# A GAN-Based Image Transformation Scheme for Privacy-Preserving Deep Neural Networks

arXiv: https://arxiv.org/abs/2006.01342 · HTML: https://mlsanity.com/paper/2006.01342/

## Key facts

- Cited by 27 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 2 Jun 2020.

## Built on by (most cited first, 27 of 27)

- [Re-thinking Model Inversion Attacks Against Deep Neural Networks](https://mlsanity.com/paper/2304.01669/) (2023)
- [An Overview of Compressible and Learnable Image Transformation with Secret Key and Its Applications](https://mlsanity.com/paper/2201.11006/) (2022)
- [Diff-Privacy: Diffusion-based Face Privacy Protection](https://mlsanity.com/paper/2309.05330/) (2023)
- [A Protection Method of Trained CNN Model with Secret Key from Unauthorized Access](https://mlsanity.com/paper/2105.14756/) (2021)
- [Image and Model Transformation with Secret Key for Vision Transformer](https://mlsanity.com/paper/2207.05366/) (2022)
- [Piracy-Resistant DNN Watermarking by Block-Wise Image Transformation with Secret Key](https://mlsanity.com/paper/2104.04241/) (2021)
- [Privacy-Preserving Image Classification Using Vision Transformer](https://mlsanity.com/paper/2205.12041/) (2022)
- [Hiding Visual Information via Obfuscating Adversarial Perturbations](https://mlsanity.com/paper/2209.15304/) (2022)
- [Access Control Using Spatially Invariant Permutation of Feature Maps for Semantic Segmentation Models](https://mlsanity.com/paper/2109.01332/) (2021)
- [Leveraging Image-based Generative Adversarial Networks for Time Series Generation](https://mlsanity.com/paper/2112.08060/) (2021)
- [On the Transferability of Adversarial Examples between Encrypted Models](https://mlsanity.com/paper/2209.02997/) (2022)
- [Access Control of Semantic Segmentation Models Using Encrypted Feature Maps](https://mlsanity.com/paper/2206.05422/) (2022)
- [Color-NeuraCrypt: Privacy-Preserving Color-Image Classification Using Extended Random Neural Networks](https://mlsanity.com/paper/2301.04875/) (2023)
- [Unveiling Hidden Visual Information: A Reconstruction Attack Against Adversarial Visual Information Hiding](https://mlsanity.com/paper/2408.04261/) (2024)
- [Transfer Learning-Based Model Protection With Secret Key](https://mlsanity.com/paper/2103.03525/) (2021)
- [StyleGAN Encoder-Based Attack for Block Scrambled Face Images](https://mlsanity.com/paper/2209.07953/) (2022)
- [Access Control with Encrypted Feature Maps for Object Detection Models](https://mlsanity.com/paper/2209.14831/) (2022)
- [Ensembler: Protect Collaborative Inference Privacy from Model Inversion Attack via Selective Ensemble](https://mlsanity.com/paper/2401.10859/) (2024)
- [Privacy-Preserving Deep Learning Using Deformable Operators for Secure Task Learning](https://mlsanity.com/paper/2404.05828/) (2024)
- [A Lightweight Privacy-Preserving Scheme Using Label-based Pixel Block Mixing for Image Classification in Deep Learning](https://mlsanity.com/paper/2105.08876/) (2021)
- [Protecting Semantic Segmentation Models by Using Block-wise Image Encryption with Secret Key from Unauthorized Access](https://mlsanity.com/paper/2107.09362/) (2021)
- [An Encryption Method of ConvMixer Models without Performance Degradation](https://mlsanity.com/paper/2207.11939/) (2022)
- [Privacy-Preserving Image Classification Using ConvMixer with Adaptive Permutation Matrix](https://mlsanity.com/paper/2208.02556/) (2022)
- [On the Adversarial Transferability of ConvMixer Models](https://mlsanity.com/paper/2209.08724/) (2022)
- [A Privacy Preserving Method with a Random Orthogonal Matrix for ConvMixer Models](https://mlsanity.com/paper/2301.03843/) (2023)
- [Attack GAN (AGAN ): A new Security Evaluation Tool for Perceptual Encryption](https://mlsanity.com/paper/2407.06570/) (2024)
- [Generative Adversarial Networks Applied for Privacy Preservation in Biometric-Based Authentication and Identification](https://mlsanity.com/paper/2509.20024/) (2025)

## Abstract (arXiv)

We propose a novel image transformation scheme using generative adversarial networks (GANs) for privacy-preserving deep neural networks (DNNs). The proposed scheme enables us not only to apply images without visual information to DNNs, but also to enhance robustness against ciphertext-only attacks (COAs) including DNN-based attacks. In this paper, the proposed transformation scheme is demonstrated to be able to protect visual information on plain images, and the visually-protected images are directly applied to DNNs for privacy-preserving image classification. Since the proposed scheme utilizes GANs, there is no need to manage encryption keys. In an image classification experiment, we evaluate the effectiveness of the proposed scheme in terms of classification accuracy and robustness against COAs.