Erwan Le Merrer
email: erwan.le-merrer@inria.fr

Patrick Pérez
email: patrick.perez@valeo.com

Gilles Trédan
email: gtredan@laas.fr

Adversarial frontier stitching for remote neural network watermarking

Keywords: Watermarking, Neural network models, Black box interaction, Adversarial examples, Model decision frontiers

 proposed to watermark convolutional neural networks for image classification, by embedding information into their weights. While this is a clear progress towards model protection, this technique solely allows for extracting the watermark from a network that one accesses locally and entirely.

Instead, we aim at allowing the extraction of the watermark from a neural network (or any other machine learning model) that is operated remotely, and available through a service API. To this end, we propose to mark the model's action itself, tweaking slightly its decision frontiers so that a set of specific queries convey the desired information. In the present paper, we formally introduce the problem and propose a novel zero-bit watermarking algorithm that makes use of adversarial model examples. While limiting the loss of performance of the protected model, this algorithm allows subsequent extraction of the watermark using only few queries. We experimented the approach on three neural networks designed for image classification, in the context of MNIST digit recognition task.

Introduction

Recent years have witnessed a fierce competition for the design and training of top notch deep neural networks. The industrial advantage from the possession of a state of the art model is now widely acknowledged, starting to motivate some attacks for stealing those models [START_REF] Tramèr | Stealing machine learning models via prediction apis[END_REF][START_REF] Duddu | Stealing neural networks via timing side channels[END_REF]. Since it is now clear that machine learning models will play a central role in the IT development in the years to come, the necessity for protecting those models appears more salient.

In 1994, [START_REF] Van Schyndel | A digital watermark[END_REF] proposed to covertly embed a marker into digital content (such as audio or video data) in order to identify its ownership: by revealing the presence of such marker a copyright owner could prove its rights over the content. The authors coined the term digital watermarking. The fact that neural networks are digital content naturally questions the transferability of such techniques to those models. [START_REF] Uchida | Embedding watermarks into deep neural networks[END_REF][START_REF] Nagai | Digital watermarking for deep neural networks[END_REF] published the first method for watermarking a neural network that might be publicly shared and thus for which traceability through ownership extraction is important. The marked object is here a neural network and its trained parameters. However, this method requires the ability to directly access the model weights: the model is considered as a white box. The watermark embedding is performed through the use of a regularizer at training time. This regularization introduces the desired statistical bias into the parameters, which will serve as the watermark. We are interested in a related though different problem, namely zero-bit watermarking of neural networks (or any machine learning models) that are only remotely accessible through an API. The extraction of a zero-bit watermark in a given model refers to detecting the presence or the absence of the mark in that model. This type of watermark, along with the required key to extract it, is sufficient for an entity that suspects a non legitimate usage of the marked model to confirm it or not.

In stark contrast to [START_REF] Uchida | Embedding watermarks into deep neural networks[END_REF][START_REF] Nagai | Digital watermarking for deep neural networks[END_REF]'s approach, we seek a black box watermarking approach that allows extraction to be con-ducted remotely, without access to the model itself. More precisely, the extraction test of the proposed watermark consists in a set of requests to the machine learning service, available through an API [START_REF] Tramèr | Stealing machine learning models via prediction apis[END_REF]. This allows the detection of (leaked) models when model's parameters are directly accessible, but also when the model is only exposed through an online service. Second, we target the watermarking of models in general, i.e., our scheme is not restricted solely to neural networks, whether of a certain type or not.

Rationale. We thus aim at embedding zero-bit watermarks into models, that can be extracted remotely. In this setup, we can only rely on interactions with the model through the remote API, e.g., on object recognition queries in case of an image classification model. The input, e.g., images, must thus convey a means to embed identification information into the model (zero-bit watermarking step) and to extract, or not, the identification information from the remote model (watermark extraction step), see Fig. 1. Our algorithm's rationale is that the embedded watermark is a slight modification of the original model's decision frontiers around a set of specific inputs that form the hidden key. Answers of the remote model to these inputs are compared to those of the marked model. A strong match (despite the possible manipulation of the leaked model) must indicate the presence of the watermark in the remote model with a high probability.

The inputs in the key must be crafted in a way that watermarking the model of interest does not degrade significantly its performance. To this end, we leverage adversarial perturbations of training examples [START_REF] Goodfellow | Explaining and harnessing adversarial examples[END_REF] that produce new examples (the "adversaries") very close the model's decision frontiers. As such adversaries tend to generalize across models, notably across different neural network architectures for visual recognition, see e.g., [START_REF] Rozsa | Are accuracy and robustness correlated?[END_REF], this frontier tweaking should resist model manipulation and yield only few false positives (wrong identification of non marked models).

Contributions. The contributions of this article are: 1) A formalization of the problem of zero-bit watermarking a model for remote identification, and associated requirements (Section 2); 2) A practical algorithm, the frontier stitching algorithm based on adversaries that "clamp" the model frontiers, to address this problem. We also introduce a statistical framework for reasoning about the uncertainty regarding the remote model; we leverage a null hypothesis, for measuring the success of the watermark extraction (Section 3); 3) Experiments with three different types of neural networks on the MNIST dataset, validating the approach with regards to the specified requirements (Section 4).

Watermarking for Remote Extraction

Considered scenario. The scenario that motivates our work is as follows: An entity, having designed and trained a machine learning model, notably a neural network, wants to zero-bit watermark it (top-action on Fig. 1). This model could then be placed in production for applications and services. In case of the suspicion of a security breach in that application (model has leaked by being copied at a bit-level), the entity suspecting a given online service to re-use that leaked model can query that remote service for answering its doubts (bottom-action).

Like for classic media watermarking methods ( [START_REF] Hartung | Multimedia watermarking techniques[END_REF][START_REF] Van Schyndel | A digital watermark[END_REF]), our approach includes operations of embedding (the entity inserts the zero-bit watermark in its model), and extraction (the entity verifies the presence or not of its watermark in the suspected model), and a study of possible attacks (actions performed by others in order to remove the watermark from the model).

Modeling Requirements. Following works in the multimedia domain [START_REF] Hartung | Multimedia watermarking techniques[END_REF], and by [START_REF] Uchida | Embedding watermarks into deep neural networks[END_REF][START_REF] Nagai | Digital watermarking for deep neural networks[END_REF], we adapt the requirements for a watermarking method to the specific capability of remote watermark extraction (black box set-up). We choose those requirements to structure the remaining of this article.

We consider the problem of zero-bit watermarking a generic classifier, for remote watermark extraction. Let d be the dimension of the input space (raw signal space for neural nets or hand-crafted feature space for linear and non-linear SVMs), and C the finite set of target labels. Let k : R d → C be the perfect classifier for the problem (i.e., k(x) is always the correct answer). Let k : R d → C be the trained classifier to be watermarked, and F be the space of possible such classifiers. Our aim is to find a zero-bit watermarked version of k (hereafter denoted kw ) along with a set K ⊂ R d of specific inputs, named the key, and their labels { kw (x), x ∈ K}.

The purpose is to query with the key a remote model that can be either kw or another unmarked model k r ∈ F . The key, which is thus composed of "objects" to be classified, is used to embed the watermark into k.

Here are listed the requirements of an ideal watermarked model and key couple, ( kw , K):

Loyal. The watermark embedding does not hinder the performance of the original classifier:

∀x ∈ R d , / ∈ K, k(x) = kw (x). (1)
Efficient. The key is as short as possible, as accessing the watermark requires |K| requests. Effective. The embedding allows unique identification of kw using K (zero-bit watermarking):

∀k r ∈ F, k r = kw ⇒ ∃x ∈ K s.t. k r (x) = kw (x). (2)
? Robust. Attacks (such as fine-tuning or compression) to kw do not remove the watermark1 :

∀x ∈ K, ( kw + ε)(x) = kw (x). (3)
Secure. No efficient algorithm exists to detect the presence of the watermark in a model by an unauthorized party.

Note that effectiveness is a new requirement as compared to the list of Uchida et al. Also, their capacity requirement, i.e., the amount of information that can be embedded by a method, is not part of ours as our goal is to decide whether watermarked model is used or not (zero-bit watermark extraction).

One can observe the conflicting nature of effectiveness and robustness: If, for instance, ( kw +ε) ∈ F then this function violates one of the two. In order to allow for a practical setup for the problem, we rely on a measure m K (a, b) of the matching between two classifiers a, b ∈ F :

m K (a, b) = x∈K δ(a(x), b(x)), (4)
where δ is the Kronecker delta. One can observe that m K (a, b) is simply the Hamming distance between the vectors a(K) and b(K), thus based on elements in K. With this focus on distance, our two requirements can now be recast in a nonconflicting way:

-Robustness: ∀ε ≈ 0, m K ( kw , kw + ε) ≈ 0 -Effectiveness: ∀k r ∈ F, m K ( kw , k r ) ≈ |K| 3

The Frontier Stitching Algorithm

We now present a practical zero-bit model watermarking algorithm that permits remote extraction through requests to an API, following the previously introduced requirements.

Our aim is to output a watermarked model kw , which can for instance be placed into production for use by consumers, together with a watermark key K to be used in case of model leak suspicion. For the security requirement to hold, we obviously discard any form of visible watermark insertion [START_REF] Braudaway | Color correct digital watermarking of images[END_REF]. Fig. 2 illustrates the approach in the setting of a binary classifier (without loss of generality).

As we use input points for watermarking the owned model and subsequently to query a suspected remote model, the choice of those inputs is crucial. A non watermarking-based solution based simply on choosing arbitrarily |K| training examples (along with their correct labels), is very unlikely to succeed in the identification of a specific valuable model: Classifying those points correctly should be easy for highly accurate classifiers, which will then provide similar results, ruining the effectiveness. On the other hand, the opposite strategy of selecting |K| arbitrary examples and fine-tuning k so that it changes the way they are classified (e.g., ∀x ∈ K, k(x) = kw (x)) is an option to modify the model's behavior in an identifiable way. However, fine-tuning on even few examples that are possibly far from decision frontiers will significantly alter the performance of k: The produced solution will not be loyal.

Together, those observations lead to the conclusion that the selected points should be close to the original model's decision frontier, that is, their classification is not trivial and depends heavily on the model (Fig. 2(a)). Finding and manipulating such inputs is the purpose of adversarial perturbations [START_REF] Goodfellow | Explaining and harnessing adversarial examples[END_REF][START_REF] Moosavi-Dezfooli | Universal adversarial perturbations[END_REF]. Given a trained model, any well classified example can be modified in a very slight way such that it is now misclassified. Such modified samples are called "adversarial examples", or adversaries in short.

