# An Overview of Compressible and Learnable Image Transformation with Secret Key and Its Applications

arXiv: https://arxiv.org/abs/2201.11006 · HTML: https://mlsanity.com/paper/2201.11006/

## Key facts

- Cited by 29 papers in the map (data through 14 Oct 2026).
- Builds on 36 of its 103 references that are in the map.
- First posted on arXiv 26 Jan 2022.

## Builds on (most cited first, 30 of 36)

- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Intriguing properties of neural networks](https://mlsanity.com/paper/1312.6199/) (2013)
- [Towards Evaluating the Robustness of Neural Networks](https://mlsanity.com/paper/1608.04644/) (2016)
- [Membership Inference Attacks against Machine Learning Models](https://mlsanity.com/paper/1610.05820/) (2016)
- [Deep Learning and the Information Bottleneck Principle](https://mlsanity.com/paper/1503.02406/) (2015)
- [Fast is better than free: Revisiting adversarial training](https://mlsanity.com/paper/2001.03994/) (2020)
- [Evasion Attacks against Machine Learning at Test Time](https://mlsanity.com/paper/1708.06131/) (2017)
- [Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooring](https://mlsanity.com/paper/1802.04633/) (2018)
- [Embedding Watermarks into Deep Neural Networks](https://mlsanity.com/paper/1701.04082/) (2017)
- [EAD: Elastic-Net Attacks to Deep Neural Networks via Adversarial Examples](https://mlsanity.com/paper/1709.04114/) (2017)
- [Adversarial Machine Learning -- Industry Perspectives](https://mlsanity.com/paper/2002.05646/) (2020)
- [Adversarial Frontier Stitching for Remote Neural Network Watermarking](https://mlsanity.com/paper/1711.01894/) (2017)
- [Defense Against Adversarial Attacks Using Feature Scattering-based Adversarial Training](https://mlsanity.com/paper/1907.10764/) (2019)
- [Encryption-then-Compression Systems using Grayscale-based Image Encryption for JPEG Images](https://mlsanity.com/paper/1811.00236/) (2018)
- [Learnable Image Encryption](https://mlsanity.com/paper/1804.00490/) (2018)
- [Block-wise Image Transformation with Secret Key for Adversarially Robust Defense](https://mlsanity.com/paper/2010.00801/) (2020)
- [Block-wise Scrambled Image Recognition Using Adaptation Network](https://mlsanity.com/paper/2001.07761/) (2020)
- [A GAN-Based Image Transformation Scheme for Privacy-Preserving Deep Neural Networks](https://mlsanity.com/paper/2006.01342/) (2020)
- [Encryption Inspired Adversarial Defense for Visual Classification](https://mlsanity.com/paper/2005.07998/) (2020)
- [DeepSigns: A Generic Watermarking Framework for IP Protection of Deep Learning Models](https://mlsanity.com/paper/1804.00750/) (2018)
- [A Protection Method of Trained CNN Model with Secret Key from Unauthorized Access](https://mlsanity.com/paper/2105.14756/) (2021)
- [Attacks on Image Encryption Schemes for Privacy-Preserving Deep Neural Networks](https://mlsanity.com/paper/2004.13263/) (2020)
- [Privacy-Preserving Deep Learning via Weight Transmission](https://mlsanity.com/paper/1809.03272/) (2018)
- [Piracy-Resistant DNN Watermarking by Block-Wise Image Transformation with Secret Key](https://mlsanity.com/paper/2104.04241/) (2021)
- [A Privacy-Preserving Machine Learning Scheme Using EtC Images](https://mlsanity.com/paper/2007.08775/) (2020)
- [P3: Toward Privacy-Preserving Photo Sharing](https://mlsanity.com/paper/1302.5062/) (2013)
- [Image Transformation Network for Privacy-Preserving Deep Neural Networks and Its Security Evaluation](https://mlsanity.com/paper/2008.03143/) (2020)
- [Bridging machine learning and cryptography in defence against adversarial attacks](https://mlsanity.com/paper/1809.01715/) (2018)
- [Privacy-Preserving Support Vector Machine Computing Using Random Unitary Transformation](https://mlsanity.com/paper/1908.07915/) (2019)
- [Image Manipulation Specifications on Social Networking Services for Encryption-then-Compression Systems](https://mlsanity.com/paper/1810.02062/) (2018)

