Pauline Puteaux

Zichi Wang

Xinpeng Zhang

William Puech

Hierarchical High Capacity Data Hiding in JPEG Crypto-compressed Images

Keywords: Signal processing in the encrypted domain, data hiding, crypto-compression, JPEG compression

With the fast development of cloud computing, exchanging JPEG compressed images in a secure way has significantly increased. Data hiding in encrypted images (DHEI) is an effective way to embed additional data directly into the encrypted domain. In recent state-of-the-art methods, almost all DHEI processes focused on uncompressed images. Recently, some schemes using data hiding (DH) in JPEG crypto-compressed images have been designed, but most of them are not fully JPEG format compliant. In this paper, we propose a hierarchical high capacity data hiding (HHCDH) approach for JPEG cryptocompressed images. After encrypting every non-null coefficients, they are processed from low to high frequencies. Sign bits that are specific to them are then substituted by bits of a secret message. During the decoding phase, correlations between neighboring blocks are exploited to hierarchically recover the original sign bit values. According to our experiments, we achieve to obtain a high payload value, while preserving a very good quality of the reconstructed JPEG image.

I. INTRODUCTION

During transfer or storage, bandwidth is limited and JPEG compressed images are often used [START_REF] Wallace | The JPEG still picture compression standard[END_REF]. Therefore, JPEG compressed image exchanges have significantly increased in the last years and their security can be exposed to privacy leaks.

For authentication, data enrichment or retrieval purposes in the confidential domain, methods of data hiding in encrypted images (DHEI) are effective. In these kinds of schemes, the owner of the image and the data hider are not necessary the same party, such as in a cloud scenario. In fact, encryption is completed by the content owner to protect image privacy and then, the encrypted image is sent over a network or uploaded on to a cloud server. Therefore, the server -considered as a data hider -has no access to the original image content and has to perform the secret message embedding directly on the encrypted data.

Even if most methods were designed for uncompressed images [START_REF] Cao | High capacity reversible data hiding in encrypted images by patch-level sparse representation[END_REF]- [START_REF] Puteaux | An efficient MSB prediction-based method for high-capacity reversible data hiding in encrypted images[END_REF], some DHEI schemes focused on JPEG bitstreams specifically [START_REF] Qian | Reversible data hiding in encrypted JPEG bitstream[END_REF]- [START_REF] Qian | New framework of reversible data hiding in encrypted JPEG bitstreams[END_REF]. First, Qian et al. proposed to encode bits of a secret message with Error Correction Codes (ECC) [START_REF] Qian | Reversible data hiding in encrypted JPEG bitstream[END_REF]. In [START_REF] Qian | Separable reversible data hiding in encrypted JPEG bitstreams[END_REF], the same authors suggested to form a new JPEG bitstream with some blocks from the original image. Unused blocks are also hidden in the JPEG header, using the same method as in JPEG XT [START_REF] Richter | JPEG XT: A new family of JPEG backward-compatible standards[END_REF]. Chang et al. proposed to reserve space for secret message embedding before bitstream encryption [START_REF] Chang | A separable reversible data hiding scheme for encrypted JPEG bitstreams[END_REF]. Recently, Qian et al. improved their previous scheme [START_REF] Qian | Separable reversible data hiding in encrypted JPEG bitstreams[END_REF] using a combination of code mapping and ordered embedding [START_REF] Qian | New framework of reversible data hiding in encrypted JPEG bitstreams[END_REF]. None of these methods allows us to obtain a large payload, even using a high quality factor. Another issue lies in the fact that most of them are not fully JPEG format compliant.

In this paper, we propose a new framework of hierarchical high capacity data hiding (HHCDH) in JPEG cryptocompressed images. During the Huffman coding step, both AC and DC coefficients are encrypted. A secret message can be then embedded directly in the crypto-compressed domain. Adopting a chessboard configuration, diagonals from each Minimum Coded Unit (MCU) suitable for data embedding are processed, from low to high frequency coefficients. The sign bit of the largest coefficient of each diagonal is then substituted by a bit of the message. During the decoding phase, a hierarchical reconstruction is performed to predict the lost values. Finally, the reconstructed image quality is very good, even if a large amount of data has been embedded in the JPEG crypto-compressed image.