The proposed frontier stitching algorithm, presented in Algorithm 1, makes use of such adversaries, selected to "clamp" the frontier in a unique, yet harmless way (Fig. 2(a)). It proceeds in two steps to mark the model. The first step is to select a small key set K of specific input points, which is composed of two types of adversaries. It first contains classic adversaries, we call true adversaries, that are misclassified by k although being each very close to a well classified example. It also contains false adversaries, each obtained by applying an adversarial perturbation to a well classified example without ruining its classification. In practice, the "fast gradient sign method" proposed in [START_REF] Goodfellow | Explaining and harnessing adversarial examples[END_REF] is used with a suitable gradient step to create potential adversaries of both types from training examples, these adversaries are inputs that will be closer to a decision frontier than their base inputs. This modification in the direction of other classes is the purpose of adversarial attacks. (Other methods include for instance the "Jacobian-based saliency map approach" [START_REF] Papernot | The limitations of deep learning in adversarial settings[END_REF]). These frontier clamping inputs are then used to mark the model (Fig. 2(b)). The model k is fine-tuned into kw such that all points in K are now well classified:

∀x ∈ K, kw (x) = k(x). (5)
In other words, the true adversaries of k in K become false adversaries of the marked model, and false adversaries remain as such. The role of the false adversaries is to limit strongly the amount of changes that the decision frontiers will undergo when getting true adversaries back to the right classes. False adversaries also have the role of characterizing the shapes of the model frontiers, for adding robustness to the statistical watermark extraction process we now present.

Statistical watermark extraction. The marking step is thus the embedding of such a crafted key in the original model, while the watermark extraction consists in asking the remote model to classify the inputs in key K, to assess the presence or not of the zero-bit watermark (Algorithm 2). We now analyze statistically this extraction problem.

As discussed in Section 2, the key quantity at extraction time is the Hamming distance m K (Eq. 4) between remote model's answers to the key and expected answers. The stitching algorithm produces deterministic results with respect to the imprinting of the key: A marked model perfectly matches the key, i.e., the distance m k between kw and query results in Algorithm 2(K, K labels ) equals zero. However, as the leaked model may undergo arbitrary attacks (e.g., for watermark removal), transforming kw into a model k w , one should expect some deviation in k w answers to watermark extraction (0

m K ( kw , k w ) |K|).
On the other hand, other unmarked models might also partly match key labels, and thus have a positive non-maximum distance too. As an extreme example, even a strawman model that answers a label uniformly at random produces |K|/|C| matches in expectation, when classifying over |C| classes. Consequently, two questions are central to the frontier stitching approach: How large is the deviation one should tolerate from the original watermark in order to state about successful zero-bit watermark? And, dependently, how large should the key be, so that the tolerance is increased?

We propose to rely on a probabilistic approach by estimating the probability of an unmarked model k r to produce correct answers to requests from inputs in the key. While providing an analysis that would both be precise and cover all model behaviors is unrealistic, we rely on a null-model assuming that inputs in the key are so close to the frontier that, at this "resolution", the frontier only delimits two classes (the other classes being too far from the considered key inputs), and that the probability of each of the two classes is 1/2 each. This is all the more plausible since we leverage adversaries especially designed to cause misclassification.

More formally, let k ∅ be the null-model:

∀x ∈ K, P[k ∅ (x) = kw (x)] = 1/2.
Having such a null-model allows applying a p-value approach to the decision criteria. Indeed, let Z = m K ( kw , k r ) be the random variable representing the number of mismatching labels for key inputs K. Assuming that the remote model is the null-model, the probability of having exactly z errors in the key is

P[Z = z|k r = k ∅ ] = 2 -|K| |K|
z , that is Z follows the binomial distribution B(|K|, 1 2 ). Let θ be the maximum number of errors tolerated on k r 's answers to decide whether or not the water-

key f alse ← key f alse ∪ {(c, y x )} 8:
end if 9: end while 10: (K, K labels ) ← key true ∪ key f alse {Force embedding of key adversaries in their original class} 11: kw ← TRAIN( k, K, K labels ) 12: return kw , K, K labels Algorithm 2 Zero-bit watermark extraction from a remote model Require: K and K labels , the key and labels used to watermark the neural network 1: We thus consider the zero-bit watermark extraction from the remote model successful if the number of errors is below that threshold θ, as presented in Algorithm 2. Next Section includes an experimental study of false positives related to this probabilistic approach.

m K ← 0 2: for each c ∈ K do 3: if QUERY REMOTE(c) = K labels (c)

Experiments

We now conduct experiments to evaluate the proposed approach in the light of the requirements stated in Section 2.

In particular, we evaluate the fidelity, the effectiveness and the robustness of our algorithm.

We perform our experiments on the MNIST dataset [START_REF] Lecun | The mnist database of handwritten digits[END_REF], using the Keras backend [START_REF] Chollet | Keras[END_REF] to the TensorFlow platform 2 2 Code will be open-sourced on GitHub, upon article acceptance. [START_REF] Abadi | TensorFlow: Large-scale machine learning on heterogeneous systems[END_REF]. As neural network architectures, we use three off-theshelf implementations, available publicly on the Keras website, namely mnist mlp (0.984% accuracy at 10 epochs, we denote as MLP), mnist cnn (0.993% at 10, denoted as CNN) and mnist irnn (0.9918% at 900, denoted as IRNN). Their characteristics are as follows. The MLP is composed of two fully connected hidden layers of 512 neurons each, for a total of 669, 706 parameters to train. The CNN is composed by two convolutional layers (of size 32 and 64), with kernel sizes of 3 × 3, followed by a fully connected layer of 128 neurons (for a total of 710, 218 parameters). Finally, the IRNN refer to settings by Le et al. [START_REF] Le | A simple way to initialize recurrent networks of rectified linear units[END_REF] and uses a fully connected recurrent layer (for a total of 199, 434 parameters). All three architectures use a softmax layer as output.

All experiments are run on networks trained with the standard parametrization setup: MNIST training set of 60, 000 images, test set of size 10, 000, SGD with mini-batches of size 128 and a learning rate of 0.001. 4.1 Generating adversaries for the watermark key.

We use the Cleverhans Python library by [24] to generate the adversaries (function GEN ADVERSARIES() in Algorithm 1). It implements the "fast gradient sign method" by [START_REF] Goodfellow | Explaining and harnessing adversarial examples[END_REF], we recall here for completeness. With θ the parameters of the attacked model, J(θ, x, y) the cost function used to train the model and the gradient of that cost function with respect to input x, the adversarial image x * is obtained from the input image x by applying the following perturbation:

x * = x + ε . sign( x J(θ, x, y)).
ε thus controls the intensity of the adversarial perturbation; we use a default setting of ε = 0.25.

Alternative methods, such as the "Jacobian-based saliency map" ( [START_REF] Papernot | The Limitations of Deep Learning in Adversarial Settings[END_REF]), or other attacks for generating adversaries may also be used (please refer to [START_REF] Yuan | Adversarial examples: Attacks and defenses for deep learning[END_REF] for a list of existing approaches). Adversaries are crafted from some test set images that are then removed from the test set to avoid biased results.

As explained in Section 3, our key set K is composed by 50% of true adversaries, and by 50% of false adversaries (adversarial perturbations that are not causing misclassification). In the fast gradient sign method, the value of ε controls the intensity of the perturbations that are applied to the attacked images. With a large value, most of the adversaries are true adversaries and, conversely, a small ε produces mostly false adversaries. As a consequence, ε must be chosen so that Algorithm 1 as enough inputs ( /2) of each kind, in order to build the key. Altogether, the adversaries in the key are close to the decision frontiers, so that they "clamp" these boundaries. An example of a key is displayed in Fig. 3.

Impact of watermarking (fidelity requirement).

This experiment considers the impact on fidelity of the watermark embedding, of sizes |K| = 20 and |K| = 100, in the three networks. We generated multiple keys for this experiment and the following ones (see Algorithm 1), and kept those which required fewer that 100 epochs for embedding in the models (resp. 1000 for IRNN), using a fine tuning rate of 1 10 th of the original training rate. The following results are averaged over 30 independent markings per network.

The cumulative distribution function (CDF) in Fig. 4 shows the accuracy for the 3 networks after embedding keys of the two sizes. IRNN exhibits nearly no degradation, while embedding in the MLP causes on average 0.4% and 0.8% loss for respectively key sizes 20 and 100.

We remarked no significant degradation difference when marking (|K| = 20, 10 independent runs) a model with adversaries generated under 1 , 2 and ∞ norms. For instance, we marked the CNN model with ε = 150 ( 1 , fooling 88.54% of MNIST test set), ε = 7 ( 2 , fooling 87.56%) and ε = 0.25 ( ∞ , fooling 89.08%); This has resulted in accuracy drops of respectively 0.23%, 0.22% and 0.14%. We use ∞ in the sequel.

False positives in remote watermark extraction (effectiveness requirement).

We now experiment the effectiveness of the watermark extraction (Algorithm 2). When querying the remote model returns True, it is important to get a low false positive rate. To measure this, we ran on non watermarked and retrained networks of each type the extraction Algorithm 2, with keys used to watermark the three original networks. Ideally, the output should always be negative. We use |K| = 100, and various values of ε ∈ {0.025, 0.1, 0.25, 0.5}. We observe on Fig. 6 that the false positives are occurring for lower values 0.025 and 0.1 on some scenarios. False positives disappear for ε = 0.5. This last experiment indicates that the model owner has to select a high ε value, depending on her dataset, as the generated adversaries are powerful enough to prevent accurate classification by the remote inspected model. We could not assess a significant trend for a higher degradation of the marked model when using a higher ε as depicted in Fig. 5, where the CNN model is marked with keys of |K| = 20 and for ε ∈ {0.025, 0.1, 0.5} (10 runs per ε value). The 0.25 value is to be observed on Fig. 4. We note that this relates to adversarial training, a form of specialized data augmentation that can be used as generic regularization [START_REF] Goodfellow | Explaining and harnessing adversarial examples[END_REF] We now address the robustness of the stitching algorithm. Two types of attacks are presented: Model compression (via both pruning and singular value decomposition) and overwriting via fine-tuning.

We consider plausible attacks over the leaked model, i.e., attacks that do not degrade the model beyond a cer-tain accuracy, which we set to 0.95 in the sequel 3 (the three networks in our experiments have accuracy above 0.984).

In our set-up, re-using a leaked model that has been significantly degraded in the hope to remove a possible watermark does not make sense; the attacker would rather use a less precise, yet legitimate model.

We remark that due to the nature of our watermarking method, an attacker (who does not possess the watermark key) will not know whether or not her attacks removed the watermark from the leaked model.

Compression attack via pruning As done by [START_REF] Uchida | Embedding watermarks into deep neural networks[END_REF], we study the effect of compression through parameter pruning, where 25% to 85% of model weights with lowest absolute values are set to zero. Results are presented on Tab. 1. Among all plausible attacks, none but one (50% pruning of IRNN parameters) prevents successful and 100% accurate extraction of the watermarks. We note that the MLP is prone to important degradation of accuracy when pruned, while at the same time the average number of erased key elements from the model is way below the decision threshold of 42. Regarding the CNN, even 85% of pruned parameters are not enough to reach that same threshold.

Compression attack via Singular Value Decomposition

We experimented with a second compression attack: we used a compression library available on GitHub (keras compressor 4 ) which leverages singular value decomposition (SVD) on model weights, to compress them. We tested it to be compatible with MLP and CNN. Tab. 2 shows that the key extraction on CNN is not affected by this new attack, as accuracy drops at 88% for 50% weights compression and with an average of 20 elements removed (over 42 tolerated).

The extraction from MLP starts to be affected with high 4 https://github.com/DwangoMediaVillage/ keras_compressor compression of 75% of the weights, with 48 elements removed.

