# _Applied Sciences_
## 2 Methods and Materials
### Privacy Level Evaluation
Before training, both the inputs (obfuscated images) and the targets (original images) are normalized through min-max scaling in the [0, 1] interval. The U-Net architecture introduced in [32] is employed for reconstruction. The first half of the network, which behaves like an encoder, consists of convolutional and pooling layers that perform downsampling. Each decoder block combines its input with information from the corresponding encoder block, and performs convolutional and upsampling operations. The same activation function, number of filters, kernel size, pooling window and stride as in the original paper were used. The batch size and momentum values were set to 1 and 0.99, respectively. The model was trained for 30 epochs with a learning rate of 0.001. The architecture was implemented in the PyTorch framework [33], and the models were trained on a machine equipped with 128 GB RAM and NVIDIA GeForce GTX 1080 Ti GPU with 11 GB of dedicated memory. The reconstruction network was trained on images obfuscated using the methods described in Sections 2.1 and 2.2, and the algorithm presented in Section 2.3 for multiple values of the parameter \(N\). To determine the degree of similarity between the reconstructed images and the original counterparts, SSIM and PSNR are computed across all frames sent by the victim (the training dataset of the classifier). Considering the threshold values of SSIM, in the results presented in Section 3.3, a lower SSIM value denotes a poor reconstruction performance and a high privacy level. Regarding the interpretation of PSNR, in the following experiments, values under 30 indicate inaccurate reconstruction and high security. The scikit-image library [34] was employed for computing the similarity metrics. Expert readers manually performed a visual assessment to determine to what extent the reconstructed images are protected against human perception. The assessment was performed on 50 frames (25 LCA, 25 RCA). Since in most cases the background was reconstructed more accurately than the arteries, two separate scores were assigned for each image. A scale from 1 to 5 was chosen, where 1 indicates that the object was not reconstructed at all and 5 denotes a visual similarity larger than 95%. Some scoring guidelines were formulated to limit the evaluation bias. Tables 1 and 2 synthesize the links between scores and image descriptions. Figures 10 and 11 display for each score an evaluation example corresponding to the scoring guidelines. The mean scores are computed for all evaluations of all frames. The LCA and RCA frames were also considered separately to determine if reconstruction performs better on a specific class. \begin{table}
\begin{tabular}{c p{227.6 pt}} \hline \hline
**Score** & **Vessel Tree Description** \\ \hline
1 & No vessel is visible in the image. \\
2 & There are some fine lines in the background, but it is hard to distinguish whether they are blood vessels or to identify the angiographic view. \\
3 & The main vessel is visible, but there are many missing details, and additional artifacts are present. \\
4 & All branches are visible but not with the same clarity as in the original image. Enough details are present to be able to distinguish the angiographic view. \\
5 & The reconstruction is more than 95\% similar to the original image. Some portions might be unclear, or some additional artifacts might be present, but the main arteries are well visible. \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Scoring guidelines concerning the vessels’ accurateness.