Hansjörg Albrecher
email: hansjoerg.albrecher@unil.ch

Dina Finger
email: dina.finger@unil.ch

Pierre-O Goffard
email: pierre-olivier.goffard@univ-lyon1.fr

Blockchain mining in pools: Analyzing the trade-off between profitability and ruin

The resource-consuming mining of blocks on a blockchain equipped with a Proof-of-Work consensus protocol bears the risk of ruin, namely when the operational costs for the mining exceed the received rewards. In this paper we investigate to what extent it is of interest to join a mining pool that reduces the variance of the return of a miner for a specified cost for participation. Using methodology from ruin theory and risk sharing in insurance, we quantitatively study the effects of pooling in this context and derive several explicit formulas for quantities of interest. The results are illustrated in numerical examples for parameters of practical relevance.

Introduction

A blockchain is a decentralized data ledger maintained by a Peer-to-Peer network. Blockchain users issue transactions to the network peers who agree on those to be recorded by following a consensus protocol. In public and permissionless blockchains, such as the one for Bitcoin, the consensus protocol is called Proof-of-Work (PoW). The nodes, referred to as miners, compete to solve a challenging cryptographic puzzle using some brute force search algorithm. The first miner to come up with a solution includes the pending transactions in a block and is rewarded with newly minted crypto-coins. This reward compensates the operational cost of mining mainly induced by the consumption of electricity.

The PoW protocol is designed to be incentive compatible in the sense that a miner is compensated proportionally to her computational effort. When the Peer-to-Peer network grows large, the share of the network computing power owned by a given miner shrinks, which in turn makes the gains infrequent. The constant operating costs therefore endanger the solvency of miners and has led them to join forces by forming mining pools.

Mining pools grant miners a steadier income, as block finding rewards are collected more often. The earnings are then fairly distributed to the pool participants based on their contribution to the computational effort. The simplest way to do so consists in splitting the reward whenever a block is found. This is the proportional reward system. More sophisticated reward schemes have been put together to increase the amount of risk transferred from the miners to the pool and to fill the gaps of the proportional system that we will discuss later. These more sophisticated systems require the supervision of a manager who undertakes part of the risk in exchange for a commission. An early work of Rosenfeld [START_REF] Rosenfeld | Analysis of Bitcoin Pooled Mining Reward Systems[END_REF] provides a detailed overview on mining pool reward systems, see also the recent survey of Zhu et al. [START_REF] Zhu | A survey: Reward distribution mechanisms and withholding attacks in Bitcoin pool mining[END_REF]. In practice, the individual contribution of a miner is measured through a share submission process. A share refers to an easier-to-find 'fake' solution to the crypto-puzzle that miners must send to the pool manager to prove their involvement (for instance, a solution to the crypto-puzzle with only m instead of the n > m leading zeroes required for the successful mining of a block). In this work we provide a risk analysis of Pay-per-Share (PPS) reward systems in which the pool manager pays for each share submitted by the miners. In that way the manager takes on much of the randomness associated to the mining activity, which is therefore very appealing to the participant. Using utility theory, Schrijvers et al. [START_REF] Schrijvers | Incentive Compatibility of Bitcoin Mining Pool Reward Functions[END_REF] showed that such systems are incentive-compatible for risk-averse miners. Both Rosenfeld [START_REF] Rosenfeld | Analysis of Bitcoin Pooled Mining Reward Systems[END_REF] and Zhu et al. [START_REF] Zhu | A survey: Reward distribution mechanisms and withholding attacks in Bitcoin pool mining[END_REF] stressed that a scheme of this kind must go hand in hand with a proper capital allocation strategy on the part of the manager to avoid ruin.

Reliable information on mining companies filing for bankruptcy are hard to come by, we are able to provide one. Bcause Mining, LLC, the mining affiliate operating in Virginia Beach, Virginia, filed voluntarily for bankruptcy court protection under Chapter 11 on April 11, 2019 in order to reorganize its debts. Unsecured creditors included a Virginia power company ($1, 459, 267.38), the U.S. Customs and Border Patrol ($737, 041.90), landlords, and staff 1 .

The aim of this paper is to provide risk-analytic tools to inform the decision making process of miners and pool managers. This is achieved by taking an approach inspired from insurance risk theory. The wealth of miners and pool managers is modelled via stochastic processes that take into account operational costs, pool participation fees and block finding rewards. The resulting processes are similar to those appearing in the surplus modelling for insurance companies which collect premiums continuously and have to pay loss reimbursements to policyholders in case a claim occurs. A standard risk measure in this context is the ruin probability defined as the probability that the wealth process falls below zero, see e.g. Asmussen and Albrecher [START_REF] Asmussen | Ruin probabilities[END_REF] for an overview. This analogy was already used in Albrecher and Goffard [START_REF] Albrecher | On the profitability of selfish blockchain mining under consideration of ruin[END_REF], where the opportunity for miners to deviate from the prescribed protocol by withholding blocks was investigated. A first result was also obtained there in relation to the advantage of joining a mining pool which applies the proportional system. Our objective in this paper is to considerably extend this line of thinking towards the Pay-per-Share redistribution systems that are more commonly used in practice. We will also consider a variant of the model in which the collected rewards are random variables. This assumption will enable the application of classical results from double-sided jumps in a risk reserve process for modelling insurance portfolios, see for example Albrecher at al. [START_REF] Albrecher | A direct approach to the discounted penalty function[END_REF], Labbé and Sendova [START_REF] Labbé | The expected discounted penalty function under a risk model with stochastic income[END_REF]. Incorporating random rewards allows us to account for the transactions fees and the exchange rate of cryptocurrencies to fiat ones. Transaction fees are included by blockchain users to entice the network to process their transactions, see Easley al. [START_REF] Easley | From mining to markets: The evolution of bitcoin transaction fees[END_REF] and Kasahara and Kawahara [START_REF] Kasahara | Effect of Bitcoin fee on transaction-confirmation process[END_REF]. The redistribution of the revenue generated by the transaction fees among the pool participants also varies from one mining pool to another. Closed-form expressions for the probability of ruin and the expected profit given that ruin has not occurred are provided up to an exponentially distributed time horizon. These formulas are amenable for a quick numerical evaluation to perform a sensitivity analysis of risk and reward indicators with respect to the model parameters.

We believe that our results will be useful for miners and pool managers to make the right financial choices. Our indicators can also serve as the basis for a potential future regulatory framework for mining activity on blockchains equipped with the Proof-of-work consensus protocol.

A major concern associated to mining pool formation is the centralization of the network. Cong et al. [START_REF] Cong | Decentralized Mining in Centralized Pools[END_REF] have explained that miners who direct their mining power to multiple small mining pools enjoy the same risk sharing benefits as miners that choose to join a single mining pool. Hence the intuition that a larger mining pool would grow even larger is misguided. Empirical data shows that the participation fees are greater in larger mining pools, which naturally slows down their growth. We aim at providing more insight on the risk of centralization in the light of our analysis.

The remainder of the paper is organized as follows. Section 2 gives a brief description of the mining process in blockchains equipped with Proof-of-Work. Section 3 provides an overview of the existing reward systems and describes the Pay-Per-Share mechanism in more detail, as it will be the focus later on. Formulas for the ruin probability and expected surplus for the pool manager are derived for deterministic rewards in Section 4 and for randomized reward in Section 5. Section 6 provides formulas from the individual miner's perspective. Section 7 is devoted to numerical illustrations where the sensitivity of the risk and performance indicator is analysed with respect to the model parameters. Section 8 concludes.

Mining blocks in a Proof-of-Work powered blockchain

A block consists of a header and a list of "transactions" that represents the information recorded through the blockchain. The header usually includes the date and time of creation of the block, the block height which is the index inside the blockchain, the hash of the block and the hash of the previous block. The hash of a block is obtained by concatenating the header and the transactions in a large character string thus forming a "message", to which a hash function is applied. A hash function is a function that can map data of arbitrary size to fixed-sized values. The hash functions used in blockchain applications must be cryptographic, i.e. quick to compute, one way and deterministic. It must be nearly infeasible to generate a message with a given hash value or to find two messages with the same hash value. A small change in the message should change dramatically the hash value so that the new hash value appears to be uncorrelated to the previous hash. We will not expand on how to build such a cryptographic hash function, we refer the interested reader to the work of Al-Kuwari et al. [START_REF] Al-Kuwari | Cryptographic Hash Functions: Recent Design Trends and Security Notions[END_REF]. In the bitcoin blockchain as well as in many other applications, the standard is the SHA-256 function which converts any message into a hash value of 256 bits. The latter is usually translated into a hexadecimal digest, for instance the hash value of the title of the present manuscript reads as 98b1146926548f6b57c4347457713ff2f035beda9c93f12fbc9b202e9c512e80.

The information recorded in a public blockchain may be retrieved by anyone and can be accessed through a blockchain explorer such as blockchain.com, the content of the block of height #724724 may be viewed through the following link block content. Mining a block means finding a block hash value lower than some target which can only be achieved by brute force search thanks to the properties of cryptographic hash functions. In practice, the search for an appropriate hash value, referred to as a solution, is done by appending a nonce to the block message before applying the hash function. A nonce is a 32 bits number, drawn at random by miners until a nonce resulting in a proper block hash value is found. For illustration, consider the block in Figure 1.

Figure 1: A block that has not been mined yet.

The hash value in decimal notation is 1.43e 76 while the maximum value for a 256 bits number is 2 256 -1 ≈ 1.16e 77 . We refer to the latter as the maximal target and denote it by T max . The Proofof-Work protocol sets a target T < T max and ask miners to find a nonce such that the hash value of the block is smaller than T . Practitioners would rather talk about the difficulty which is defined as D = T max /T . If the difficulty is one, any hash value is acceptable. Increasing the difficulty reduces the set of allowable hash values, making the problem harder to solve. A hash value is then called acceptable if its hexadecimal digest starts with a given number of zeros. If we set the difficulty to 2 4 , then the hexadecimal digest of the hash of the block must start with at least 1 leading zero, making the hash value of the block in Figure 1 not acceptable. After completing the nonce search we get the block in Figure 2. Note that it took 5 attempts to find this nonce. The number of needed trials is Figure 2: A mined block with a hash value having on leading zero. geometrically distributed with parameter 1/D, which means that with a difficulty of D = 2 4 it takes on average 16 trials. The protocol adjusts the difficulty automatically every 2, 016 block discoveries so as to (globally) maintain one block discovery every 10 minutes on average. The time between two block discoveries depends on the number of hash values computed by the network at a given instant. At the time of writing, the network computes 182.58 Exahashes per second and the difficulty is 27, 967, 152, 532, 434. 2 For an exhaustive overview of the mining process in the bitcoin blockchain, we refer the reader to the book of Antonopoulos [START_REF] Antonopoulos | Mastering Bitcoin[END_REF]Chapter 10]. As each trial (of the system) for mining a block is independent of the others and leads to a success with very small probability, the overall number of successes is binomially distributed and will be very well approximated by a Poisson random variable. This justifies the Poisson process assumption made in the sequel to model the block arrival and the reward collecting processes. Empirical studies of the block inter-arrival times data tend to confirm this hypothesis, see the work of Bowden et al. [START_REF] Bowden | Modeling and analysis of block arrival times in the Bitcoin blockchain[END_REF].