Overwriting attack via adversarial fine-tuning Since we leverage adversaries in the key to embed the watermark in the model, a plausible attack is to try overwriting this watermark via adversarial fine-tuning of the leaked model. As explained in Section 4.3, this action also relates to adversarial training that originally aims to improve model resilience to adversarial attacks [24]. In this experiment, we turn 1, 000 images from the MNIST test set into adversaries and use them to fine-tune the model (the test set being the remaining 9, 000 images). The results of the overwriting attacks is presented on Tab. 3. An adversarial fine-tuning of size 1, 000 uses 20 times more adversaries than the watermarking key (as |K| = 100, with 50% true adversaries). We see perfect watermark extractions (no false negatives) for CNN and MLP, while there are few extraction failures from the attacked IRNN architecture. This experiment is thus consistent with recent arguments about the general difficulty to defend against adversaries [START_REF] Tramèr | Ensemble adversarial training: Attacks and defenses[END_REF][START_REF] Shafahi | Are adversarial examples inevitable?[END_REF].

Conclusion on the attacks of watermarks

We highlight that in all but two tries, the watermark is robust to considered attacks. In addition, since the attacker cannot know whether her attack is successful or not (as the key is unknown to her), each new attack trial is bound to degrade the model even further, without removal guarantee. This uncertainty will probably considerably discourage trials of this kind.

4.5 About the efficiency and security requirements.

The efficiency requirement deals with the computational cost of querying a suspected remote service with the |K| queries from the watermarking key. Given typical pricing of current online machine learning services (Amazon's Machine Learning, for instance, charges $0.10 per 1, 000 classification requests as per Jan. 2018), keys in the order of hundreds of objects as in our experiments incur financial costs that are negligible, an indication of negligible computational cost as well. It is to be noted that if the suspected model is running on an embedded device [START_REF] Guo | Watermarking deep neural networks for embedded systems[END_REF], there is no cost in querying that model; if we target such an application, keys can then be of arbitrary length as far as their embedding preserve the accuracy of the model to be watermarked. As for the watermark-ing step (key embedding), it is as complex as fine-tuning a network using set K. Since the size of K is negligible compared to the original training set size, the computational overhead of embedding a key is considered low. The frontier stitching algorithm deforms slightly and locally the decision frontiers, based on the labelled samples in key K. To ensure security, this key must be kept secret by the entity that watermarked the model (otherwise, one might devise a simple overwriting procedure that reverts these deformations). Decision frontier deformation through fine-tuning is a complex process (see work by [START_REF] Van Den Berg | Some insights into the geometry and training of neural networks[END_REF]) which seems very difficult to revert in the absence of information on the key (this absence also prevents the use of recent statistical defense techniques [START_REF] Grosse | On the (statistical) detection of adversarial examples[END_REF]). Could a method detect specific local frontier configurations that are due to the embedded watermark?

The existence of such an algorithm, related to steganalysis in the domain of multimedia, would indeed be a challenge for neural network watermarking at large, but seems unlikely.

Our watermarking method relies on algorithms for finding adversarial examples, in order to get inputs nearby decision frontiers. Last few years have witnessed an arms race between attacks (algorithms for producing adversarial examples) and defenses to make neural networks more robust to those attacks; the problem is still open [START_REF] Shafahi | Are adversarial examples inevitable?[END_REF] (please refer to [START_REF] Yuan | Adversarial examples: Attacks and defenses for deep learning[END_REF] for a survey). We argue that our method will remain functional regardless of this arms race, as the purpose of machine learning for classification is to create decision frontiers for separating target classes; there will always be means to cross those frontiers, and then to create the inputs we require in order to create our watermark keys. Authors in [START_REF] Shafahi | Are adversarial examples inevitable?[END_REF] precisely characterize classes of problems for which adversarial examples cannot be avoided, and that depend on properties of the data distribution as well as the space dimensionality of the dataset.

Related Work

Watermarking aims at embedding information into "objects" that one can manipulate locally. One can consider the insertion of visible watermarks in those objects [START_REF] Braudaway | Color correct digital watermarking of images[END_REF]; we consider in this work and related work the insertion of invisible watermarks. Watermarking multimedia content especially is a rich and active research field, yet showing a two decades old interest [START_REF] Hartung | Multimedia watermarking techniques[END_REF]. Neural networks are commonly used to insert watermarks into multimedia content [START_REF] Chang | A neural-network-based robust watermarking scheme[END_REF].

After extension to surprising domains such as network science [START_REF] Zhao | Towards graph watermarks[END_REF], the extension to watermarking neural networks as objects themselves is new, following the need to protect the valuable assets of today's state of the art machine learning techniques. Uchida et al. [START_REF] Uchida | Embedding watermarks into deep neural networks[END_REF][START_REF] Nagai | Digital watermarking for deep neural networks[END_REF] thus propose the watermarking of neural networks, by embedding information in the learned weights. Authors show in the case of convolutional architectures that this embedding does not significantly change the distribution of parameters in the model. Mandatory to the use of this approach is a local copy of the neural network to inspect, as the extraction of the watermark requires reading the weights of convolution kernels. This approach is motivated by the voluntary sharing of already trained models, in case of transfer learning, such as in [START_REF] Shin | Deep convolutional neural networks for computer-aided detection: Cnn architectures, dataset characteristics and transfer learning[END_REF]'s work for instance.

Neural network watermarking techniques that allow verification in a remote black-box context were recently proposed. These works relate to our black box system model (as introduced in the technical report [START_REF] Merrer | Adversarial frontier stitching for remote neural network watermarking[END_REF]). They indeed leverage the model's outputs to carefully chosen inputs to retrieve the watermark. [START_REF] Zhang | Protecting intellectual property of deep neural networks with watermarking[END_REF] proposes to train the model to be protected with a set of specifically crafted inputs in order to trigger the assignment of a specific target label by the model on those inputs. In other words, their approach is very similar to trojaning [START_REF] Liu | Trojaning attack on neural networks[END_REF]: the triggering of a specific label facing a crafted input constitutes for the authors a proof of ownership. Similarly, [START_REF] Adi | Turning your weakness into a strength: Watermarking deep neural networks by backdooring[END_REF] explicitly exploits the possibility of neural network trojaning (i.e., , backdooring) for the same purpose. Finally, [START_REF] Rouhani | Deepsigns: A generic watermarking framework for IP protection of deep learning models[END_REF] directly embeds the watermark into the layer weights using specific loss functions. However, contrary to [START_REF] Uchida | Embedding watermarks into deep neural networks[END_REF] for instance where the weights directly contain the watermark (which is therefore not accessible in a black box context), weights in [START_REF] Rouhani | Deepsigns: A generic watermarking framework for IP protection of deep learning models[END_REF] are modified in order to produce desired activations at runtime given specific inputs. Surprisingly, the authors also show that watermarking mechanisms designed in a black box context can also be used in a white box context. In a more restricted setup, Guo et al. propose the adaptation to embedded devices of a black box capable watermark extraction [START_REF] Guo | Watermarking deep neural networks for embedded systems[END_REF].

Since more and more models and algorithms might only be accessed through API operations (as being run as a component of a remote online service), there is a growing body of research which is interested in leveraging the restricted set of operations offered by those APIs to gain knowledge about the remote system internals. [START_REF] Tramèr | Stealing machine learning models via prediction apis[END_REF] demonstrates that it is possible to extract an indistinguishable copy of a remotely executed model from some online machine learning APIs.

Depth of neural models may also be infered using timing side channel attacks [START_REF] Duddu | Stealing neural networks via timing side channels[END_REF]. [START_REF] Papernot | Practical black-box attacks against machine learning[END_REF] have shown attacks on remote models to be feasible, yielding erroneous model outputs.

Authors in [START_REF] Sethi | Data driven exploratory attacks on black box classifiers in adversarial domains[END_REF] target attacks such as evading a CAPTCHA test, by the reverse engineering of a remote classifier models. Other attacks focus on the stealing of model hyperparameters, from APIs [START_REF] Wang | Stealing hyperparameters in machine learning[END_REF][START_REF] Oh | Towards reverseengineering black-box neural networks[END_REF]; [START_REF] Oh | Towards reverseengineering black-box neural networks[END_REF] aims at infering inner hyperparameters (e.g., number of layers, non-linear activation type) of a remote neural network model by analysing its response patterns to certain inputs. Finally, algorithms in [START_REF] Merrer | Tampernn: Efficient tampering detection of deployed neural nets[END_REF] propose to detect the tampering with a deployed model, also through simple queries to the API; tested attacks are trojaning, compression, fine-tuning and the watermarking method proposed in this paper. In present work, we propose a watermarking algorithm that is compliant with APIs, since it solely relies on the basic classification query to the remote service.

Conclusion and perspectives

This article introduces the frontier stitching algorithm, to extract previously embedded zero-bit watermarks from leaked models that might be used as part of remote online services. We demonstrated this technique on image classifiers; sound [START_REF] Carlini | Audio adversarial examples: Targeted attacks on speech-to-text[END_REF] and video classifiers [START_REF] Li | Adversarial perturbations against real-time video classification systems[END_REF] were also recently found to be prone to adversarial attacks. We believe that a demonstration of existing watermarking techniques in those domains would be of a great practical interest.

We focused on classification problems, which account for many if not most ML-based services. Extensions to other problems (like regressions or semantic segmentation of images) are a next step for future work, since adversarial examples also affect those domains.

Regarding the model architecture aspect, we have seen that the IRNN model is prone to compression attacks (pruning rate of 50% of parameters). This underlines the specific behavior of architectures facing attacks and marking; in depth characterization is an interesting future work.

We challenged the robustness of our watermarking scheme facing compression and overwriting attacks. Other more advanced types of attacks might be of interest for an attacker that wants to remove the inserted watermark. In particular, another attack may be the transfer learning of the watermarked model to another task. Recent work [START_REF] Davchev | An empirical evaluation of adversarial robustness under transfer learning[END_REF] provides a first empirical evidence that the adversaries that were integrated in the model through learning (defense) might not survive the transfer, leading to a potentially successful watermark removal. A full characterization of the resilience of adversaries facing transfer learning attacks is of great importance for future work.

As another future work, we stress that the watermark information is currently extracted using the binary answers to the query made on each object in the key: Whether or not this object is classified by the remote model as expected in the key label. Leveraging not only those binary answers, but also the actual classification issued by the remote model (or even the classification scores), may allow one to embed more information with the same watermark size. Another possible improvement may come from the use of the recent concept of universal adversarial perturbations ( [START_REF] Moosavi-Dezfooli | Universal adversarial perturbations[END_REF]): they might be leveraged to build efficient and robust watermarking algorithms. Indeed, this method generates adversaries that can fool multiple classifiers at once. Relying on such adversaries in an extension of our framework might give rise to new, improved watermarking algorithms for neural networks that are queried in a black box setup.

Finally, we recall that the watermarking technique we proposed, as well as the ones from the related work [START_REF] Zhang | Protecting intellectual property of deep neural networks with watermarking[END_REF][START_REF] Adi | Turning your weakness into a strength: Watermarking deep neural networks by backdooring[END_REF][START_REF] Guo | Watermarking deep neural networks for embedded systems[END_REF][START_REF] Rouhani | Deepsigns: A generic watermarking framework for IP protection of deep learning models[END_REF], make the assumption that the watermarked model leaked as a bit-level copy. Recent attacks on stealing models yet shown the possibility to leak a model by approximating it [START_REF] Tramèr | Stealing machine learning models via prediction apis[END_REF] through tailored queries. A crucial perspective is thus to investigate watermark techniques that can resist this alternative type of attacks.

