khorasgani@inria.fr

Teddy Furon
email: teddy.furon@inria.fr

Laurent Amsaleg
email: laurent.amsaleg@irisa.fr

Privacy Preserving Group Membership Verification and Identification

published or not. The documents may come   L'archive ouverte pluridisciplinaire

Introduction

The verification that an item, a device or an individual is a member of a group is a natural task which forms the basis of many applications granting or refusing access to sensitive resources (buildings, wifi, payment, conveyor units, . . . ). Group membership can be implemented through a twophase process where an identification is first performed, revealing the identity of the individual under scrutiny, followed by a verification phase where it is checked whether or not the identified individual is indeed a member of the claimed group. That implementation breaks privacy: there is no fundamental reason to identify the individual before running the verification step. It is easier, but not truly needed. It is fundamental to distinguish the members of the group from the non-members, but it does not require to Research supported by the ERA-Net project ID IoT 20CH21 167534. distinguish members from one another.

The same comments hold for group identification. Such a system manages multiple groups, separating e.g. individuals according to the team they work in. The goal is then to identify the precise group a member belongs to, without proceeding first to the identification of the individual.

Privacy preserving protocols exist, for the most part in the area of signal processing in the encrypted domain [START_REF] Troncoso-Pastoriza | Fully private noninteractive face verification[END_REF][START_REF] Erkin | Privacy-preserving face recognition[END_REF][START_REF] Sadeghi | Efficient privacy-preserving face recognition[END_REF]. These protocols, however, are costly, making them hard to use in practice.

In contrast, some other approaches propose privacy preserving mechanisms that are cheaper to use because they solely rely on pure signal processing techniques, excluding all encryption mechanisms. They tend to be less secure, of course, but they put in the way of malicious users so many obstacles that breaking privacy or counterfeiting identities becomes discouragingly complicated and almost impossible. At their core, these approaches use for example sketching or quantization techniques that prohibit reconstructing identities with sufficient precision [START_REF] Bianchi | better than nothing" privacy with bloom filters: To what extent?[END_REF][START_REF] Boneh | Public key encryption that allows pir queries[END_REF]. Other techniques embed real vectors into another representational space with the purpose of security and privacy [START_REF] Razeghi | Privacy preserving identification using sparse approximation with ambiguization[END_REF][START_REF] Razeghi | Privacy-preserving outsourced media search using secure sparse ternary codes[END_REF].

Recently, Gheisari et al. proposed a privacy preserving group membership verification protocol quantizing identities' biometric templates into discrete embeddings and aggregating multiple embeddings into a group representation [START_REF] Gheisari | Aggregation and embedding for group membership verification[END_REF]. That scheme has several desirable properties: It is pure signal processing and linear algebra, hence it is cheap to run; quantization and aggregation fully succeed to make reconstruction difficult and impede identification; it is demonstrated to allow trading-off the strength of its security against group verification error rates.

That work, however, is fully deterministic in the sense that it sticks to a set of hard coded rules that drive the way templates are embedded, how they are grouped and then aggregated into group representations. Although well justified and sound, these rules govern the behavior of two independent procedures, one for embedding, the other for aggregating. The main contribution of this paper shows that jointly considering the embedding and aggregation stages results in better performances, i.e. a better membership verification without damaging security.

This paper is therefore revisiting the core mechanisms proposed by Gheisari et al. in [START_REF] Gheisari | Aggregation and embedding for group membership verification[END_REF], by jointly optimizing the embedding and aggregation stages. It is structured as follows. Section 2 defines the context of this work and surveys existing approaches. Then, Section 3 gives a formal problem statement and the details of proposed method are introduced in Section 4. Section 5 presents the experimental protocol and results.

Context and Related Work

Context

Without any loss of generality, group membership verification needs first to acquire templates of items (passive PUF), devices (active PUF), or individuals (biometric trait) and to enroll them into a data structure stored in a server. Then, at verification time, that data structure is queried by a client with a new template and the access is granted or refused. Security assesses that the data structure is adequately protected so that a honest but curious server cannot reconstruct the templates. Privacy requires that verification should proceed without disclosing the identity.

The nature of templates can vary from one application to the other. For example, the templates encode information related to fingerprints, iris, or faces of individuals, or to Physically Unclonable Functions (PUF) like speckle patterns captured from laser-illuminated transparent plastic.