Risk models and reward systems

A risk model defines the wealth of some company or individual as a stochastic process

R t = u -C t + B t , t ≥ 0
which corresponds to the income (B t ) t≥0 net of the expenses (C t ) t≥0 . The surplus process (R t ) t≥0 starts at some initial level R 0 = u > 0. We take a continuous time approach where t ∈ R + , and (C t ) t≥0 and (B t ) t≥0 define increasing functions or stochastic processes. A risk analysis is relevant only if at least one of the model components is random. The activity of the company is profitable if on average the earnings exceed the expenses, namely E(B t ) > E(C t ). Even if the net profit condition holds, the variability of the process (R t ) t≥0 can lead to bankruptcy as it may become negative. Define the ruin time as τ u = inf{t ≥ 0 : R t < 0}, which corresponds to the first time at which the surplus goes below 0. The risk of bankruptcy is classically assessed by computing the ruin probability up to time t ≥ 0 defined by ψ(u, t) = P(τ u ≤ t).

(

It is sometimes more convenient from a mathematical point of view to consider the infinite-time horizon by letting t → ∞, and in that case we write ψ(u) := lim t→∞ ψ(u, t). Following the rationale developed in [START_REF] Albrecher | On the profitability of selfish blockchain mining under consideration of ruin[END_REF], we also consider a performance indicator defined as

V (u, t) = E(R t I τu>t ), (2)
which corresponds to the expected surplus at time t ≥ 0 in case ruin did not occur until then.

Consider a network of n miners, where miner i ∈ {1, . . . , n} owns a share p i ∈ (0, 1) of the network hashpower, i.e. n i=1 p i = 1. If the number of blocks found by the network is governed by a homogeneous Poisson process (N t ) t≥0 with intensity λ, then the number of blocks found by miner i is a (thinned) Poisson process (N i t ) t≥0 with intensity p i • λ. Denote by b > 0 the amount of the reward for finding a new block and assume that the cumulative operational cost is a linear function with slope c i > 0 which depends on the price of the electricity and the computing power of miner i. The surplus process of miner i is then given by

R i t = u -c i • t + N i t • b, t ≥ 0. (3)
Model (3) has been considered by Albrecher and Goffard [START_REF] Albrecher | On the profitability of selfish blockchain mining under consideration of ruin[END_REF], and formulas for both the finite-time ruin probability (1) and the expected surplus (2) were derived. To make the formulas more amenable for numerical evaluation, the authors then decided to approximate the fixed time horizon t ≥ 0 by an exponential random variable T ∼ Exp(t) with mean t ≥ 0, resulting in tractable expressions for

ψ(u, t) = E[ψ(u, T )], and V (u, t) := E[V (u, T )], (4)
which were then used to carry out a numerical analysis.

Remark 3.1. Model (3) assumes that the block-finding reward is constant, while the bitcoin protocol stipulates a halving of the reward every 210, 000 blocks. However, first note that 210, 000 blocks take 4 years to be found which is greater than the time horizon we have in mind when defining ψ(u, t) and V (u, t). Second, since these halving dates are known to blockchain networks, the market automatically adjusts the cryptocurrency exchange rate before the halving occurs. Eventually, one could also replace b in Model (3) with a piecewise constant function to account for halving events. However, this would only be relevant for very long time horizons and will not be pursued in the present work.

Consider now a situation where a subset of miners I ⊂ {1, . . . , n} decides to gather in a mining pool.

The cumulated hashpower of this pool is then

p I = i∈I p i ,
and the arrival rate of block rewards for a given miner i rises from p i • λ to p I • λ. Because the reward is shared among the pool participants, the size of the reward collected by miner i decreases from b to

p i • b.
The expected surplus is the same when mining solo and mining for a pool, but the variance (and therefore the risk) is smaller when mining for a pool. The management of a mining pool relies heavily on the reward distribution mechanism set up by a pool manager. For the redistribution system to be fair, each miner must be remunerated in proportion to her calculation effort. Miner i must earn a share p i /p I of the mining pool total income. The pool manager has to find a way to estimate the contribution of each pool participant. This is done by submitting shares which are partial solutions to the cryptopuzzle easier to find than the actual solution. Recall from Section 2 that a proper solution corresponds to a hash value starting with a given number of zeros, so shares are hash values with a smaller number of leading zeros. If the current difficulty of the cryptopuzzle is D, then the difficulty for finding a share is set to q • D by the pool manager, where q ∈ (0, 1). The manager's cut is a fraction f ∈ (0, 1) of the block discovery reward b. We start by presenting the proportional reward system in Section 3.1.

The proportional reward system

The proportional reward system splits time in rounds which correspond to the time elapsed between two block discoveries. During these rounds, the miners submit shares. The ratio of the number of shares submitted by miner i over the total number of shares submitted by her fellow mining pool participants determines her share of the reward and should converge to her share of the mining pool computing power, that is p i /p I (for sufficiently low complexity of the shares, the latter limit will be a very good approximation for the actual situation indeed). The surplus of miner i is then given

R i t = u -c i • t + N I t • (1 -f ) • p i p I • b, t ≥ 0, (5)
where (N I t ) is a Poisson proccess of intensity p I • λ that gives the number of blocks appended to the blockchain by the mining pool. The duration of a round is exponentially distributed Exp (p I λ) -1 .

The uncertainty on the length of the round has undesirable consequences on the time value of the shares submitted by the miners. Indeed, if n shares are submitted during a round, then the value of a given share is (1 -f ) • b/n. The longer a round lasts, the greater the value of n is. The shares are worth less in longer rounds which triggers an exodus behavior of miners toward mining pools with shorter rounds. This phenomenon, called pool hopping, has been documented in the early work of Rosenfeld [START_REF] Rosenfeld | Analysis of Bitcoin Pooled Mining Reward Systems[END_REF]. Yet another drawback is that a miner that has found a full solution may delay the submission until her ratio of shares submitted reflects her fraction of the mining pool computing power. The proportional system is not incentive-compatible using the terminology of Schrijvers et al. [START_REF] Schrijvers | Incentive Compatibility of Bitcoin Mining Pool Reward Functions[END_REF]. A discounting factor may be applied to compensate the decreasing value of shares over time, see for instance the slush's method [START_REF]Reward system specifications[END_REF].

Our work is also concerned about the risk undertaken by pool managers. Within the frame of the proportional reward system, the surplus of the pool manager is given by

R I t = u + N I t • f • b, t ≥ 0. (6)
Model ( 6) does not account for any mining pool operating cost. The mining costs are entirely borne by miners and the mining pool manager only serves as coordinator. A proportional-type reward system should therefore lead to a low management fee f .

Although this system provides fairness, it has weaknesses that justify the introduction of a more sophisticated distribution mechanism. In particular, if miners seek to actually transfer some of the risk associated to the mining activity to the pool manager, then they should rather turn to a mining pool based on a Pay-per-Share system, which is the focus of this paper and introduced in the next section.

The Pay-Per-Share reward system

In a Pay-per-Share reward system, the pool manager immediately rewards the miners for each share submitted. Let (M t ) t≥0 be a Poisson process of intensity µ that counts the number of shares submitted by the entire network of miners up to time t ≥ 0. Denote by q ∈ (0, 1) the relative difficulty of finding a block compared to finding a share. Let 0 < w < b be the reward for finding a share. The number of shares submitted by miner i is then a (thinned) Poisson process (M i t ) t≥0 with intensity p i • µ, p i being the share of the individual miner's network hashpower as defined above, and her surplus when joining a PPS mining pool becomes

R i t = u -c i • t + M i t • w, t ≥ 0. ( 7
)
The intensities of the processes (N t ) t≥0 and (M t ) t≥0 are linked through λ = q • µ. By setting w =

(1 -f ) • b • q, we observe that the surplus ( 5) and ( 7) have the same expectation at time t, but the variance and therefore the risk associated to [START_REF] Avanzi | Optimal dividends in the dual model[END_REF] is lower. This reward system has been shown to be resistant to pool hopping and is incentive compatible. It also entails a significant transfer of risk to the pool manager whose surplus process is now given by

R I t = u -M I t • w + N I t • b, t ≥ 0, (8)
making her subject to the risk of bankruptcy.

Remark 3.2. Since the process (M I t ) t≥0 requires solving for a problem of lower complexitiy than (N I t ) t≥0 , (N I t ) t≥0 is a subset of the path defined by the process (M I t ) t≥0 . It means that both processes are not independent. Concretely, at the moment of the block reward payment b, at the same time there is a realisation of the miners' reward w. As we sometimes will need to isolate downward jumps without the simultaneous upward jump point, we define another process with a reduced intensity. We apply the superposition theorem (see e.g. [START_REF] Kingman | Poisson Processes. Oxford Studies in Probability[END_REF]) to the Poisson process M I t by redefining the down jump process as (M I,d t ) t≥0 ∼ P oisson(µ d ), where µ d = µ -λ. In addition to the bounty for finding a new block, blockchain users usually include a small financial incentive for the network to process their transaction. These transaction fees (e.g. referred to as gas within the ETHEREUM blockchain), are known to be variable as they highly depend on the network congestion at a given time. Note also that since the operational cost is paid by miners using a fiat currency, it would be more accurate to account for the exchange rate of the cryptocurrency to some fiat currency. We can therefore model the successive rewards for shares and blocks as sequences of nonnegative random variables denoted by (W k ) k≥1 and (B k ) k≥1 respectively, which for simplicity we will both assume to be i.i.d. in this paper. A reward system that features a Pay-per-Share mechanism and includes in the miners' reward the transaction fees is referred to as a Full Pay-per-Share reward system by practitioners. The surplus of miner i in a mining pool applying the FPPS system is given by

R i t = u -c i • t + M i t k=1 W k , t ≥ 0, (9)
and the surplus of the pool manager then becomes

R I t = u - M I t k=1 W k + N I t l=1 B l , t ≥ 0. ( 10
)
In the following sections, we will now derive formulas for the ruin probability and expected surplus in case ruin did not occur up to a given time horizon for the models discussed above.

Pool analysis with deterministic rewards

We start with a fixed time horizon. For simplicity, we drop the superscript I in the following developments.