Fig. 1

 1 Fig. 1 Our goal: zero-bit watermarking a model locally (top-action), for remote assessment of a potential model leak (bottom-action).

Fig. 2

 2 Fig.2Illustration of proposed approach for a binary classifier. (a) The proposed algorithm first computes "true adversaries" (R and B) and "false" ones ( R and B) for both classes from training examples. They all lie close the decision frontier. (b) It then fine-tunes the classifier such that these inputs are now all well classified, i.e., the 8 true adversaries are now correctly classified in this example while the 4 false ones remain so. This results in a loyal watermarked model (very similar to original one) and a key size of |K| = 12 here. This process resembles "stitching" around data points.

Algorithm 1

 1 Zero-bit watermarking a model Require: Labelled sample set (X, Y ); Trained model k; Key length = |K|; Step size ε for adversary generation; Ensure: kw is watermarked with key K {Assumes X is large enough and ε is balanced to generate true & false adversaries} {Key construction} 1: adv candidates ← GEN ADVERSARIES( k,(X, Y ),ε) 2: while |key true | < /2 or |key f alse | < /2 do 3: pick random adversary candidate c ∈ adv candidates, associated to x ∈ X with label y x 4: if k(x) = y x and k(c) = y x and |key true | < /2 then {c is a true adversary} 5: key true ← key true ∪ {(c, y x )} 6: else if k(c) = k(x) = y x and |key f alse | < /2 then {c is a false adversary} 7:

  then

4 :m

 4 K ← m K + 1 {remote model answer differs from recorded answer} 5: end if 6: end for {Having θ such that 2 -|K| θ z=0 |K| z < 0.05 (null-model)} 7: return m K < θ{True ⇔ successful extraction} mark extraction is successful. To safely (p-value < 0.05) reject the hypothesis that k r is a model behaving like our null-model, we need P[Z ≤ θ|k r = k ∅ ] < 0.05. That is 2 -|K| θ z=0 |K| z < 0.05. In particular, for key sizes of |K| = 100 and |K| = 20 a p-value of 0.05, the maximum number of tolerated errors are θ = 42 and 6, respectively.

Fig. 3

 3 Fig.3An example of a key K of size four (generated with the "fast gradient sign method" and ε = 0.1), for the CNN classifier and the MNIST task: Key inputs (a) and (b) are true adversaries (2 and 1 digits, classified as 9 and 8 respectively), while (c) and (d) are false adversaries (9 and 8 digits that are correctly classified but knowingly close to a decision frontier).

Fig. 4 Fig. 5

 45 Fig. 4 Distribution of the degradation caused by watermarking models (resulting accuracy), with multiple keys of size 20 and 100 (ε = 0.25). Black vertical dot-dash lines indicate pre-watermarking accuracies.

Fig. 6

 6 Fig. 6 Distribution of (normalized) Hamming distance when extracting the watermark (generated on networks kw listed on right axis) from remote unmarked models kr (w. names on the top), for |K| = 100 and four values of ε. Vertical solid bars indicate the decision threshold corresponding to p < .05 criteria. False positives (i.e., unmarked model at distance less than the threshold) happen when the CDF is on the left of the bar. Algorithm 1's value ε = 0.5 (purple solid curve) prevents the issue of false positives in all cases.

Table 1

 1 Robustness to compression attack (pruning-based): Watermark extraction success rates (|K| = 100), after a pruning attack on watermarked models. Different pruning rates are tested to check if watermarks get erased while accuracy remains acceptable. Results in gray rows are to be ignored (not plausible attacks).

		Pruning rate K elts removed Stdev	Extraction rate Acc. after
	CNN	0.25	0.053/100	0.229	1.000	0.983
	-	0.50	0.263/100	0.562	1.000	0.984
	-	0.75	3.579/100	2.479	1.000	0.983
	-	0.85	34.000/100	9.298	0.789	0.936
	IRNN	0.25	14.038/100	3.873	1.000	0.991
	-	0.50	59.920/100	6.782	0.000	0.987
	-	0.75	84.400/100	4.093	0.000	0.148
	MLP	0.25	0.360/100	0.700	1.000	0.951
	-	0.50	0.704/100	0.724	1.000	0.947
	-	0.75	9.615/100	4.392	1.000	0.915
	-	0.80	24.438/100	5.501	1.000	0.877

Table 2

 2 Robustness to compression from library keras compressor (SVD-based), compatible with CNN and MLP.

				Pruning rate K elts removed Stdev	Extraction rate Acc. after
			CNN	0.25	1.867/100	1.457	1.000	0.987
			-	0.50	20.143/100	4.721	1.000	0.885
			-	0.75	69.643/100	3.296	0.000	0.426
			-	0.90	83.714/100	3.989	0.000	0.255
			MLP	0.25	0.385/100	0.898	1.000	0.973
			-	0.50	5.760/100	2.697	1.000	0.966
			-	0.75	48.423/100	5.742	0.077	0.953
			-	0.90	83.760/100	6.346	0.000	0.157
		K elts removed Stdev	Extraction rate Acc. after
	CNN	17.842	3.594	1.000	0.983
	IRNN	37.423	3.931	0.884	0.989
	MLP	27.741	5.749	1.000	0.972

Table 3

 3 Robustness to overwriting attacks: Rate of remaining zero-bit watermarks in the three attacked models, after model fine-tuning with 1, 000 new adversaries.

" kw + ε" stands for a small modification of the parameters of kw that preserves the value of the model, i.e., that does not deteriorate significantly its performance.

This about 3.5% accuracy drop is also the one tolerated by a recent work on trojaning neural networks[START_REF] Liu | Trojaning attack on neural networks[END_REF].

Acknowledgements The authors would like to thank the reviewers for their constructive comments.


Pierre-Yvon Bryk

Renaud Côte
email: cote@lma.cnrs-mrs.fr

Sergio Bellizzi

Targeted energy transfer from a resonant room to a hybrid electro-acoustic nonlinear membrane absorber: numerical and experimental study

Keywords: Nonlinear absorber, Targeted energy transfer, Periodic excitation, Acoustic resonance, Noise reduction

We present the first real size evidence of targeted energy transfer in a concrete building, with an efficient action on low frequency noise reduction. It is achieved by the means of a hybrid Electro-Acoustic Nonlinear Energy Sink (EA-NES). The EA-NES action is based on targeted energy transfer.

a nonlinear dynamics, and an active system based on a loudspeaker which controls the pressure applied to the rear face of the membrane. We study here a proportional feedback control law driving the loudspeaker in current mode, and compare it with the voltage mode command law. The experiment is fully modeled. A singular perturbation method around a 1:1 resonance is used to find the slow critical manifold of the system and its dependence on the control loop gain for the two driving modes, in view of finding conditions allowing Strongly Modulated Regime (SMR). A good quantitative agreement is found between the model and the experiments. In the experimental study

Introduction

It is always a challenge to reduce low-frequency noise transmission through an enclosure as for example in the case of acoustic enclosures for machine noise attenuation. Recent works focus on passive, active and hybrid active/passive devices. In [START_REF] Yu | Location optimization of a long t-shaped acoustic resonator array in noise control of enclosures[END_REF][START_REF] Cambonie | Bending a quarter wavelength resonator : Curvature effects on sound absorption properties[END_REF], the authors study passive acoustic resonators used as noise absorbers. In [START_REF] Lissek | Electroacoustic absorbers: Bridging the gap between shunt loudspeakers and active sound absorption[END_REF][START_REF] Boulandet | Toward broad band electroacoustic resonators through optimized feedback control strategies[END_REF], electro-acoustic absorbers are proposed.

They are based on the use of an enclosed loudspeaker including an electric load that shunts the loudspeaker electrical terminals. An electro-acoustic absorber can either be passive or active in terms of external power, including pressure or velocity feedback techniques. In [START_REF] Lacour | Preliminary experiments on noise reduction in cavities using active impedance changes[END_REF][START_REF] Dupont | Active absorption to reduce the noise transmitted out of an enclosure[END_REF], loudspeakers have also been used to design an active system which controls the normal impedance of surfaces in a room. Two approaches have been developed. The first is referred to as direct control: the acoustic pressure is measured close to the diaphragm of the loudspeaker and used to produce the desired impedance. In the second approach, passive and active means are combined: the rear face of a porous layer is actively controlled so as to make the front face normal impedance take a prescribed value. In [START_REF] Melon | One dimensional study of a module for active/passive control of both absorption and transmission[END_REF], devices involving loudspeakers for active/passive control of both absorption and transmission are investigated. This challenge is considered here through the relatively new concept of Targeted Energy Transfer (TET). TET is based on a coupling between a primary system (which vibrations must be mitigated) and a nonlinear absorber.

The principle is to place the coupled system on one of its nonlinear modes in order to produce quasi-irreversible transfers of the vibratory energy from the primary system to the nonlinear absorber. This phenomenon is called energy pumping [START_REF] Vakakis | Nonlinear targeted energy transfer in mechanical and structural systems[END_REF] and the nonlinear absorber is known as NES for Nonlinear Energy Sink. A basic NES generally consists of a light mass, an essentially nonlinear spring and a viscous linear damper. In the field of structural vibration, a wide variety of NES designs has been proposed, with different types of stiffness (cubic , non-polynomial, non-smooth nonlinearities...) [START_REF] Gourdon | Nonlinear energy pumping under transient forcing with strongly nonlinear coupling: Theoretical and experimental results[END_REF][START_REF] Sigalov | Resonance captures and targeted energy transfers in an inertially-coupled rotational nonlinear energy sink[END_REF][START_REF] Gourc | Quenching chatter instability in turning process with a vibro-impact nonlinear energy sink[END_REF][START_REF] Mattei | Nonlinear targeted energy transfer of two coupled cantilever beams coupled to a bistable light attachment[END_REF].

In acoustics, two types of NES have been proposed, one named acoustic NES based on an Helmholtz resonator with nonlinear behaviors [START_REF] Gourdon | Targeted energy transfer from one acoustical mode to an helmholtz resonator with nonlinear behavior[END_REF], the other named vibroacoustic NES based on the use of a simple thin clamped structure involving geometric nonlinearity at large displacement. In [START_REF] Cochelin | Experimental evidence of energy pumping in acoustics[END_REF][START_REF] Bellet | Experimental study of targeted energy transfer from an acoustic system to a nonlinear membrane absorber[END_REF][START_REF] Shao | Theoretical and numerical study of targeted energy transfer inside an acoustic cavity by a non-linear membrane absorber[END_REF], the thin clamped structure consists of a simple thin circular latex (viscoelastic) membrane whereas in [START_REF] Mariani | Toward an adjustable nonlinear low frequency acoustic absorber[END_REF] a loudspeaker used as a suspended piston is considered. It was demonstrated that a vibroacoustic NES can achieve very efficient noise reduction at low frequency. In both cases, the thin clamped structure has to be part of the frontier of the closed acoustic domain, one face (named the front face) is exposed to the primary acoustic field (to be controlled) whereas the other face (the rear face) radiates outside [START_REF] Shao | Theoretical and numerical study of targeted energy transfer inside an acoustic cavity by a non-linear membrane absorber[END_REF]. It results in a pressure difference applied to the membrane, which is necessary for TET. Neglecting the rear radiation impedance, the thin baffled structure is mainly coupled to the primary acoustic field.

