Biometric identification through hand geometry measurements AbstractÐA work in defining and implementing a biometric system based on hand geometry identification is presented here. Hand features are extracted from a color photograph taken when the user has placed his hand on a platform designed for such a task. Different pattern recognition techniques have been tested to be used in classification and/or verification from Euclidean distance to neural networks. Experimental results, up to a 97 percent rate of success in classification, will show the possibility of using this system in medium/high security environments with full acceptance from all users. DAY by day, biometric identification is gaining more importance.. Different techniques have been developed, each of them having its own advantages and disadvantages, according to user acceptance, cost, performance, etc. [4] . From all these techniques, hand geometry is considered to achieve medium security, but with several advantages compared to other techniques:. 1. Medium cost as it only needs a platform and a low/ medium resolution CCD camera. 2. It uses low-computational cost algorithms, which leads to fast results. 3. Low template size: from 9 to 25 bytes, which reduces the storage needs. 4. Very easy and attractive to users: leading to a nearly null user rejection. 5. Lack of relation to police, justice, and criminal records. There are nearly no bibliographic references about hand geometry biometrics ( [4] ), although there is one commercial system available, developed by Recognition Systems Inc. ( [8] ). The hand geometry identification system detailed in this work has the typical architecture of any other biometric system [7] . It works in two phases: an enrollment one and a comparison one. In the enrollment phase, several photographs are taken from the user; these photographs are then preprocessed to enter the feature extraction block, where a set of measurements is performed. With the features extracted, the user's pattern is computed and stored in a central database or a portable storage media. In the verification phase, a single photograph is taken, preprocessed, and entered in the feature extraction block. This single set of features is compared with the template previously stored, obtaining a ratio of likeliness to determine who the user is whose hand has been photographed.. The comparison block can be configured in two ways: as a classifier (i.e., biometric recognition), where the features extracted are compared to all the users' templates to determine which is the user photographed, or as a verifier (i.e., biometric verification), where the user's identity is stated and, therefore, the sample is only compared with the pattern of the claimed user.. Throughout this work, an explanation of all the different blocks of the hand geometry biometric identification system designed will be given. Section 2 presents the feature extraction block, including preprocessing, measurements taken, and optimization of the template size through selection of representative features. In Section 3, the classification and verification problem will be studied. In Section 4, we present our experimental results, detailing the system used, the database, and final figures in classification and verification. The conclusions, according to the results obtained, and future research directions are presented in Section 5. A hand geometry-based biometric identification system has been reported. A detailed explanation of the different blocks has been stated and different approaches have been studied, especially for the comparison block. Experimental results have been shown, giving a great performance of the system for medium security environments, achieving up to 97 percent of success in classification and error rates much below 10 percent in verification. From the comparison methods, Gaussian Mixture Modeling (GMM) has been revealed as the one with the best performance through a higher computational cost and template size. This system as designed currently is considered a good alternative for security applications, although further work is being carried out to achieve better results and ease in implementation. Further work should be applied to increase the database size in order to study if the results obtained can be generalized.

O O O B I O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B O B I O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B O O O O O O O O O O O O O O O O O O O O O O B O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Propositions as sessions Continuing a line of work by Abramsky (1994) , by Bellin and Scott (1994) , and by Caires and Pfenning (2010) , among others, this paper presents CP, a calculus in which propositions of classical linear logic correspond to session types. Continuing a line of work by Honda (1993) , by Honda, Kubo, and Vasconcelos (1998) , and by Gay and Vasconcelos (2010), among others, this paper presents GV, a linear functional language with session types, and presents a translation from GV into CP. The translation formalises for the first time a connection between a standard presentation of session types and linear logic, and shows how a modification to the standard presentation yield a language free from deadlock, where deadlock freedom follows from the correspondence to linear logic. Functional programmers know where they stand: upon the foundation of λ-calculus. Its canonicality is confirmed by its double discovery, once as natural deduction by Gentzen and once as λ-calculus by Church. These two formulations are related by the Curry-Howard correspondence, which takes propositions as types, proofs as programs, and normalisation of proofs as evaluation of programs. The correspondence arises repeatedly: Girard's System F corresponds to Reynold's polymorphic λ-calculus; Peirce's law in classical logic corresponds to Felleisen's call-cc.. Today, mobile phones, server farms, and multicores make us all concurrent programmers. Where lies a foundation for concurrency as firm as that of λ-calculus? Many process calculi have emergedranging from CSP to CCS to π-calculus to join calculus to mobile ambients to bigraphs-but none is as canonical as λ-calculus, and none has the distinction of arising from Curry-Howard.. Since its inception by Girard (1987) , linear logic has held the promise of a foundation for concurrency rooted in Curry-Howard. In an early step, Abramsky (1994) and Bellin and Scott (1994) devised a translation from linear logic into π-calculus. Along another Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. line, Honda (1993) introduced session types, further developed by Honda et al. (1998) and others, which take inspiration from linear logic, but do not enjoy a relationship as tight as Curry-Howard.. Recently, Caires and Pfenning (2010) found a twist on Abramsky's translation that yields an interpretation strongly reminiscent of session types, and a variant of Curry-Howard with propositions as session types, proofs as processes, and cut elimination as communication.. The correspondence is developed in a series of papers by Caires, Pfenning, Toninho, and Pérez. This paper extends these lines of work with three contributions.. First, inspired by the calculus πDILL of Caires and Pfenning (2010) , this paper presents the calculus CP. Based on dual intuitionistic linear logic, πDILL uses two-sided sequents, with two constructs corresponding to output (⊗ on the right of a sequent and on the left), and two constructs corresponding to input ( on the right of a sequent and ⊗ on the left). Based on classical linear logic, CP uses one-sided sequents, offering greater simplicity and symmetry, with a single construct for output (⊗) and a single construct for input ( ), each dual to the other. Caires et al. (2012a) compares πDILL with πCLL, which like CP is based on classical linear logic; we discuss this comparison in Section 4. (If you like, CP stands for Classical Processes.). Second, though πDILL is clearly reminiscent of the body of work on session types, no one has previously published a formal connection. Inspired by the linear functional language with session types of Gay and Vasconcelos (2010) , this paper presents the calculus GV, and presents a translation from GV into CP, for the first time formalising a tight connection between a standard presentation of session types and linear logic. In order to facilitate the translation, GV differs from the language of Gay and Vasconcelos (2010) in some particulars. These differences suffice to make GV, unlike the original, free from deadlock. (If you like, GV stands for Good Variation.). Curry-Howard relates proof normalisation to computation. Logicians devised proof normalisation to show consistency of logic, and for this purpose it is essential that proof normalisation terminates. Hence, a consequence of Curry-Howard is that it identifies a fragment of λ-calculus for which the Halting Problem is solved. Well-typed programs terminate unless they explicitly resort to nonlogical features such as general recursion. Similarly, a consequence of Curry-Howard for concurrency is that it identifies a fragment of a process calculus which is free of deadlock. In particular, πDILL and CP are both such fragments, and the proof that GV is deadlockfree follows immediately from its translation to CP.. Third, this paper presents a calculus with a stronger connection to linear logic, at the cost of a weaker connection to traditional process calculi. Bellin and Scott (1994) and Caires and Pfenning (2010) each present a translation from linear logic into π-calculus such that cut elimination converts one proof to another if and only if ICFP'12, September 9-15, 2012 , Copenhagen, Denmark. Copyright © 2012 ACM 978-1-4503-1054 the translation of the one reduces to the