Deterministic time horizon

For the pool manager's side, we first define some measures of interest. Let τ = inf{t ≥ 0 : R t < 0} be the time of ruin of the pool manager, i.e. the first time his surplus reaches 0. The corresponding ruin probabilities in finite and infinite horizon respectively are given by ψ(u, t) = P(τ ≤ t), and ψ(u

) = P(τ < ∞). (11)
The net profit condition in this case translates to λb > µw. It implies from [START_REF] Asmussen | Ruin probabilities[END_REF], that ψ(u) < 1. We also define the expected surplus at time t given that ruin has not occurred up to time t:

V (u, t) = E(R t I τ >t ). ( 12
)
In the sequel, we will use the process (M d t ) t≥0 defined in Remark 3.2 representing the pure downward jumps. Note that ruin can only occur at discrete times when the process (M d t ) t≥0 admits a jump. We can rewrite the ruin time τ as

τ = inf{t ≥ 0; M d t w > u + N t (b -w)} = inf{t ≥ 0; M d t > u/w + N t (b -w)/w}. ( 13
)
Equivalently, we can rewrite it as

τ = inf{t ≥ 0; M d t w/(b -w) > u/(b -w) + N t } (14)
to isolate the (N t ) t≥0 process with unit jumps. The study of the p.d.f. f τ of τ is analogous to the derivations in [START_REF] Goffard | Fraud risk assessment within blockchain transactions[END_REF]. Since (N t ) t≥0 and (M d t ) t≥0 are Poisson process, they enjoy the order statistic property. That is, given that N t = n, the jump times {T 1 , . . . , T n } of the process N t have the same distribution as the order statistics vector of a random variable having distribution

F t (s) = s/t, 0 ≤ s ≤ t.
f τ (t) = +∞ n=0 E (-1) n t n G n 0|S v 0 , . . . , S d v n-1 |S d vn = t f S d vn (t)P [N t = n] , ( 15
)
where (v n ) n≥0 is a sequence of integers defined as v n = ⌈n(b-w)/w+u/w⌉, n ≥ 0, and

(G n (•|{. . .}) n∈N
is the sequence of Abel-Gontcharov polynomials defined in Appendix A.

The proof is delegated to Appendix B. The expression of the ruin time p.d.f. ( 15) is not convenient for numerical purposes. The infinite series in (15) must be truncated, possibly to a high order to reach an acceptable level of accuracy. Also, the evaluation of the Abel-Gontcharov polynomials relies on the recurrence relationships (67) which are known to suffer from numerical instabilities. Moreover, the conditional expectation with respect to {S d vn = t} itself requires the use of Monte Carlo simulations. Finally, a similar algebraic expression for V (u, t) is out of sight. In view of all these difficulties, we therefore propose as in [START_REF] Albrecher | On the profitability of selfish blockchain mining under consideration of ruin[END_REF] a workaround which consists of replacing the deterministic time horizon by a random variable with exponential distribution.

Exponential time horizon

To obtain a nicer solution to the problem, we now randomize the time horizon T . The practical intuition suggests that the time horizon is never fixed in advance and is subject to various external factors, such as bitcoin price fluctuations, in-pool events etc. We choose the time horizon T to be exponentially distributed with rate 1/t (so that E(T ) = t). This leads to computable expressions having an intuitive justification due to the lack of memory property of the exponential distribution.

V (u, t) = w i=1 c i x u i + u + λb t -(λ + µ d )w t,
where x 1 , . . . , x w are the w roots inside the unit disk of the equation

λx b -(λ + µ d + 1/t)x w + µ d = 0, ( 16
)
and the constants c 1 , . . . , c w are the solution of the linear equation system

       λx b-w 1 -(λ + µ d + 1/t) • • • λx b-w w -(λ + µ d + 1/t) λx b-w+1 1 -(λ + µ d + 1/t)x 1 • • • λx b-w+1 w -(λ + µ d + 1/t)x w . . . . . . . . . λx b-1 1 -(λ + µ d + 1/t)x w-1 1 • • • λx b-1 w -(λ + µ d + 1/t)x w-1 w               c 1 c 2 . . . c w        =        A 1 A 2 . . . A w        , ( 17
)
with

A i = (i -1)µ d + µ d t(λb -(λ + µ d )w) -µ d w, i = 1, . . . , w.
Proof. Akin to the approach in [START_REF] Albrecher | A direct approach to the discounted penalty function[END_REF], consider some small h > 0 and condition on the following scenarios during the time interval (0, h):

1. no jump and T > h;

no jump and T ≤ h;

3. occurrence of an upward jump;

4. occurrence of a downward jump.

All other combinations of these events have negligible probability in the limit h → 0 that we will pursue below. One then obtains

V (u, t) = e -( 1 t +λ+µ d )h V (u, t) + 1 t h 0 e -s/t e -(λ+µ d )s u ds + λ h 0 e -λs e -(1/t+µ d )s V (u + b -w, t) ds + µ d h 0 e -µ d s e -(1/t+λ)s V (u -w, t) ds. ( 18
)
We now take the derivative w.r.t. h and set h = 0 to obtain

λ V (u + b -w, t) -(λ + µ d + 1/t) V (u, t) + µ d V (u -w, t) + u/t = 0, u ≥ 0. ( 19
)
By definition of V (u, t) we have the boundary conditions V (u, t) = 0 for all u < 0 and the linear boundedness 0 ≤ V (u, t) ≤ u + (λb -µ d w)t in both u and t for all u, t ≥ 0.

Equation ( 19) is an inhomogeneous difference equation with constant coefficients (see e.g. [START_REF] Jerri | Linear difference equations with discrete transform methods[END_REF] for solution methods), which has the general solution

V (u, t) = b i=1 c i x u i + d 0 + d 1 u
with constants {c i } b i=1 , {x i } b i=1 , d 0 , d 1 still to be determined. Let us start with the inhomogeneous part: plugging the ansatz d 0 + d 1 u into [START_REF] Mazza | A link between wave governed random motions and ruin processes[END_REF] gives

d 1 = 1, d 0 = λbt -(λ + µ d )wt.
For the homogeneous part, we consider the characteristic equation [START_REF] Labbé | The expected discounted penalty function under a risk model with stochastic income[END_REF], which by the Fundamental Theorem of Algebra has exactly b complex roots x 1 , . . . , x b . The linear boundedness of V (u, t), however, excludes any solution with absolute value exceeding 1 (i.e., the corresponding constants c i must be zero). In fact, it turns out that exactly w roots of the polynomial in ( 16) are located inside the unit disk in the complex plane. To see this, observe first that (λ + µ d + 1/t)x w + µ d has exactly w roots inside the unit disk (due to µ d /(λ + µ d + 1/t) < 1). Then Rouché's Theorem establishes that the same is true for the entire polynomial in [START_REF] Labbé | The expected discounted penalty function under a risk model with stochastic income[END_REF], if

|λz b | < | -(λ + µ d + 1/t)z w + µ d | on |z| = 1,
which translates into the condition

|µ d -(λ + µ d + 1/t)z w | > λ on |z| = 1. ( 20
)
The reverse triangle inequality states for any complex a, b ∈ C that |a -b| ≥ |a| -|b| , which shows that for |z| = 1 the left-hand side of ( 20) is larger than λ + 1/t, so that ( 20) is indeed fulfilled.

It is now only left to determine the coefficients c 1 , . . . , c w corresponding to the w roots x 1 , . . . , x w ∈ C with |x i | < 1 of (16). To that end, note that (19) evaluated at u = 0, . . . , w -1 gives the following system of equations:

λ V (b -w, t) -(λ + µ d + 1/t) V (0, t) = 0, λ V (b -w + 1, t) -(λ + µ d + 1/t) V (1, t) + 1/t = 0, • • • λ V (b -1, t) -(λ + µ d + 1/t) V (w -1, t) + (w -1)/t = 0.
Substituting the form

V (u, t) = w i=1 c i x u i + u + a t with a t = λb t -(λ + µ d )w t into this system leads to λ w i=1 c i x b-w i + λ(b -w) + λa t -(λ + µ d + 1/t) w i=1 c i + a t = 0, λ w i=1 c i x b-w+1 i + λ(b -w + 1) + λa t -(λ + µ d + 1/t) w i=1 c i x i + (1 + a t ) + 1/t = 0, • • • λ w i=1 c i x b-1 i + λ(b -1) + λa t -(λ + µ d + 1/t) w i=1 c i x w-1 i + (w -1 + a t ) + (w -1)/t = 0.
But the latter can be rewritten in the form [START_REF] Li | A Mean Field Games Model for Cryptocurrency Mining[END_REF]. Note that for some capital levels u the increase of V (u, 1) from u to u + 1 is larger than for others. This is linked to how many down-jumps relative to up-jumps are needed to become negative, and due to the discrete nature of the problem such jumps in V (u, t) occur naturally. where x 1 , . . . , x w are the w roots inside the unit disk of Equation ( 16) and the constants c 1 , . . . , c w are the solution of the linear equation system

       λx b-w 1 -(λ + µ d + 1/t) • • • λx b-w w -(λ + µ d + 1/t) λx b-w+1 1 -(λ + µ d + 1/t)x 1 • • • λx b-w+1 w -(λ + µ d + 1/t)x w . . . . . . . . . λx b-1 1 -(λ + µ d + 1/t)x w-1 1 • • • λx b-1 w -(λ + µ d + 1/t)x w-1 w               c 1 c 2 . . . c w        =        -µ d -µ d . . . -µ d        . ( 22
)
Proof. We proceed in the same way as in the proof of Theorem 4.2. The analogue of ( 18) then is

ψ(u, t) = e -( 1 t +λ+µ d )h ψ(u, t) + λ h 0 e -λs e -(1/t+µ d )s ψ(u + b -w, t) ds + µ d h 0 e -µ d s e -(1/t+λ)s ψ(u -w, t) ds (23)
and ( 19) is replaced by

λ ψ(u + b -w, t) -(λ + µ d + 1/t) ψ(u, t) + µ d ψ(u -w, t) = 0, u ≥ 0, (24)
which is the homogeneous equation of the former. The boundary conditions here are given by ψ(u, t) = 1 for u < 0 as well as the obvious bound ψ(u + b -w, t) ≤ 1 for all u ≥ 0. Correspondingly, from the proof of the previous theorem we then know that

ψ(u, t) = w i=1 c i x u i ( 25
)
with constants c 1 , . . . , c w still to be determined. Evaluating [START_REF] Zhu | A survey: Reward distribution mechanisms and withholding attacks in Bitcoin pool mining[END_REF] at u = 0, . . . , w -1 gives

λ ψ(b -w + j, t) -(λ + µ d + 1/t) ψ(j, t) + µ d = 0, j = 0, . . . , w -1.
Substituting (25) into these leads to

λ w i=1 c i x b-w+j i -(λ + µ d + 1/t) w i=1 c i x j i + µ d = 0, j = 0, . . . , w -1,
or equivalently [START_REF] Schrijvers | Incentive Compatibility of Bitcoin Mining Pool Reward Functions[END_REF].

Pool analysis with stochastic rewards

Until this point, we considered deterministic rewards b and w for jump sizes of the surplus process.

However, in practice, one may desire to incorporate variability in these quantities to account for instance for the incorporation of variable transaction fees attached to the block reward, or to capture the price volatilities to convert the reward to a fiat currency.

Let us therefore assume now that the up-and downward jumps in the dynamics of the pool manager's surplus are stochastic. Under certain assumptions on the nature of these jumps, this will allow us to still derive closed form formulas for ψ and V in the spirit of [START_REF] Albrecher | A direct approach to the discounted penalty function[END_REF], see also [START_REF] Asmussen | Ruin probabilities[END_REF]Ch. 4]. Equation ( 8) then is replaced by

R t = u - M d t n=1 W n + Nt n=1 B r,n , t ≥ 0, (26)
where we assume W n , n ∈ N to be i.i.d. positive random variables with cumulative distribution function Consider the expected surplus of the pool manager as defined previously with a random time horizon T . Concretely, T follows an exponential distribution with mean t. As in the previous section, we are interested in V (u, t).

