## 2 Problem Formulation and System Model
### System Model
#### 2.2.2 Privacy-Preserving Strategy  
To protect the privacy of the image content and camera model identity, we use a privacy-preserving strategy, consisting of two steps: pixel positional scrambling encryption, and noise linear mapping encryption. Furthermore, the encryption security of this privacy-preserving strategy has been verified in previous studies [12], proving that this method can adequately protect image content and camera fingerprint information from malicious attackers.  
* Pixel position scrambling encryption: Pixel position scrambling encryption is employed to safeguard the authentic content of images by concealing their original structure. As illustrated in Figure 5, when comparing the image before and after encryption, it is evident that pixel position scrambling effectively preserves the privacy of the image content. This encryption technique obfuscates the image content by rearranging the original pixel sequence into a random, disordered configuration.  
Figure 4: Model parameters \((c,d)\) and \((c,d)\) extracted from real JPEG images captured by three different devices of a specific camera model: (**a**) Camera fingerprints \((c,d)\) estimated from images before encryption. (**b**) Camera fingerprints \((\dot{c},d)\) estimated from images after encryption.  
Figure 3: Model parameters \((a,b)\) and \((c,d)\) extracted from real JPEG images captured by three different camera models: (**a**) Camera fingerprints \((a,b)\) estimated from images based on existing statistical noise model. (**b**) Camera fingerprints \((c,d)\) estimated from images based on our proposed hybrid fingerprint model.  
Importantly, as illustrated in Figure 6, the camera fingerprint remains consistent before and after encryption, confirming that the scrambling process does not alter the original value of the camera fingerprint. Therefore, the scrambling encryption technique serves to effectively protect image content, without compromising the performance of source camera identification.  
* Noise linear mapping encryption: Although pixel position scrambling encryption effectively safeguards the image content, it does not alter the values of camera fingerprints. As a result, while the scrambling encryption offers content protection, it does not safeguard information about the image's origin. To address the above limitations, we apply a noise linear mapping encryption method to encrypt the camera fingerprints, thus enhancing the image source protection. Since the camera fingerprint is extracted from the image noise based on our hybrid fingerprint model \(\sigma_{\text{m}_{\text{f}}}^{2}\),  
Figure 5: Example of the effect of the pixel position scrambling encryption method in the privacy-preserving strategy for image content: (**a**) Original image [24]. (**b**) Encrypted image.  
Figure 6: The original camera fingerprints \((c,d)\) and the encrypted camera fingerprints \((\ell,d)\) estimated from real JPEG images captured by a specific camera model before and after pixel position scrambling encryption.  
encrypting the camera fingerprint \((c,d)\) is equivalent to encrypting the image noise. Therefore, we multiply the image noise by a linear coefficient to protect the image source. The above operation modifies the camera fingerprint values \((c,d)\), effectively concealing the authentic camera fingerprint, and thus avoiding the risk of leaking the authentic image source. As demonstrated in Figure 4, both the original and encrypted camera fingerprint exhibit distinguishable characteristics between different devices of the same camera model. Consequently, the noise linear mapping encryption does not degrade the performance of source camera identification, ensuring that protection of the image source is achieved without compromising identification accuracy.