In [START_REF] Shao | Theoretical and numerical study of targeted energy transfer inside an acoustic cavity by a non-linear membrane absorber[END_REF] a theoretical study was made on a system quite close to the one presented here, but it was much simpler (the NES was made of a bare membrane on the room's wall), the NES dynamics was simplified (purely passive, and no linear part in the membrane dynamics) and the numerical results were found for a very low damping (quality factor Q = 36000) that cannot be found in usual buildings. Moreover, like similar studies the rear face of the membrane needed to be exposed to a null acoustic field. In practice it means that it could not be enclosed and thus caused unwanted outward radiations preventing applications for acoustic enclosures.

In [START_REF] Bryk | Experimental study of a hybrid electroacoustic nonlinear membrane absorber[END_REF], a modified vibroacoustic NES was used on a resonant tube in order to provide noise reduction. The proposed NES named hybrid Electro-Acoustic nonlinear membrane absorber (EA-NES) is composed of a thin circular visco-elastic membrane with one face coupled to the acoustic field to be reduced and the other face enclosed. The enclosure includes a loudspeaker for the control of the acoustic pressure felt by the rear face of the membrane through proportional feedback control. It was shown experimentally that the EA-NES is able to perform resonance capture with the acoustic field, resulting in noise reduction by targeted energy transfer. Furthermore it was shown that the EA-NES provides a better noise attenuation in this setup than the classic vibroacousctic NES [START_REF] Bellet | Experimental study of targeted energy transfer from an acoustic system to a nonlinear membrane absorber[END_REF][START_REF] Shao | Theoretical and numerical study of targeted energy transfer inside an acoustic cavity by a non-linear membrane absorber[END_REF], but in [START_REF] Bryk | Experimental study of a hybrid electroacoustic nonlinear membrane absorber[END_REF] there was no model of the dynamics of the experiment.

The objective of this paper is to investigate analytically and experimentally the performance of the EA-NES considering voltage and current driving mode of the control loudspeaker in realistic conditions. Unlike previous theoretical or experimental studies, the primary system where the acoustic field is meant to be mitigated is an acoustic cavity mostly made of concrete walls. Indeed the enclosure of the EA-NES makes the membrane interact with the primary acoustic field without the need to be placed across the outer boundary and thus solves the problem of outward radiation. A simple three Degrees Of Freedom (DOF) model is developed coupling an electro-mechanicalacoustic model for the EA-NES with a model cavity representative of one of the acoustic modes. We investigated the targeted energy transfer occurring between the acoustic medium and the EA-NES during sinusoidal forced regimes. The predictions of this model is compared with the experimental data.

The paper is organized as follows. In Section 2, we start with a short description of the system under study and the experimental setup, then we describe each element of the acoustic system, considering first each substructure separately, and then modeling the coupled system. In Section 3, we study the forced responses to harmonic excitation. The responses are estimated with the complexification averaging method, and compared with results of direct numerical integration of the equations in time domain. In Section 4, we begin with a description of the experimental setup. Then, we check the stability analysis of the feedback loop and perform a frequency analysis under broadband excitation. In the last part we analyze the forced responses and their agreement with the model in the nonlinear regime, and we discuss the efficiency of the EA-NES.

System under study

The system under study is shown in Fig. 1. It is composed of an acoustic cavity that includes the EA-NES at the position M a and a source loudspeaker at the position M S . We are looking at the acoustic pressure at positions M 1 ,

M 2 and M 3 . O x y z L y L x L z (1) (2) M S M a M 1 (3) M 2 M 3 (3)
(3) loudspeaker, 8 Inch) named "control loudspeaker" is mounted inside the box (see Fig. 2(b)). The coupling between the membrane and the control loudspeaker is ensured acoustically by the air in a coupling box of a volume V e .

The volume of the rear enclosure of the control loudspeaker is V r . An active controller is used to perform a pressure reduction at the rear face of the membrane using the control loudspeaker in voltage or current driving mode. The controller is an analog feedback loop that reduces the pressure measured in the enclosure V e by using a proportional gain K. The gain K is calibrated by feeding the power amplifier with a reference sinus of 0.1 V rms and measuring its output level. The maximum value for K is limited by the stability of the loop and depends on the electrical driving mode. The maximum value of K before instability can be predicted thanks to the measurement of the open loop transfer, as described in [START_REF] Bryk | Experimental study of a hybrid electroacoustic nonlinear membrane absorber[END_REF].

The EA-NES is based on the conjugate functioning of three elements:

(i) the clamped membrane that interacts with the acoustic field in order to provide noise attenuation in its non-linear range; (ii) the hood by which the EA-NES can work inside a surrounding acoustic field unlike previous developed NES; (iii) the feedback loop that reduces the pressure in the hood and allows to use a small hood volume and also to tune the stiffness and damping linear behavior of the EA-NES.

Equations of Motion

A simplified model is developed to address the properties of the device.

The model is obtained by coupling the behaviors of the membrane and the control loudspeaker.

As explained in [START_REF] Bellet | Experimental study of targeted energy transfer from an acoustic system to a nonlinear membrane absorber[END_REF], a simplified model of the pre-stressed membrane motion can be formulated as a one DOF nonlinear oscillator

m m ẍm (t) + c 1m ẋm (t) + k 1m x m (t) + g m (x m (t), ẋm (t)) = S m 2 (p e (t) -p(t)) (1)
where x m denotes the transverse displacement of the center of the membrane, p e (t) denotes the acoustic pressure in the coupling box V e and p(t) is the acoustic pressure at the outer (front) surface of the membrane; p(t) is considered here as the forcing term. The linear parameters are given by [START_REF] Bellet | Experimental study of targeted energy transfer from an acoustic system to a nonlinear membrane absorber[END_REF]

m m = ρ m h m S m + m a 3 , k 1m = k 0m ( f 1m f 0m ) 2 and c 1m = ηk 0m (2)
with

k 0m = 2πEh 3 m 3(1 -ν 2 )R 2 m and f 0m = 1 2π 1.015 4 π 4 Eh 2 m 12(1 -ν 2 )ρ m R 4 m . (3)
The nonlinear term is given by [START_REF] Bellet | Experimental study of targeted energy transfer from an acoustic system to a nonlinear membrane absorber[END_REF] g

m (x m , ẋm ) = k 3m (x 3 m + 2ηx 2 m ẋm ) with k 3m = 1 2 8πE m h m 3(1 -ν 2 )R 2 m (4)
where ρ m is the mass volume, ν the Poisson's coefficient and E the Young's modulus of the membrane (made here in latex), h m is its thickness, R m its radius and S m its area. A mass term m a has been added to include in the model the mass of the air column introduced by the sliding system. The coefficients k 1m and k 3m stand for the linear and nonlinear stiffness coefficients, respectively. As suggested and justified in [START_REF] Bellet | Experimental study of targeted energy transfer from an acoustic system to a nonlinear membrane absorber[END_REF], the coefficient k 3m was divided by 2 [START_REF] Bellet | Enhancing the dynamic range of targeted energy transfer in acoustics using several nonlinear membrane absorbers[END_REF]. f 0m represents the resonance frequency of the membrane without pre-stress. The last two parameters f 1m (≥ f 0m ) and η (> 0)

have to be adjusted. The first one is related to the pre-tension applied to the membrane. When no pre-tension is considered, f 1m = f 0m . The second parameter η characterizes the damping.

Considering now the control loudspeaker, assuming a linear behavior, the equations of motion follow from Newton's second and Kirchhoff's laws as m ms ẍLS (t) + c ms ẋLS (t) + k ms x LS (t) = Bli LS (t) + S LS (p r (t) -p e (t)) , (5)

u LS (t) = R e i LS (t) + Bl ẋLS (t) (6)
where x LS (t) is the diaphragm displacement, u LS (t) the voltage applied at the electrical terminals of the control loudspeaker, i LS (t) the electrical current flowing through the voice coil and p r (t) the acoustic pressure in the rear enclosure. The coefficients m ms , c ms and k -1 ms represent the moving mass, the mechanical damping and the mechanical compliance accounting for the elastic surround suspension and the spider. Bl is the force factor of the transducer, S LS is the effective radiation area of the loudspeaker and R e is DC resistance (the inductance has been neglected) of the voice coil. All the parameters used in this model are commonly denoted as a part of the Thiele-Small parameters of the loudspeaker.

Equations ( 1) and ( 5) are coupled by writing that the acoustic pressures p e (t) and p r (t) are related to the relative variation of the volumes V e and V r due to the motion of the membrane and the diaphragm of the control loudspeaker as

p e (t) = ρ a c 2 0 V e (S LS x LS (t) - S m 2 x m (t)) and p r (t) = - ρ a c 2 0 V r S LS x LS (t) (7)
where ρ a is the density of the air and c 0 is the sound wave velocity in the air.

Finally the feedback loop using the electric terminals of loudspeaker as input is defined as

u LS (t) = -KS mic p e (t) (8)
when the loudspeaker is driven by voltage-output power amplifier and

i LS (t) = -KS mic p e (t) (9)
when the loudspeaker is driven by current-output power amplifier. In Eqs. ( 8) and ( 9), S mic denotes the microphone sensibility and K the control gain of the feedback loop. Note that a minus sign has been included in the model to ensure that a positive gain K leads to a reduction of the pressure p e (t) in the volume V e as observed for the step up.

Combining Eqs. (1) to ( 9) and eliminating the variables p e (t), u LS (t),i LS (t) and p r (t), results in a 2-DOF nonlinear system of the form

M Ẍ(t) + C Ẋ(t) + KX(t) + Bg m (x m (t), ẋm (t)) = -B S m 2 p(t) (10)
where

X(t) = (x m (t), x LS (t)) T , B = (1, 0) T , M =   m m 0 0 m ms   , C =   c 1m 0 0 c ms + α ms (Bl) 2 aa   and (11)
K =    k 1m + ρ a c 2 0 V e S 2 m 4 - ρ a c 2 0 V e S m 2 S LS - ρ a c 2 0 V e S m 2 ( Bl aa KS mic + S LS ) k ms + ρ a c 2 0 V e S LS ( Bl aa KS mic + S LS V e + V r V r )    (12)
with aa = 1 -α ms + α ms R e . The parameter α ms has been introduced to characterize the output power amplifier mode of the loudspeaker. If α ms = 1, the loudspeaker is assumed driven by a voltage output power amplifier (Eq. ( 8)) whereas if α ms = 0, the loudspeaker is driven by a current output power amplifier (Eq. ( 9)).

Independently of the control loop strategy, the mass M and the damping C matrices are always diagonal with positive terms whereas the stiffness matrix K is not symmetric except if K = 0 (passive system). When the loudspeaker is driven by a current output power amplifier only the stiffness matrix K is affected and the damping effect is only due to the mechanical system whereas when the loudspeaker is driven by a voltage output power amplifier the stiffness matrix K and the damping matrix C are affected by the electrical resistance. In this case, the corrective term in the damping matrix C is equal to (Bl) 2 R e and, in practice, it dominates over the mechanical damping constant c ms . The corrective terms in the stiffness matrix K due to the control loop are proportional to Bl aa KS mic reducing to Bl R e KS mic when α ms = 1 and to BlKS mic when α ms = 0 and showing that choosing the gain K R e when the loudspeaker is driven by a current output power amplifier is equivalent in terms of stiffness matrix to choosing the gain K when the loudspeaker is driven by a voltage output power amplifier.