The rest of this paper is organized as follows. Section II describes our new framework for HHCDH in JPEG cryptocompressed images. Experimental results are presented in Section III. Finally, the conclusion is drawn in Section IV.

II. PROPOSED METHOD

In this section we develop our proposed method of high capacity data hiding in JPEG crypto-compressed images. The encoding phase consists of crypto-compression and hierarchical data hiding, as presented in Fig. 1. After encrypting an original image, a user uploads it to a cloud platform. A data hider, can then process the crypto-compressed image in order to embed bits of an encrypted secret message.

A. Crypto-compression

From an original uncompressed image I, the first steps of JPEG compression are performed until the JPEG Huffman coding step to form MCU with 8 × 8 encoded frequency coefficients. These MCU are made up by pairs of head and amplitude parameters encoding the coefficient values.

Each block of the luminance Y component is then encrypted to obtain crypto-compressed blocks {F e (u, v)} 0≤u,v<8 . An encryption key K e is then used as the seed of a pseudorandom number generator (PRNG) to generate a pseudorandom bit stream. According to their amplitude size (in bits), each coefficient is encrypted by XORing its amplitude bits with its associated part in the generated pseudo-random bit stream, as illustrated in Fig. 1.

B. Data embedding

In the JPEG crypto-compressed bit stream, we propose using a chessboard configuration in order to perform the data embedding phase in only one encrypted MCU by two. Indeed, half of the MCU of the JPEG crypto-compressed bit stream are not modified so that they can be used for prediction during the reconstruction phase.

To embed bits of an encrypted secret message (using a key K dh ), each MCU with 8 × 8 encoded frequency coefficients is processed in a hierarchical way, from low to high coefficients, depending on the diagonal number in the original block before reordering and coding. A parameter max diag, saved in the JFIF header, is fixed for each MCU, this indicates the number of the last marked diagonal. From the first to max diag, each diagonal is analyzed and processed independently from each other. By analyzing the run-length value, it is possible to know if there is at least one non-null AC coefficient in the current diagonal. If there is, the maximum coefficient absolute value in the diagonal is considered. The associated coefficient is used to hold one encrypted bit b(α) of the secret message {b(α)} 0≤α<max diag that can be embedded in the current MCU. Indeed, a marked encrypted coefficient F e-dh (u, v) is obtained using sign bit substitution, according to Eq. (1) (we can see that the sign of a coefficient is indicated by the most significant bit (MSB) of its Huffman code):

F e-dh (u, v) =    F e (u, v), if F e (u, v) < 0, b(α) = 0, F e (u, v), if F e (u, v) > 0, b(α) = 1, -F e (u, v), else.
(1) The original sign bit value of the largest coefficient into each diagonal of the MCU suitable for data embedding is then lost.

It must be predicted without error during the decoding phase. Therefore, if this value is modified due to bit substitution, sign bit values of all the other coefficients in the diagonal are also flipped in order to introduce noise and help the decoding step. Prediction performance during the decoding phase is then significantly increased. At the end, a marked JPEG cryptocompressed image I e-dh is obtained.

C. Data extraction and image recovery

During the decoding phase, because the proposed method is separable, there are two possible outcomes, depending of the owned key.

On one hand, from the marked encrypted JPEG bitstream, if a recipient only has K dh , they scan all marked encrypted MCU and collect the marked encrypted frequency coefficient values {F e-dh (u, v)} 0≤u,v<8 . According to max diag, they process each diagonal #1 to #max diag, i.e. from low to high frequency coefficients. If there exists at least one nonnull AC coefficient on this diagonal, they then focus on the frequency coefficient which has the largest absolute value and examine its sign. If the coefficient is negative, they extract 0 as the value of the expected embedded bit, else they extract 1. After processing each MCU, the encrypted secret message is then obtained and decrypted with the key K dh . However, note that in this case the image content in the clear domain cannot be reconstructed.