Proposition 5.1. The quantity V (u, t) = E(R T I τ >T ) for the pool surplus process (26) is a solution of the integral equation

λ ∞ 0 V (u+b r , t) dF Br (b r )-(λ+µ d +1/t) V (u, t)+µ d u 0 V (u-w, t) dF W (w)+u/t = 0, u ≥ 0, ( 27
)
with boundary conditions V (u, t) = 0 for all u < 0 and 0 ≤ V (u, t)

≤ u + (λE[B r ] -µ d E[W ])t for all u, t ≥ 0.
Proof. We extend the approach of the proof of Theorem 4.2 by conditioning on the size of the jump in case a jump occurs. For some small h > 0 we correspondingly get

V (u, t) = e -( 1 t +λ+µ d )h V (u, t) + 1 t h 0 e -s/t e -(λ+µ d )s u ds + λ h 0 e -λs e -(1/t+µ d )s ∞ 0 V (u + b r , t) dF Br (b r ) ds + µ d h 0 e -µ d s e -(1/t+λ)s u 0 V (u -w, t) dF W (w) ds. ( 28
)
Taking the derivative w.r.t. h and setting h = 0, one obtains (27). The property V (u, t) = 0 for all u < 0 follows by definition and the linear upper bound in u and t is obtained from the inequality V (u, t) ≤ E(R T ).

Remark 5.2. For degenerate F Br and F W (i.e. for constant B r and W ), the integral equation ( 27) simplifies to [START_REF] Mazza | A link between wave governed random motions and ruin processes[END_REF] (and for integer constants, we get back to the setting of Theorem 4.2).

For our purposes, it is very reasonable to assume (and will lead to simplified notation) that the generic random variables B r and W are connected via

B r = a W (29)
for some constant a > 1 that depends on the number of miners in the pool. Indeed, W is the payment to the pool miner for solving a less complex puzzle, and B r can be seen as the bounty reward when the more complex puzzle is solved minus the payment to the miner who solved it, and that latter payment will be a constant fraction, depending on the specification of the pool rules. Note that for most positive random variables, a scaled version of it belongs to the same class of random variables with only the parameter(s) changed, and the latter is indeed the case for all distributional assumptions that we will pursue in this paper. In any case, all results below can easily be adapted to the case when B r and W follow distributions that are unrelated combinations of exponentials with different n and

A i 's.
Let us now consider in more detail the case where both the up-and down-jumps are random variables whose distributions are combinations of exponentials. The latter class is dense in the class of all random variables on the positive half-line, so that the result is in fact quite general (see e.g. Dufresne [START_REF] Dufresne | Fitting combinations of exponentials to probability distributions[END_REF]). Concretely, the density of downward jumps is then assumed to be of the form

f W (w) = n i=1 A i α i e -α i w , w > 0, ( 30
)
where

α 1 < α 2 < . . . < α n and A 1 + • • • + A n = 1 (but the A i are not necessarily positive). The
Laplace transform of this density is given by fW (s

) := E(e -sW ) = n i=1 A i α i α i + s , Re(s) > -α 1 .
From (29), we then have

f Br (b r ) = n i=1 A i β i e -β i br , b r > 0 ( 31
)
with β i = α i /a, i = 1, . . . , n.

Theorem 5.3. If W and B r are random variables with densities given in (30) and (31), then we have

V (u, t) = n k=1 C k e -r k u + u + t n i=1 A i λ β i - µ d α i , ( 32
)
where r 1 , . . . , r n are the solutions with positive real parts of

λ n i=1 A i β i β i + r + µ d n i=1 A i α i α i -r -(λ + µ d + 1/t) = 0 ( 33
)
and

C k = n j=1 B j n h=1 (α j -r h ) n i=1,i̸ =j r k -α i α j -α i n h=1,h̸ =k (r k -r h ) , k = 1, . . . , n (34)
with

B j = 1 α 2 j - t α j n i=1 A i λ β i - µ d α i , j = 1, . . . , n.
Proof. Substituting (30) and ( 31) into (27), we get

λ n i=1 A i β i ∞ 0 V (u + b r , t)e -β i br db r -(λ + µ d + 1/t) V (u, t) + µ d n i=1 A i α i u 0 V (u -w, t)e -α i w dw + u/t = 0, u ≥ 0.
The function V (u, t) then has the form

V (u, t) = n k=1 C k e -r k u + d 1 u + d 0 ,
for constants C 1 , . . . , C n , r 1 , . . . , r n , d 0 , d 1 to be determined. In fact, plugging this ansatz into the above equation shows that comparing coefficients of e -r k u exactly gives (33) (which is a generalized Lundberg equation in the terminology of ruin theory, cf. [START_REF] Asmussen | Ruin probabilities[END_REF]). That equation has exactly n solutions with positive real part r 1 , . . . , r n and n solutions with negative real part (see e.g. [START_REF] Zhang | The Perturbed Compound Poisson Risk Model with Two-Sided Jumps[END_REF]). The solutions with negative real part would enter V with positive real part and are correspondingly irrelevant for our purpose, as that would violate the linear boundedness of the resulting V (in other words, the coefficients in front of such terms need to be zero). Comparing coefficients of e -α i u , i = 1, . . . , n gives

n k=1 C k α i -r k = d 1 α 2 i - d 0 α i , i = 1, . . . , n. ( 35
)
Coefficients in front of u e -α i u , i = 1, . . . , n all cancel. After a little algebra, one sees that a comparison of coefficients of u in that equation establish d 1 = 1 and a comparison of the constant coefficients gives

d 0 = t n i=1 A i λ β i - µ d α i .
These obtained values of d 1 and d 0 can now be plugged into (35), and the resulting system of linear equations can be solved explicitly to give (34), either by realizing that the coefficient matrix is a Cauchy matrix or by using the trick of rational function representation developed in [START_REF] Albrecher | A direct approach to the discounted penalty function[END_REF]Sec.4].

Example 5.4. A particular simple example of the above is the case where W is exponentially distributed with parameter α and B r is exponentially distributed with parameter β. In that case n = 1 in Theorem 5.3 and we obtain

V (u, t) = 1 α 2 - t α λ β - µ d α (α -R)e -Ru + u + t λ β - µ d α , ( 36
)
where R is the (unique) solution with positive real part of

λ β β + r + µ d α α -r -(λ + µ d + 1/t) = 0. ( 37
)
Let us now move on to study the ruin probability ψ(u, t) = E [ψ(u, T )] in the present context.

Theorem 5.5. If W and B r are random variables with densities given in (30) and (31), then we have

ψ(u, t) = n k=1 D k e -r k u , ( 38
)
where r 1 , . . . , r n are the n solutions with positive real parts of (33) and

D k = n j=1 1 α j n h=1 (α j -r h ) n i=1,i̸ =j r k -α i α j -α i n h=1,h̸ =k (r k -r h ) , k = 1, . . . , n. ( 39
)
Proof. We can proceed in the same way as in the proof of Proposition 5.1 to derive an integral equation for the ruin probability. The analogue of Equation (28) here is

ψ(u, t) = e -( 1 t +λ+µ d )h ψ(u, t) + λ h 0 e -λs e -(1/t+µ d )s ∞ 0 ψ(u + b r , t) dF Br (b r ) ds + µ d h 0 e -µ d s e -(1/t+λ)s u 0 ψ(u -w, t) dF W (w) + ∞ u 1 dF W (w) ds. ( 40
)
Taking the derivative w.r.t. h and evaluating at h = 0 then gives

λ ∞ 0 ψ(u+b r , t) dF Br (b r )-(λ+µ d +1/t) ψ(u, t)+µ d u 0 ψ(u-w, t) dF W (w)+µ d (1-F W (u)) = 0, u ≥ 0. (41)
Here the boundary conditions are ψ(u, t) = 1 for u < 0 and ψ(u, t) ≤ 1 for u ≥ 0 and arbitrary t > 0, and uniqueness of its solution follows analogously to Theorem 5.3. Under the assumptions on F Br and

F W this reads λ n i=1 A i β i ∞ 0 ψ(u + b r , t) e -β i br db r -(λ + µ d + 1/t) ψ(u, t) + µ d n i=1 A i α i u 0 ψ(u -w, t) e -α i w dw + µ d n i=1 A i e -α i u = 0, u ≥ 0. ( 42
)
In analogy to the proof of Theorem 5.3 we then see that the ruin probability must have the form

ψ(u, t) = n k=1 D k e -r k u
for constants D 1 , . . . , D n to be determined, and r 1 , . . . , r n being the n positive solutions of (33).

The constants D k are now obtained by substituting the above expression into (42) and comparing coefficients of e -α i u , i = 1, . . . , n. This gives

n k=1 D k α i -r k = 1 α i , i = 1, . . . , n. ( 43
)
This system of linear equations is again of Cauchy matrix form with explicit solution (39), establishing the result.

Example 5.6. If W and B r are exponentially distributed with parameter α and β, respectively, then (38) simplifies to

ψ(u, t) = (1 -R/α)e -Ru , u ≥ 0, ( 44
)
where R is the (unique) solution with positive real part of (37).

Note that for t → ∞ one obtains R = (λα -µ d β)/(λ + µ d ) > 0, so that

ψ(u) = µ d (1 + β/α) λ + µ d e - λα-µ d β λ+µ d u , u ≥ 0. (45)
In particular, without initial capital in the pool, the infinite-time ruin probability amounts to

ψ(0) = µ d (1 + β/α) λ + µ d ,
in accordance with Formula (8.1) in [START_REF] Albrecher | A direct approach to the discounted penalty function[END_REF].

Individual miner analysis 6.1 Deterministic rewards

Comparing the formula describing the miner's surplus under the PPS pooling scheme [START_REF] Avanzi | Optimal dividends in the dual model[END_REF] with the solomining surplus (3), one can see that they are in fact the same type of process, only distinguished by the reward amount and frequency. Correspondingly, the formulas obtained by Albrecher and Goffard [START_REF] Albrecher | On the profitability of selfish blockchain mining under consideration of ruin[END_REF] for the expected value of the surplus and the ruin probability of a honest miner apply in the PPS case with deterministic rewards. Adapted to the present context, we hence get: Theorem 6.1. [START_REF] Albrecher | On the profitability of selfish blockchain mining under consideration of ruin[END_REF] For the miner's surplus process

R i t = u -c i • t + M i t • w, t ≥ 0, with M i t ∼ P oisson(p i µt), the value function V (u, t) can be expressed as V (u, t) = u + (p i µw -c i )t(1 -e ρ * u ), ( 46
)
where ρ * is the negative solution of the equation

-c i ρ + p i µ(e wρ -1) = 1/t. ( 47
)
Theorem 6.2. [START_REF] Albrecher | On the profitability of selfish blockchain mining under consideration of ruin[END_REF] For the same surplus process, the ruin probability with exponential time horizon is given by ψ(u, t) = e ρ * u , where ρ * is the negative solution of (47).