Primary system: acoustic room

The primary system is a rectangular shaped room with dimension L x , L y and L z (see Fig. 1). We assume that all the walls of the room are rigid.

The equation of motion as a one DOF system is obtained by performing a Rayleigh-Ritz reduction taking account of one mode on the following wave equation (see for example [START_REF] Shao | Theoretical and numerical study of targeted energy transfer inside an acoustic cavity by a non-linear membrane absorber[END_REF])

1 c 2 0 ∂ 2 ∂t 2 p(M, t) -∆p(M, t) = -ρ a (δ Ma (M ) qm (t) + δ M S (M ) qS (t)) on Ω, (13) ∂ n p(M, t) = 0 on ∂Ω ( 14
)
where Ω is the internal volume of the room and ∂Ω is the surface of room.

The first term of the right hand side of Eq. ( 13) characterizes the coupling with the EA-NES considering the volumetric flow rate q m (t) resulting from the vibration of the membrane as

q m (t) = - S m 2 ẋm (t). ( 15
)
The minus sign results from the vector direction used to represent the motion of the membrane (see Fig. 2). The last term in Eq. ( 13) characterizes the acoustic source inside the room as a point flow source with the volumetric flow q S (t).

Considering the mode marked by the integers (l, m, n) defined by the frequency ω lmn and the mode shape Φ lmn (x, y, z) as

ω lmn = c 0 π l 2 L 2 x + m 2 L 2 y + n 2 L 2 z and Φ lmn (x, y, z) = cos lπx L x cos mπy L y cos nπz L z ,
and approximating the acoustic pressure as

p(M, t) = Φ lmn (M )p(t), (16)
Eqs. ( 13) and ( 14) reduce to

m lmn p(t) + c lmn ṗ(t) + k lmn p(t) = ρ 2 a c 2 0 (Φ lmn (M a ) S m 2 ẍm (t) -Φ lmn (M S ) qS (t)) (17)
where Finally for the sake of simplicity, we do not model the loudspeaker source and its power supply. We assume that the volumetric flow source is of the form

m lmn = m c ((2 -δ 0 (l)(2 -δ 0 (m))(2 -δ 0 (n)))) -
q S (t) = √ 2A S cos(ω S t) (18)
where ω S (= 2πf S ) denotes the excitation frequency and A S the RMS value of the excitation amplitude.

The final dimensional and non-dimensional 3-DOF systems

The final dimensional model is obtained by grouping Eq. ( 17) with Eq. [START_REF] Sigalov | Resonance captures and targeted energy transfers in an inertially-coupled rotational nonlinear energy sink[END_REF].

Introducing the non dimensional quantity by normalizing the acoustic pressure p(t) with ρ a c 2 0 , normalizing the time with the resonance frequency ω lmn of the cavity and resealing the final dimensional system with the parameter as p(t) = p(t)/(ρ a c 2 0 ), t = ω lmn t and =

m m m lmn , (19)
we obtain the following non-dimensional 3-DOF system (after omission of tilde)

p + λ p ṗ + p -µ p ẍm = -β(1 + σ) sin((1 + σ)t), ( 20
) ẍm + λ m ẋm + λ 2m x 2 m ẋm + k11 x m + k12 x LS + k3m x 3 m + µ m p = 0, (21)
γ LS ẍLS + λ LS ẋLS + k21 x m + k22 x LS = 0 ( 22
)
where now the dot denotes the differentiation with respect to the new time variable,

λ p = c lmn mmω lmn , µ p = Φ lmn (Ma)ρaSm 2mm , k11 = k 11 mmω 2 lmn , k12 = k 12 mmω 2 lmn , (23)
k21 = k 21 mmω 2 lmn , k22 = k 22 mmω 2 lmn , λ m = c 11 mmω lmn , λ 2m = 2ηk 3m mmω lmn , (24) k3m
= k 3m mmω 2 lmn , µ m = Φ lmn (Ma)ρ a c 2 0 Sm 2mmω 2 lmn , γ LS = m LS mm , λ LS = c 22 mmω lmn , (25) β = Φ lmn (M S )ρ a √ 2A S mmω lmn and σ = ω S -ω lmn ω lmn m lmn mm (26)
with k ij (respectively c ij ) denotes the ij-component of the matrix K (respectively C).

About the numerical values for the parameters of the models

The biggest size, L x , of the room was L x = 3.928 m given (with ρ a = 1.17 kg m -1 and c 0 = 344.5 m s -1 ) for the (1, 0, 0)-mode the frequency To maximize the modal sensitivity they are located in the corners and near the floor, reducing the perturbation due to the ceiling pyramidal shape.

f
To characterize completely the behavior of the EA-NES, we have to choose the driving mode of the control loudspeaker (current (α ms = 0) or voltage (α ms = 1)) and the gain value K.

Asymptotic analysis

In this section we assume that << 1 i.e the mass of the membrane is small with respect to the mass of the primary system ( = 5 • 10 -5 with parameter values as described in Section 2.4). We assume also that the parameters λ p , µ p , k11 , k12 , k21 , k22 , λ m , λ 2m , k3m , µ m , γ LS , λ LS , β, and σ are of order 0(1).

The objective of the asymptotic analysis is to characterize analytically the forced responses of Eqs. ( 20) to [START_REF] Manevitch | Complex representation of dynamics of coupled nonlinear oscillators[END_REF] near the resonance frequency of the primary system.

We follow the same methodology as proposed in [START_REF] Starosvetsky | Strongly modulated response in forced 2DOF oscillatory system with essential mass and potential asymmetry[END_REF]. The method combines the complexification averaging procedure (as described in [START_REF] Manevitch | Complex representation of dynamics of coupled nonlinear oscillators[END_REF]) and an asymptotic analysis which is here based on the framework of the geometric singular perturbation theory [START_REF] Fenichel | Geometric singular perturbation theory for ordinary differential equations[END_REF][START_REF] Desroches | Mixed-mode oscillations with multiple time scales[END_REF].

The complexification consists in introducing the change of variables

ψ 1 = ṗ + jp, ψ 2 = ẋm + jx m and ψ 3 = ẋLS + jx LS (27)
where j 2 = -1 and writing the complex variables ψ i as

ψ i = φ i e jt for i = 1, 2, 3 (28)
where the φ i are the complex (assumed) slow modulated amplitude of the fast component e t .

Substituting Eqs. ( 27) and (28) into Eqs. [START_REF] Côte | Experimental evidence of simultaneous multi-resonance noise reduction using an absorber with essential nonlinearity under two excitation frequencies[END_REF] to [START_REF] Manevitch | Complex representation of dynamics of coupled nonlinear oscillators[END_REF] and averaging over one period of frequency 1 yields to a system of equations describing the behavior of the slow complex amplitudes φ i as

φ1 = f 1 (φ 1 , φ 2 , φ 3 ), ( 29
) φ2 = f 2 (φ 1 , φ 2 , φ 3 , ), (30)
φ3 = f 3 (φ 1 , φ 2 , φ 3 , ) (31)
where

f 1 (φ 1 , φ 2 , φ 3 ) = j 8 (4β + (4jλ p -8σ + 4µ m µ p )φ 1 + 4µ p (jλ m + k11 )φ 2 +4 k12 µ p φ 3 + (3 k3m µ p + jλ 2m µ p )|φ 2 | 2 φ 2 ), (32)
f 2 (φ 1 , φ 2 , φ 3 , ) = j 8 (4µ m φ 1 + (4 k11 + 4jλ m -8σ -4)φ 2 + 4 k12 φ 3 +(3 k3m + jλ 2m )|φ 2 | 2 φ 2 ), (33)
f 3 (φ 1 , φ 2 , φ 3 , ) = j 2γ LS k21 φ 2 + ( k22 -2σ γ LS -γ LS + jλ LS )φ 3 . ( 34
)
Eqs. ( 29) to (31) have a classic form of singular perturbation equations (slow-fast system), which is more evident by switching from the fast time scale t to the slow time scale τ = t as

φ 1 = f 1 (φ 1 , φ 2 , φ 3 ), (35)
φ 2 = f 2 (φ 1 , φ 2 , φ 3 , ), (36)
φ 3 = f 3 (φ 1 , φ 2 , φ 3 , ) (37)
where (.) = d/dτ and φ(τ ) = φ(t = τ / ), since now the small parameter affects the first derivative of some slow-fast state variables (φ 2 and φ 3 here).

Stating = 0, the following subsystems are derived from Eqs. (29) to (31) and Eqs. (35) to (37) respectively

φ1 = 0, ( 38
) φ2 = f 2 (φ 1 , φ 2 , φ 3 , 0), ( 39
) φ3 = f 3 (φ 1 , φ 2 , φ 3 , 0) (40)
which is the fast subsystem, and

φ 1 = f 1 (φ 1 , φ 2 , φ 3 ), ( 41
) 0 = f 2 (φ 1 , φ 2 , φ 3 , 0), ( 42
) 0 = f 3 (φ 1 , φ 2 , φ 3 , 0) (43)
which is the slow subsystem.

In the following sections the geometric singular perturbation theory is used to describe the dynamics of the full system Eqs. ( 29) to (31) (and Eqs. ( 35) to (37)) for 0 < << 1 from the analysis of the fast, Eqs. (38) to (40), and slow, Eqs. ( 41) to (43), subsystems.

The Slow Invariant Manifold

At slow time, the motions of the slow subsystem, Eqs. ( 41) to (43), take place in the so-called Slow Invariant Manifold (SIM) defined by the algebraic equations ( 42) and (43) as

CM := (φ 1 , φ 2 , φ 3 ) ∈ C 3 f 2 (φ 1 , φ 2 , φ 3 , 0) = 0, f 3 (φ 1 , φ 2 , φ 3 , 0) = 0 . (44)
The points of the SIM are also fixed points for the fast subsystem (fast time) (Eqs. (38) to (40)).

Substituting Eq. (43) into Eq. ( 42), the SIM can take the following form

φ 1 = φ 2 F (|φ 2 |), (45)
φ 3 = k21 γ LS -k22 -jλ LS φ 2 (46)
where the complex function F of a real variable is defined as

F (x) = F R (x) + jF I (x) with F R (x) = k12 k21 ( k22 -γ LS ) µ m k22 -γ LS 2 + λ 2 LS + 1 -k11 µ m - 3 4 k3m µ m x 2 , (47)
F I (x) = - k12 k21 λ LS µ m ( k22 -γ LS 2 + λ 2 LS ) - λ m µ m + 1 4 λ 2m µ m x 2 . ( 48
)
It is convenient to characterize the CM in the real domain. To achieve this, polar coordinates are introduced as

φ i = N i e jθ i for i = 1, 2, 3 (49)
and we compute successively the module and the argument of Eqs. ( 45) and

(46) that lies to

N 2 1 = N 2 2 (F R (N 2 ) 2 + F I (N 2 ) 2 ), (50)
N 3 = | k21 γ LS -k22 -jλ LS |N 2 , (51)
θ 1 = θ 2 + arctan( F I (N 2 ) F R (N 2 ) , (52)
θ 3 = θ 2 + arg( k21 γ LS -k22 -jλ LS ). ( 53
)
The SIM is characterized by as a one-dimensional parametric curve (N 2 , N 1 , N 3 ) evolving in R + 3 . A typical critical manifold is plotted in Fig. 3(a)(red curve).