It is worth highlighting two fundamental properties of the templates. The template used at verification time is a noisy version of the one acquired at enrollment time. Lighting conditions, blood pressure, aging, worn-outs, transient physical conditions are possible factors that might cause variations at acquisition time. The verification protocol must be able to absorb such variations and cope with the continuous nature of the templates. However, it is very unlikely that a noisy version of the template corresponding to one group member gets similar enough to the enrolled template of any other group member. The first property is therefore in relation with the continuous and distinguishable nature of the templates. The second property is in relation with the statistical independence of the enrolled templates.

The traditional operational scenario considers a server which runs the group membership verification. The server receives queries from clients. A client acquires a new template and then queries the server. Clients are trusted. The server is honest but curious: It may try to reconstruct the enrolled templates or spy on the queries. The design intends to prevent the server from reconstructing the private template from the system while correctly determining whether or not a user is a member of the claimed group (group verification) or identifying the group of membership (group identification).

Related Work 2.2.1 Cryptography

There exist cryptographic protocols setting a key management system to provide the members of a group with anonymous authentication [START_REF] Schechter | Anonymous authentication of membership in dynamic groups[END_REF]. There is no enrollment of biometric or PUF templates since membership is equivalent to holding one of the valid keys. As for biometry or PUF applications, our scenario is different from authentication, identification and secret binding. These applications secure the templates at the server and/or the client sides, but ultimately reveal the identity of the user/object.

Signal processing in the encrypted domain can provide a solution to group membership verification. At enrollment time, each template is quantized and protected with homomorphic encryption. The query is protected in the same manner at the verification stage. This allows to compute distances between the query and the templates in the encrypted domain [START_REF] Troncoso-Pastoriza | Fully private noninteractive face verification[END_REF]. There exist protocols for comparing encrypted results to a threshold [START_REF] Erkin | Privacy-preserving face recognition[END_REF][START_REF] Sadeghi | Efficient privacy-preserving face recognition[END_REF]. These encrypted comparisons are sent back to the clients which decrypt and check whether there is at least one positive. Security and privacy are as high as the security of the cryptographic primitives. Homomorphic encryption, however, is costly, both in terms of memory footprint (space) and CPU consumption (time).

Sketching techniques

Group membership is linked to the well-known Bloom filter that is used to test whether an element is a member of a set. A Bloom filter hashes and blends elements into one array of bits. When used in the context of privacy, it was demonstrated that a server using Bloom filters cannot infer any information on one specific entry [START_REF] Bianchi | better than nothing" privacy with bloom filters: To what extent?[END_REF]. However, a Bloom filter can not be used as is in our application, but it needs two adaptations. First, a Bloom Filter deals with discrete objects whereas we consider continuous high dimensional vectors, the templates. We first need to design a quantizer hashing the continuous templates into discrete objects. That quantizer must absorb the noise, i.e. the difference between the enrolled and the fresh template. Second, at verification time, the hash of the query cannot be sent in the clear for privacy reasons [START_REF] Boneh | Public key encryption that allows pir queries[END_REF]. For instance, Beck and Kerschbaum protect the query with partially homomorphic encryption since there is no need to protect the filter at the server side [START_REF] Beck | Approximate two-party privacy-preserving string matching with linear complexity[END_REF].

Aggregating, Embedding

Aggregating signals into one representation is a very common mechanism in computer vision. Approaches like BoW (Bag of Words) [START_REF] Sivic | Video google: a text retrieval approach to object matching in videos[END_REF], VLAD [START_REF] Jégou | Aggregating local image descriptors into compact codes[END_REF], Fisher vectors [START_REF] Perronnin | Fisher kernels on visual vocabularies for image categorization[END_REF], aggregate some local descriptors extracted from one image into one global description. However, these approaches are de-signed to facilitate the identification of similar elements in images and have no security or privacy capabilities.

Another recent aggregation method better fits with the security and privacy requirements that we need. In [START_REF] Iscen | Memory vectors for similarity search in high-dimensional spaces[END_REF], Iscen et al. use the group testing paradigm to design a strategy for packing a random set of image descriptors into a unique high-dimensional vector. One salient property of that strategy is that the similarity between images can be determined by solely comparing these (few) aggregated vectors to the description of the query, without the need of the original (and numerous) raw image descriptors. This saves space (memory footprint of the database) and time (complexity at query time). These gains are the main motivation of [START_REF] Iscen | Memory vectors for similarity search in high-dimensional spaces[END_REF].

