###### Abstract
In [32; 33], specific image encryption schemes were designed to transfer the redundancy of the original image into the encrypted image. In [32], a reversible image transformation scheme was used to encrypt images. After the images were encrypted, they were transformed other plaintext images as encrypted images, and traditional RDH methods can be used directly on the encrypted images. In [33], a reversible image reconstruction scheme was used to encrypt images. The original image was reconstructed into a meaningless redundancy image on which the traditional RDH methods were available. In VRAE methods, the encrypted image has no spatial correlation or redundancy. The reversibility relies on the spatial correlation of the decrypted image. In [34], the image was divided into non-overlapping blocks. To embed one bit into one block, the three LSBs of half of the pixels in the block were flipped. At the receiver's side, first, the image was decrypted and then a smoothness estimator was used for each block to identify the flipped pixels so that the image could be recovered and the embedded bits could be extracted. This method was improved in [35; 36; 37; 38]. In [35], an improved smoothness estimator and a side match scheme were used to reduce errors in the extraction of data and the recovery of images. In [36], a more precise estimator and a smoothness difference ordering scheme were used. In [37], the data embedding scheme was improved to reduce distortion, and a content-based predictor was used to estimate the smoothness. In [38], the data embedding scheme was improved, and an estimation scheme that used multiple judgements was used to reduce the error rate. In [39], an LSB-swap scheme was used for embedding data to improve capacity. In [40], a public key modulation mechanism was used for embedding data, and a support vector machine (SVM) classifier was used for the extraction of data and to recover the image. In [41], pixels were divided into same-size groups for embedding data, and a designed predictor was used to recover the images. The method was extended in [42; 43] for higher capacity. In [44], the LSBs of the image were compressed by using a compression matrix for embedding room, and an LSB predictor was used for the recovery of the compressed bits. The methods in [45; 46] improved the method in [44]. In [45], the LSB planes of the pixels were divided into three subsets and compressed by three different compression matrices, and three different predictors were used in three rounds to recover the images. In [46], the images were divided into smooth blocks and complex blocks, and only the LSBs of the smooth blocks were compressed. In [47; 48], LDPC encoding was used to directly compress the encrypted bits, and the uncompressed bits were used to recover the images. Because these three types of the RDHEI methods embed secret data and achieve reversibility in completely different ways, the RRBE, CRBE, and VRAE methods cannot be replaced with each other. In RRBE methods, so far, the existing methods use the redundancy and spatial correlation of the original image to vacate room for embedding data. Some methods vacate room by lossless compression [14; 15; 16; 17; 18]. In these methods, the key point is how to efficiently encode the redundancy information by fewer bits. Aiming to design a more efficient encoding scheme to vacate larger capacity, in this paper, a novel RRBE RDHEI method was proposed based on linear regression and Huffman coding. Due to the lightweight and fast training of linear regression models, the cost of training a specific linear regression model for an original image is acceptable. The linear regression model can be used as a pixel predictor. Based on the predictor, most of the prediction errors of the pixels are concentrated in a small range centered on 0. These prediction errors can be encoded efficiently by using Huffman coding.