translation of the other; but to achieve this tight connection several adjustments are necessary. Bellin and Scott (1994) restrict the axiom to atomic type, and Caires and Pfenning (2010) omit the axiom entirely. In terms of a practical programming language, such restrictions are excessive. The former permits type variables, but instantiating a type variable to a type requires restructuring the program (as opposed to simple substitution); the latter outlaws type variables altogether. In consequence, neither system lends itself to parametric polymorphism.. Further, Bellin and Scott (1994) only obtain a tight correspondence between cut elimination and π-calculus for the multiplicative connectives, and they require a variant of π-calculus with surprising structural equivalences such as x(y).x(z).P ≡ x(z).x(y).Ppermuting two reads on the same channel! Caires and Pfenning (2010) only obtain a tight correspondence between cut elimination and π-calculus by ignoring commuting conversions; this is hard to justify logically, because commuting conversions play an essential role in cut elimination. Pérez et al. (2012) show commuting conversions correspond to contextual equivalences, but fail to capture the directionality of the commuting conversions.. Thus, while the connection established in previous work between cut elimination in linear logic and reduction in π-calculus is encouraging, it comes at a substantial cost. Accordingly, this paper cuts the Gordian knot: it takes the traditional rules of cut elimination as specifying the reduction rules for its process calculus. Pro: we let logic guide the design of the 'right' process calculus. Con: we forego the assurance that comes from double discoveries of the same system, as with Gentzen and Church, Girard and Reynolds, and Pierce and Felleisen. Mitigating the con slightly are the results cited above that show a connection between Girard's linear logic and Milner's π-calculus, albeit not as tight as the other connections just mentioned.. In return for loosening its connection to π-calculus, the design of CP avoids the problems described above. The axiom is interpreted at all types, using a construct suggested by Caires et al. (2012a) , and consequently it is easy to extend the system to support polymorphism, using a construct suggested by Turner (1995) . All commuting conversions of cut elimination are satisfied. This paper is organised as follows. Section 2 presents CP. Section 3 presents GV and its translation to CP. Section 4 discusses related work. Section 5 concludes. One reason λ-calculus provides such a successful foundation for functional programming is that it includes both fragments that guarantee termination (typed λ-calculi) and fragments that can model any recursive function (untyped λ-calculus, or typed λ-calculi augmented with a general fixpoint operator). Indeed, the former can be seen as giving rise to the latter, by considering recursive types with recursion in negative positions; untyped λ-calculus can be modelled by a solution to the recursion equation X X → X. Similarly, a foundation for concurrency based on linear logic will be of limited value if it only models deadlock-free processes. Are there extensions that support more general forms of concurrency? Girard (1987) proposes one such extension, the Mix rule. In our notation, this is written:. Mix differs from Cut in that there are no channels in common between P and Q, rather than one. Mix is equivalent to provability of the proposition A ⊗ B A B. Systems with Mix still do not deadlock, but support concurrent structures that cannot arise under CLL, namely, systems with two components that are independent. Caires et al. (2012a) consider two variations of the rules for 1 and ⊥, the second of which is less restrictive and derives a rule similar to Mix. Abramsky et al. (1996) proposes another extension, the Binary Cut rule (a special case of Multicut). In our notation, this is written: Binary Cut differs from Cut in that there are two channels in common between P and Q, rather than one. Binary Cut is equivalent to provability of the proposition A B A ⊗ B. Binary Cut allows one to express systems where communications form a loop and may deadlock.. Systems with both Mix and Binary Cut are compact, in that from either of A ⊗ B and A B one may derive the other. Abramsky et al. (1996) provides a translation of full π-calculus into a compact linear system, roughly analogous to the embedding of untyped λ-calculus into typed λ-calculus based on the isomorphism X X → X.. Searching for principled extensions of CP that support the unfettered power of the full π-calculus is a topic for future work. As λ-calculus provided foundations for functional programming in the last century, may we hope for this emerging calculus to provide foundations for concurrent programming in the coming century? Session types Session types were introduced by Honda (1993) , and further extended by Takeuchi et al. (1994) , Honda et al. (1998) , and Yoshida and Vasconcelos (2007) . Subtyping for session types is considered by Gay and Hole (2005) , and the linear functional language for session types considered in this paper was introduced by Gay and Vasconcelos (2010) . Session types have been applied to describe operating system services by Fähndrich et al. (2006) .. Deadlock freedom Variations on session types that guarantees deadlock freedom are presented in Sumii and Kobayashi (1998) and Carbone and Debois (2010) . Unlike CP, where freedom from deadlock follows from the relation to cut elimination, in the first it is ensured by introducing a separate partial order on time tags, and in the second by introducing a constraint on underlying dependency graphs.. Linear types for process calculus A variety of linear types systems for process calculus are surveyed by Kobayashi (2002) . Most of these systems look rather different than session types, but Kobayashi et al. (1996) presents an embedding of session types into a variant of π-calculus with linear types for channels.. Linear proof search Functional programming can be taken as arising from the Curry-Howard correspondence, by associating program evaluation with proof normalisation. Analogously, logic programming can be taken as arising by associating program evaluation with proof search. Logic programming approaches based on linear logic give rise to systems with some similarities to CP, see Miller (1992) and Kobayashi and Yonezawa (1993 , 1994 , 1995 .. Polymorphism CP's support of polymorphism is based on the polymorphic π-calculus introduced by Turner (1995) and further discussed by Pierce and Turner (2000) and Pierce and Sangiorgi (2000) , which uses explict polymorphism (Church-style). In contrast, Berger et al. (2005) introduce a polymorphically typed session calculus that uses implicit polymorphism (Curry-style).. Linear logic as a process calculus Various interpretations of linear logic as a process calculus are proposed by Abramsky (1993) , Abramsky (1994) , and Abramsky et al. (1996) , the second of these being elaborated in detail by Bellin and Scott (1994) . This paper is inspired by a series of papers by Caires, Pfenning, Toninho, and Pérez. Caires and Pfenning (2010) first observed the correspondence relating formulas of linear logic to session types; its journal version is Caires et al. (2012b) . Pfenning et al. (2011) extends the correspondence to dependent types in a stratified system, with concurrent communication at the outer level and a dependently-typed functional language at the inner level, and Pfenning et al. (2011) extends further to support proof-carrying code and proof irrelevance. explores encodings of λ-calculus into πDILL. Pérez et al. (2012) introduces logical relations on linear-typed processes to prove termination and contextual equivalences. Caires et al. (2012a) is the text of an invited talk at TLDI, summarising the above. Mazurak and Zdancewic (2010) present Lolliproc, which also offers a Curry-Howard interpretation of session types by relating the call/cc control operators to communication using a doublenegation operator on types. DILL vs. CLL Caires et al. (2012b) consider a variant of πDILL based on one-sided sequents of classical linear logic, which they call πCLL. Their πCLL is similar to CP, but differs in important particulars: its bookkeeping is more elaborate, using two zones, one linear and one intuitionitic; it has no axiom, so cannot easily support polymorphism; and it does not support reductions corresponding to the commuting conversions. Caires et al. (2012b) state they prefer a formulation based on DILL to one based on CLL, because DILL satisfies a locality property for replicated input while CLL does not. Locality requires that names received along a channel may be used to send output but not to receive input, and is useful both from an implementation point of view and because a process calculus so restricted satisfies additional observational equivalences, as shown by Merro and Sangiorgi (2004) . Caires et al. (2012b) only restrict replicated input, because restricting all input is too severe for a session-typed calculus. However, the good properties of locality have been studied only in the case where all input is prohibited on received names. It remains to be seen to what extent the fact that DILL imposes locality for replicated names is significant.. Additionally, in a private conversation, Pfenning relayed that he believes DILL may be amenable to extension to dependent types, while he suspects CLL is not because strong sums become degenerate in some classical settings, as shown by Herbelin (2005) . However, linear logic is more amenable to constructive treatment than traditional classical logic, as argued by Girard (1991) , so it remains unclear to what extent CP, or πCLL, may support dependent types.