Due to the linear relation (51), its form is mainly given by its projection on the (N 2 , N 1 )-plane (see Fig. 3(a)(blue continuous curve)) which corresponds to Eq. (50). The expression of the SIM is similar to that obtained in [START_REF] Starosvetsky | Strongly modulated response in forced 2DOF oscillatory system with essential mass and potential asymmetry[END_REF] to study harmonic forced linear system. As in [START_REF] Starosvetsky | Strongly modulated response in forced 2DOF oscillatory system with essential mass and potential asymmetry[END_REF], the SIM do not depend on the excitation level, the damping of the primary system and the coupling term µ p . The form of the SIM is characterized by the local extrema of the function

H(x) = x 2 (F R (x) 2 + F I (x)
2 ) in the (N 2 , N 1 )-plane (see Eq. ( 50)). Local extrema are equivalently defined as the positive root of the derivative of H as a function of x 2 resulting in a polynomial of degree 2 admitting zero, one or two positive roots.

The stability of each point of the SIM as a fixed point of the fast subsystem (38-40) (fast time) can be determined. It can be shown that the condition of stability is equivalent to

H (N 2 ) > 0 ( 54
)
where H (x) = dH(x)/dx. Hence when two local extrema exist for H, denoted N f 1 2 and N f 2 2 , these local extrema define two points (N f 1 2 , H(N f 1 2 ) and (N f 2 2 , H(N f 2 2 ) called fold points where stability change occurs. Fig. 3 corresponds to a case where two fold points exist, see Fig. 3(b), and the stability zones are also reported. Such a SIM structure may give rise to Strongly Modulated Responses (SMR) [START_REF] Starosvetsky | Strongly modulated response in forced 2DOF oscillatory system with essential mass and potential asymmetry[END_REF].

Formulating conditions on the model parameters for getting two positive roots would result in large expressions which would be difficult to manipulate. Some numerical parametric study will only be discussed in Section 3.2.

A characterization of the fixed points and folded singularities of the slowflow from the slow subsystem (41)-( 43) is given Appendix Appendix A including conditions on the excitation level β for allowing SMR.

Parametric study of the current and voltage gain K

The SIMs are plotted Fig. 4(a) from Eq. (50) in the (N 2 , N 1 )-plane using the numerical values discussed Section 2.4 and for different values of gain K for current control. The associated plot, Fig. 4(b), represents the critical excitation level β cr versus K from Eq. (A.22) for the same conditions. For small values of K, the SIM does not show fold points whereas for K > K rel ≈ 2.01 (see Fig. 4(b)), two fold points exist (see Fig. 4(a)). Hence K rel defines the threshold gain from which SMRs can take place if β > β rel cr (i.e if the excitation level is sufficient high). The critical excitation level β rel cr characterizes a threshold in terms of excitation level. Equivalently a threshold can be defined in terms of N 1 -amplitude (primary system) by H(N f 1

2 ) (the ordinates of the fold points, see Fig. 4(a)(black markers)). Both thresholds increase with the gain K. differential models were solved using c Mathematica ordinary differential equations solver NDSolve (with the choice Automatic for the option Method)

with the trivial equilibrium point as initial conditions. In the area of the stable periodic solutions, the asymptotic approximation matches very well with the integrated solution. In the unstable area, the integrated solution has a low amplitude compared to the response without EA-NES. This reduction is what the EA-NES is aimed at.

When the periodic solution is unstable, the system can exhibit SMR as obtained from Eq. [START_REF] Côte | Experimental evidence of simultaneous multi-resonance noise reduction using an absorber with essential nonlinearity under two excitation frequencies[END_REF][START_REF] Starosvetsky | Strongly modulated response in forced 2DOF oscillatory system with essential mass and potential asymmetry[END_REF][START_REF] Manevitch | Complex representation of dynamics of coupled nonlinear oscillators[END_REF] in the (N 2 , N 1 )-plan for f S = 44.2 Hz with the fold points (maximum-black and minimum-red markers) and the unstable fixed point (green marker).

Experimental study

Setup and primary analysis

The experiments were conducted in a concrete parallelepipedic room, except for the ceiling which has the shape of a shortened pyramid covered by a thick wooden floor as it can be seen in Fig. 7(a). A complete description can be founding in [START_REF] Bryk | Pompage énergétique en acoustique par absorbeur dynamique non-linéaire hybride passif-actif[END_REF]. The size of the room is L During a measurement, a target voltage signal e(t) from a generator (not shown in Fig. 1) and a power amplifier TIRA, BAA120 (not shown in Fig. 1) provide an input current signal to the source loudspeaker operating in current-feedback control mode. The responses of the system are recorded simultaneously using a multi-channel analyzer/recorder OROS, OR38 (not shown in Fig. 1): the acoustic pressures at M 1 , M 2 and M 3 , the acoustic pressure p e (t) inside the EA-NES and the displacement at the center of the membrane of the EA-NES measured with an optical sensor Keyence LK-G152 (not shown in Fig. 1). Also recorded are the control loudspeaker current i LS (t) and voltage u LS (t) responses and the source loudspeaker current i s (t)

and voltage e s (t) responses. The sampling frequency is fs = 8192 Hz.

The Frequency Response Function (FRF) denoted p(M 2 )/i s measured between the source loudspeaker current i s (t) and the acoustic pressure, p(M 2 , t), at M 2 with the blocked EA-NES inside the room is plotted Figure 7(b). The FRF was measured using a white noise in the frequency range [30, 80] Hz as target signal e(t). Blocked EA-NES means that the front face membrane is covered by a rigid plate and does not interact with the acoustic pressure. This configuration defines the primary system as introduced Section 2. The first resonance frequency appears at f ≈ 43.8 Hz corresponding to the (1, 0, 0)mode and it is associated to a quality factor near to Q 100 ≈ 133. Note that these numerical values have been used in the previous theoretical analysis.

The EA-NES

The tension of the membrane of the EA-NES must be tuned so that the resulting resonance frequency may be under the frequency of the targeted mode (43.8 Hz). The resonance at low level of the EA-NES is identified by using a short Kundt tube following the methodology described in [START_REF] Chauvin | Acoustic characterization of a nonlinear vibroacoustic absorber at low frequencies and high sound levels[END_REF]. This measurement is made for some values of K for current and voltage feedback controls. Successive modifications of the pre-stress applied to the membrane were performed up to obtain the results displayed Table 1. For both current and voltage feedback controls, the resonance frequency is for K = 0 near the resonance frequency of the (1, 0, 0)-mode and decreases when the gain K increases.

Current

Nonlinear analysis

We measure the response of the cavity around its (1, 0, 0)-mode under sinusoidal forcing defined from a target signal

e(t) = E sin(2πf e + φ e ) (55)
which provides an input current signal to the source loudspeaker. Several measurements were performed increasing the forcing amplitude E from 0.01 to 0.25 and varying the forcing frequency from 42.5 Hz to 45 Hz, with a step of 0.1 Hz. The phase φ e is introduced arbitrarily by the signal generator. occurrence, at high excitation level, of a resonance peak around f ≈ 43.6 Hz, smaller than the resonance frequency observed at low excitation level. These behaviors were already reported in NES analysis [START_REF] Bellet | Enhancing the dynamic range of targeted energy transfer in acoustics using several nonlinear membrane absorbers[END_REF][START_REF] Bryk | Experimental study of a hybrid electroacoustic nonlinear membrane absorber[END_REF] and attributed to TET from the primary system to the NES. In order to quantify the triggering threshold and the width of the TET, ridge lines are extracted from each 3D plot of the acoustic pressure. The ridge line is defined as the maxima of the RMS values of the acoustic pressure for the considered frequency range for a given excitation amplitude. The measured ridge line at position M 3 (obtained from Fig. 8(a)) is displayed with the related simulations (obtained from Fig. 8(b)) in Fig. 9. Also plotted are the measured ridge line at positions M 1 and M 2 . Furthermore we also present as a reference the ridge line measured at position M 3 with the blocked EA-NES. In the blocked EA-NES configuration, the EA-NES is isolated from the acoustic field and cannot perform TET. It allows to measure the attenuation provided by the EA-NES as a function of the level of excitation. One can observe a limitation of the pressure (around 11 Pa) at positions M 1 , M 2 and M 3 from A s = 0.08 to A s = 0.17. According to the reference ridge line, the EA-NES provides until 8 dB of attenuation in the pumping range. The power spent into the loudspeaker (around 2 W [START_REF] Bryk | Pompage énergétique en acoustique par absorbeur dynamique non-linéaire hybride passif-actif[END_REF]) is in the range of the acoustic power absorbed from the room [START_REF] Bellizzi | Responses of a two degree-of-freedom system coupled to a nonlinear damper under multi-forcing frequencies[END_REF]. It is interesting because these orders of magnitude are consistent with self-powering by acoustic energy harvesting. This result is close to the numerical simulations except for the upper boundary of the excitation range which is overestimated. In this range the SMR regimes that mark the transfer of energy from the cavity to the EA-NES occur as it can be seen in Fig. 10 where three families of response regimes are illustrated depending of the excitation level. At low excitation level (A s = 0.03), the regime is sinusoidal, the EA-NES do not act (Fig. 10(a,b)). For A s = 0.12 (in the limitation range), a SMR regime occurs (Fig. 10(c,d)) and, for large excitation level (A s = 0.19), the regime is again periodic (Fig. 10(e,f)). Note that we have chosen to plot the complete measured time responses including a first step with no source signal, a second step with source signal and a last step with no source signal. Furthermore one notices a good match between numerical simulation and measurements.

Influence of K in current and voltage modes

The influence of the parameters characterizing the active part of the EA-NES on the TET efficiency are investigated in order to validate the asymp- totic analysis discussed in Section 3. The parameters are: the feedback control mode of the loudspeaker (current versus voltage) and the gain K.

The gain K varies from K = 0 to K = 15. when current feedback control is considered and K = 550. when voltage feedback control is considered. In all cases, the stability of the feedback control system is satisfied. For both feedback control modes, the value K = 0 is set with a shortcut on the input of the amplifier of the control loudspeaker and a gain set to the maximum.

We focus on the analysis to the ridge line (as defined in the previous section) of the acoustic pressure at position M 3 . Indeed the ridge lines are convenient to compare the triggering threshold and width of pumping regimes between the different configurations.

According to the Fig. 11(a), the triggering threshold of the TET depends on the gain K in the case of the current control as observed in the SIM in Fig. 4.

Indeed, starting from K = 2.5, the triggering threshold increases from 9 Pa to 15 Pa. The same phenomenon is observed with the voltage drive but in a less pronounced way (see Fig. 11(b)). As shown in [START_REF] Bryk | Experimental study of a hybrid electroacoustic nonlinear membrane absorber[END_REF], the effect of the gain K is to decrease the resonance frequency of the EA-NES at low level.

As a consequence the needed level of excitation to synchronize the EA-NES with the (1, 0, 0)-mode is increasing and one can observe in the related SIM that the fold points also increase. One can also observe that the excitation range where occurs the limitation of the pressure depends very little on the gain K.