On the other hand, if a recipient only has K e , they also scan all marked encrypted MCU and they collect the marked encrypted frequency coefficient values {F e-dh (u, v)} 0≤u,v<8 . As an initialization step, the DC coefficient and all AC coefficients that are not on marked diagonals (i.e. whose the diagonal number is larger than max diag), are directly decrypted using the encryption key K e . Other frequency coefficients are initialized to zero. By this way, the recipient can then process each diagonal one by one, in order to hierarchically recover frequency coefficient values, from low to high frequencies. For each diagonal where there is at least one non-null frequency coefficient, two scenarios are considered: Correlation between neighboring blocks is thus exploited by computing a similarity score between each of these two configurations and neighboring blocks (in the clear domain in the chessboard configuration). As a similarity score, we chose to evaluate the differences between the current block edges and neighboring block edges. The block configuration that minimizes the difference is considered as the expected value in the clear domain. Indeed, the modification of only one coefficient bit sign in the frequency domain may significantly impact all pixel values in the current block, especially when the coefficient amplitude size is large. After recovering all coefficients of one diagonal, we hierarchically repeat the same steps on the next diagonal as soon as the diagonal number does not exceed max diag. At the end of this process, all the coefficients are reconstructed and can be decoded to obtain the original image content, with the same quality factor QF as used during crypto-compression.

III. EXPERIMENTAL RESULTS

In this section, we present experimental results obtained by applying our proposed method of hierarchical RDH in JPEG crypto-compressed images. Note that even if our experiments have been done on grey-level images. They can be easily extended to color images, by considering the luminance component only for data embedding.

In Fig. 2, we have applied our proposed method on the Girl image (71.2 kB) illustrated in Fig. 2.a. Fig. 2.b corresponds to the image obtained with a standard JPEG compression in the clear domain using a quality factor QF = 100%. Although the image size has decreased (50.8 kB), high quality has been preserved, as indicated by a PSNR of 51.23 dB and a SSIM of 0.9983. To perform the encryption step of our method, we propose to crypto-compress the JPEG image displayed in Fig. 2.a using a quality factor QF = 100%. Non-null AC and DC coefficients are all encrypted. Note that this encryption method is format-compliant and sizepreserving. Moreover, Fig. 2.c and Fig. 2.d are marked cryptocompressed JPEG images obtained by embedding information in the first diagonal and the first to seventh diagonals in the crypto-compressed image respectively. Using only the first diagonal, it is possible to embed 570 bits of the secret message, which means that half of the blocks of the image contain one bit of information. Using the 1 st to 7 th diagonals, a high payload value is achieved (3, 988 bits, i.e. 0.054 bpp). Even with this large amount of embedded information, the visual confidentiality of the original content is not altered. Moreover, the file size is preserved: the marked crypto-compressed JPEG images (Fig. 2.c and Fig. 2.d) have exactly the same size as the compressed JPEG image in the clear domain. Fig. 2.e and Fig. 2.f are the reconstructed images after correction using the differences between neighboring blocks edges as a similarity score. Then, we compare these reconstructed images with the original uncompressed Girl image (Fig. Moreover, if we observe using the naked eye the original and reconstructed images, we cannot notice a difference, due to the fact that, even in the case of bad reconstruction, a wrong sign bit coefficient has not necessary an impact on the reconstructed pixel values. This is especially true in homogeneous areas, where frequency coefficients have very small sizes, even the low ones. According to the coefficient size distributions, we can see that most of the large size coefficients are correctly reconstructed. Indeed, they are easier to reconstruct because they are significant in the IDCT computation.

We have applied our method on the Girl image illustrated in Fig. 2.a, with four different quality factors (QF = 100%, QF = 90%, QF = 80% and QF = 50%) and embedded variable amounts of bits of the secret message. Fig. 3 illustrates the quality of the reconstructed image with respect to the expected compressed JPEG image, in terms of PSNR. First of all, we can see that there is a real trade-off between the payload and the reconstructed image quality: the larger the embedding rate is, the lower the reconstructed image quality. This is explained by the fact that more bits of the JPEG bitstream are replaced by bits of the secret message and therefore, have to be predicted. Moreover, we can see that the quality factor QF also impacts the efficiency of the reconstruction. Indeed, with a small QF, it is more difficult to obtain a significant similarity score according to the neighboring values and therefore, to discriminate the correct configuration from the badly reconstructed one, in particular due to the natural block effect with JPEG compression.