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Hawks and doves in a dynamic framework Abstract-We revisit in this paper the well-studied Hawk and Dove game within a dynamic framework. A non-standard evolutionary game approach is taken, in which the starting point of the modelling is the dynamic evolution of the populations as a function of the strategies used, instead of a fitness based model (in which the fitness functions determine the evolution). This work is motivated by the discussion in the book of Thomas L. Vincent co-authored with J. Brown [4] in which they raise (on page 73) the puzzling question of whom should one consider to be the players: the individuals or the populations? Competition between Hawks and Doves has been used as one of the basic models for the evolution of some feature (aggressiveness in our case) within a population. The framework in which this model was studied the most is the one of evolutionary games, a branch of game theory developed by J. Maynard Smith [2] . This paradigm specializes in large populations in which the fraction of the different behaviours change as a result of large number of local pairwise interactions, i.e. interactions between randomly chosen pairs of individuals. Central in evolutionary games is the concept of Evolutionary Stable Strategy (ESS), which is a distribution of (deterministic or mixed) actions such that if used, the population is immune to penetration of mutations. This notion is stronger than that of Nash equilibrium as ESS is robust against a deviation of a whole fraction of the population where as the Nash equilibrium is defined with respect to possible deviations of a single player [4] . A second basic element in the theory of evolutionary games is that of the replicator dynamics, which provides the dynamic evolution of the ratio of the population that uses each action. There are various variants of the replicator dynamics, each giving distinct trajectories, that can be justified under appropriate conditions. We note that the ESS concept does not rely on how the dynamics are modelled, and therefore the modelling phase in evolutionary games often restricts to describing the local interactions between players along with the possible related fitness, and does not include global dynamic aspects of the populations.. In this paper, we propose a new modelling with several features that differs from the standard modelling of the Hawk and Dove game. E. V. Belmega is now with ETIS/ENSEA -Université de Cergy-Pontoise -CNRS, Cergy-Pontoise, France.. • First, instead of defining a fitness (that each individual would optimize and then study the dynamics using some replicator dynamics), we start by including the dynamics of the population into the model and into the decision process.. • We supply each individual with an energy state and define how the "decision" of being aggressive or peaceful affect the transitions between the energy states. This decision is taken at birth genetically and it can't be changed (framework of an evolutionary game in [3] ).. • Our approach differs from previous ones (where the global state is composed of the "fractions" of the population that adopt each type of behaviour) by proposing a model where the expected outcome of an interaction is determined not just by the fractions of the population in different states (against a randomly selected individual).. • We chose to focus on modelling of the whole population as players having a common objective. In this case, the rate of population growth depends on the number of individuals with a higher energy level. We do not assume that an individual inherits the behaviour of its parent. Our goal here is to characterize the equilibrium policies as a function of the system parameters.. The structure of the paper is as follows. In Sec. II, we present the model and afterwards we focus on the population size dynamics. In Sec.III, we describe the evolutionary game and investigate the existence of ESS. We give explicit results (Sec. IV), on conditions for having pure or mixed equilibria. Finally, Sec. V gives a discussion on the framework of the paper. We conclude the paper in Sec. VI. Due to space limitations, all the proofs will be incorporated in the final version of the paper. • The last state corresponds to a dead individual. Therefore, the life of an individual is governed by a threestate Markov process in which the transition rates depend on the action of the individual, genetically defined at his birth, and also the population profile and size.. The main difference with the model described in [1] is that the authors do not consider birth of individuals but penalties. Also, MacNamara et al. consider an infinite population of individuals but, in our model, we consider a finite number of individuals evolving depending on interactions.

O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


The Two-Median Problem on Manhattan Meshes We investigate the two-median problem on a mesh with M columns and N rows (M ≥ N ), under the Manhattan (L 1 ) metric. We derive exact algorithms with respect to m, n, and r , the number of columns, rows, and vertices, respectively, that contain requests. Specifically, we give an O(mn 2 log m) time, O(r ) space algorithm for general (nonuniform) meshes (assuming m ≥ n). For uniform meshes, we give two algorithms both using O(MN ) space. One is an O(MN 2 ) time algorithm, while the other is an algorithm running in O(MN log N ) time with high probability and in O(MN 2 ) time in the worst case assuming the weights are independent and identically distributed random variables satisfying certain natural conditions. These improve upon the previously bestknown algorithm that runs in O(mn 2 r ) time. In the k-median problem we are given a graph G = (V , E) with nonnegative edge costs. We want to choose k vertices (the medians) from V to minimize the sum of the distances between each vertex and its closest median. As motivation, the vertices can be thought of as customers, the medians as service centers, and the distance between a customer and a service center as the cost of servicing the customer from that center. In this view, the k-median problem is about choosing a set of k service centers that minimizes the total cost of servicing all customers. In a parallel computing scenario, the vertices can be thought of as clients and the medians as servers; the k-median problem then corresponds to a form of load-balancing.. The k-median problem is often extended so that each customer (vertex) has a weight, corresponding to the amount of service requested. The distance between a customer and its closest service center (median) then becomes the cost of providing one unit of service, that is, the cost of servicing a customer will then be the weight of the customer-vertex times its distance from the closest service center.. Lin and Vitter [13] proved that, in general graphs, even finding an o(ln n)-approximate solution to the k-median problem is NP-hard. They were able to show, though, that it is possible in polynomial time to achieve a cost within O(1 + ) of optimal if one is allowed to use (1 + 1/ )(ln n + 1)k medians. Guha and Khuller [8] proved that this problem is still MAX-SNP hard if restricted to metric spaces. Charikar et al. [3] showed that constant-factor approximations can be computed for any metric space. In the specific case of points in Euclidean space, Arora et al. [1] developed a polynomial time approximation scheme (PTAS). There are some special graph topologies for which fast polynomial time algorithms for finding exact solutions exist, though. For example, this is true for trees [15, 17] and lines [9] .. In the literature, the k-median problem is also classified according to the number of medians k. If k = 1, the problem is known as the one-median problem. If k = 2, the problem is known as the two-median problem. For k ≥ 3, the problem is known as the k-median problem. In particular, the twomedian problem was discussed widely on trees [2, 5, 6, 11] .. In this article, we deal with the specific problem of solving the two-median problem on an M × N orthogonal mesh (M ≥ N) where the distance function is the Manhattan (L 1 ) metric. This problem was recently introduced by Lau et al. [12] , who were motivated by load-balancing on parallel machines with mesh-topologies such as the iWarp system [7] . In [12] , they developed an exact algorithm that runs in O(mn 2 r) time, where m, n (assume m ≥ n) and r are, respectively, the number of columns, rows, and vertices of the mesh containing requests. Because r ≥ m, their algorithm, therefore, needed at least O(m 2 n 2 ) time. Recently, Tse and Lau [16] also developed an approximation algorithm with worst case ratio 1.5 and running in O(m 2 + r log r) time. Both of their algorithms required that the mesh must be a subset of the uniform mesh. The main result of this article is an improved exact algorithm that runs in O(mn 2 log m) time and uses O(r) space. The algorithm also works for arbitrary meshes, dispensing with the requirement that the mesh be a subset of a uniform one. We also give two algorithms for uniform meshes. One algorithm runs in O(MN 2 ) time in the worst case. The other runs in O(MN log N) time with high probability if the requests of all vertices of the mesh are independent and identically distributed (iid) random variables satisfying certain natural conditions, for example, if the requests from each vertex are bounded by a constant (that is, resources needed by a single vertex do not depend on the size of the mesh) and the number of vertices that have requests is not too small (say, the proportion of the vertices having requests being ln N/ √ N is enough). A natural example of such a distribution would be that each vertex requests i ∈ {0, 1, . . . , B} units of service independently with constant probability p i , where at least one p i for i ≥ 1 is nonzero. Both of the two algorithms for uniform meshes use O(MN) space.. The article is organized as follows. In Section 1, we give the notations and the formal definitions. We begin with some basic observations in Section 2. In Section 3, we show the algorithm for general nonuniform meshes, which is later improved in Section 4 for uniform meshes. In Section 5, we discuss the range query subroutine that is used as a black box in the preceding sections.