At last the influence of the electrical drive of the EA-NES is investigated thanks to the comparison of the ridge lines obtained with each type of control.

We only take account of the ridge lines where a limitation of pressure can be observed. Indeed these ridge lines correspond to the values of K for which the TET has been observed. In each case, we plot the lower and the higher ridge

Conclusion

We have studied a hybrid EA-NES coupled to a resonant room. We have modeled the electro-mechanical dynamics of the system. The asymptotic study of the model shows the existence of a critical value above which SMRs can exist. This threshold rises along with the gain of the control loop and is affected by the kind of control loop command law (voltage or current command law).

The experimental study shows that a hybrid EA-NES can work in a concrete building. It is able to limit the sound level in the room in its working range up to 8 dB for a footprint of only 0.2% of the room volume. The different regimes observed correspond well to previous observations for NESs, including SMRs, although the system or experimental conditions in previous works were far from this study's ones. Unlike previous acoustical studies, here the SMR responses are simulated with a good quantitative agreement, in voltage or current command law. We have also simulated and observed that the thresholds defining the working range of the NES can be tuned electrically by setting the gain K of the control loop. The thresholds are at sound levels much lower than in the previous studies [START_REF] Bryk | Experimental study of a hybrid electroacoustic nonlinear membrane absorber[END_REF] where the primary system and its coupling to the EA-NES were different. ) sin(θ s 2 ) + a 11 (N

f 1/2 2
) cos(θ s 2 )) = d 2 (N

f 1/2 2
) (A.17)

where the functions d 1 (x) and d 2 (x) are not explicitly given.

The associated determinant of this linear system is equal to zero showing that one of the two equations can be removed. Therefore, the folded singularities can be only defined by Eq. (A.17 ) sin(θ s 2 ) + a 11 (N However, Condition (A.22) is necessary but not sufficient to guarantee the stability of SMR regimes. Under certain conditions, the slow flow may be attracted to another stable response. This mechanism of annihilation of SMR is explained in detail in [START_REF] Starosvetsky | Strongly modulated response in forced 2DOF oscillatory system with essential mass and potential asymmetry[END_REF] and to access this possibility, a procedure of 1D mapping has been also developed. We have not extended this procedure to our case.

f

Figure 1 :

 1 Figure 1: Schematic representation of the acoustic cavity: (1) EA-NES, (2) loudspeaker source, (3) microphones.

Figure 2 :

 2 Figure 2: Picture and schematic representation of the hybrid electro-acoustic nonlinear absorber: (1) clamped membrane, (2) control loudspeaker, (3) control microphone, (4) amplifier with conditioning filter loop gain.

  1 and k lmn = m lmn ω 2 lmn with m c = ρ a L x L y L z (the mass of the air inside the cavity). The acoustic damping gives a viscous term c lmn = √ m lmn k lmn Q -1 lmn with Q lmn the quality factor associated to the corresponding mode.

  100 43.8 Hz in good agreement with the measured one. The quality factor was fixed as Q 100 = 133 the measured one. The volumes of the two main closed boxes of the EA-NES were V e = 0.018225 m 3 and V r = 0.0248 m 3 . The membrane parameters were: radius R m = 0.05 m, thickness h m = 0.00024 m and material parameters defined by ρ m = 980. kg.m -3 , ν = 0.49, E = 1500000. Pa. The free parameters of the membrane model, m a , f 1m and η, were adjusted as m a = 0.00011 kg (about 15% of the mass membrane), f 1m = 2.5 Hz (corresponding to moderate pretension) and η = 0.001 (light damping). These numerical values were chosen in accordance with numerical/experimental studies proposed in [15, 20, 16]. The Thiele-Small parameters of the control loudspeaker were measured given the following parameter values: m ms = 19.4 10 -3 kg, c ms = 1.7 Nsm -1 , k ms = 2834.9 Nm -1 , S LS = 0.022 m 2 , R e = 6.6 Ω, Bl = 9.21 NA -1 . The resonance frequency of the driver part is 60.8 Hz and the effective diaphragm area is six time larger than the effective latex membrane. A microphone G.R.A.S. 40BH with a sensitivity S mic = 0.46 mVPa -1 was used as the control microphone. The source loudspeaker was positioned at M S with coordinates x M S = 0.3 m, y M S = 2.75 m and z M S = 0.5 m. The EA-NES was positioned at M a with coordinates x Ma = 3.65 m, y Ma = 0.35 m and z Ma = 0.35 m. The microphone M 1 (respectively M 2 and M 3 ) was positioned at (3.65, 2.8, 0.2) (respectively (0.5, 0.2, 0.2) and (3.65, 0.2, 0.2)).

Figure 3 :

 3 Figure 3: Typical slow invariant manifold: (a) in (N 2 , N 1 , N 3 )-space (red curve) and (b) in 2 , N 1 )-plane (blue curve) with fold points (maximum-black, minimum-red) and unstable zone (dotted curve).

Figure 5 Figure 4 :

 54 Figure 5 represents the same quantities but obtained for different values of gain K for voltage control. Here also for small values of K, the SIM does not show fold points whereas for K > K rel ≈ 27.18R e (see Fig. 5(b)), two fold points exist (see Fig. 5(a)). Contrary to the current control, the excitation level threshold slowly decreases and the N 1 -amplitude level threshold slowly

Figure 6 Figure 5 :

 65 Figure 6 gives an example of the action of the EA-NES. We focus on EA-NES driven by current with K = 7.5 (> K rel ) and β = 0.032 (> β cr ).The acoustic pressure amplitude at point M 3 obtained with the adimensional model Eqs.[START_REF] Côte | Experimental evidence of simultaneous multi-resonance noise reduction using an absorber with essential nonlinearity under two excitation frequencies[END_REF] to[START_REF] Manevitch | Complex representation of dynamics of coupled nonlinear oscillators[END_REF] and the asymptotic analysis Eq. (A.13) are compared in Fig.6 (a). Also plotted are the response of the primary system showing the efficiency of the EA-NES. It is slightly shifted to lower frequencies due to the absence of the linear part of the NES in the model of the room. The

observed Fig. 6 (

 6 b) for f S = 44.2 Hz. The time response obtained from Eq. (20-22) is plotted in the (N 2 , N 1 )-plane. It oscillates around the unstable range.These observations show that the EA-NES we study should be able to reduce significantly the sound level in the room. These observations give also an indication about the source level and frequency around which the experiments should be done.

Figure 6 :

 6 Figure 6: System with EA-NES driven by current with K = 7.5 and A s = 0.136 (β = 0.032): (a) Forced response (acoustic pressure) at point M 3 : primary system without NES (black dots), Eq. (20-22) (red squares), and stable (blue diamonds) and unstable (green triangles) fixed points obtained from Eq. (A.13). (b) Time responses (red curves)

= 3 .

 3 Fig. 1 and detailed in Section 2.4.

Figure 7 :

 7 Figure 7: (a) Picture of the room with the EA-NES. (b) Frequency response function p(M 2 )/i s measured with the blocked EA-NES inside the room.

.

Figure 8 :

 8 Figure 8: System with the EA-NES driven by current with K = 7.5: RMS values of the steady state regime of the acoustic pressure at the point M 3 as a surface level according to frequency and excitation amplitude: (a) measured values, (b) simulated values.

4. 2 . 1 .

 21 EA-NES driven in current with K = 7.5 We first consider the EA-NES with current feedback control and the gain value K = 7.5. TET has been observed with this configuration in the numerical simulation. The RMS values of the acoustic pressure measured at location M 3 are plotted in Fig. 8(a) as a surface level depending on the excitation frequency and the RMS values of the source loudspeaker current. The related numerical simulation are plotted Fig. 8(b). We can observe that the two surfaces are very similar. As expected a resonance peak around f ≈ 44 Hz is observed on the acoustic pressure response at low excitation level. The flat surface at low excitation level becomes, due to the nonlinear behavior of the EA-NES, substantially disturbed by an increase in the excitation level accompanied by a reduction of the response level and the

Figure 9 : 2 (

 92 Figure 9: System with the EA-NES driven by current with K = 7.5: Ridge line of the RMS values of pressure measured at point M 1 (magenta triangle markers), at point M 2 (green triangle markers) and at point M 3 (red diamond markers), and simulated at point M 3 (blue square markers). The blue circle markers correspond to the ridge line at point M 3 with the blocked EA-NES.

Figure 10 :

 10 Figure 10: System with EA-NES driven by current with K = 7.5: (a, c, e) acoustic pressure at point M 3 and (b, d, f) displacement at the center of the membrane for f s = 43.9 Hz and (a,b) A s = 0.03, (c,d) A s = 0.12 and (e,f) A s = 0.19. Numerical results from Eq. (20-22) (red curves) and data (blue curves).

Figure 11 :

 11 Figure 11: Ridge line of the RMS values of pressure measured at point M 3 for the system with EA-NES driven by (a) current, (b) voltage. (c) Comparison between current and voltage modes. In all plots, the blocked EA-NES is also reported.

denotes N f 1 2 or N f 2 2 .

 2 This work opens the way to direct applications for acoustic noise treatment. It permits to envision further studies in several directions, like developments of the control law (adaptive tuning) in view of particularly reducing the the triggering threshold of the TET, or the merging of the EA-NES membrane and loudspeaker into one part only.of the adimensional model. The stability of the periodic solution is found by looking at the sign of the real parts of the eigenvalues of the Jacobian matrix of differential system Eqs. (A.8) and (A.9).The folded singularities of Eqs. (A.8) and (A.9), denoted hereafter (N s 2 , θ s 2 ), are defined byf N 2 (N s 2 , θ s 2 ) = 0, f θ 2 (N s 2 , θ s 2 ) = 0 and g(N s 2 ) = 0. (A.14)A folded singularity is a fold point (N s 2 = N f 1 2 or N f 2 Recalling Eqs. (A.7), (A.11) and (A.12), Eq. (A.15) is reduced to the linear system with respect to (sin(θ s 2 ), cos(θ s 2

Acknowledgments

The first author acknowledges DGA-France for the financial support.

The authors thank P. Herzog [7] for his enriching inputs. This work was done in the framework of the Labex MEC.

Appendix A. Fixed points and folded singularities of the slow-flow

This appendix characterizes the fixed points and folded singularities of the slow-flow from the slow subsystem Eqs. (41) to (43). Substituting Eqs. ( 45) and (46) into Eqs. (41), the slow subsystem can be written only with respect to the variable φ 2 as

where

Using the polar coordinates (49) for i = 2 with now N 2 and θ 2 being τ dependent, and separating real and imaginary parts, Eq. (A.1) takes (after some calculation steps) the following form

where (.) (respectively (.)) denotes the real part (respectively imaginary part) of (.) Systems of Eqs. (A.3) and (A.4) can be finally reduced (after some calculation steps) to the following form

where g(x) = a 11 (x)a 22 (x) -a 12 (x)a 21 (x) = H (x)/2, (A.10)

From Eqs. (A.8) and (A.9) it is possible to detect fixed points and folded singularities.

The (regular) fixed points of Eqs. (A.8) and (A.9), denoted hereafter (N e 2 , θ e 2 ), are defined by

2 ) = 0 with g(N e 2 ) = 0. (A.13)

For << 1, the (regular) fixed points are good approximation of the fixed points of the full system Eqs. (29) to (31) corresponding to a periodic solution