In order to test the efficiency of our method for various image contents, we have applied our scheme to 1,000 randomly selected images using a size of 512 × 512 pixels from the BOSSbase dataset [START_REF] Pevný | BOSSBase dataset[END_REF]. Table I presents the average results in Fig. 3. PSNR (in dB) as a function of the payload (in bits) and QF with our method applied to the Girl image in Fig. 2.a. terms of payload (in bits), PSNR (in dB) and SSIM (between each image of the database and their relative compressed JPEG image), according to different quality factors when only the first diagonal and when the first to seventh diagonals are used for data embedding. First, we can see that the lower the QF is, the lower the payload is. Indeed, if the QF is small, frequency coefficients are strongly quantized during the quantization step of JPEG. Consequently, most of them become equal to zero and are not suitable for data embedding. Nonetheless, we can remark that the first diagonal, composed of the lower two frequency coefficients, is almost always marked, even with a small QF. In addition, it is important to stress that the compression rate with a low quality factor (QF= 50%) is equal to 0.35 bpp on average. Therefore, the image size (in kB) is much more smaller than using a high quality factor. Then, the ratio between the image size (in kB) and the payload is very attractive using QF= 50%. If we observe the reconstructed image quality, whatever the used quality factor, when only the first diagonal is used for data embedding, results are very good (PSNR ≈ 50 dB and SSIM ≈ 1). By reconstructing in a hierarchical way each diagonal from the first to the seventh, the probability of a perfect reconstruction decreases, because high frequency coefficients are less predictable. Nevertheless, results remain interesting and the reconstructed image content is close to the expected compressed JPEG image content (PSNR > 36 dB and SSIM > 0.9555). Note that it is not recommended to use the next diagonals after the seventh) for data embedding because high frequency coefficients are not easily predictable.

In Table II, we compare our proposed method with previous approaches of Qian et al. in [START_REF] Qian | Reversible data hiding in encrypted JPEG bitstream[END_REF], [START_REF] Qian | Separable reversible data hiding in encrypted JPEG bitstreams[END_REF] and [START_REF] Qian | New framework of reversible data hiding in encrypted JPEG bitstreams[END_REF] and of Chang et al. in [START_REF] Chang | A separable reversible data hiding scheme for encrypted JPEG bitstreams[END_REF], on five images with QF = 80%. Even while embedding information only in the first diagonal using a chessboard configuration, we note that we can achieve a larger payload than methods [START_REF] Qian | Reversible data hiding in encrypted JPEG bitstream[END_REF], [START_REF] Qian | Separable reversible data hiding in encrypted JPEG bitstreams[END_REF] and [START_REF] Chang | A separable reversible data hiding scheme for encrypted JPEG bitstreams[END_REF], but the payload remains smaller than using method [START_REF] Qian | New framework of reversible data hiding in encrypted JPEG bitstreams[END_REF]. Finally, if we use the first to the seventh diagonals to embed bits of the secret message, we can see that our proposed scheme can achieve a much larger payload than current state-of-the-art methods.

IV. CONCLUSION

In this paper, we proposed a new method of hierarchical high capacity data hiding in JPEG crypto-compressed images. In the crypto-compressed domain, we suggested embedding bits of a secret message on non-zero AC coefficients. Into each MCU suitable for data embedding, the sign bit of the largest coefficient of each diagonal is substituted by a bit of the hidden message. During the decoding phase, a hierarchical reconstruction is performed to predict the lost values, from low to high frequency coefficients. Indeed, significant coefficients, especially with a large amplitude size, can be correctly reconstructed with a high level of confidence. Experimental results show that our proposed method achieves a larger embedding rate when compared to other current state-of-the-art methods, while preserving the JPEG structure, the original image size and high visual quality. In future work, we are interested in computing similarity scores in the frequency domain to predict original sign bit values.

Fig. 1 .

 1 Fig. 1. Overview of the encoding phase of our HHCDH method in JPEG crypto-compressed images.

Fig. 2 .

 2 Fig. 2. Example of our proposed method: a) Original Girl image (304 × 240 pixels, 71.2 kB), b) JPEG image, QF = 100% (50.8 kB; with (a), PSNR = 51.23 dB, SSIM = 0.9983), c-d) Marked crypto-compressed JPEG images, embedding in the 1 st diagonal (payload of 570 bits), and in the 1 st to 7 th diagonals (payload of 3,988 bits) resp., e-f) Reconstructed JPEG images after correction from (c) (with (a), PSNR = 47.87 dB, SSIM = 0.9972; with (b), PSNR = 51.46 dB, SSIM = 0.9989) and from (d) (with (a), PSNR = 34.19 dB, SSIM = 0.9407; with (b), PSNR = 34.26 dB, SSIM = 0.9417) resp., g)-h) Coefficient size distributions according to (e) (1 st diagonal only) and to (f) (7 th diagonal only) resp.

