# _Applied Sciences_
## 4 Discussion and Conclusions  
### Advantageous Properties and Limitations  
A first key feature of the proposed obfuscation algorithm is its irreversibility. It is impossible to undo the encoding stage, since performing the decoding without having access to the trained decoder is impossible. Furthermore, reversing the non-bijective mapping is also impossible since it establishes many-to-one relationships, resulting in a large number of alternative substitutes. When the data is sensitive but the partners  
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline  & \multicolumn{2}{c}{**Encoding**} & \multicolumn{2}{c}{**Non-Bijective Mapping**} & \multicolumn{2}{c}{**Combined Techniques**} \\ \cline{2-7}  & **Vessels** & **Background** & **Vessels** & **Background** & **Vessels** & **Background** \\ \hline Mean score & \(3.50\pm 0.91\) & \(4.37\pm 0.70\) & \(1.40\pm 0.51\) & \(2.97\pm 0.79\) & \(1.03\pm 0.17\) & \(1.75\pm 0.61\) \\ \hline \hline \end{tabular}
\end{table}
Table 6: Mean scores regarding the quality of the reconstructed images.  
Figure 16: Influence of parameter \(N\) on PSNR in \(A_{3}\) (\(E_{1}\)) and \(A_{6}\) (\(E_{2}\)), respectively, configuration experiments.  
Figure 17: Mean scores of manual evaluation for vessels (**left**) and background (**right**) reconstructions.  
are untrustworthy, this property addresses the challenge of encryption key management generally involved in collaborative model training. Because there is no inverse function, this obfuscation algorithm can be used by multiple entities to create a common dataset and train a more robust DL model without exposing the original data to each other. Even if the receiver is considered trustworthy, the simple fact of externalizing the data exposes it to the risk of being accessed by an unauthorized party. Thus, an essential requirement that the approach must meet is the preservation of the image utility in the altered state. Once this is achieved, the collaborative work can be carried out based on a zero-trust architecture where the original data can be accessed only by authorized personnel inside the hospital environment.  
Another benefit of this strategy is that the VAE does not have to be trained on the same or similar dataset as the one being obfuscated. Even if the encoder is not trained on the target dataset, the underlying information is preserved, and the privacy level is unaffected. As a result, there is no need to disclose sensitive data when training the encoder because any publicly available dataset can be used. Furthermore, it does not need to be trained in the clinical environment; it may be provided as a black-box tool. Furthermore, an outside party can not exploit the decoder to reverse the encoding if it is combined with non-bijective intensity shuffling.  
The main drawback of the method is the drop in accuracy for the model that uses obfuscated images to perform a specific task. Such solutions, particularly in the medical domain, should provide performance comparable to that of an expert, to be adopted in the clinical decision-making process. Thus, a path for further development of the method would consist of integrating different strategies for enhancing the performance and robustness of models trained on secured images. An interesting research idea in this direction is to assess how training a DL-based model on a mixed dataset (containing both obfuscated and non-obfuscated synthetic images) would improve the performance. The usage of denoising modules directly in the classification network to increase accuracy without compromising privacy should also be investigated.  
Another shortcoming is the lack of a precise security level quantification that would allow a clinical user to choose a particular algorithm configuration for a specific use case. To achieve a rigorous separation of the privacy and accuracy levels according to the obfuscation technique specifications, we intend to conduct within future work additional experiments which solve other medical tasks and employ different datasets and DL solutions.