As for the embedding, our scenario is similar to a privacy-preserving identification mechanism based on sparsifying transform [START_REF] Razeghi | Privacy preserving identification using sparse approximation with ambiguization[END_REF][START_REF] Razeghi | Privacy-preserving outsourced media search using secure sparse ternary codes[END_REF]. It obtains a sparse ternary embedding preserving locality information while ensuring privacy of the data users and security of the templates. Indeed, paper [START_REF] Gheisari | Aggregation and embedding for group membership verification[END_REF] uses the aggregation methods designed in [START_REF] Iscen | Memory vectors for similarity search in high-dimensional spaces[END_REF] combined with the sparsifying transform [START_REF] Razeghi | Privacy preserving identification using sparse approximation with ambiguization[END_REF][START_REF] Razeghi | Privacy-preserving outsourced media search using secure sparse ternary codes[END_REF]. Our design resorts to this latter mechanism for inheriting its privacy-preserving properties as well, yet we replace the former ad-hoc hard coded rules of [START_REF] Iscen | Memory vectors for similarity search in high-dimensional spaces[END_REF] by a machine learning approach.

Face recognition

Aggregating templates into one group representation also exists in face recognition, but privacy and security are not a requirement in the design of this primitive. They are usually taken into account with an extra layer (see Sect. 2.2.1). In a common approach, multiple face captures of the same person are combined to gain robustness against poses, expression, and quality variations [START_REF] Zhong | Ghostvlad for set-based face recognition[END_REF]. In our scenario, the group is composed of unique faces of different persons.

Paper [START_REF] Zhong | Compact deep aggregation for set retrieval[END_REF] computes a single compact descriptor for the faces of celebrities appearing in the same picture. The query is a small set of face descriptors and their system returns photos where these celebrities appear altogether. This paper consists in jointly learning the face description and the aggregation mechanism. The authors report "a minimal loss of discriminability up to two faces per image, and degrades slowly after that".

Our paper deals with the aggregation for a given on-theshelf face descriptor. On one hand, our setup is easier because the query is a single face. On the other hand, our group typically comprises more than two faces, and each is possibly captured according to very different conditions.

Problem Formulation

This section details the way the group membership problem is formulated and also defines the metrics used to evaluate performances.

Notations

The set of individuals is denoted as [N ] := {1, . . . , N }, partitionned into M groups: [N ] = g∈[M ] S g . The size of a group S is denoted by |S|. In the experiments of Sect. 5, all the groups share the same size denoted as m.

The templates to be enrolled are the vectors {x 1 , . . . , x N } ⊂ R d . They are stored column wise in d × N matrix X according to the partition over the groups: X = [X 1 , . . . , X M ], where X g stores the templates belonging to S g , ∀g ∈ [M ]. The output of the enrollment is a × M matrix R = [r 1 , . . . , r M ] composed of the representations of the M groups. It is imposed that the group representations are quantized and sparse: r g ∈ A with A := {-1, 0, 1} and r g 0 ≤ S < , ∀g ∈ [M ]. Moreover, the analysis is restricted to the case where ≤ d.

The template for which the membership has to be verified is a query vector y ∈ R d that is cast onto A thanks to an embedding before being compared to the group representations.

Embedding

Function e : R d → A maps a vector to a sequence of discrete symbols. We intentionally choose the sparsifying transform coding described in [START_REF] Razeghi | Privacy preserving identification using sparse approximation with ambiguization[END_REF][START_REF] Razeghi | Privacy-preserving outsourced media search using secure sparse ternary codes[END_REF] for its security and privacy good properties. It projects x ∈ R d on the column vectors of W ∈ R d× . The output alphabet A = {-1, 0, +1} is imposed by quantizing the components of W x. The -S components having the lowest amplitude are set to 0. The S remaining ones are quantized to +1 or -1 according to their sign. e : R d → A

(1) x → e(x) = T S (W T x).

Performances Metrics

Paper [START_REF] Gheisari | Aggregation and embedding for group membership verification[END_REF] defines metrics to assess (i) the ability of the protocol to correctly perform the verification task, and (ii) the security and privacy.