  2.a) and with the reference image obtained after a standard JPEG compression in the clear domain using a quality factor QF = 100% (Fig. 2.b). Fig. 2.g and Fig. 2.h are the coefficient size distributions of the first and seventh diagonals respectively (obtained according to Fig. 2.e and Fig. 2.f). Using only the first diagonal for data embedding, we can see that almost all coefficients are correctly reconstructed, as indicated by the PSNR and the SSIM values with the original uncompressed image comparable to the values obtained between this image and the reference one. Even using the first to seventh diagonals, the reconstructed image is very similar to the original uncompressed version and the reference image (PSNR ≈ 35 dB, SSIM ≈ 0.95).

TABLE I PAYLOAD

 I (IN BITS) ON 1,000 IMAGES USING A SIZE OF 512 × 512 PIXELS FROM[START_REF] Pevný | BOSSBase dataset[END_REF], ACCORDING TO QF.

	Average	QF=100%		QF=90%		QF=80%		QF=50%
	results	Diag. 1	Diag. 1 to 7	Diag. 1	Diag. 1 to 7	Diag. 1	Diag. 1 to 7	Diag. 1	Diag. 1 to 7
	Payload (bits)	2,006	13,913	1,959	10,401	1,819	8,581	1,522	6,198
	PSNR (dB)	51.34	37.75	50.84	37.62	50.18	37.43	48.10	36.71
	SSIM	0.9984	0.9678	0.9981	0.9645	0.9978	0.9616	0.9965	0.9554

TABLE II PAYLOAD

 II COMPARISONS WITH CURRENT STATE-OF-THE-ART METHODS (QF = 80%, IMAGE SIZE = 512 × 512 PIXELS).

	Images	[5]	[6]	[7]	[8]	Diag. 1	Diag. 1 to 7
	Lena	750	1,364	798	3,667	2,010	10,051
	Baboon	750	768	1,555	7,447	2,044	13,785
	Man	750	1,368	1,809	4,856	2,022	11,925
	Peppers	750	1,026	960	4,253	2,013	10,436
	Sailboat	750	1,023	1,032	4,964	2,006	11,675


Pauline Puteaux

William Puech

Localization and Correction of Corrupted Pixel Blocks in Noisy Encrypted Images

Keywords: Multimedia security, image encryption, image denoising, deep learning, convolutional neural network, signal processing in the encrypted domain

Digital data such as images must be secured during transmission or cloud storage. Image encryption algorithms can be a solution to this problem, but these approaches are very noise sensitive. Because of the introduction of noise, the original image cannot be recovered, even if we know the secret key. In this paper, we propose a new noisy encrypted image correction algorithm containing a convolutional neural network (CNN) training stage and then, two main steps. After a direct decryption of a noisy encrypted image, the first step is to identify and localize the blocks that are probably incorrectly decrypted using a fine-tuned CNN. The second step of our proposed approach is to analyze and correct these blocks. Experimental results show that the proposed method can be used to blindly correct noisy encrypted images, while preserving the image structure and without increasing the original data size with additional information, unlike error correcting codes.

I. INTRODUCTION

During transmission or storage of encrypted images, it is often necessary to analyze or process them, without knowing the original content or the secret key used during the encryption phase [START_REF] Erkin | Protection and retrieval of encrypted multimedia content: When cryptography meets signal processing[END_REF]. When an encrypted image is corrupted during its transmission, even if the secret key is known, it becomes difficult to reconstruct the original image without errors.

Most of the previous methods propose to remove noise in noisy encrypted images by using error correcting codes (ECC) [START_REF] Wicker | Error control systems for digital communication and storage[END_REF], [START_REF] Morelos-Zaragoza | The art of error correcting coding[END_REF]. ECC-based approaches consist of introducing redundancy in digital data. Check bits, computed from data using some algorithms, are added to the original bitstream. At the recipient side, check bits are derived from received data and compared with the received ones. If they are the same, no error is found, however, if an error is detected, an error correcting method needs to be applied. Error correction can be carried out using automatic repeat request (ARQ) or forward error correction (FEC). The ARQ technique consists of repeating the request for retransmission of corrupted data until the whole data is verified. The FEC approach is based on encoding data using error correcting code before transmission.

