# Block-wise Image Transformation with Secret Key for Adversarially Robust Defense

arXiv: https://arxiv.org/abs/2010.00801 · HTML: https://mlsanity.com/paper/2010.00801/

## Key facts

- Cited by 30 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 2 Oct 2020.

## Built on by (most cited first, 30 of 30)

- [An Overview of Compressible and Learnable Image Transformation with Secret Key and Its Applications](https://mlsanity.com/paper/2201.11006/) (2022)
- [Privacy-Preserving Image Classification Using Isotropic Network](https://mlsanity.com/paper/2204.07707/) (2022)
- [A Protection Method of Trained CNN Model with Secret Key from Unauthorized Access](https://mlsanity.com/paper/2105.14756/) (2021)
- [Image and Model Transformation with Secret Key for Vision Transformer](https://mlsanity.com/paper/2207.05366/) (2022)
- [Piracy-Resistant DNN Watermarking by Block-Wise Image Transformation with Secret Key](https://mlsanity.com/paper/2104.04241/) (2021)
- [A Protection Method of Trained CNN Model Using Feature Maps Transformed With Secret Key From Unauthorized Access](https://mlsanity.com/paper/2109.00224/) (2021)
- [Access Control Using Spatially Invariant Permutation of Feature Maps for Semantic Segmentation Models](https://mlsanity.com/paper/2109.01332/) (2021)
- [On the Transferability of Adversarial Examples between Encrypted Models](https://mlsanity.com/paper/2209.02997/) (2022)
- [Generative Model-Based Attack on Learnable Image Encryption for Privacy-Preserving Deep Learning](https://mlsanity.com/paper/2303.05036/) (2023)
- [Enhanced Security against Adversarial Examples Using a Random Ensemble of Encrypted Vision Transformer Models](https://mlsanity.com/paper/2307.13985/) (2023)
- [Access Control of Semantic Segmentation Models Using Encrypted Feature Maps](https://mlsanity.com/paper/2206.05422/) (2022)
- [Hindering Adversarial Attacks with Implicit Neural Representations](https://mlsanity.com/paper/2210.13982/) (2022)
- [Efficient Fine-Tuning with Domain Adaptation for Privacy-Preserving Vision Transformer](https://mlsanity.com/paper/2401.05126/) (2024)
- [Hindering Adversarial Attacks with Multiple Encrypted Patch Embeddings](https://mlsanity.com/paper/2309.01620/) (2023)
- [Transfer Learning-Based Model Protection With Secret Key](https://mlsanity.com/paper/2103.03525/) (2021)
- [Towards Understanding and Harnessing the Effect of Image Transformation in Adversarial Detection](https://mlsanity.com/paper/2201.01080/) (2022)
- [Access Control of Object Detection Models Using Encrypted Feature Maps](https://mlsanity.com/paper/2202.00265/) (2022)
- [Access Control with Encrypted Feature Maps for Object Detection Models](https://mlsanity.com/paper/2209.14831/) (2022)
- [Advancing Adversarial Training by Injecting Booster Signal](https://mlsanity.com/paper/2306.15451/) (2023)
- [Domain Adaptation for Efficiently Fine-tuning Vision Transformer with Encrypted Images](https://mlsanity.com/paper/2309.02556/) (2023)
- [Efficient Key-Based Adversarial Defense for ImageNet by Using Pre-trained Model](https://mlsanity.com/paper/2311.16577/) (2023)
- [A Privacy-Preserving Semantic-Segmentation Method Using Domain-Adaptation Technique](https://mlsanity.com/paper/2507.12730/) (2025)
- [Protecting Semantic Segmentation Models by Using Block-wise Image Encryption with Secret Key from Unauthorized Access](https://mlsanity.com/paper/2107.09362/) (2021)
- [Protection of SVM Model with Secret Key from Unauthorized Access](https://mlsanity.com/paper/2111.08927/) (2021)
- [Adversarial Detector with Robust Classifier](https://mlsanity.com/paper/2202.02503/) (2022)
- [An Encryption Method of ConvMixer Models without Performance Degradation](https://mlsanity.com/paper/2207.11939/) (2022)
- [On the Adversarial Transferability of ConvMixer Models](https://mlsanity.com/paper/2209.08724/) (2022)
- [Adversarial Attacks Neutralization via Data Set Randomization](https://mlsanity.com/paper/2306.12161/) (2023)
- [AdROD: HyperNetwork-based Adversarially Robust Object Detection for Autonomous Driving](https://mlsanity.com/paper/2608.16031/) (2026)
- [Privacy-Preserving Object Detection for Vision Transformer-Based Models](https://mlsanity.com/paper/2608.20712/) (2026)

## Abstract (arXiv)

In this paper, we propose a novel defensive transformation that enables us to maintain a high classification accuracy under the use of both clean images and adversarial examples for adversarially robust defense. The proposed transformation is a block-wise preprocessing technique with a secret key to input images. We developed three algorithms to realize the proposed transformation: Pixel Shuffling, Bit Flipping, and FFX Encryption. Experiments were carried out on the CIFAR-10 and ImageNet datasets by using both black-box and white-box attacks with various metrics including adaptive ones. The results show that the proposed defense achieves high accuracy close to that of using clean images even under adaptive attacks for the first time. In the best-case scenario, a model trained by using images transformed by FFX Encryption (block size of 4) yielded an accuracy of 92.30% on clean images and 91.48% under PGD attack with a noise distance of 8/255, which is close to the non-robust accuracy (95.45%) for the CIFAR-10 dataset, and it yielded an accuracy of 72.18% on clean images and 71.43% under the same attack, which is also close to the standard accuracy (73.70%) for the ImageNet dataset. Overall, all three proposed algorithms are demonstrated to outperform state-of-the-art defenses including adversarial training whether or not a model is under attack.