Stochastic rewards

Consider now the same surplus process as in the previous section, but with stochastic rewards. Let us define this process by

R i t = u -c i • t + M i t n=1 W n , t ≥ 0, (48)
where we assume W n , n ∈ N to be i.i.d. positive random variables with cumulative distribution function F W and finite mean and M i t ∼ P oisson(p i µt) as previously. This type of process is denominated as the dual problem in the insurance context, see e.g. [START_REF] Avanzi | Optimal dividends in the dual model[END_REF]. We assume that the net profit condition

p i µE[W n ] > c i is satisfied.
We are again interested in deriving the expected value of the surplus and the ruin probability for the miner. To simplify the computations, we consider again an exponential time horizon. Theorem 6.3. For exponential time horizon, the expected value of the miner's surplus V (u, t) can be expressed as the solution of the integro-differential equation

c i V ′ (u, t) + ( 1 t + p i µ) V (u, t) -p i µ +∞ 0 V (u + w, t)dF W (w) -u/t = 0, ( 49
)
with boundary conditions V (0, t) = 0 and 0 ≤ V (u, t) ≤ u -c i t + p i µE[W ].
Proof. As in previous sections, by conditioning the occurrence of T to a small time interval (0, h), we can write the value function as

V (u, t) = e -h( 1 t +p i µ) V (u -c i h, t) + h 0 1 t e -s( 1 t +p i µ) (u -c i s)ds + h 0 p i µe -s( 1 t +p i µ) +∞ 0 V (u -c i h + w, t)dF W (w)ds. (50)
Taking the derivative w.r.t. h and evaluating it at h = 0 gives us (49). The boundary condition follows from ruin considerations.

For rewards whose distribution is a combination of exponentials (30), we can refine Theorem 6.3.

Theorem 6.4. When W has density f W (w) = n j=1 A j α j e -α j w , w > 0, then V (u, t) = t   c i -p i µ n j=1 A j α j   e -Ru + u + t   p i µ n j=1 A j α j -c i   , u > 0, ( 51
)
where R is the unique solution with positive real part of the equation

c i R + p i µ n j=1 A j α j R + α j -( 1 t + p i µ) = 0.
Proof. Equation (49) translates into

c i V ′ (u, t) + ( 1 t + p i µ) V (u, t) -p i µ n j=1 A j α j +∞ 0 V (u + w, t)e -α j w dw -u/t = 0. ( 52
)
This equation has a solution of the form

V (u, t) = Ce -Ru + d 1 u + d 0 (53)
and we plug this ansatz into (52)

c i (-RCe -Ru + d 1 ) + ( 1 t + p i µ)(Ce -Ru + d 1 u + d 0 ) -p i µ n j=1 A j α j +∞ 0 (Ce -R(u+w) + d 1 (u + w) + d 0 )e -α j w dw -u/t = 0. (54)
Comparing coefficients, we obtain

d 1 = 1, d 0 = t   p i µ n j=1 A j α j -c i   .
Further, a comparison of the coefficients in front of e -Ru simplifies to the following equation:

c i R + p i µ n j=1 A j α j R + α j -( 1 t + p i µ) = 0. ( 55
)
Similarly to the Lundberg equation derived in [START_REF] Lu ; Hansjörg | A Direct Approach to the Discounted Penalty Function[END_REF], we note that there is one positive root R to this equation. To complete the proof, we consider the boundary condition V (0, t) = 0 and substituting into the ansatz gives C = -d 0 .

Example 6.5. When W is exponentially distributed, i.e. f W (w) = αe -αw , w > 0, Equation ( 51)

simplifies to V (u, t) = t c i - p i µ α e -Ru + u + t p i µ α -c i , u > 0, ( 56
)
where R is the solution with positive real part of

c i R 2 + (αc i - 1 t -p i µ)R -α 1 t = 0.
Theorem 6.6. For exponential time horizon, the miner's ruin probability can be expressed as

ψ(u, t) = e -R•u , ( 57
)
where R is the unique positive root of

p i µ + 1 t -c i R = p i µE[e -RWn ]. ( 58
)
Proof. The proof is adapted from Example 2 of Mazza and Rullière [START_REF] Mazza | A link between wave governed random motions and ruin processes[END_REF]. From the latter, we have that the Laplace transform of the ruin time τ in the dual problem is E[e -sτ ] = e -R(s)•u , with R(s)

being the unique positive root of p i µ + s -c i R = p i µE[e -RWn ]. Since the ruin probability up to an exponential time horizon can be rewritten as

ψ(u, t) = E[P(T > τ ) | τ ], (59)
with T ∼ Exp(1/t), it immediately follows that ψ(u, t) = E[e τ /t ] (60) which completes the proof.

Example 6.7. If W is an exponential random variable, i.e. f W (w) = αe -αw , w > 0, then the ruin probability reduces to ψ(u, t) = e -R * u , (

where

R * = 1/t + p i µ -c i α + √ ∆ 2c i , ∆ = (c i α -p i µ -1/t) 2 + 4c i α/t. ( 62
)
Remark 6.8. Results concerning the ruin probability can also be retrieved from the respective results for a more general renewal model considered in Alcoforado et al. [START_REF] Alcoforado | Ruin and Dividend Measures in the Renewal Dual Risk Model[END_REF].

Numerical illustration 7.1 Pool manager

In this section, we will illustrate the pool dynamics in both the deterministic and stochastic setting. In addition, we will perform a sensitivity analysis on main decision variables from the pool's perspective. The functions are reduced by u to isolate the expected gain realized by the pool manager. We can see that the exact formula falls nicely within the 95% confidence interval bounds of the MC simulations within fixed or exponential time horizon. The red line represents the upper limit of the function to which it converges as u → +∞, which is also the expected value of the gain in absence of ruin considerations. One can see that for small levels of initial capital potential ruin affects the resulting profit considerably, and for any given u the pool manager can quantify the undesirable effect of ruin.

Figure 6 exhibits the corresponding ruin probability ψ(u, t) for the mining pool. We can note that ruin is highly non-negligible for low levels of initial capital. Indeed, ψ(u, t = 336) < 5% for u > 22594, which is equivalent to $5238419. We also see how the exponential time horizon slightly underestimates the ruin probability for low capital levels, which is due to the skewness of the exponential distribution.

This graph can also be interpreted sideways: if one fixes a threshold for the ruin probability on the vertical axis, the corresponding initial capital can be read off on the horizontal axis.

In Figure 7, we depict the sensitivity of the expected surplus and the ruin probability to the management fee f . Not surprisingly, the relationship between f and ψ(u, t) is decreasing, as the pool retains more reward for itself. The parameter f impacts the expected gain of the pool manager.

Remark 7.1. Note that here we consider the interplay of all factors in a static set-up for a fixed number of participants in the pool. One may then go one step further to consider the fact that a higher fee f may deter some participants to join the pool, with respect to their willingness to pay and the payout of shares to the pool members is getting less frequent, thus the pool manager retains more liquidity and controls his probability of ruin at lower levels. The parameter q adjusts the magnitude of the risk transfer between the miners and their manager. Figure 13 gives a two-way sensitivity analysis with respect to the pool size p I and the pool fee f . The level curves indicate the expected profit for the pool manager for different pool sizes.

V ^-u, V ¡ u V u without ruin consideration V ^-u V ^-u simulated : T ~ Exp(1/t) V u simulated : t=t V(u,t) u (without ruin consideration) V ^ u t -u (exact) V ^ u t -u V(u,t) u
ψ simulated : t=1 ψ ^ u t (exact) ψ ^ u t ψ u t
For a bigger pool size p I , in order to maintain the same level of expected profit, the pool manager can reduce the fee size. One can clearly see an inverse relationship between the pool size and the fee. Thus, a bigger pool can diminish its fees to attract more miners and thus to grow even more.

This implies a threat on the decentralized nature of the consensus protocol. If a mining pool manager concentrates more than 50% of the total hashpower, then the blockchain is prone to 51%-type attacks such as double spending in the bitcoin context. How can a smaller mining pool tackle this problem?

One solution consists in offering to take on more risk by decreasing the difficulty of finding a share which reduces to decreasing the value of q. Figure 14 shows the expected profit of two mining pools, one for which p I = 0.1 and a smaller one for which p I = 0.02, both having an initial capital level u = 22500, for both the reward and the time horizon being exponentially distributed. The level curves indicate that in terms of expected profit a smaller miner may decrease q without increasing the pool fee f , while maintaining the same level of profitability. That is not the case for the larger mining pool whose expected profit turns out to more sensitive to q.

Individual miner

Let us now compare the situation of an individual miner before and after joining the pool. We recall Figure 3 (left panel), which examplifies the pool members' surplus. Also, the surplus of the member is described by [START_REF] Cong | Decentralized Mining in Centralized Pools[END_REF]. Finally, we use the results presented in Sections 6.1 and 6.2 to assess the pool effect for the individual miner's surplus following the protocol. Consider a miner in a deterministic rewards environment. We assume a PPS pool and consider a pool member whose hashpower is equal to 1% of the pool's total hashpower, i.e. p i = 0.001. For the choice of other parameters, we assume that the cost of electricity c is given by

c = p i × e W × π W ,
where e W is the electricity consumption of the network expressed in kWh, and π W is the price of electricity per kWh. For the sake of our example, we take the estimate of e W as 115.541×10 9 365.25×24 . 3 The price of electricity is taken to be $0.06, then converted to our M U . Therefore, the net profit condition is satisfied both with and without joining the pool. Figures 15 and16 illustrate the expected surplus and ruin probability with deterministic rewards and exponential time horizon. One can observe how effective the risk reduction in case of joining the pool is for the individual miner. Figure 16 particularly emphasizes the drastic decrease of ruin probability for low capital levels. Up until a level of initial capital of u = 1255, it is more profitable for the miner to join the pool, whereas for higher levels of capital the pool fee becomes the main decision driver instead of the ruin considerations. Converted to USD, this amounts to approximately $290, 971. Recall that this is akin to the effects of reinsurance, as the miner cedes part of his risk to the pool in exchange of a fixed contractual payment (pool fee).

Finally, we investigate the sensitivity of the miner's expected surplus with respect to the key model parameters. In Figure 17, the miner can see for his level of initial capital u whether it is better to join the pool or not, depending on the employed fee f . As before, for higher levels of capital, the miner is less willing to accept high fees than a miner with less initial capital. We also observe that the two red lines (miner in the pool with different initial capital u) are much closer to each other than the two black lines (miner outside of the pool with different initial capital u). This is due to the risk reduction of the miner inside the pool, since he is transferring part of the risk to the pool and getting more frequent rewards. Figure 18 shows the level curves of V (u, t) with a varying difficulty for the miner's problem q and pool fee f . Note that not joining the pool is equivalent to setting the difficulty level equal to the block finding problem level and letting the pool fee be f = 0. With such a two-way analysis, the pool can fix an appropriate fee and the miner can see whether he is better off joining the pool for his given level of capital u.

The miner's decision to join a pay-per-share mining pool does not depend on the size of the mining pool. Hence a miner will be indifferent whether to direct her hashpower towards a small or large pool.

All that matters is the level of expected profit (decreasing in f ) and the share of risk transferred to the mining pool (decreasing in q). Decentralization will prevail if the preferences, more specifically the risk aversion, of both the pool managers and the individual miners are sufficiently heterogeneous.

Note that a situation where a mining pool would control most of the computing power is not desirable for anyone. The blockchain would then be prone to attacks and the associated cryptocurrency would no longer be of value.

