# _Applied Sciences_
## 2 Methods and Materials
### Obfuscation Based on Non-Bijective Pixel Intensity Shuffling  
This approach starts with a simple obfuscation technique--random pixel intensity shuffling. Every pixel intensity is randomly associated with another value from the same interval as described by Equation (4), where \(range(a,b)\) is a function that returns all integer numbers between \(a\) and \(b\), including the interval's endpoints, and \(shuffle(x)\) is a function that randomly interchanges the positions of the elements of a list \(x\) inside the returned array. We call this array a map because it creates connections between each possible pixel  
Figure 1: Schematic representation of the obfuscation technique based on a VAE.  
Figure 2: Comparison between the original frame (**a**) and the obfuscated counterparts when channel 1 (**b**) and channel 2 (**c**) are chosen.  
intensity embodied in the list of indexes of the array and a new random value contained in the array at the corresponding position.  
\[intensityMap=shuffle(range(0,255)) \tag{4}\]  
This association is a bijective function because for each domain component there is only one corresponding element in the codomain. Although this operation preserves the underlying information of the images, while making them unrecognizable for the human eye, the approach is still susceptible to AI-based attacks, statistical or even reverse engineering attacks. Presuming that an external party has access to the obfuscation algorithm in a black-box form, an unlimited number of new images can be obfuscated, and a statistical evaluation should reveal that a one-to-one mapping was used. By reversing this mapping, a potential attacker can obtain the original images with no information loss. Training a deep learning model to reconstruct the obfuscated images is another attack approach. In anticipation of this kind of attack, a second step is proposed for this obfuscation method. The bijective function is modified so that the injectivity property is lost. In other words, multiple elements of the domain will correspond to the same element of the codomain. This effect is achieved by applying the same _mod_\(N\) operation on each value of the previously obtained map. Hence, the obfuscation method can be defined by a function \(f:A\to B\), where \(A=[0,255]\) and \(B=[0,N)\). When obfuscating an image, an iteration across all pixels must be performed. In Equation (5), \(pv\) denotes the intensity of the pixel found at the \((i,j)\) coordinates in the _image_ matrix.  
\[pv=image_{i,j} \tag{5}\]  
This value is modified according to Equation (6), where the _mod_ function represents the typical modulo operation and the \(pv\) value is used as an index.  
\[image_{i,j}=intensityMap_{pv}\;mod\;N \tag{6}\]  
Figure 3 synthesizes the steps proposed for this obfuscation technique. The key concept is that applying a _mod_\(N\) operation limits the range of possible values to \(N\) elements. However, this is not equivalent to filtering the highest intensities due to the previously performed random associations. Thus, more details are preserved in images by arbitrary but consistent replacement of \(256-N\) pixel intensities. Since the obfuscation function is represented by a many-to-one mapping, the task of reconstructing unseen images becomes more complex and more uncertain, even for an AI-based model trained on original-obfuscated image pairs.  
Figure 3: Schematic representation of the obfuscation technique based on pixel intensity shuffling.  
The \(N\) value is an adjustable parameter that improves security when being set to lower values. As a function of this parameter, the underlying information is preserved in different degrees, presumably retaining enough details in the images for DL-based applications. Figure 4 displays a comparison between an angiographic frame Figure 4a and the obfuscated counterparts when bijective Figure 4b or non-bijectiveFigure 4c-e mapping is applied. The obfuscated samples are rescaled in \([0,255]\) interval to allow a better visual comparison.