## 2 Related Work
### Security Analysis of the TCSIS Scheme  
The scheme on GF (\(2^{8}\)) in [37] uses binary polynomials to construct a \((k\to h,n)\) TCSIS that can provide multiple thresholds. The participants update the initial shares autonomously according to the changing thresholds without the involvement of the secret owner, which effectively improves security. The TCSIS scheme is described as follows:  
1. Secret share generation  
First, the image owner divides the image into \(l\) blocks equally, and each block contains \(k\times h\) pixels. Then, the owner selects a block to construct a binary polynomial. Assuming its pixel value is \(p_{i,j}\), \(i=0\), \(1\), \(\ldots\), \(k-1\), \(j=0\), \(1\), \(\ldots\), \(h-1\), the polynomial can be expressed as follows:  
\[F(x,y)=\left(1,x^{1},\ldots,x^{k-1}\right) \begin{pmatrix}p_{0,0}&\cdots&p_{0,h- 1}\\ \vdots&\ddots&\vdots\\ p_{k-1,0}&\cdots&p_{k-1,h-1}\end{pmatrix} \left(1,y^{1},\ldots,y^{h-1}\right)^ {\mathrm{T}} \tag{2}\]  
The owner computes \(f_{t}(y)=F(t,y)\) and \(g_{t}(x)=F(t,i)\); then, \((f_{t}(y),g_{t}(x))\) can be an initial share distributed to the participants \(P_{t}\), \(t=0\), \(1\), \(\ldots\), \(n\). 2. Secret image reconstruction  
The secret owner selects the threshold \(T\) from \(\{k,k+1,\ldots,h\}\) according to the current security environment, and the participants update the shares according to different thresholds using the corresponding methods:  
1. When \(T=k\), \(P_{t}\) updates the secret share to \(S_{t}^{k}=f_{t}(y)\);
2. When \(T=h\), \(P_{t}\) updates the secret share to \(S_{t}^{h}=g_{t}(x)\);
3. When \(k<T<h\), \(P_{t}\) first choose \(h\)-\(T\) integers randomly different from \(1\), \(2\), \(\ldots\), \(n\) and then update the secret share to \(S_{t}^{T}=\left\{S_{t}^{h}\), \(f_{t}(e_{1}),f_{t}(e_{2}),\ldots,f_{t}(e_{h-T})\right\}\). The scheme is susceptible to exhaustive attacks using all pixel values as all polynomial coefficients. Assuming that there are \(T-1\) different \(P_{t^{\prime}}\) (\(t^{\prime}=0\), \(1\), \(\ldots\), \(k-1\)) attempts to recover the secret image, the \(T-1\) attacker can provide \(T-1\) different shares: \(S_{1}^{k}\), \(S_{2}^{k}\), \(\ldots\), \(S_{k-1}^{k}\). From Equation (2), \(F(x,y)\) can be expressed as follows:  
\[F(x,y)=u_{0}(x)+u_{1}(x)y+\ldots+u_{h-1}(x)y^{h-1}. \tag{3}\]  
where \(u_{0}(x),\ u_{1}(x),\ \ldots\), \(u_{h-1}(x)\) are monic polynomials of order \(k-1\). In addition, \(S_{t}^{k}\) can be expressed as:  
\[s_{t}^{k}=F(t,y)=c_{t,0}+c_{t,1}y+\ldots+c_{t,h-1}y^{h-1}. \tag{4}\]  
Therefore, \(c_{1,0},c_{2,0},\ldots,c_{n,0}\) can be regarded as the interpolation of \(u_{0}(x)\), and \(c_{t,0}=u_{0}(t)\)[37]. Then, the \(k-1\) attacker can provide \(k-1\) different \(c_{t,0}\) to obtain \(k-1\) different equations:  
\[p_{0,0}+t^{\prime}\times p_{1,0}+\ldots+t^{k-1}\times p_{k-1,0}=c_{t^{\prime },0},\ t^{\prime}=0,1,\ldots,k-1. \tag{5}\]  
Although Equation (5) contains \(k\) unknowns and the attacker can only provide \(k-1\) equations, since \(0\leq p_{t^{\prime},0}\leq 255\), an exhaustive attack on one of the unknowns \(255\) times can yield \(255\) different solutions. Since there is a strong correlation between the image pixels, the attacker can determine the correct solution from the \(255\) different solutions. Similarly, attacking each column of the coefficient matrix up to \(255\) times yields the correct solution, so up to \(255\) exhaustive attacks can recover the secret image block. We have experimentally proven this security problem, and the results are shown in Figure 1. The test images are gray images selected from BOWS2 ([[https://dde.binghamton.edu/download/](https://dde.binghamton.edu/download/)]([https://dde.binghamton.edu/download/](https://dde.binghamton.edu/download/)) (Accessed on 20 June 2017)) named Peppers, Woman, Baboon, Airplane, and Camera. Figure 1a-e are the original images, and Figure 1f-j are the reconstructed images when \(k-1\) attackers are involved.