O B O O O O O O O B O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Temporal synchronization of non-overlapping videos using known object motion This paper presents a robust technique for temporally aligning multiple video sequences that have no spatial overlap between their fields of view. It is assumed that (i) a moving target with known trajectory is viewed by all cameras at non-overlapping periods in time, (ii) the target trajectory is estimated with a limited error at a constant sampling rate, and (iii) the sequences are recorded by stationary cameras with constant frame rates and fixed intrinsic and extrinsic parameters. The proposed approach reduces the problem of synchronizing N non-overlapping sequences to the problem of robustly estimating a single line from a set of appropriately-generated points in R N +1 . This line describes all temporal relations between the N sequences and the moving target. Our technique can handle arbitrarily-large misalignments between the sequences and does not require any a priori information about their temporal relations. Experimental results with real-world and synthetic sequences demonstrate that our method can accurately align the videos. The use of multiple video cameras to visualize and reconstruct large-scale scenes has become popular worldwide. As a result, many novel applications have been developed using multiple video recordings, such as, video post-production (Cao et al., 2009) , three-dimensional photogrammetric analysis (Raguse and Heipke, 2006) , video mosaicing (Gong and Yang, 2005) , sporting analysis (Saito et al., 2004) and interactive reconstruction of virtual environments (Gibson et al., 2003) . In order to retrieve accurate semantic and geometric information from the monitored scene, all those applications demand on synchronized video sequences. Typically, the temporal misalignment between video sequences occurs when they have different frame rates, or when there is a time shift between them (e.g. the cameras are not activated simultaneously).. Although synchronization can be manually performed, this approach is prone to human error, especially when there are several video sequences. Alternatively, the temporal alignment may be estimated using camera synchronization hardwares or network connections (Kitahara et al., 2001) . Unfortunately, special hardwares are not a practical solution for remote and wireless applications. Moreover, it is very complex to specify special hardwares for synchronizing cameras of different technologies and vendors. On the other hand, the use of a network connection to synchronize cameras requires the application of special methods to deal with the non-determinism in the network dynamics, such as propagation time or physical channel access time, which makes the synchronization task a very challenging problem in many multi-camera systems (Sivrikaya and Yener, 2004) .. In this context, the use of software-based methods has demonstrated to be an interesting alternative to recover synchronization from visual cues. This work proposes a method that belongs to this last group of software based solutions. Specifically, we propose an algorithm for temporally aligning multiple video sequences that have no spatial overlap between their fields of view. Our method is derived from the method presented by Pádua et al. (2008) and is based on the concept of a timeline. Consider the scenario illustrated in Figure 1 . Given N non-overlapping sequences, the timeline is a line in R N +1 that completely describes all temporal relations between the sequences and a moving target in the viewed scene. Note that the space considered has an additional dimension, indistinguishable from the other N , which refers to the moving target. The trajectory of the moving target is assumed to be known a priori, being related to a fixed reference frame and estimated with a limited error at a constant sampling rate.. An interesting characteristic of the timeline is that even though knowledge of the timeline implies knowledge of the sequences' temporal alignment, we can compute points on the timeline without knowing this alignment. Using this property as a starting point, the temporal alignment problem for N sequences is reduced to the problem of estimating a single line of N + 1 dimensions from a set of appropriately-generated points in ℜ N +1 . Importantly, a reliable algorithm for the solution of the asynchronism problem between multiple video sequences should be able to handle cases like ):. • Unknown cameras frame rates;. • Arbitrary time shift between the sequences; • Unknown object motion;. • Presence of tracking failures; • Computational efficiency should degrade gracefully with increasing number of video sequences; • Unknown user-defined camera set-up;. Our approach operates under all the above conditions, except the last one. In particular, we assume that the camera set-up is composed by stationary cameras, whose intrinsic and extrinsic parameters are known a priori. This scenario is typical in several applications, such as, automatic video-based surveillance of large-scale scenes and videobased modeling and rendering of three-dimensional scenes. This work presents an approach to estimate the temporal alignment between N unsynchronized video sequences captured by cameras with non-overlapping fields of view. The results suggest that timeline reconstruction algorithm provides a simple and effective method that is able to handle arbitrary temporal dilations and large time shifts. By reducing the alignment problem to a RANSAC-based procedure, our method is able to tolerate large proportions of outliers in the data due to errors in the 3D target localization and in the tracking and camera calibration techniques.. Additional theoretical investigations need to be considered for future work. Firstly, the methodology proposed assumes that all cameras acquire frames at constant (albeit not necessarily identical) temporal sampling rates. Based on that assumption, the approach model the temporal misalignment between a pair of video sequences as an one-dimensional affine transformation. The pairwise temporal relations modelled by that transformation induce a global relationship between the frame numbers of the input sequences and the sample numbers of the moving target. However, such a kind of mathematical modelling is not appropriate when some sequences work with variable frame rates. Therefore, the development of an alternative mathematical model, which can couple with this problem represents an important topic for future research.. Another direction for future work consists in to extend our approach to be used with unknown user-defined camera setups. If rough information about the relative camera positions and orientations is available, it may be possible to extend the algorithm to do both synchronization and refinement of the camera calibration parameters, assuming that several objects cross the fields of view. Some authors classify the existing video