Conclusion

In this paper, we developed a framework for a bitcoin mining pool analysis from a risk and profitability perspective. Given a pay-per-share pooling scheme, we investigated the profitability of a pool under ruin probability considerations, which allows us to derive original results for the pool manager's expected profit. When describing the pool income process as a stochastic double-sided jump process, one can adapt techniques developed in the actuarial literature for applications in the blockchain universe.

Figure 3

 3 Figure 3 represents sample paths of the surplus processes for an individual miner and the pool manager.

Figure 3 :

 3 Figure 3: Illustration of surplus paths for the pool members and the pool manager.

Theorem 4 . 2 .

 42 Let V (u, t) := E(R T I τ >T ) denote the expected value of the surplus at the exponential time horizon T . Let b and w, b > w, be fixed positive integers and assume that the net profit condition λb > µw holds. Then the expected surplus at an exponential time horizon can be expressed in the form

Example 4 . 3 .

 43 Figure 4 depicts V (u, t) as a function of u for the parameters b = 100, w = 9, t = 1, λ = 10, µ d = 90.

Figure 4 :Theorem 4 . 4 .

 444 Figure 4: V (u, 1) as a function of u

F

  W and finite mean representing payments to the pool members, and B r,n , n ∈ N are assumed to be i.i.d. positive random variables with distribution function F Br and finite mean representing the remaining inflow of bounty rewards diminished by the simultaneous payout to the respective pool member. If one wishes to draw a parallel to the previous case with deterministic rewards, the random variable B r assumes the role of b -w, the fixed block reward minus the payout to the pool member.

First, let us

  define the set of parameters used in the following examples. For each illustration, we keep all the parameters fixed to these levels except the one that is varying :t = 336, p I = 0.1, q = 0.1, f = 0.02, b = 1000M U, w = (1 -f )bq = 98M U, λ = 6p I = 0.6, µ d = 6p I (1/q -1) = 5.4.The units we use are hours (h) for the time parameters and monetary units (M U ) for the value functions. The choice for the time horizon t is equal to 2 weeks because it is linked to the period of difficulty adjustment. The monetary units are related to bitcoin in this way : 1000M U = 6.25BT C.The reason for this scaling is purely practical to solve the deterministic problem which involves integer constraints. As of May 28th 2021, 1BT C ≈ $35670.5, so 1M U ≈ $231.85.

Figure 5

 5 Figure 5 compares the function V (u, t) defined in Theorem 4.2 with the Monte Carlo simulation of the mining process with deterministic and exponential time horizon fixed at the same mean parameter.

  V (u, t) -u as a function of f . u, t) as a function of f .

Figure 7 :

 7 Figure 7: Sensitivity to f in case of deterministic rewards and exponential time horizon.

Figure 8 :

 8 Figure 8: Sensitivity to q in case of deterministic rewards and exponential time horizon.

Figures 9 ,

 9 Figures 9,[START_REF] Dufresne | Fitting combinations of exponentials to probability distributions[END_REF][START_REF] Easley | From mining to markets: The evolution of bitcoin transaction fees[END_REF][START_REF] Goffard | Fraud risk assessment within blockchain transactions[END_REF] illustrate the same concepts with exponentially distributed rewards. For comparison, the parameters for the exponential distributions are chosen so that the resulting mean matches the deterministic jump sizes, i.e. α = 1/w = 1/98, β = 1/b = 1/1000.

Figure 9 :

 9 Figure 9: V (u, t) -u as a function of u and simulated V (u, t) -u and V (u, t) -u with their 95% confidence interval bound in dashed. Both jumps are exponentially distributed.

Figure 10 :

 10 Figure 10: ψ(u, t) as a function of u and simulated ψ(u, t) and ψ(u, t) with their 95% confidence interval bound in dashed. Both jumps are exponentially distributed.

  V (u, t) -u as a function of f . u, t) as a function of f .

Figure 11 :

 11 Figure 11: Sensitivity to f in case of exponentially distributed rewards and exponential time horizon.

Figure 12 :

 12 Figure 12: Sensitivity to q in case of exponentially distributed rewards and exponential time horizon.

Figure 13 :

 13 Figure 13: V (u, t) as a function of p I and f for u = 22500. Both jumps are exponentially distributed.

Figure 14 :

 14 Figure 14: Sensitivity to q and f of the expected profit of two mining pools of different size over and exponentially distributed time horizon and reward for u = 22500.

Figure 15 :

 15 Figure 15: V (u, t) -u as a function of u for an individual pool miner alone in black and within the pool in red.

Figure 16 :

 16 Figure 16: ψ(u, t) as a function of u for an individual pool miner alone in black and within the pool in red.

  u without pool, u = 250 V ^u with pool, u = 250 V ^u without pool, u = 1000 V ^u with pool, u = 1000

Figure 17 :

 17 Figure 17: V (u, t) -u as a function of f for an individual pool miner alone in black and within the pool in red.

Figure 18 :

 18 Figure 18: V (u, t) as a function of q and f for an individual pool miner alone in black and within the pool in red.

  Further, let {S d n , n ∈ N} be the sequence of arrival times associated with the process (M d t ) t≥0 . Its distribution function is denoted by F S d

n (t) and its p.d.f. by f S d n (t). Denote by ⌈x⌉ the ceiling function. Following Corollary 1 from

[START_REF] Goffard | Fraud risk assessment within blockchain transactions[END_REF]

, we proceed from Equation (

14

) and derive the next steps. Theorem 4.1. Let (N t , t ≥ 0) and (M d t , t ≥ 0) be Poisson processes with intensities {λ, µ d } respec-tively, and assume that the net profit condition λb > µw holds, then the p.d.f. of τ is given by

Source: https://www.theblockcrypto.com

Source: bitcoinblockhalf.com

https://cbeci.org/, consulted on May 28th 2021.

Acknowledgements

Hansjörg Albrecher acknowledges financial support from the Swiss National Science Foundation Project 200021_191984.

when comparing with fees of other competitive pools in the market. This outflow of miners would consequently impact negatively the expected profit of the pool. However, such considerations naturally ask for an analysis with competing pools, which is beyond the scope of this paper.

In Figure 8, we explore the impact of the relative difficulty to find a share q on ruin and expected surplus.

It is worthwhile to note that increasing q is profitable to the pool manager. Indeed, as q increases, In addition, we also looked at the problem from the individual miner's side, to identify conditions under which it is profitable for her to enter the pool or not.

We find that ignoring ruin considerations highly overestimates the expected gain for a pool for small values of initial capital and quantify the required capital level needed for which the ruin aspect becomes negligible. Moreover, we define a trade-off between the main pool defining parameters to set up conditions for optimizing the pool profit for different levels of capital. For an individual miner, pooling has similar effects as a reinsurance treaty for an insurer. We provide a sensitivity analysis that can be helpful for the miner to select the most appropriate pool given his initial parameters.

For a randomized time horizon, it was possible to obtain explicit formulas for all quantities of interest.

The flexibility of our model enabled to consider deterministic as well as stochastic reward sizes. The established formulas for combinations of exponentials are in fact quite flexible, as any other distribution on the positive halfline can be approximated arbitrary well with such distributions (cf. [START_REF] Dufresne | Fitting combinations of exponentials to probability distributions[END_REF]).

Naturally, some restrictive assumptions were needed to enable the explicit mathematical treatment in this paper, in particular the assumption of independent and identically distributed jump sizes. It will be interesting in future research to look into relaxing these assumptions.

The study of the formation of mining pools naturally raises the question of whether they pose a threat to the decentralized nature of blockchain-based applications. We find that the size of the mining pool does not interfere in a miner's decision making process. A miner chooses a mining pool according to the share of risk she wishes to cede and the profit she wishes to make. The preferences of miners and pool managers have been analysed using game theory in Cong et al. [START_REF] Cong | Decentralized Mining in Centralized Pools[END_REF] and Li et al. [START_REF] Li | A Mean Field Games Model for Cryptocurrency Mining[END_REF]. The results of the present paper may serve as concrete risk management tools for miners and pool managers that could also be integrated as value or cost functions within such a game-theoretic approach.

A. Abel-Gontcharov polynomials

Let U = {u i , i ≥ 1} be a sequence of real non-decreasing numbers. The (unique) family {G n (x|U ) , n ≥ 0} of Abel-Gontcharov polynomials of degree n in x attached to U is defined as follows. Starting with G 0 (x|U ) = 1, the polynomials G n (x|U ) satisfy the differential equations

where EU is the shifted family {u i+1 , i ≥ 1}, and with boundary conditions

So, each G n , n ≥ 1, has the integral representation

The polynomials G n , n ≥ 1, can be interpreted in terms of the joint distribution of the order statistics (U 1:n , . . . , U n:n ) of a sample of n independent uniform random variables on (0, 1). Indeed, for 0

This last identity is used inside the proof of Theorem 4.1 together with the following property Note that

Lastly, the numerical evaluation of ( 15) can rely on the recursive relations

Formula (67) follows from an Abelian expansion of x n based on (63), and (64).

B. Proof of Theorem 4.1

The event {τ ∈ (t, t + dt)} can be viewed conditioned over the values of the process (N t ) t≥0 . In other terms,

We distinguish according to the value of N t . For N t = 0, Equation ( 14) can be rewritten as

which occurs when the ⌈ u w ⌉ th jump of M d t occurs at t, where ⌈x⌉ denotes the ceiling function. It follows that

and

In case N t ≥ 1, one needs to constrain {M d t , t ≥ 0} so it does not reach N u,s w/(b-w)+u/(b-w) for any time s < t but does so at t. Let (v n ) n≥0 is a sequence of integers defined as v n = ⌈n(b -w)/w + u/w⌉, n ≥ 0. We have

as M d t > N t =n (b -w)/w + u/w at the time of the fatal jump (and before t, N t reaches each step before the payout process surpasses it). Now

By the order statistic property, we get Inserting that last expression into (74) yields the announced result [START_REF] Kingman | Poisson Processes. Oxford Studies in Probability[END_REF].


Sylvain Guy
email: sylvain.guy.vidal@gmail.com

Christophe Jacquet

Damien Tsenkoff

Jean-Noël Argenson

Matthieu Ollivier

Deep learning for the radiographic diagnosis of proximal femur fractures: Limitations and programming issues

Keywords: Deep learning Artificial intelligence Traumatology Proximal femur fracture AI, Artificial Intelligence, PFF, proximal femur fracture, ED, emergency department

Introduction: Radiology is one of the domains where artificial intelligence (AI) yields encouraging results, with diagnostic accuracy that approaches that of experienced radiologists and physicians. Diagnostic errors in traumatology are rare but can have serious functional consequences. Using AI as a radiological diagnostic aid may be beneficial in the emergency room. Thus, an effective, low-cost software that helps with making radiographic diagnoses would be a relevant tool for current clinical practice, although this concept has rarely been evaluated in orthopedics for proximal femur fractures (PFF). This led us to conduct a prospective study with the goals of: 1) programming deep learning software to help make the diagnosis of PFF on radiographs and 2) to evaluate its performance. Hypothesis: It is possible to program an effective deep learning software to help make the diagnosis of PFF based on a limited number of radiographs. Methods: Our database consisted of 1309 radiographs: 963 had a PFF, while 346 did not. The sample size was increased 8-fold (resulting in 10,472 radiographs) using a validated technique. Each radiograph was evaluated by an orthopedic surgeon using RectLabel TM software (https://rectlabel.com), by differentiating between healthy and fractured zones. Fractures were classified according to the AO system. The deep learning algorithm was programmed on Tensorflow TM software (Google Brain, Santa Clara, Ca, USA, tensorflow.org). In all, 9425 annotated radiographs (90%) were used for the training phase and 1074 (10%) for the test phase. Results: The sensitivity of the algorithm was 61% for femoral neck fractures and 67% for trochanteric fractures. The specificity was 67% and 69%, the positive predictive value was 55% and 56%, while the negative predictive value was 74% and 78%, respectively. Conclusion: Our results are not good enough for our algorithm to be used in current clinical practice. Programming of deep learning software with sufficient diagnostic accuracy can only be done with several tens of thousands of radiographs, or by using transfer learning. Level of evidence: III; Diagnostic studies, Study of nonconsecutive patients, without consistently applied reference "gold" standard.