Verification Performance

The first metrics is seeded by considering the following two hypotheses:

• H 1 : The query is related to one of the vectors of group g. For instance, it is a noisy version of vector j, y = x j + n, with n to be a noise vector and j ∈ S g . • H 0 : The query is not related to any vector in the group. The group membership test decides which hypothesis is deemed true by comparing e(y) to r g . This is done by first computing a score function c and thresholding its result:

t := [c(e(y), r g ) > τ ].
The probabilities of false negative, p fn (τ ) := P(t = 0|H 1 ), and false positive, p fp (τ ) := P(t = 1|H 0 ) are summarized by the AUC (Area Under the ROC Curve). Paper [START_REF] Gheisari | Aggregation and embedding for group membership verification[END_REF] also considers p fn (τ ) for τ s.t. p fp (τ ) = , a required false positive level, 0.05 for example.

Security and Privacy Performance

A curious server can reconstruct the query template y from its embedding: ŷ := rec(e(y)). This endangers privacy of the querying user. The mean squared error assesses how accurate is this reconstruction:

MSE P = d -1 E( Y -rec(e(Y)) 2 ), (2)
assuming that Y is a white gaussian vector in R d .

As for the security of the enrolled templates, a curious server can only reconstruct a single vector x from the aggregated representation, and this vector serves as an estimation of any template in the group:

MSE S = (dN ) -1 M g=1 |Sg| i=1 E( x i -xg 2 ). (3)

Proposed Method

Variants of the Protocol

Our group membership protocol is based on embedding and aggregation functions. Whereas the embedding function e is fixed, we can have two constructions: The aggregation of embeddings or the embedding of the aggregation.

EoA aggregates raw templates into one vector of R d , and then embeds this vector. Then, the group representative vector r g is computed as:

r g = e(a EoA (X g )), (4)
where X g is the d × |S g | matrix storing the templates of the g-th group.

AoE first embeds each template according to (1) before aggregating them into r g :

r g = a AoE {e(x i )} i∈Sg . (5)
This work aims at learning the aggregated vectors and the embeddings jointly. For both construction, this is done by minimizing an objective function summing a cost for embedding C E and a cost for aggregating C A .

For AoE (first embed, then aggregate), denote E ∈ A ×N the matrix storing the embeddings of the enrolled templates. Like for X, we write E := [E 1 , . . . , E M ] with E g the matrix gathering the embeddings of the templates of Matrices E and A will be defined through optimization problems detailed below. For the embedding, function e is still prototyped according to Sect. 3.2. Papers [START_REF] Razeghi | Privacy preserving identification using sparse approximation with ambiguization[END_REF][START_REF] Razeghi | Privacy-preserving outsourced media search using secure sparse ternary codes[END_REF] show that privacy and security stem from the sparsifying transform. Only its matrix W is learned.

For EoA, Fig. 1 shows that it starts from X to create A before outputting R using matrix W. This defines the optimization problem:

min A,W,R γC A EoA (X, A) + C E EoA (A, R, W), (6)
where γ is the penalty parameter, A ∈ R d×M , W ∈ R d× , and R ∈ A ×M . On the other hand, Fig. 1 shows that for AoE, we start from X to create E using matrix W before outputting the group representations R. This defines the optimization problem:

min E,W,R C E AoE (X, W, E) + ξC A AoE (E, R), (7)
with E ∈ A ×M , W ∈ R d× , and R ∈ A ×M . Under both constructions, the optimization is joint because the embedding and the aggregating costs share a common variable (A or E). What follows define the costs and solve the optimization problems.

AoE: Aggregation of Embeddings

This scheme first embeds and then aggregates by solving [START_REF] Iscen | Memory vectors for similarity search in high-dimensional spaces[END_REF]. The cost for embedding is defined as

C E AoE (X, W, E) := N i=1 e i -W x i 2 2 , (8)
= E -W X 2 F . (9)
This term represents the fidelity penalty of an embedding e w.r.t. a template x in the transformed domain.

For each group of embedded templates, the aggregated vector should satisfy some properties as well:

• For each group the overall distance between group members and the aggregated vector is minimized. • Aggregated vector should be represented as a sparse ternary code. The cost of aggregation is then defined as

C A AoE (E, R) := M g=1 E g -r g 1 |Sg| 2 . ( 10
)
We add the following constraints:

W W = I , (11)
e i 0 ≤ S, ∀i ∈ [N ] (12) r g 0 ≤ S ∀g ∈ [M ]. (13)
The constraint makes sure that the representative r is sparse, ternary, and diverse. We propose to optimize problem [START_REF] Iscen | Memory vectors for similarity search in high-dimensional spaces[END_REF] iteratively by alternating updates of one parameter while fixing the remaining ones. Each step minimizes the total cost function lower bounded by 0, insuring a convergence to a local minimum.