synchronization methods in two groups: the feature-based methods and the direct methods.. Most part of recent related work on video synchronization is formed by feature-based methods (Cao et al., 2009; Tresadern and Reid, 2009; Pádua et al., 2008; Wedge et al., 2007; Wolf and Zomet, 2006; Raguse and Heipke, 2006; Lei and Hang, 2006; Caspi et al., 2006) , to list just a few. Those methods extract all information needed to perform temporal alignment from detected features, for example, frame-to-frame object motion, or object trajectories throughout an entire sequence. On the other hand, direct methods (Ushizaki et al., 2006; Ukrainitz and Irani, 2006; Shakil, 2006; Dai et al., 2006a,b; Sand and Teller, 2004; Irani, 2001, 2000) extract that information from the intensities and intensity gradients of all pixels that belong to overlapping regions. Therefore, direct methods tend to align sequences more accurately if their appearances are similar, while featurebased methods are widely prescribed for sequences with dissimilar appearance such as those acquired with wide baselines, different magnifications, or by cameras with distinct spectral sensitivities. The method proposed in this work belongs to the group of feature-based methods.. Many existing feature-based techniques (Wolf and Zomet, 2006; Caspi et al., 2006; Wedge et al., 2005; Rao et al., 2003; Wolf and Zomet, 2002a,b; Lee et al., 2000; Stein, 1998) perform an explicit search in the space of all possible alignments and are aware of use constraints based on correspondences between points of object trajectories. The combinatorial nature on that search requires several additional assumptions to make it manageable. These include assuming known frame rates; restricting N to be two; assuming that the temporal misalignment is an integer; and assuming that this misalignment falls within a small user-specified range. Hence, efficiency considerations greatly limit the applicability of these solutions.. Some other feature-based methods are based on the establishment of putative frame correspondences and use robust line-fitting techniques such as RANSAC or the Hough Transform (Tresadern and Reid, 2009; Pooley et al., 2003) to reduce the effect of gross outliers when estimating synchronization parameters. Tresadern and Reid (2009) present a method for synchronizing two video sequences, which recovers potential frame correspondences, estimates the synchronization parameters via the Hough transform and refines these parameters using nonlinear optimization methods. The main limitation of that method is that it relies on two matched sets of points moving non-rigidly in the scene. Pádua et al. (2008) propose an approach to align N overlapping sequences directly. That work reduces the problem of synchronizing N sequences to the problem of robustly estimating a single line in R N . Moreover, it is based on the assumption of known epipolar geometry, which is often computed using static background points that are common to the views. For pairs of cameras with wide baselines, this should be done using feature descriptors that are appropriate for wide-baseline stereo matching (Tola et al., 2008) .. The method proposed in this work is inspired by the work of Pádua et al. (2008) . Differently from their approach, we propose a technique to align N non-overlapping sequences that are acquired by stationary cameras, whose intrinsic and extrinsic parameters are known a priori. In this scenario, instead of using the assumption of known epipolar geometry and estimating trajectories of objects that are observed by all the cameras, our approach uses a single moving target in a preliminary step, whose 3D localization with respect to a fixed reference frame may be estimated with a constant sampling rate. This moving target crosses all the fields of view (see Figure 1 ) and our technique establishes correspondences between the temporal coordinates of the frames of the sequences and the sample numbers of the moving target. This procedure leads to a simple algorithm for reconstructing the timeline that recovers the temporal alignment between the sequences. Our approach is useful, not only in the case of non-overlapping sequences, but also when there is very little common appearance information between images, and are therefore difficult for standard video alignment techniques. Feature-based techniques relying on space-time interest points have also been proposed for pairwise video alignment (Wedge et al., 2007; Laptev et al., 2005; Yan and Pollefeys, 2004) . Usually, these techniques are not robust when the sequences contain objects moving in front of a cluttered background and tend to fail on sequences from widely-separated viewpoints.. Regarding feature-based methods for simultaneously aligning more than two sequences, only a few works have been proposed (Cao et al., 2009; Pádua et al., 2008; Lei and Hang, 2006; Raguse and Heipke, 2006; Whitehead et al., 2005) . Cao et al. (2009) present a method to synchronize multiple non-overlapping video sequences that are captured by cameras undergoing similar ego-motions. The proposed algorithm makes use of fundamental ratios, which are the ratios of the elements of homogeneous fourdimensional feature vectors characterizing the camera egomotion. As our method, that approach assumes that the camera internal parameters are fixed throughout the video. Raguse and Heipke (2006) propose a method where the temporal misalignment is modeled by a 2 nd order polynomial and is converted to an interpolation factor in image space. Through the use of the interpolation factor, temporal correction terms for the image coordinates are calculated and introduced in the functional model of a bundle adjustment. Unlike the method proposed in this paper, the technique developed by Raguse and Heipke (2006) works with overlapping sequences, requires a reliable tracker and if the acquisition network consists only of two cameras, it is necessary that the object motion does not occur in an epipolar plane, because otherwise the temporal misalignment results in a systematic point shift in that plane since the two image rays still intersect. Whitehead et al. (2005) present a two-stage approach for aligning three sequences.. The method relies on 2D shape heuristics in order to bring feature trajectories into a rough temporal alignment. This alignment is then refined by enforcing trifocal constraints. Differently from their approach, our method is applied to a general number of video sequences and does not demand on a reliable tracker across many frames.. Finally, there are only a few works based on direct methods to align sequences without any overlap (Shakil, 2006; Caspi and Irani, 2001 ). The most relevant work was developed by Caspi and Irani (2001) , and, unlike our approach, it does not work with stationary cameras. Specifically, it only works with sequences acquired by pairs of cameras that remain rigidly attached to each other while moving relative to a mostly rigid scene.

