# _Applied Sciences_
## 2 Methods and Materials
### Obfuscation Method Based on a Variational Autoencoder  
The Variational Autoencoder [22] considered herein is a generative model based on the work of [PERSON] et al. [23]. It consists of two models that support each other: an encoder (recognition model) and a decoder (generative model). The difference between VAEs and other AEs is that the input is not encoded as a single point, but as a distribution over the latent space, from which the decoder draws random samples. Due to the reparameterization trick, which allows for backpropagation through the layers, the two components of the VAE can be chosen to be (deep) neural networks. The autoencoders, and by extension VAEs, generate an encoding of the inputs that allow for an accurate reconstruction. This property also ensures that the encoding contains useful information extracted from the input, and, hence, it can be employed in further DL-based analysis or model training, e.g., within an obfuscation method based on VAE. From a probabilistic perspective, a VAE implies approximate inference in a latent Gaussian model, where the model likelihood and the approximate posterior are parameterized by neural networks. The recognition model compresses the input data \(x\) into a dimensionally reduced latent space \(\chi\), while the generative model reconstructs the data given the hidden representation \(z\in\chi\). Let us denote the encoder \(q_{\theta}(z|x)\) and the decoder \(p_{\phi}(x|z)\), where \(\theta\) and \(\phi\) represent the neural network parameters. The latent variables \(z\in\chi\) are considered to be drawn from a simple distribution: \(p(z)=\mathcal{N}(0,I)\), named prior (here, \(I\) denotes the identity matrix). The input data \(x\) have a likelihood \(p(x|z)\) that is conditioned on \(z\). As a result, a joint probability distribution over data and latent variables can be defined:  
\[p(x,z)=p(x|z)p(z). \tag{1}\]  
The aim is to calculate the posterior distribution \(p(z|x)\). This can be achieved by applying [PERSON] rule:  
\[p(z|x)=\frac{p(x|z)p(z)}{p(x)}, \tag{2}\]  
where \(p(x)\) can be obtained by marginalizing out \(z\): \(p(x)=\int p(x|z)p(z)dz\). Unfortunately, the integral is usually intractable [24]. As a consequence, an approximation of this posterior distribution is required. There are two main ways for posterior approximation: applying Markov Chain Monte Carlo (MCMC) methods such as the Metropolis-Hastings algorithm [25] or Gibbs sampling [26], and variational inference (VI) [27]. VAE uses the latter because the sampling methods converge slower [28]. This approach implies approximating the posterior with a family of Gaussian distributions \(q_{\lambda}(z|x)\), where parameters \(\lambda\) represent the mean and the variance of each hidden representation. As a result, the encoder parameterizes the approximate posterior \(q_{\theta}(z|x,\lambda)\), taking \(x\) as input data, and parameters \(\lambda\) as outputs. On the other hand, the decoder parameterizes the likelihood \(p(x|z)\), having the latent variables as input and the parameters to distribution \(p_{\phi}(x|z)\) as output. The approximation is penalized by computing the Kullback-Leibler (KL) divergence that measures the distance between \(q_{\theta}(z|x,\lambda)\) and \(p(z)\). Hereupon, the loss function which is minimized during training is composed of two terms: (i) the reconstruction error between input data \(x\) and output data \(x^{\prime}\), and (ii) the KL divergence between the approximate posterior and \(p(z)\), chosen to be a normal distribution:  
\[Loss=\mathcal{L}\big{(}x,x^{\prime}\big{)}+KL(q_{\theta}(z|x,\lambda)||p(z)). \tag{3}\]  
The first step of our method is to train a convolutional VAE on another dataset from the same domain as the working dataset. Additionally, one of the layers is used for noise addition. At the bottleneck, the information is divided between two channels to obtain an encoded version of the input. Those channels correspond to the mean (channel 1) and standard deviation (channel 2) of the normal distribution obtained from the encoder.