Introduction

Artificial intelligence (AI) plays an important role in our day-today lives [START_REF] Xiong | Toward Human Parity in Conversational Speech Recognition[END_REF][START_REF] Pendleton | Perception, Planning, Control, and Coordination for Autonomous Vehicles[END_REF]. When compared to human intelligence, it can hold its own against professional video gamers [START_REF] Mnih | Humanlevel control through deep reinforcement learning[END_REF], poker players [START_REF] Schmid | Deep-Stack: Expert-level artificial intelligence in heads-up no-limit poker[END_REF] or even Go players [START_REF] Silver | Mastering the game of Go with deep neural networks and tree search[END_REF]. Such good performances can be explained by the development of "deep learning" [START_REF] Lecun | Deep learning[END_REF], a learning method based on human convolutional neural networks.

The medical world has also been impacted by AI [START_REF] Deo | Machine Learning in Medicine[END_REF], especially molecular biology [START_REF] Alipanahi | Predicting the sequence specificities of DNA-and RNA-binding proteins by deep learning[END_REF][START_REF] Yuan | DeepGene: an advanced cancer type classifier based on deep learning and somatic point mutations[END_REF], ophthalmology [START_REF] Gulshan | Development and Validation of a Deep Learning Algorithm for Detection of Diabetic Retinopathy in Retinal Fundus Photographs[END_REF], dermatology [START_REF] Esteva | Dermatologistlevel classification of skin cancer with deep neural networks[END_REF], and even anatomical pathology [START_REF] Cires ¸an | Mitosis detection in breast cancer histology images with deep neural networks[END_REF][START_REF] Sirinukunwattana | Locality Sensitive Deep Learning for Detection and Classification of Nuclei in Routine Colon Cancer Histology Images[END_REF]. However, the progress has been the most striking in radiology [START_REF] Litjens | A survey on deep learning in medical image analysis[END_REF][START_REF] Hosny | Artificial intelligence in radiology[END_REF][START_REF] Shen | Deep Learning in Medical Image Analysis[END_REF][START_REF] Erickson | Machine Learning for Medical Imaging[END_REF]. Despite inconclusive results early on [START_REF] Lehman | Diagnostic Accuracy of Digital Screening Mammography With and Without Computer-Aided Detection[END_REF], the rapid development of deep learning has allowed AI to approach human performance. Thus it comes close to the performance of trained radiologists in reading mammograms [START_REF] Kooi | Large scale deep learning for computer aided detection of mammographic lesions[END_REF], and can help to optimize the radiologist's work by doing triage before the analysis [START_REF] Rajkomar | High-Throughput Classification of Radiographs Using Deep Convolutional Neural Networks[END_REF]. However, no program has successfully surpassed the performance of a trained radiologist. AI may turn out to be most beneficial in assisting non-radiologists to make a diagnosis.

In the emergency department (ED), 3.7% to 4.1% of fractures are missed [START_REF] Hallas | Errors in fracture diagnoses in the emergency departmentcharacteristics of patients and diurnal variation[END_REF][START_REF] Wei | Systematic analysis of missed extremity fractures in emergency radiology[END_REF], and 70% to 80% of missed diagnoses in the ED are fractures [START_REF] Guly | Diagnostic errors in an accident and emergency department[END_REF][START_REF] Leeper | The role of trauma team leaders in missed injuries: does specialty matter?[END_REF]. These errors are more likely at night [START_REF] Hallas | Errors in fracture diagnoses in the emergency departmentcharacteristics of patients and diurnal variation[END_REF], because of overwork and because no orthopedic specialists are available. The consequences for the patient can be serious: loss of function and autonomy, increased risk of nonunion, post-traumatic osteoarthritis [START_REF] Lindsey | Deep neural network improves fracture detection by clinicians[END_REF]. The counter this deficit, programs to assist in the radiographic diagnosis of proximal femur fractures (PFF) [START_REF] Cheng | Application of a deep learning algorithm for detection and visualization of hip fractures on plain pelvic radiographs[END_REF][START_REF] Urakawa | Detecting intertrochanteric hip fractures with orthopedist-level accuracy using a deep convolutional neural network[END_REF], distal radius fractures [START_REF] Lindsey | Deep neural network improves fracture detection by clinicians[END_REF] and general trauma [START_REF] Olczak | Artificial intelligence for analyzing orthopedic trauma radiographs[END_REF] have been developed. In some cases, their accuracy surpasses that of experienced orthopedic surgeons [START_REF] Urakawa | Detecting intertrochanteric hip fractures with orthopedist-level accuracy using a deep convolutional neural network[END_REF]. The diagnostic error rate of ED physicians is reduced [START_REF] Lindsey | Deep neural network improves fracture detection by clinicians[END_REF]. Since PFF are a public health problem, a more accurate and refined diagnosis can optimize the treatment, reduce post-traumatic morbidity and improve clinical recovery [START_REF] Shin | Three-dimensional analyses to predict surgical outcomes in non-displaced or valgus impaction fractures of the femoral neck: A multicenter retrospective study[END_REF][START_REF] Oba | New scoring system at admission to predict walking ability at discharge for patients with hip fracture[END_REF]. Thus, an effective, low-cost software that aids radiographic diagnoses would be a relevant tool for current clinical practice, although this concept has rarely been evaluated in orthopedics for the proximal femur. This led us to conduct a prospective study with the goals of:

• programming deep learning software to help make the diagnosis of PFF on radiographs; • to evaluate its performance.

We hypothesized that deep learning software can be programmed to help make the diagnosis of PFF using a limited number of radiographs.

Materials and methods

Database

After approval from our facility's Data Protection Committee, 1309 radiographs from 623 patients were collected retrospectively from an imaging database of patients who had been hospitalized at our facility. The inclusion criteria were the availability of a highquality AP radiograph of the pelvis or AP and lateral views of one or both hips, in a patient who presented at the ED between 1 January 2015 and 1 July 2018. Both AP and lateral views were used to match the realities of clinical practice; these views are taken routinely when a patient presents with this type of injury. This allows the software to be trained to read different radiographic views, without reducing the database size. Excluded were patients who were less than 18 years of age, who had a fracture other than in the proximal femur, who previously had surgery on the femur, who had a fracture that did not require hospitalization, or who had a fracture distal to the trochanteric area. All the radiographs were anonymized. These data are summarized in the flow chart in Fig. 1.

All the radiographs were made on the Digital Diagnost FLEXR TM (Philips, Amsterdam, The Netherlands) using the following parameters: Study Time 155919.174000, Series Time 155920.000000, Acquisition Time 155921, Content Time 155921.

Annotation of radiographs

All the radiographic images were processed in JPEG format and were annotated using the Rect Label TM software (https://rectlabel.com) by an experienced orthopedic and trauma surgeon (MO-MD, PhD). Two groups were made: a healthy group, corresponding to healthy landmarks and a fracture group, corresponding to fractured areas. First, the healthy landmarks were identified to allow our program to differentiate a fracture-free zone from a fractured one. Nineteen landmarks were chosen: 13 bone landmarks and 6 metal landmarks. Certain patients had metal implants in their contralateral femur or lumbar spine. The latter were identified to allow the software to recognized them as "healthy". However, if the fracture affected the side that had previously been operated on, these patients were excluded from the analysis.

Among the bone landmarks, 12 were lateralized as "right" or "left", with the pubic symphysis acting as the central landmark. The metal landmarks were not lateralized to simplify the learning phase. These healthy landmarks are shown in Fig. 2.

The 963 fractures were annotated this way. The fractures were classified based on the AO classification for PFF [START_REF] Meinberg | Fracture and Dislocation Classification Compendium-2018[END_REF]. Despite debatable intra-and inter-rater reliability [START_REF] Masionis | The reliability of a Garden, AO and simple II stage classifications for intracapsular hip fractures[END_REF], the association of a treatment decision tree to each subgroup makes this classification relevant for use by a non-specialized physician. However, given the small number of radiographs annotated in each AO subgroup, a satisfactory success rate could not be achieved for classifying the fractures. Only our algorithm's ability to distinguish between femoral neck fractures and trochanteric fractures was evaluated during the test phase.

To simplify our program's learning, the fracture annotation did not specify which side it was on. The 31A1.1 subgroup represents isolated greater trochanter or lesser trochanter fractures. Since these fractures do not require hospitalization, none were found in our study. All the data are given in Table 1.

Increasing the database size

All the images were turned 180 • , inverting left and right, to double the sample size. Next, the images were rotated, and their width, height and magnification modified randomly by 0 to 15% of their original value. These manipulations increased 8-fold the total number of radiographs, resulting in 10,472 analyzable images. This technique has previously been described and validated [START_REF] Kim | Artificial intelligence in fracture detection: transfer learning from deep convolutional neural networks[END_REF].

Programming

The deep learning algorithm was programmed on Tensorflow TM software (Google Brain, Santa Clara, Ca, USA, tensorflow.org). This is the automatic learning tool that is currently used the most in the AI domain. The Lobe neuronal network (Microsoft, Redmond, Washington, USA, lobe.ai), consisting of multiple convolutional layers, made up the architecture for our algorithm. This network has not previously been trained to read medical images.

Training phase

Among the 10,472 images obtained after the database expansion, 90% (9425 radiographs) were used for the training phase. The remaining 1074 radiographs were reserved for the test phase. The training phase was divided into two parts: a learning phase with 8351 radiographs (80% of the total) and a validation phase with 1074 (10% of the total). A statistically similar proportion of pathological radiographs were found in each phase, corresponding to the ratio in the entire sample: 25% to 30% healthy radiographs versus 70% to 75% pathological radiographs. Our algorithm's performance was evaluated by analyzing its success rate for detecting fractures during the test phase.

Statistical analysis

The primary aim of this study was to evaluate diagnostic performance. The data were described using the senior author's analysis for each radiograph (reference). From this comparison, the true and false positive/true and false negatives were calculated along with the positive predictive value (PPV), negative predictive value (NPV), sensitivity and specificity of the tests.

Results

One thousand seventy-four radiographs were submitted to our trained algorithm. Its ability to recognize healthy landmarks and detect fractures was evaluated.

Facture detection

The fracture detection results are provided in Table 2.