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O B I I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


A Novel Statistical Generative Model Dedicated To Face Recognition Abstract. In this paper, a novel statistical generative model to describe a face is presented, and is applied on the face authentication task. Classical generative models used so far in face recognition, such as Gaussian Mixture Models (GMM) and Hidden Markov Models (HMM) for instance, are making strong assumptions on the observations derived from a face image. Indeed, such models usually assume that local observations are independent, which is obviously not the case in a face. The presented model hence proposes to encode relationships between salient facial features by using a static Bayesian Network. Since robustness against imprecisely located faces is of great concern in a real-world scenario, authentication results are presented using automatically localised faces. Experiments conducted on the XM2VTS and the BANCA databases showed that the proposed approach is suitable for this task, since it reaches state-of-the-art results. We compare our model to baseline appearance-based systems (Eigenfaces and Fisherfaces) but also to classical generative models, namely GMM, HMM and pseudo-2DHMM. Face recognition has been and is still an active research area, probably because of its wide-range of applications, including video-surveillance, user authentication and human-computer interaction to name a few. Hence, many different algorithms have been proposed to solve this task over the last thirty years. Nowadays, various systems are able to properly recognise people based on their face image. However, such results are often attained only if a sufficient amount of training data covering a reasonable range of variations (such as pose or illumination conditions for instance) is available to train the recognition system, and provided that the face is perfectly located in the image.. A face recognition system can be used in two modes: authentication (or verification) and identification. An authentication system involves confirming or denying the identity claimed by an individual. On the other hand, an identification system attempts to establish the identity of a given person out of a pool of different people. Identification generally operates on a closed-set scenario (the individual to identify is present in the database), while authentication operates on an open-set scenario, where people not present in the database could try to fool the system. Although these tasks are slightly different, both modes usually share the same classification algorithms. In this work, the focus is made on the face authentication task.. Existing face recognition algorithms are often divided into two categories: appearance-based (also referred to as holistic) and feature-based, depending on the way the face image is processed. In appearance-based method, the whole face image is represented as a high-dimensional vector. Due to the curse of dimensionality, such vectors cannot be compared directly. Hence, holistic methods use dimensionality reduction techniques to resolve this problem and thus derive lower-dimensional vectors for subsequent classification. The most popular examples among such approaches are based on Principal Component Analysis (PCA) and on Linear Discriminant Analysis (LDA). In PCA-based systems, also known as Eigenfaces [1] , high-dimensional vectors are projected onto the subspace defined by the leading eigenvectors of the data covariance matrix. LDA-based face recognition, also referred to as Fisherfaces [2] , is a supervised method: the linear projection is based on Fisher's linear discriminant formula to find a subspace where vectors of the same class are close to each other, and at the same time far from the ones belonging to other classes. The PCA or LDA subspace representation is then used for classification using a simple metric, or more sophisticated machine learning techniques, such as Support Vector Machines for instance [3] . Other dimensionality reduction techniques were applied to the face recognition problem, including Independent Component Analysis (ICA) [4] , as well as non-linear methods such as Locality Preserving Projections (also known as Laplacianfaces) [5] , Kernel PCA [6] [7] and Generalised Discriminant Analysis (GDA), which is actually a kernelized version of LDA [8] [9] . Amongst all these systems, empirical evaluation showed that Kernel methods, and Kernel Fisherfaces in particular, are the best for the face recognition task [9] . However, all these subspace-based approaches usually require a large amount of training data, but also a proper alignment or warping of the faces to be classified. Indeed, experiments conducted using holistic methods with automatically localised faces (i.e. when face localisation is error-prone) showed a significant drop in performance [10] [11] .. Feature-based approaches are typically using a set of local observations obtained from the face image to derive a model of an individual, which is subsequently used for recognition. One of the most representative systems in this family is probably the Elastic Bunch Graph Matching (EBGM) [12] . In this case, a face image is represented by a set of wavelets coefficients arranged in a graph, whose nodes corresponds to fiducial points (eyes, tip of the nose, corner of the mouth, etc.). During the recognition process, the lattice is allowed to be deformable so as to maximise the correlation between corresponding wavelet coefficients of the gallery and of the probe image. Others recent approaches are based on Local Binary Patterns (LBP) [13] [14] , where the face is represented by a set of concatenated LBP histograms, each one being computed in a different block of pixels along the image. Recognition is then performed by measuring the similarity between histograms. Other successful feature-based approaches are based on statistical generative models, such as Gaussian Mixture Models (GMM) [15] , Hidden Markov Models (HMM) [16] [17] [18] , or its variant [10] [19] [20] . Such systems usually decompose the face image into blocks and then learn the distribution of the blocks using one of the previously mentioned models. As compared to holistic approaches, feature-based systems have several advantages: they are more robust to little variations in pose, illumination, occlusion, expression and localisation errors [10] [21] [22] . Moreover, and in contrast to appearance-based systems, feature-based approaches are able to incorporate more a priori knowledge on the object to recognise, by selecting which features to use and how to relate them to each other.. In this paper, we propose a new statistical generative model based on static Bayesian Networks and especially tailored to deal with the object to be considered, that is the human face. Actually, classical generative models and GMM in particular, make strong independence assumptions on the way that face image data are generated. Indeed, in the GMM framework as applied in [15] for instance, overlapping blocks are considered to be independent, which is obviously not the case in a face image. Consider the two eyes for instance: the block containing the right eye is certainly related to the block containing the left one. HMM-based approaches, as well as models based on dynamic Bayesian Networks [23] are able to introduce some kind of structure into the observations, and usually performs better than GMM. In these cases however, the structure only constrain the ordering of the observations (i.e. the nose has to be above the mouth for instance) but do not add relationships between observations themselves, since Hidden Markov modelling considers that observations are independent, provided that the state is known. Hence, the main assumption that drove us towards the proposed model is that salient facial features are related to each others, and hence should not be treated as if they were independent. Actually, this paradigm along with the use of Bayesian Networks has already been successfully applied in two face processing task: face detection [24] and facial expression recognition [25] . For the task of face authentication, preliminary experiments using the proposed approach and yielding encouraging results were presented in [26] . In this contribution, we present experiments on the XM2VTS [27] and BANCA [28] databases using automatically located faces. Indeed, since face localisation is the necessary first step to any other face analysis task, we believe that robustness to imperfectly located faces is worth investigating. A comparison of the proposed approach to other face authentication systems is made using exactly the same settings. Namely, our system is compared to two popular appearance-based method, Eigenfaces and Fisherfaces, and also to classical generative models such as GMM, HMM and pseudo-2DHMM as applied in [10] .. The remaining of this paper is organised as follows. Section 2 briefly introduce the Bayesian Networks framework while Section 3 presents the proposed model, as well as the inference and the learning algorithms in more details. In Section 4, an overview of the face and the facial features localisation systems are outlined. The experimental framework and the databases are described in Section 5 whereas results are presented in Section 6. Finally, Section 7 conclude the paper and propose possible future research directions. Compared to the popular holistic systems (Eigenfaces and Fisherfaces), the proposed system performs consistently better on both databases. Moreover, Figures 6(a) and 7(a) representing EPC curves for BNFace and both holistic systems show that the authentication error is drastically reduced at all operating points when the proposed system is used. These results are not surprising, since it has been previously shown that the performance of appearance-based systems is severely affected when faces are not perfectly aligned. Hence, conducted experiments confirms that local feature-based systems are more robust to imperfectly located faces.. Since classical generative models also uses local features to perform classification, such systems are usually less affected by the face localisation step. Indeed, they perform generally better than the holistic ones (Tables 1 and 2 ). Hence, a comparison of the proposed models with GMM, HMM and pseudo-2DHMM may reveal the advantages and the drawbacks at the models level, when applied to face authentication.. It must be noted that BNFace performs way better than the simple GMM-based system on both databases. This result is particularly interesting since it tends to support two stated hypothesis. First, only a subset of the face image, corresponding to salient facial features, is sufficient to perform authentication. Indeed, in the GMM framework, blocks of pixels are extracted from the whole face image. Second, it also suggests that blocks extracted from the face image are correlated and hence should not be treated as if they were independent. However, results obtained with GMM are surprising since they are much worse than previously published results on the same databases, also using automatic registration [15] [10] . Nevertheless, this fact can be explained thanks to three observations. First, the preprocessing step used in our work is different. Second, previous work used mirroring and additional data to train the models and third, we did not fine-tune