W-

Step. We fix E and R and update W by solving:

min W E -W X 2 F s.t. W W = I (14)
This problem is a least square Procruste problem with orthogonality constraint. By setting S := XE , [START_REF] Schönemann | A generalized solution of the orthogonal procrustes problem[END_REF] shows that W = UV , where U contains the eigenvectors corresponding to the ( < d) largest eigenvalues of SS and V contains the eigenvectors of S S.

E-

Step. W and R being fixed, we can solve the problem for each E g independently:

∀g ∈ [M ], min Eg E g -W X g 2 F + ξ E g -r g 1 |Sg| 2 F s.t. E g ∈ A ×|Sg| , e i 0 ≤ S, ∀i ∈ S g . (15)
According to [START_REF] Razeghi | Privacy preserving identification using sparse approximation with ambiguization[END_REF], we first find the solution without considering the constraints and then apply ternarization function T S (1) to obtain sparse codes. Therefore E g is found as:

E g = T S (W X g + ξr g 1 |Sg| ). (16)

R-

Step. Like for the E-step, updating each group representation r g is done independently, while fixing W and E:

min rg E g -r g 1 |Sg| 2 F s.t. r g ∈ A , r g 0 ≤ S. (17)
Then the representative of g-th group is obtained as:

r g = T S (E g 1 |Sg| ). ( 18
)

EoA: Embedding of Aggregation

We now consider the construction of ( 6) that first aggregates and then embeds. The cost of the aggregation is defined as:

C A EoA (X, A) := M g=1 X g a g -1 |Sg| 2 2 + η a g 2 2 . ( 19
)
Minimizing this cost amounts to equalize the similarity between each members of the group and the aggregated vector a. The cost for embedding is defined as previously:

C E EoA (A, R, W) := R -W A 2 F . (20)
As for the constraints:

W W = I , (21)
r g ∈ A , r g 0 ≤ S, ∀g ∈ [M ]. ( 22
)
The optimization problem [START_REF] Huang | Labeled faces in the wild: A database forstudying face recognition in unconstrained environments[END_REF] with these costs and constraints is solved by iterating the following steps.

W-

Step. Like for [START_REF] Schechter | Anonymous authentication of membership in dynamic groups[END_REF], updating W while R, A are fixed is a Procruste problem under orthogonality constraint:

min W R -W A 2 F , s.t. W W = I . (23)
Similar to [START_REF] Schechter | Anonymous authentication of membership in dynamic groups[END_REF], we define S := AR . The solution is found as W = UV , where U contains the eigenvectors corresponding to the largest eigenvalues of SS and V the eigenvectors of S S.

A-

Step. When fixing W and R, the aggregated vector for each group g ∈ [M ] is found independently by minimizing:

min ag r g -W a g 2 2 + γ( X g a g -1 |Sg| 2 2 + η a g 2 2 ), ( 24
)
whose solution is

a g = (WW + γ(X g X g + ηI d ))
-1 (Wr g + γX g 1 |Sg| ).

Experiments

We fully implemented the group membership protocol that is described in [START_REF] Gheisari | Aggregation and embedding for group membership verification[END_REF]. Experimenting with this implementation gives the baseline performances. Note that the experimental part of [START_REF] Gheisari | Aggregation and embedding for group membership verification[END_REF] only deals with synthetic data. Our implementation could reproduce these results. However, the sequel presents comparisons on real data.

Experimental Setup

We evaluate the performances of our scheme with face recognition. Face images are coming from LFW [START_REF] Huang | Labeled faces in the wild: A database forstudying face recognition in unconstrained environments[END_REF], CFP [16] and FEI [START_REF] Thomaz | A new ranking method for principal components analysis and its application to face image analysis[END_REF] databases. Face descriptors are obtained from a pre-trained network based on VGG-Face architecture [9]. The output vector of the penultimate layer (i.e. before the final classifier layer) is PCA reduced to a lower dimension (d = 1, 024 for LFW and CFP, d = 256 for FEI database), and then L 2 -normalized. The result is the template x ∈ R d . The values of , S, ξ, γ and η are set empirically as 0.9d, 0.7l, 1, 10 4 and 1 respectively. Also, not all individuals from these databases are enrolled.