Furthermore, some papers have focused on error correction during the AES encryption algorithm, by parity determination and modification during the input and output of each round [START_REF] Wu | Low cost concurrent error detection for the advanced encryption standard[END_REF], [START_REF] Ocheretnij | On-line error detection and bist for the AES encryption algorithm with different Sbox implementations[END_REF]. Privacy-preserving error correction schemes have also been proposed. Hu et al. suggested using a double cipher to perform non-local means denoising [START_REF] Hu | Non-local denoising in encrypted images[END_REF]. SaghaianNejadEsfahani et al. proposed to resort to secret sharing for wavelet denoising [START_REF] Saghaiannejadesfahani | Privacy protected image denoising with secret shares[END_REF]. Recently, Pedrouzo-Ulloa et al. presented an error correction scheme based on 2-ring learning with errors, for homomorphically denoising images in the encrypted domain [START_REF] Pedrouzo-Ulloa | Image denoising in the encrypted domain[END_REF].

Other methods consist of performing statistical analysis of each block on the encrypted image during the decryption process to determine if it is correctly decrypted or not. Islam et al. explained how to correct noisy AES-encrypted images by calculating three statistical measurements: global variance method, mean local variance method and the sum of the squared derivative method [START_REF] Islam | Denoising and error correction in noisy AES-encrypted images using statistical measures[END_REF]. Puteaux and Puech described an approach based on the local Shannon entropy measurement suitable for pixel blocks of very small sizes [START_REF] Puteaux | Noisy encrypted image correction based on Shannon entropy measurement in pixel blocks of very small size[END_REF].

Moreover, note that most of the methods do not allow us to localize corrupted parts in the noisy encrypted image and do not preserve the original image structure or size.

In this paper, we propose a new method for correcting noisy encrypted using a block cipher images in order to first identify and localize, and then analyze and correct corrupted pixel blocks. Deep learning, in particular convolutional neural network (CNN), is involved in our algorithm. Indeed, in the last few years, deep learning architectures have obtained a significant performance gain with respect to conventional methods in many fields, such as multimedia security or clear image denoising [START_REF] Xie | Image denoising and inpainting with deep neural networks[END_REF]. In our application case, we show that it is actually possible to fine-tune a CNN to infer if a pixel block is clear or not. With such classification, a probable incorrectly decrypted block can be discriminated from a clear block of the original image. Thus, using this model, we can first identify and localize all probable incorrectly decrypted blocks after the direct decryption of a noisy encrypted image and then, we can perform the analysis and the correction of these blocks.

The rest of this paper is organized as follows. Section I describes our proposed algorithm of noisy encrypted image correction based on two main steps. Section III presents experimental results and discussion and finally, this paper is concluded in Section IV.

II. PROPOSED METHOD OF NOISY ENCRYPTED IMAGE CORRECTION

Starting from an encrypted image using AES algorithm in ECB mode, with blocks of 4×4 pixels, the encrypted image is corrupted during transmission due to channel noise. Therefore, during decryption, even with the key, it is not possible to correctly decrypt the noisy encrypted image directly. Indeed, all of the encrypted blocks that are noisy cannot be decrypted at all, this is because at least one bit has been flipped. In fact, it is

ȋȌ ȋ ͶͶ Ȍ ǫ ͳʹͻ ʹ ǡ ǡ ȋ ͶͶ Ȍ Ϊ Ǧ Ǧ
Fig. 1. Overview of the proposed method.

very difficult to discriminate a correctly decrypted block from an incorrectly decrypted one and, in particular, when the block size is very small. In this paper, we propose a new method to solve the problem of noisy encrypted image decryption. Our algorithm is based in two main steps where deep learning, in particular CNN, is involved. We first identify and localize all the probable incorrectly decrypted pixel blocks, and then we analyze and correct them. Indeed, from a fine-tuned, pretrained CNN, it is possible to learn if a block is clear or not. As illustrated in Fig. 1, in order to specialize a CNN, each image of a database of clear and encrypted (i.e. not clear) images is used and split into blocks of 4 × 4 pixels to train and fine-tune the CNN. Then we have a fine-tuned CNN (FT-CNN), which is able to classify a block as being clear, with a probability p clear (), or not clear, with a probability 1 -p clear ().

