# Privacy-Preserving Image Classification Using Isotropic Network

arXiv: https://arxiv.org/abs/2204.07707 · HTML: https://mlsanity.com/paper/2204.07707/

## Key facts

- Cited by 17 papers in the map (data through 14 Oct 2026).
- Builds on 13 of its 23 references that are in the map.
- First posted on arXiv 16 Apr 2022.

## Builds on (most cited first, 13 of 13)

- [An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale](https://mlsanity.com/paper/2010.11929/) (2020)
- [The Unreasonable Effectiveness of Deep Features as a Perceptual Metric](https://mlsanity.com/paper/1801.03924/) (2018)
- [Federated Learning: Strategies for Improving Communication Efficiency](https://mlsanity.com/paper/1610.05492/) (2016)
- [Patches Are All You Need?](https://mlsanity.com/paper/2201.09792/) (2022)
- [InstaHide: Instance-hiding Schemes for Private Distributed Learning](https://mlsanity.com/paper/2010.02772/) (2020)
- [Encryption-then-Compression Systems using Grayscale-based Image Encryption for JPEG Images](https://mlsanity.com/paper/1811.00236/) (2018)
- [Learnable Image Encryption](https://mlsanity.com/paper/1804.00490/) (2018)
- [Block-wise Image Transformation with Secret Key for Adversarially Robust Defense](https://mlsanity.com/paper/2010.00801/) (2020)
- [An Overview of Compressible and Learnable Image Transformation with Secret Key and Its Applications](https://mlsanity.com/paper/2201.11006/) (2022)
- [Block-wise Scrambled Image Recognition Using Adaptation Network](https://mlsanity.com/paper/2001.07761/) (2020)
- [Attacks on Image Encryption Schemes for Privacy-Preserving Deep Neural Networks](https://mlsanity.com/paper/2004.13263/) (2020)
- [NeuraCrypt: Hiding Private Health Data via Random Neural Networks for Public Training](https://mlsanity.com/paper/2106.02484/) (2021)
- [NeuraCrypt is not private](https://mlsanity.com/paper/2108.07256/) (2021)

## Built on by (most cited first, 17 of 17)

- [Image and Model Transformation with Secret Key for Vision Transformer](https://mlsanity.com/paper/2207.05366/) (2022)
- [Privacy-Preserving Image Classification Using Vision Transformer](https://mlsanity.com/paper/2205.12041/) (2022)
- [Generative Model-Based Attack on Learnable Image Encryption for Privacy-Preserving Deep Learning](https://mlsanity.com/paper/2303.05036/) (2023)
- [Enhanced Security against Adversarial Examples Using a Random Ensemble of Encrypted Vision Transformer Models](https://mlsanity.com/paper/2307.13985/) (2023)
- [Efficient Fine-Tuning with Domain Adaptation for Privacy-Preserving Vision Transformer](https://mlsanity.com/paper/2401.05126/) (2024)
- [A Random Ensemble of Encrypted Vision Transformers for Adversarially Robust Defense](https://mlsanity.com/paper/2402.07183/) (2024)
- [Color-NeuraCrypt: Privacy-Preserving Color-Image Classification Using Extended Random Neural Networks](https://mlsanity.com/paper/2301.04875/) (2023)
- [StyleGAN Encoder-Based Attack for Block Scrambled Face Images](https://mlsanity.com/paper/2209.07953/) (2022)
- [Domain Adaptation for Efficiently Fine-tuning Vision Transformer with Encrypted Images](https://mlsanity.com/paper/2309.02556/) (2023)
- [A Privacy-Preserving Semantic-Segmentation Method Using Domain-Adaptation Technique](https://mlsanity.com/paper/2507.12730/) (2025)
- [An Encryption Method of ConvMixer Models without Performance Degradation](https://mlsanity.com/paper/2207.11939/) (2022)
- [Privacy-Preserving Image Classification Using ConvMixer with Adaptive Permutation Matrix](https://mlsanity.com/paper/2208.02556/) (2022)
- [An Access Control Method with Secret Key for Semantic Segmentation Models](https://mlsanity.com/paper/2208.13135/) (2022)
- [A Privacy Preserving Method with a Random Orthogonal Matrix for ConvMixer Models](https://mlsanity.com/paper/2301.03843/) (2023)
- [Combined Use of Federated Learning and Image Encryption for Privacy-Preserving Image Classification with Vision Transformer](https://mlsanity.com/paper/2301.09255/) (2023)
- [Privacy-Preserving Vision Transformer Using Images Encrypted with Restricted Random Permutation Matrices](https://mlsanity.com/paper/2408.08529/) (2024)
- [Privacy-Preserving Object Detection for Vision Transformer-Based Models](https://mlsanity.com/paper/2608.20712/) (2026)

## Abstract (arXiv)

In this paper, we propose a privacy-preserving image classification method that uses encrypted images and an isotropic network such as the vision transformer. The proposed method allows us not only to apply images without visual information to deep neural networks (DNNs) for both training and testing but also to maintain a high classification accuracy. In addition, compressible encrypted images, called encryption-then-compression (EtC) images, can be used for both training and testing without any adaptation network. Previously, to classify EtC images, an adaptation network was required before a classification network, so methods with an adaptation network have been only tested on small images. To the best of our knowledge, previous privacy-preserving image classification methods have never considered image compressibility and patch embedding-based isotropic networks. In an experiment, the proposed privacy-preserving image classification was demonstrated to outperform state-of-the-art methods even when EtC images were used in terms of classification accuracy and robustness against various attacks under the use of two isotropic networks: vision transformer and ConvMixer.