LFW. Labeled Faces in the Wild contains 13,233 images of faces collected from the web. We used cropped LFW images. The enrollment set consists of N = 1, 680 individuals with at least two images in the LFW database. One random template of each individual is enrolled in the system, playing the role of x i . The other templates are used for queries. These are partitioned into two subsets: templates that are correlated with x i with a similarity bigger than 0.95 form the "easy queries" set ; the remaining templates with a similarity bigger than 0.9 form the "hard queries" set. The re-maining individuals not enrolled in the system (5, 749 -N ) play the role of impostors (hypothesis H 0 ).

CFP.

The Celebrities in Frontal-Profile (CFP) database is composed of 500 subjects with 10 frontal and 4 profile images for each subject in a wild setting. We only use the frontal images. The impostor set is a random selection of 100 individuals. One random template of the remaining individuals is enrolled in the system. Like the setting described for LFW, we have two subsets of queries. FEI. We use frontal and pre-aligned images of the Brazilian FEI database. There are 200 subjects with two frontal images (one with a neutral expression and the other with a smiling facial expression). The database is created by random sampling 150 individuals. For each identity, one random image is enrolled while the other is used as query. The remaining individuals are considered as impostors.

At the enrollment phase, all groups have exactly the same number of members:

|S g | = m, ∀g ∈ [M ]
. Individuals are randomly assigned to a group.

The performances of the system are gauged with error probabilities evaluated by Monte Carlo estimator over the testing set. Since N is not so large, the confidence interval at 95% is ≈ ±N -1/2 = ±2.5%, which prevents us from estimating small probabilities. Therefore, we put our system under stress by selecting a hard setup. First, note that LFW and CFP are difficult datasets due to the 'in the wild' variations (poses, illuminations, expressions and occlusions). They do not reflect the application of accessing a building (as mentioned in the Introduction) where the capture environment is more under control and the individuals collaborate. Second, not only the dimension of the templates have been reduced but also the length of the embeddings and the group representation ( = 0.9d) with a sparsity of S = 0.7l (unless stated otherwise). Probabilities of errors are then big but measurable with accuracy. We believe that this protocol makes sense to benchmark approaches.

Two applications scenarios are investigated: group verification and group identification.

Group verification. A user claims she/he belongs to group g. This claim is true under hypothesis H 1 and false under hypothesis H 0 (i.e. the user is an impostor). Her/his template y is embedded, and (h(y), g) is sent to the system, which compares h(y) to the group representation r g . The system accepts (t = 1) or rejects (t = 0) the claim. This is a two hypothesis test with two probabilities of errors: P fp := P(t = 1|H 0 ) is the false positive rate and P fn := P(t = 0|H 1 ) is the false negative rate. The figure of merit is P fn when P fp = 0.05.

Group identification. The scenario is an open set identification where the querying user is either enrolled or an impostor. The system has two steps. First, it decides whether or not this user is enrolled. This is verification as above, except that the group is unknow: The system computes δ j = h(y) -r j , ∀j ∈ [M ]. The system accepts (t = 1) if the minimum of these M distances is below a given threshold τ . The figure of merit is P fn when P fp = 0.05.

When t = 1, the system proceeds to the second step. The estimated group is given by ĝ = arg min j∈[M ] δ j . The figure of merit for this second step is P := P(ĝ = g) or the Detection and Identification Rate DIR := (1-P )(1-P fn ). aggregation-the accumulated losses are therefore great; EoA (Baseline) has better performances since plain templates are first aggregated before running the embedding step which causes less information loss.

Exp. #1: Comparison to the baseline

Our method does not suffer that much from this information loss: EoA and AoE have roughly similar performances, with much more acceptable P fn values.

Exp. #2: Detection and Identification Rate

Figure 3 compares the DIR performances for group identification with m = 16. Our schemes have results close to perfection on the FEI dataset. Easy queries are correctly handled on CFP but not on the LFW dataset at this size of group. Hard queries are more difficult to cope with. This is explained by the poor correlations they have with their corresponding x i . That poor correlation, already existing on the original templates, before any embedding or aggregation, can only lower the performances of any membership identification scheme.

