# _Applied Sciences_
## 2 Methods and Materials
### Secure Obfuscation Algorithm  
As previously explained, the security of VAE obfuscation also depends on the image itself. For images with a uniform distribution of pixel intensities, the method will not only protect the content from the human eye perception but, due to the additional noise, also make it more difficult for an AI-based model to reconstruct the original image. In contrast, the human eye would be able to discern the environment from the main structures, or even details of the structures, in a dichromatic image where two predominant intensities describe the object and the background. The noise level can vary, but this would also affect the utility of the image. Using a non-bijective function to substitute the intensities makes the obfuscated images unrecognizable by the human eye. Although the modulo operation is meant to protect against more sophisticated attacks, the success rate of an AI-based reconstruction attack depends on the value of \(N\). The smaller this parameter is, the more difficult the reconstruction becomes. However, this implies a trade-off between privacy and utility. We integrate the strengths of each method into a new obfuscation algorithm to maximize their effectiveness. The steps are as follows, in the order in which they should be performed :  
1. The VAE model is trained on images similar to those that will be obfuscated in the clinical use case.
2. All pixel intensities are randomly shuffled, and a \(modulo\)\(N\) operation is performed on each resulting value leading to a non-bijective mapping between different intensities.
3. The original image is encoded using the VAE encoder.
4. Each pixel value of the encoded image is substituted with the corresponding value in the non-bijective map.  
As a result, an obfuscated image is created, which retains the original image's underlying relevant information and can be used for further analysis and processing (e.g., image classification). Regardless of the initial structure of an image, combining the techniques improves privacy. First, the eye perception is affected by the intensity shuffling even if, after encoding, the sensitive content is still distinguishable. Then, the protection against AI-based reconstruction attacks is ensured by the conjunction of noise and non-bijectivity. The entire obfuscation workflow is schematically depicted in Figure 5.  
Although the underlying information of an image is preserved using this technique, an essential requirement that must be met to use multiple images in the same application (e.g., training a classifier on obfuscated images) is that the same encoder and the same shuffling map should be applied on all images (both for training and inference). The  
Figure 4: Comparison between the original frame (**a**) and the obfuscated counterparts when \(N=256\) (**b**), \(N=156\) (**c**), \(N=50\) (**d**) and \(N=45\) (**e**).  
trade-off between privacy and utility can be managed by tuning certain method-specific parameters according to the needs of the use case. For the technique based on non-bijective intensity mapping, the choice of parameter \(N\) may influence the image utility. Regarding confidentiality, a higher \(N\) implies less information retained in the obfuscated image and, thus, a more difficult to perform image reconstruction. Figure 6 displays an original angiographic frame and the obfuscated counterparts for each obfuscation approach. The chosen value for the modulo operator \(N\) in Figure 6c is 96. More examples are included in Appendix A, Figure A1.