Femoral neck fractures

In all, 391 radiographs with femoral neck fractures were tested. The algorithm identified 238 fractures-122 left (62%, 122/198) and 116 right (60%, 116/193)-thus a success rate of 61% (238/391) (Table 2). With 213 false positives versus 238 true fractures identified, our diagnostic tool had a PPV of 55%. There were fewer false negatives (n = 153) relative to the number of radiographs correctly identified as not having a femoral neck fracture (n = 443), which means our diagnostic tool had a NPV of 74% (Table 2). The sensitivity was 61% and the specificity was 67% for detecting femoral neck fractures (Table 2).

Trochanteric fractures

In all, 383 radiographs with trochanteric fractures were tested. The algorithm successfully identified 256 fractures-141 on the left side (68%, 141/208) and 115 on the right side (66%, 115/175)-thus an overall success rate of 67% (256/383) (Table 2). There were 202 false positives. Given that 256 trochanteric fractures were correctly identified, the PPV was 56%. There were 443 false negatives. Since 153 fractures were missed, the PPV of our tool was 78% (Table 2).

The sensitivity was 67% and the specificity was 70% for detecting trochanteric fractures (Table 2).

Healthy radiographic markers

On average, 60% of the healthy radiographic markers were correctly identified by our algorithm. All the results are given in Table 3. The highest success rate was found for the pubic symphysis (100%), femoral diaphysis (84% on the right, 478/572, and 82% on the left, 492/603) and greater trochanters (75% on the right, 352/472, and 86% on the left, 372/431). The other landmarks were identified in only about half the cases. While many ischiums were used during the training phase, they were located successfully in only 60% (423/709) and 62% (442/715) of cases for the right and left sides, respectively. The most common error was incorrect identification of the side.

The metal landmarks were the most difficult to identify, with a success rate of only 47%. While there were few lumbar fusion constructs in the database, their central and easily identifiable nature resulted in good performance of our algorithm.

Discussion

To be relevant in clinical practice, our algorithm needs to have equal or better diagnostic accuracy than an experienced ED physician. In the literature, it is said that an ED physician without specific trauma surgery training has a minimum sensitivity of about 80% [START_REF] Lindsey | Deep neural network improves fracture detection by clinicians[END_REF] for detecting fractures, versus nearly 90% for an experienced orthopedic surgeon [START_REF] Urakawa | Detecting intertrochanteric hip fractures with orthopedist-level accuracy using a deep convolutional neural network[END_REF], with a specificity in both cases greater than 10 points. With a maximum sensitivity of 67% and specificity of 70%, our algorithm was not good enough, thus our hypothesis is rejected.

These results can be explained by the small number of images used to train our program, despite the 8-fold increase of our 1309 radiographs. Programs described in the literature that achieve diagnostic accuracy of 90% were developed with a much larger database of images. Lindsey et al. [START_REF] Lindsey | Deep neural network improves fracture detection by clinicians[END_REF] trained their deep learning program to detect wrist fractures using more than 135,000 radiographs annotated by experienced orthopedic surgeons. This explains the excellent results with that program, allowing ED physicians to increase their diagnostic sensitivity and specificity by 10 points to above 90%, with mean reduction of 47% in the error rate.

When Olczak et al. [START_REF] Olczak | Artificial intelligence for analyzing orthopedic trauma radiographs[END_REF] published the first article on a deep learning program for fracture detection in 2017, they used a database of 256,000 wrist, hand and ankle radiographs. Despite this, the diagnostic accuracy for detecting a fracture was only 83%. Deep learning had only been used very recently in the medical field when this program was developed; the lack of experience may explain these disappointing results.

In April 2019, Cheng et al. [START_REF] Cheng | Application of a deep learning algorithm for detection and visualization of hip fractures on plain pelvic radiographs[END_REF] published the results of an algorithm trained for diagnosing proximal femur fractures. This program, which resembles ours the most, was trained using nearly 30,000 AP radiographs of the pelvis. This large number of images and use of a single view increased the reproducibility and explains the high diagnostic accuracy of this tool: 98% sensitivity with only 2% false negatives.

Our program, which was designed specifically to detect fractures, was not trained to recognize non-medical images. There are published examples of deep learning algorithms, trained to recognized non-medical images, that were effectively converted to radiographic diagnosis using "transfer learning". In these cases, a small number of radiographs were used: slightly more than 1000 for Adams et al. [START_REF] Adams | Computer vs human: Deep learning versus perceptual training for the detection of neck of femur fractures[END_REF] and 11,000 for Kim and MacKinnon [START_REF] Kim | Artificial intelligence in fracture detection: transfer learning from deep convolutional neural networks[END_REF]. Despite this, the goal of 90% accuracy was achieved. However, hundreds of thousands non-medical images were used for the programming beforehand. These good results need to be put into perspective when we attempt to determine the true impact of AI on daily radiology practice. For example, in February 2019, Adams et al. [START_REF] Adams | Computer vs human: Deep learning versus perceptual training for the detection of neck of femur fractures[END_REF] showed that, with only 1 hour of practice, a person without medical training could rival an AI trained by transfer learning for the diagnosis of femoral neck fractures.

Thus our program is not competitive, given the performance of other deep learning algorithms described in the literature. Relative to all the previously mentioned AI studies, a smaller number of radiographs were used during its programming. Despite this fact, its NPV was nearly 80% and a maximum sensitivity and specific of nearly 70%. These results are encouraging. Since we used 25 times fewer images than Olczak et al. [START_REF] Olczak | Artificial intelligence for analyzing orthopedic trauma radiographs[END_REF], we can presume that adding new annotated radiographs would greatly improves its performance.

Also, the AO classification of fractures would allow a decision tree to be attributed to each subgroup for their treatment. While the smaller number of available radiographs did not allow us to test our algorithm on this feature, this is an interesting avenue in the future when a larger database will be available.

We can now ask questions about the future of AI in the medical world. The mass of data available online can now be used by deep learning algorithms. Ausiello and Shaw [START_REF] Ausiello | Quantitative Human Phenotyping: The Next Frontier in Medicine[END_REF] content that "Quantitative Human Phenotyping" is the next great step in medical research. They point to the benefits that we could gain from exploring public personal data available online in multiple domains, such as sociology and medicine. Common use of DNA sequencing databases on the Internet could help to accelerate genetics research. Esteva et al. [START_REF] Esteva | Dermatologistlevel classification of skin cancer with deep neural networks[END_REF] advanced the hypothesis that a database of several million photographs of dermatological lesions will be available within a few years thanks to smartphones, and could help to optimize the diagnostic performance of their algorithms. Use of AI in medical practice, which is still marginal, could very likely become more widespread in the coming years given the pace of technical advances.

Our study had several limitations: image labelling was done by only one orthopedic surgeon, the ROC curve and its area under the curve were not calculated, and transfer learning was not used to optimize the performance of our software. While using a single experienced orthopedic surgeon for annotation is certainly a methodological flaw, it does not directly impact our software's performance. Furthermore, the sensitivity, specificity, PPV and NPV are reliable, relevant parameters that could be reinforced by the ROC, although these parameters can be interpreted in their current state. Lastly, not having recourse to transfer learning explains the lack of power of our software and reinforces our conclusion: effective software to help with radiographic diagnoses can only be programmed using several thousands of radiographs or with the help of transfer learning.

Conclusion

The performance of our program was not good enough to be clinically relevant. Its main flaw was the small number of radiographs available to us, which did not provide an optimal training phase. Programming of a deep learning software with sufficient diagnostic accuracy can only be done with several tens of thousands of radiographs, or by using transfer learning.

Disclosure of interest

Sylvain Guy, Christophe Jacquet and Damien Tsenkoff have no conflicts of interest to declare. Jean-Noël Argenson is a consultant for Zimmer. Matthieu Ollivier is a consultant for Newclip Technics, Arthrex and Smith & Nephew.

Fig. 1 .

 1 Fig. 1. Flow chart (AP: anteroposterior, ED: emergency department, PFF: proximal femoral fracture, w/o: without).

Fig. 2 .

 2 Fig. 2. Landmarks on radiographs of healthy hips.

Table 1

 1 AO classification of annotated fractures[START_REF] Meinberg | Fracture and Dislocation Classification Compendium-2018[END_REF].

	Trochanteric fractures n = 479		Femoral neck fractures n = 484
	31A1.1	n = 0	31B1.1	n = 26
	31A1.2	n = 40	31B1.2	n = 12
	31A1.3	n = 105	31B1.3	n = 20
	31A2.1	n = 244	31B2.1	n = 204
	31A2.3	n = 42	31B2.2	n = 195
	31A3.1	n = 10	31B2.3	n = 8
	31A3.2	n = 7	31B3	n = 19
	31A3.3	n = 31

Table 2

 2 Fracture detection results.

		n	Augmented n	Tested n	Identified n	% Identified
	Left femoral neck fracture	256	2048	198	122	61.61%
	Left trochanteric fracture	254	2032	208	141	67.79%
	Right femoral neck fracture	228	1824	193	116	60.10%
	Right trochanteric fracture	225	1800	175	115	65.71%
	Femoral neck fractures
		Patients with fracture	Patients without fracture
	Positive test	238		213
	Negative test	153		443
		Se 60.87%		VPP 55.22%
		Sp 67.53%		VPN 74.33%
	TrochTrochanteric fractures
		Patients with fracture	Patients without fracture
	Positive test	256		202
	Negative test	127		462
		Se 66.84%		VPP 55.89%
		Sp 69.58%		VPN 78.44%

Se: Sensitivity/Sp: Specificity/PPV: Positive predictive value, NPV: Negative predictive value.

Table 3

 3 Landmarks on radiographs of healthy hips: results.

		n	Augmented n	Tested n	Identified n	% Identified
	Right femoral shaft	726	5808	572	478	83.57%
	Right lesser trochanter	660	5280	513	234	45.61%
	Right greater trochanter	575	4600	472	352	74.58%
	Right femoral neck	276	2208	213	108	50.70%
	Right femoral head	603	4824	493	254	51.52%
	Right ischium	895	7160	709	423	59.66%
	Left femoral shaft	741	5928	603	492	81.59%
	Left lesser trochanter	676	5408	532	274	51.50%
	Left greater trochanter	534	4272	431	372	86.31%
	Left femoral neck	267	2136	216	102	47.22%
	Left femoral head	573	4584	449	273	60.80%
	Left ischium	906	7248	715	442	61.81%
	Pubic symphysis	924	7392	742	742	100%
	Gamma nail	29	232	24	10	41.67%
	Total hip arthroplasty	32	256	22	7	31.82%
	Hemiarthroplasty	26	208	23	12	52.17%
	Dynamic Hip Screw	4	32	2	1	50%
	Lumbar instrumentation	9	72	8	6	75%
	Screw fixation of femoral neck	6	48	3	1	33.33%

Funding

No financing was received for this study.

Authors' contributions

Sylvain Guy: Conception and design of the study, acquisition of data, experimentation, analysis and interpretation of data, statistics.

Christophe Jacquet: Revising the article critically for important intellectual content.

Damien Tsenkoff: Data scientist. Jean-Noël Argenson: Revising the article critically for important intellectual content.

Matthieu Ollivier: Experimentation, revising the article critically for important intellectual content, final approval of the version to be submitted.