Figure 4 shows the impact of the size of group on DIR. Packing more templates into one group representation is detrimental even if the queries are well correlated with their corresponding enrolled template. This suggests to split large groups into subgroups of size lower or equal to m = 32. This restricts privacy to m-anonymity as the server is now able to identify the subgroup a query belongs to.

Exp. #3: Easy vs. Hard Queries

Figure 5 gives an additional perspective on the phenomenon highlighted above, that is, the genuine similarity between the query and the enrolled template is a key factor. Easy queries are very well handled whereas hard queries are more problematic. Put differently, the proposed method do not severely degrade the recognition power of the descriptors obtained through the VGG16 network. Descriptors poorly correlated already at the image level can only cause poor performance once embedded and aggregated. This is also shown in Fig. 7 which displays some enrolled and querying faces of the 'in the wild' datasets LFW and CFP. All the failed identification examples show a change of lighting, pose or expression, and / or occlusion. Yet, such changes do not automatically give a failure.

Exp. #4: Security and Privacy

As for the security and privacy, the quantities (2) and (3) were measured as empirical average over the dataset.

Knowing that the query has unit norm, the reconstruction mechanism yields a unit vector as follows: ŷ = We(y)/ We(y) . The quality of the reconstruction mainly depends on the sparsity factor S. When S is small, the template is reconstructed with few columns of W. When S is big, more columns are used but the amplitude modulating each column is coarsely reconstructed. There might be two values of S, one small, one large, providing the same reconstruction MSE. However, these two values do not yield the same performances as shown in Fig. 6.

Reconstructing enrolled templates is even more difficult due to the aggregation (see (3)). Fig. 6 shows that our method has decreased the security a little, but overall the trade-off between security and performances is more interesting especially for AoE.

Conclusion

This paper proposes a framework for group membership verification and identification by jointly learning the embedding and the aggregation. Yet, this learning was not completely free. Some guidances were still imposed, especially the prototyping of the embedding based on a sparse ternary quantization. This is mainly for inheriting security and privacy properties of this lossy information processing [START_REF] Razeghi | Privacy preserving identification using sparse approximation with ambiguization[END_REF][START_REF] Razeghi | Privacy-preserving outsourced media search using secure sparse ternary codes[END_REF]. It is not clear whether an alternative approach does exist.

Our future work looks at increasing the length of the group representation in order to pack more templates into a group. Yet, this raises scalability issues appealing for faster but approximative learning.

Figure 1 :

 1 Figure 1: Overview group S g . For EoA (first aggregate, then embed), denote A := [a 1 , . . . , a M ] ∈ R d×M the matrix gathering the aggregations of the templates enrolled in a group.Matrices E and A will be defined through optimization problems detailed below. For the embedding, function e is still prototyped according to Sect. 3.2. Papers[START_REF] Razeghi | Privacy preserving identification using sparse approximation with ambiguization[END_REF][START_REF] Razeghi | Privacy-preserving outsourced media search using secure sparse ternary codes[END_REF] show that privacy and security stem from the sparsifying transform. Only its matrix W is learned.For EoA, Fig.1shows that it starts from X to create A before outputting R using matrix W. This defines the optimization problem:

Figure 2 :

 2 Figure2: Performances comparison of our schemes vs. baseline for varying group size m. P fn at P fp = 0.05 for group verification (solid), the first step of group identification (dashed), and P for the second step of group identification (dotted).

Figure 3 :

 3 Figure 3: The Detection and Identification Rate (DIR) vs. P fp for group identification. Performances for hard queries are plotted in dashed lines.

Figure 2 Figure 4 :

 24 Figure2shows that our method brings improvement compared to the baseline, since the AoE and the EoA plots are way below the ones corresponding to the baseline. The high probabilities of false negatives for the baseline are caused by the great losses in information: AoE (Baseline) looses information from each template it embeds before the

Figure 5 :

 5 Figure 5: The impact of the similarity of the query with the enrolled template on group verification and identification.

Figure 6 :

 6 Figure 6: The impact of sparsity factor S on the trade-off between security and performances, on FEI with m = 32 and S/d ∈ (0.1, 1).

Figure 7 :

 7 Figure 7: Examples of group identification on CFP(left) and LFW(right). Blue frames indicate enrolled samples, green / red frames successful / failed queries, respectively.