For the reconstruction of a noisy encrypted image, as illustrated in Fig. 1, from the directly decrypted image, based on the FT-CNN, the identification and localization step consists of separating the correctly decrypted blocks (p clear () = 1) from the probable incorrectly decrypted blocks (p clear () = 1). Algorithm 1 presents with more details, the identification and localization step in order to obtain the list L of probable incorrectly decrypted blocks B. Unlike correctly decrypted blocks, which can be directly used for the reconstruction of the original image, the probable incorrectly decrypted blocks must be analyzed so they can be corrected. Note that some blocks in the list L have a probability p clear () = 0, which means that we can assume that they are really incorrectly decrypted. In this case, we are pretty sure that, in these blocks, at least one bit has been flipped. But other blocks have a probability 0 < p clear () < 1, which means that these other blocks are maybe in clear, but with a higher or lower probability and therefore we must analyze and correct them too. For each probable noisy encrypted block of the list L, since there is no information about the location and the number of corrupted bits, we have to test all the possible combinations. Without any assumptions, computational complexity is too high and performing a brute-force attack is not feasible, even for a block B of size 4 × 4 pixels. This is why we propose to make two assumptions about the noise: the bit error rate due to noise is quite low; the noise is a white noise which uniformly alters the encrypted image. Under these two hypotheses, we can assume that one bit at most is flipped in each block of 4 × 4 pixels of the encrypted image, which significantly reduces the complexity of the problem. Indeed, there are 1 + 128 possible configurations for each block, corresponding to the configuration of the original probable noisy encrypted block, plus the 128 configurations obtained by flipping one bit b i , (with 0 ≤ i < 128). Algorithm 2 describes the analysis and correction process for each block. For each possible configuration of the encrypted block, the block is decrypted and used as input for the classifier FT-CNN, which returns a probability p clear (). Among all the possible configurations, the one that obtains the highest probability to be in clear p clear () max is considered as the expected block of the original image. This configuration is added to the reconstructed blocks of the original image as illustrated in Fig. 1.

III. EXPERIMENTAL RESULTS AND DISCUSSION

In order to fine-tune our CNN to decide if a block is clear or not, from the BOWS-2 database [START_REF] Bas | Image database of BOWS-2[END_REF] (grey-level images with a size of 512 × 512 pixels) we randomly picked 100 images that remain in clear and 100 images which have been encrypted with AES-256 algorithm in ECB mode by blocks of 4 × 4 pixels by using a different secret key for each image. We then obtain 1, 638, 400 blocks in clear and 1, 638, 400 encrypted blocks for training. We used the Inception v3 model pre-trained on the Im-ageNet database, which achieves effective results in natural image classification tasks [START_REF] Szegedy | Rethinking the inception architecture for computer vision[END_REF] and which is capable of extracting natural image features. Therefore, the previously computed weights of the CNN are kept fixed for our experiments and only the fully connected part is fine-tuned, substituting the last layer by a new randomly initialized softmax layer with two classes Clear and Not clear. Moreover, we upsample our images (4 × 4 pixels) to fit the required size of the Inception v3 model (299 × 299 pixels) by using nearestneighbor interpolation in order to preserve block structure. Furthermore, as Inception v3 is pre-trained on the ImageNet database, the extracted features by the CNN are linked to intrinsic properties of natural images, which are not included in encrypted images. Indeed, the AES algorithm introduces confusion and diffusion in encrypted blocks and, as a consequence, there is no correlation between neighboring pixels and no patterns can appear. Therefore, we assume that our model can easily learn to discriminate the two classes Clear using probability p clear () and Not clear using probability 1-p clear (). In order to validate the learning capacity of the model, we use a cross-validation. Our whole block database is divided into four complementary batches of 819, 200 images (409, 600 clear blocks and 409, 600 encrypted blocks). Three of these four batches are used for the the training step and the obtained results are validated on the remaining batch. The confusion matrix presented in Table I, which is an average of the prediction results, shows that the prediction works very well since more than 99.7% of the total number of blocks are correctly predicted. After normalization, the very low variance values, 1.17 × 10 -9 for the class Clear and 2.70 × 10 -7 for the class Not clear, mean that our analysis is reproducible and there is no over fitting.