the various hyperparameters, rather, we used the ones reported in [15] and [10] .. In our experiments, the HMM-based system outperforms the GMM-based system on the BANCA database (note that this is the converse on the XM2VTS database). This result is in contrast to the one obtained in [10] , where GMM were shown to perform better than HMM in the case of automatic face localisation. Hence, it is difficult to say whether the model itself is not appropriate to model the face or if its performance is affected by localisation errors. Nevertheless and according to [10] , HMM seems to better model the face image, since it performs better than GMM when the face is manually located (similar results were also observed when reproducing this experiment). On one hand, this suggest that introducing structure to the observations, in the form of vertical spatial relationships may be useful. But on the other hand, HMM also add rigid horizontal constraints, and this may explain the contradictory results obtained with this approach. However, note that the proposed model still outperforms the HMM-based system on both databases. Hence, it suggests once again that relationships between facial features themselves, and not only on their ordering, is useful to describe a face.. The pseudo-2DHMM is the only system performing better than the proposed system. It can be mainly explained thanks to two observations: first, rigid constraints are less important than in the HMM for instance, hence pseudo-2DHMM is less affected by automatic face detection. Second, the model is able to add two-dimensional spatial constraints to the observations. Results obtained with this approach hence suggest that two-dimensional spatial relationships along the entire face image are important. Note that results on the Unmatched degraded (Ud) protocol of the BANCA database, the proposed model performs better than P2D-HMM. This suggest that using only a subset of the face image less affects the authentication system in the case of a strong mismatch between training and testing acquisition conditions. However, results obtained with BNFace and with P2D-HMM are close to each other, especially on the protocol P of the BANCA database. Hence, in order to better compare these two classifiers, we present the Expected Performance Curves of the two systems together with the 95% confidence interval (Figure 8 ). One can see that in some parts, an overlap is occurring, hence showing that the two classifier are not statistically different. The bottom part of the Figure depicts the statistical difference between the two classifiers. If the curve is above 0.95, this means that the classifiers are different with 95% confidence. As can be seen on Figure 8 , the two classifiers are only statistically different with high confidence in a small range of operating points.. Although the pseudo-2DHMM approach obtained the best results, it is also the most complex. Indeed, it uses much more client-specific parameters to describe a face and is also more computationally demanding than the proposed system. In Table 3 , we report the computational time to perform the three tasks involved in face authentication: world-model training, client-model adaptation (computed on average over the client) for one individual, and authentication time for one individual (also computed on average). We also report the number of client-specific parameters for the proposed system and P2D-HMM. These quantities were obtained using the BANCA database on a computer with an AMD Athlon 2,6 GHz. Overall, obtained results suggest that the proposed model based on Bayesian Networks is suitable for the task of face authentication using automatically localised faces. Indeed, we conducted comparative experiments and the proposed model yields better performance than 4 out of 5 baseline systems. Moreover, obtained results are competitive with state-of-the-art reported in the literature on the same databases and with automatic registration [45] [46] . Note however that the proposed system strongly relies on the Active Shape Model to locate the salient facial features. Indeed, upon visual inspection of the landmarks, we remarked that, in some cases, facial features are not accurately located. Hence, our model may also suffer from such imprecision. In this section, we first describe the general framework to perform face authentication using statistical generative models. Then, we present measures used to assess the performance of the systems, as well as the databases and their respective experimental protocols. Finally, the feature extraction scheme for the proposed model is described.

O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Effects of Air Pollution on Ecosystems and Biological Diversity in the Eastern United States Conservation organizations have most often focused on land-use change, climate change, and invasive species as prime threats to biodiversity conservation. Although air pollution is an acknowledged widespread problem, it is rarely considered in conservation planning or management. In this synthesis, the state of scientific knowledge on the effects of air pollution on plants and animals in the Northeastern and Mid-Atlantic regions of the United States is summarized. Four air pollutants (sulfur, nitrogen, ozone, and mercury) and eight ecosystem types ranging from estuaries to alpine tundra are considered. Effects of air pollution were identified, with varying levels of certainty, in all the ecosystem types examined. None of these ecosystem types is free of the impacts of air pollution, and most are affected by multiple pollutants. In aquatic ecosystems, effects of acidity, nitrogen, and mercury on organisms and biogeochemical processes are well documented. Air pollution causes or contributes to acidification of lakes, eutrophication of estuaries and coastal waters, and mercury bioaccumulation in aquatic food webs. In terrestrial ecosystems, the effects of air pollution on biogeochemical cycling are also very well documented, but the effects on most organisms and the interaction of air pollution with other stressors are less well understood. Nevertheless, there is strong evidence for effects of nitrogen deposition on plants in grasslands, alpine areas, and bogs, and for nitrogen effects on forest mycorrhizae. Soil acidification is widespread in forest ecosystems across the eastern United States and is likely to affect the composition and function of forests in acid-sensitive areas over the long term. Ozone is known to cause reductions in photosynthesis in many terrestrial plant species. For the most part, the effects of these pollutants are chronic, not acute, at the exposure levels common in the eastern United States. Mortality is often observed only at experimentally elevated exposure levels or in combination with other stresses such as drought, freezing, or pathogens. The notable exceptions are the acid/aluminum effects on aquatic organisms, which can be lethal at levels of acidity observed in many surface waters in the region. Although the effects are often subtle, they are important to biological conservation. Changes in species composition caused by terrestrial or aquatic acidification or eutrophication can propagate throughout the food webs to affect many organisms beyond those that are directly sensitive to the pollution. Likewise, sublethal Annals of the New York Academy of Sciences doses of toxic pollutants may reduce the reproductive success of the affected organisms or make them more susceptible to potentially lethal pathogens. Many serious gaps in knowledge that warrant further research were identified. Among those gaps are the effects of acidification, ozone, and mercury on alpine systems, effects of nitrogen on species composition of forests, effects of mercury in terrestrial food webs, interactive effects of multiple pollutants, and interactions among air pollution and other environmental changes such as climate change and invasive species. These gaps in knowledge, coupled with the strong likelihood of impacts on ecosystems that have not been studied in the region, suggests that current knowledge underestimates the actual impact of air pollutants on biodiversity. Nonetheless, because known or likely impacts of air pollution on the biodiversity and function of natural ecosystems are widespread in the Northeast and Mid-Atlantic regions, the effects of air pollution should be considered in any long-term conservation strategy. It is recommended that ecologically relevant standards, such as "critical loads," be adopted for air pollutants and the importance of long-term monitoring of air pollution and its effects is emphasized. The past four decades have seen much research on the effects of air pollution on ecosystems. Much of this work has focused on biogeochemical responses of lakes, forests, and estuaries to elevated levels of sulfur and nitrogen deposition. Many studies have shown that plant and animal species differ in their sensitivity to air pollution and its biogeochemical consequences, such as soil and water acidification. For instance, lichens differ in sensitivity to sulfur dioxide (e.g., Thormann 2006) , vascular plants differ in sensitivity to ozone (e.g., King et al. 2005) , fish and other aquatic biota differ in sensitivity to lake acidity (e.g., Baker et al. 1990) , and grasses and forbs differ in sensitivity to added nitrogen (e.g., Wedin & Tillman 1996) . This differential sensitivity suggests that air-pollution stress will have consequences for the biodiversity of an ecosystem, either in shifting species composition or outright loss of sensitive species. Because these impacts are species-specific and pollutant-specific, and most ecosystems are exposed to multiple air pollutants simultaneously, it can be difficult to assess the overall impact of air pollution on organisms in a particular ecosystem. This lack of a "big picture" makes it difficult for conservation biologists and policymakers to determine the role of air pollution among the array of threats to biodiversity.. This report is a synthesis of scientific information on the impacts of air pollution on elements of biological diversity (e.g., species, natural communities, ecosystems) in the Northeastern and Mid-Atlantic regions of the United States. These elements are used by The Nature Conservancy (TNC), the largest conservation organization in the United States, to best represent biological diversity in planning efforts used to guide and focus conservation action. By focusing on TNC targets, we hope to provide conservation organizations with sufficient information to gauge the scope and severity of the threat of air pollution in this region. Our approach in this synthesis is to group species and communities in eight ecosystem types and to assess the evidence for the effects of four key air pollutants in each ecosystem type. To the extent possible, we attempt to quantify the levels of air pollution that produce adverse impacts, and to assess the certainty of scientific knowledge on the subject. Our goal is to gain a better appreciation for the combined impacts of air pollution on multiple taxonomic groups and ecosystem types in order to better inform biodiversity-conservation efforts about the relative significance of this threat. To our knowledge, this type of collective synthesis of impacts to biological diversity has not been previously attempted for multiple pollutants across multiple conservation target groups.

