Pixel-Based Image Encryption Without Key Management for Privacy-Preserving Deep Neural Networks

Abstract

We present a novel privacy-preserving scheme for deep neural networks (DNNs) that enables us not to only apply images without visual information to DNNs but to also consider the use of independent encryption keys for both training and testing images for the first time. In this paper, a novel pixel-based image encryption method that maintains important features of original images is proposed for privacy-preserving DNNs. For training, a DNN model is trained with images encrypted by using the proposed method with independent encryption keys. For testing, the model enables us to apply both encrypted images and plain images for image classification. Therefore, there is no need to manage keys. In addition, the proposed method allows us to perform data augmentation in the encrypted domain. In an experiment, the proposed method is applied to well-known networks, that is, deep residual networks and densely connected convolutional networks, for image classification. The experimental results demonstrate that the proposed method, under the use of independent encryption keys, can maintain a high classification performance, and it is robust against ciphertext-only attacks (COAs). Moreover, the results confirm that the proposed scheme is able to classify plain images as well as encrypted images, even when data augmentation is carried out in the encrypted domain. INDEX TERMS Deep learning, deep neural network, image encryption, privacy-preserving.

A protection method of trained CNN model with a secret key from unauthorized access

“…LIE is to perceptually encrypt images to mainly protect visual information on plain images while maintaining the network ability to learn the encrypted ones for classification tasks. Conventional LIE methods are classified into two classes in terms of application: LIE for privacy-preserving deep learning [15, 16, 18, 25–28] and LIE for adversarial robustness [12, 13].…”

“…In a block-wise manner, a color image is divided into blocks, and each block is processed by using a series of encryption with a common key to all blocks [15] or with different keys [25]. In a pixel-wise manner, negative/positive transformation to each pixel and color shuffling across three channels are exploited to produce learnable encrypted images [16, 18]. In contrast, a transformation network is trained in cooperation with a pre-trained classification model to generate images without visual information on plain images.…”

Image to Perturbation: An Image Transformation Network for Generating Visually Protected Images for Privacy-Preserving Deep Neural Networks

“…However, most perceptual encryption methods cannot be applied to DNNs. There are only three methods, Tanaka's method [18], a pixel-based encryption method [19], [20], and a GAN (generative adversarial network)-based transformation method [22], for privacy-preserving DNNs. However, with these methods, performance degrades in DNNs, compared with the use of plain images.…”

A Scheme of Reversible Data Hiding for the Encryption-Then-Compression System

“…Regardless of whether images are encrypted, several applications require image-related information and/or image-accompanied information for image/information processing [10], [11]. Thus, data hiding schemes have been proposed [12]- [16] where each scheme imperceptibly hides data into a unmarked image and takes hidden data out from the marked image whereas the image is encrypted.…”