# _Applied Sciences_
## 3 Experiments and Results
### AI-Based Reconstruction Attack  
To evaluate the security of obfuscated frames against AI-based reconstruction attacks, we formulate six experiments:  
* \(A_{1}\)--\(E_{1}\) attack configuration when images are obfuscated using only the VAE encoder;
* \(A_{2}\)--\(E_{1}\) attack configuration when images are obfuscated using only the non-bijective mapping;
* \(A_{3}\)--\(E_{1}\) attack configuration when images are obfuscated using both encoding and non-bijective mapping;
* \(A_{4}\)--\(E_{2}\) attack configuration when images are obfuscated using only the VAE encoder;
* \(A_{5}\)--\(E_{2}\) attack configuration when images are obfuscated using only the non-bijective mapping;
* \(A_{6}\)--\(E_{2}\) attack configuration when images are obfuscated using both encoding and non-bijective mapping. Figures 13 and 14 display an example of a reconstructed angiography for each attack configuration. More angiographic samples and their recovered counterparts are presented in Appendix A, Figures 15 and 16. A visual comparison provides the first intuition on the reconstruction capabilities of the AI model in different scenarios. As expected, the performance of the reconstruction model is improved when the training dataset is similar to the targeted dataset, but, even so, all it can restore is the background of the angiographic frames. Because it is typically not possible to identify a patient based on the background of an angiography, this information is not considered sensitive. Even if the background can be recreated through AI-based methods, the obfuscation techniques are deemed secure against AI-based attacks as long as the object of interest (in this case, the coronary vessels) remains unrecognizable after the reconstruction. For a quantitative analysis, the similarity metrics discussed in Section 2.5 are computed. Higher scores for both SSIM and PSNR indicate better reconstructions. The average values for each attack configuration are presented in Table 5.  
These results support the conclusions drawn from the visual inspection. The VAE-based technique enables a certain degree of reconstruction but applying the non-bijective intensity mapping eliminates this shortcoming. Although for the \(E_{1}\) attack configuration, the best privacy is achieved in experiment \(A_{2}\) (only non-bijective intensity mapping), this result is not confirmed when a similar dataset is used for training the reconstruction model. For the \(E_{2}\) setup, the results from \(A_{4}\), \(A_{5}\) and \(A_{6}\) experiments show that, when the methods are used in conjunction, the quality of recreated frames is significantly affected: the vessels are no longer visible, and the background is diffuse. Experiments \(A_{3}\) and \(A_{6}\) were repeatedly run for different values of \(N\). Figures 15 and 16 show how SSIM and PSNR vary as a function of parameter \(N\) for the attack configurations \(E_{1}\) and \(E_{2}\). As expected, the reconstruction is impossible for \(N=1\) (all information is removed) and is slightly better in \(E_{2}\) than in \(E_{1}\). However, there is no monotonous tendency in any configuration. Conversely, in the case of PSNR, although the metrics for \(N=1\) are higher due to the background similarity, there is an oscillating downward trend suggesting that a smaller \(N\) implies an increased security level. The results of the manual evaluation for all three obfuscation approaches are depicted in Figure 17. The mean scores regarding vessels and background reconstruction quality are displayed for each evaluator, alongside the average value. While similar scores were attributed to both vessels and background reconstructions when only encoding was used, for the other two obfuscation approaches, the recovered background presents a higher quality compared to the reconstructed vessels. However, overall, we observe a decreasing trend when comparing the three employed techniques.