## Built on by (most cited first, 29 of 29)

- [Privacy-Preserving Image Classification Using Isotropic Network](https://mlsanity.com/paper/2204.07707/) (2022)
- [Image and Model Transformation with Secret Key for Vision Transformer](https://mlsanity.com/paper/2207.05366/) (2022)
- [Privacy-Preserving Image Classification Using Vision Transformer](https://mlsanity.com/paper/2205.12041/) (2022)
- [On the Transferability of Adversarial Examples between Encrypted Models](https://mlsanity.com/paper/2209.02997/) (2022)
- [Generative Model-Based Attack on Learnable Image Encryption for Privacy-Preserving Deep Learning](https://mlsanity.com/paper/2303.05036/) (2023)
- [Enhanced Security against Adversarial Examples Using a Random Ensemble of Encrypted Vision Transformer Models](https://mlsanity.com/paper/2307.13985/) (2023)
- [Access Control of Semantic Segmentation Models Using Encrypted Feature Maps](https://mlsanity.com/paper/2206.05422/) (2022)
- [Efficient Fine-Tuning with Domain Adaptation for Privacy-Preserving Vision Transformer](https://mlsanity.com/paper/2401.05126/) (2024)
- [A Random Ensemble of Encrypted Vision Transformers for Adversarially Robust Defense](https://mlsanity.com/paper/2402.07183/) (2024)
- [Color-NeuraCrypt: Privacy-Preserving Color-Image Classification Using Extended Random Neural Networks](https://mlsanity.com/paper/2301.04875/) (2023)
- [Hindering Adversarial Attacks with Multiple Encrypted Patch Embeddings](https://mlsanity.com/paper/2309.01620/) (2023)
- [Access Control of Object Detection Models Using Encrypted Feature Maps](https://mlsanity.com/paper/2202.00265/) (2022)
- [StyleGAN Encoder-Based Attack for Block Scrambled Face Images](https://mlsanity.com/paper/2209.07953/) (2022)
- [Access Control with Encrypted Feature Maps for Object Detection Models](https://mlsanity.com/paper/2209.14831/) (2022)
- [Domain Adaptation for Efficiently Fine-tuning Vision Transformer with Encrypted Images](https://mlsanity.com/paper/2309.02556/) (2023)
- [Efficient Key-Based Adversarial Defense for ImageNet by Using Pre-trained Model](https://mlsanity.com/paper/2311.16577/) (2023)
- [Privacy-Preserving Deep Learning Using Deformable Operators for Secure Task Learning](https://mlsanity.com/paper/2404.05828/) (2024)
- [A Privacy-Preserving Semantic-Segmentation Method Using Domain-Adaptation Technique](https://mlsanity.com/paper/2507.12730/) (2025)
- [Adversarial Detector with Robust Classifier](https://mlsanity.com/paper/2202.02503/) (2022)
- [An Encryption Method of ConvMixer Models without Performance Degradation](https://mlsanity.com/paper/2207.11939/) (2022)
- [Privacy-Preserving Image Classification Using ConvMixer with Adaptive Permutation Matrix](https://mlsanity.com/paper/2208.02556/) (2022)
- [An Access Control Method with Secret Key for Semantic Segmentation Models](https://mlsanity.com/paper/2208.13135/) (2022)
- [On the Adversarial Transferability of ConvMixer Models](https://mlsanity.com/paper/2209.08724/) (2022)
- [A Privacy Preserving Method with a Random Orthogonal Matrix for ConvMixer Models](https://mlsanity.com/paper/2301.03843/) (2023)
- [Combined Use of Federated Learning and Image Encryption for Privacy-Preserving Image Classification with Vision Transformer](https://mlsanity.com/paper/2301.09255/) (2023)
- [A Random Ensemble of Encrypted models for Enhancing Robustness against Adversarial Examples](https://mlsanity.com/paper/2401.02633/) (2024)
- [Attack GAN (AGAN ): A new Security Evaluation Tool for Perceptual Encryption](https://mlsanity.com/paper/2407.06570/) (2024)
- [Privacy-Preserving Vision Transformer Using Images Encrypted with Restricted Random Permutation Matrices](https://mlsanity.com/paper/2408.08529/) (2024)
- [Privacy-Preserving Object Detection for Vision Transformer-Based Models](https://mlsanity.com/paper/2608.20712/) (2026)

## Abstract (arXiv)

This article presents an overview of image transformation with a secret key and its applications. Image transformation with a secret key enables us not only to protect visual information on plain images but also to embed unique features controlled with a key into images. In addition, numerous encryption methods can generate encrypted images that are compressible and learnable for machine learning. Various applications of such transformation have been developed by using these properties. In this paper, we focus on a class of image transformation referred to as learnable image encryption, which is applicable to privacy-preserving machine learning and adversarially robust defense. Detailed descriptions of both transformation algorithms and performances are provided. Moreover, we discuss robustness against various attacks.