O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B B B O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O B O O B O O O O O O B O O O B I I O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B O O O O O B O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Security types preserving compilation Starting from the seminal work of Volpano and Smith, there has been growing evidence that type systems may be used to enforce confidentiality of programs through non-interference.However, most type systems operate on high-level languages and calculi, and "low-level languages have not received much attention in studies of secure information flow" (Sabelfeld and Myers, [1]). Therefore, we introduce an information flow type system for a low-level language featuring jumps and calls, and show that the type system enforces termination-insensitive noninterference.Furthermore, information flow type systems for low-level languages should appropriately relate to their counterparts for high-level languages. Therefore, we introduce a compiler from a high-level imperative programming language to our low-level language, and show that the compiler preserves information flow types. Type systems are popular artefacts to enforce safety properties in programming languages. They are also increasingly being used in the context of mobile code to enforce security policies. For example, it is natural to assign to program variables a security level that stipulates its confidentiality status (such as secret or public), and to guarantee that programs do not leak secret information through execution. The absence of information leakage can be made precise with non-interference, as defined in the work of Goguen and Meseguer [2] , and can be enforced via information flow type systems [3] .. Such information flow type systems have been thoroughly studied in the literature, see e.g. [1] for a survey. However, most works focus on high-level calculi, including λ-calculus, see e.g. [4] , π-calculus, see e.g. [5] , and ς-calculus [6] , or high-level programming languages, including Java [7, 8] and ML [9] .. In contrast, relatively little is known about non-interference for low-level languages, in particular because their lack of structure renders control flow more intricate; in fact many existing works, among which [10, 11] , use model-checking and abstract interpretation techniques to detect illegal information flows, but do not provide proofs of non-interference for programs that are accepted by their analysis.. The first part of this paper is devoted to the definition of an information flow type system for a low-level language with jumps and procedure calls, and to a proof that the type system enforces termination-insensitive non-interference. Informally, the security policy is expressed as a mapping Γ : X → S that assigns to each register a security level taken from {H, L}. As usual H denotes confidential data and L denotes public data, so registers x ∈ X such that Γ(x) = L correspond to the registers that are observable by the attacker. Then non-interference is expressed as:. ρ ∼ ρ and P, ρ ⇓ µ and P, ρ ⇓ µ imply µ ∼ µ where P, ρ ⇓ µ denotes that executing program P with initial memory ρ yields the final memory µ, and ρ ∼ ρ denotes that ρ and ρ coincide on all variables x ∈ X such that Γ(x) = L.. In order to enforce non-interference of programs, we follow the principles of Java bytecode ver-ification, see e.g. [12] , namely to provide an abstract transition relation between typed states, and to compute types through a dataflow analysis based on the abstract transition relation. The proof of soundness of the type system relies on a general method. Informally, we define a notion ∼ of L-equivalence between states; the idea is that two states are L-equivalent if they cannot be distinguished from one another by an attacker. Then, writing s ; u to denote that performing one-step execution from state s results in a new state u, we show that:. • if s ; s , and u ; u , and s ∼ s , and the program counters of s and u coincide, then u ∼ u ; furthermore, the program counters of s and u coincide, or the program counters of s and u belong to the control dependence region of a branching instruction that performs a test on confidential data;. • if the program counter of s belongs to the control dependence region of a branching instruction that performs a test on confidential data, and s ; u, then s ∼ u, and either the program counter of u remains in the control dependence region to which s belongs, or the program counter of u is the "exit" of this region.. By appealing to properties of control dependence regions, and by combining the two results in an adequate way, and appealing to transitivity of L-equivalence, one shows that typable programs are non-interfering.. The second part of this paper is devoted to proving that information flow types can be preserved by compilation. As suggested by Abadi [13] , information flow type systems for low-level languages should appropriately relate to their counterparts for high-level languages, and one would expect that compilation preserves information flow typing. Indeed, we show for a high-level language and an information flow type system that closely resemble those of [3] that compilation function preserves typing. The proof that compilation preserves typing proceeds by induction on the structure of derivations, and can be viewed as a procedure to compute, from a certificate of well-typing at the source program, another certificate of well-typing for the compiled program. It is thus very close in spirit to a certifying compiler [14] . We have shown how type systems can be used to enforce non-interference in a low-level language with procedures, and that one can define a security types preserving compiler from a high-level imperative language to such a low-level language. Our work constitutes a preliminary investigation in the realm of certifying compilation for security properties, and may be extended in several directions.. • Language expressiveness: we would like to extend the results of this paper to more powerful languages that include objects and/or higher-order functions. We are particularly interested in scaling up our results to the sequential fragment of Java and of the JVM, building up on [7] for the former and on [16] for the latter.. • Integrity: it should be possible, and of practical interest, to adapt our results to integrity.. Indeed, weak forms of integrity guarantee that high variables may not be modified by a low writer, and are dual to confidentiality.. • Machine-checked proofs: we would like to machine-check the proof of soundness of the information flow type system of Section 4 and of [16] . Using earlier work on verified bytecode verifiers [28] in Coq [29] (see [30] for similar earlier work in Isabelle [31] ), it should be possible to derive a certified bytecode verifier that guarantees secure information flow for a representative (sequential) fragment of the JVM. As emphasized in the introduction, static enforcement of non-interference through type systems is a well-researched topic, see e.g. [1] for a survey. We only comment on some of the most relevant literature.. Low-level languages Lanet et al., see e.g. [11] , develop a method to detect illicit flows for a sequential fragment of the JVM. In a nutshell, they proceed by specifying in the SMV model checker a symbolic transition semantics of the JVM that manipulates security levels, and by verifying that an invariant that captures the absence of illicit flows is maintained throughout the (abstract) program execution. Their analysis is more flexible than ours, in that it accepts programs such as Mendel [22] have considered non-interference for a simple assembly language, using linear continuations for computing control dependence regions. Their proof technique is similar to ours. Using abstract interpretation techniques, Genaim and Spoto [23] have also developed a sound information flow analysis for a fragment of Java bytecode. Finally, the first and third author [16] have developed a sound information flow type system for a large fragment of the JVM.. Type preserving compilation Type preserving compilation has been thoroughly studied in the context of typed intermediate languages, most notably for ML and Java, see e.g. [24] . Information flow types preserving compilation has been studied by Zwandewic and Myers in the context of λ-calculus and CPS translation [25] . Also, Honda and Yoshida [5] consider type-preserving interpretations of higher-order imperative calculi with security types to π-calculus with security types.

B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O B O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O B O