From the original image Lena (512 × 512 pixels encoded with 256 grey-levels) illustrated in Fig. 2.a, we apply an AES PSNR between the original image and the noisy encrypted image remains low (8.55 dB) and PSNR of 33.91 dB between the encrypted image and the noisy encrypted image indicates that the noise power is not negligible. Fig. 2.d illustrates that direct decryption without any analysis is not possible (PSNR of 16.33 dB), even if the secret key is known. This is due to the large number of noisy encrypted blocks which are then incorrectly decrypted. Moreover, without analysis it is not possible to localize incorrectly decrypted blocks and to discriminate them from correctly decrypted blocks of the original image. Fig. 3 presents the results obtained using our proposed method in two steps: identification and localization, and then analysis and correction of probable incorrectly decrypted blocks. As illustrated in Fig. 3.a, the identification step of our proposed method consists of identifying and localizing the probable incorrectly decrypted blocks. The directly decrypted 3.a. We assume that all the other blocks are probably incorrectly decrypted due to the noise in the encrypted image. In fact 15.71% of these blocks have a probability p clear () = 0. This means that we can assume that these blocks are really incorrectly decrypted and have to be corrected (in yellow in Fig. 3.a). 1.61% of these blocks have a probability 0 < p clear () < 1, which means that we cannot directly decide if they have been correctly decrypted or not. Therefore, we also have to consider them as probably incorrectly decrypted (in red in Fig. 3.a). To perform the correction of these two kinds of blocks, from the noisy encrypted image in Fig. 2.c, we generate, for each block, the 128 possible configurations by flipping, one by one, a bit of the block and decrypting it. For blocks with a probability 0 < p clear () < 1, we also consider the initial configuration without modification. The associated probability to be clear for each configuration is computed using our classifier. The configuration that has the highest probability to be clear is then considered as the expected block of the original image represented in Fig. 2.a. After applying all the steps of our proposed method on the entire image, we are then able to reconstruct almost all the blocks of the original image (99.98% of the total number of blocks). As illustrated in Fig. 3.b, only three blocks remain incorrectly decrypted (0.02%) and the PSNR between the original image and the reconstructed image is high (45.66 dB).

Fig. 4 focuses on an area of the image where some errors remain after applying our proposed method. Blocks in blue are inferred as clear, and red frames highlight the location of the remaining incorrectly decrypted blocks after applying our proposed method. In Fig. 4.a, we can see that two of the incorrectly decrypted blocks in the reconstructed image (Fig. 3.b) are still inferred as encrypted. Indeed, their probability to be in clear is low (p clear () < 0.5). The third incorrectly decrypted block is identified as clear. Indeed, in a few cases, encrypted blocks are quite homogeneous and the prediction fails. Fig. 4.b illustrates the same area of Fig. 4.a, but using the original image (Fig. 2.a). In this case, the expected clear blocks which cannot be reconstructed have a very low probability to be in clear (p clear () < 0.2) and they are predicted as not clear. In fact, these blocks correspond to highly textured blocks of the original image and cannot be differentiated from incorrectly decrypted blocks. Fig. 5 and Fig. 6 illustrate examples of clear and encrypted blocks respectively. In Fig. 5 top row, we can see that homogeneous blocks and blocks with a pattern are inferred as Clear, with p clear () = 1. At the end of the identification and localization step, they are considered as correctly decrypted blocks of the original image. Moreover, as shown in Fig. 6 top row, if the pixel distribution in the block is uniform and if pixel values are far from each others, blocks are inferred as Not clear, with p clear () = 0. In this case, we are pretty sure that these blocks are incorrectly decrypted and need to be corrected. Middle and top rows of Fig. 5 and Fig. 6 refer to blocks with 0 < p clear () < 1. They are then considered as probably badly decrypted and taken as input of the analysis and correction step of our method. In Fig. 5 middle row, we present blocks in clear which are finally considered as expected blocks of the original image. This means that p clear () is higher than the values associated to the 128 other possible block configurations. In Fig. 6 middle row, we represent encrypted blocks whose p clear () is smaller than the value associated to the expected block in clear. Blocks in the middle of the two figures are then finally correctly inferred during the analysis and correction step. In contrast, failed cases are presented in the bottom rows. Even for the human visual system, it is not easy to make the difference between clear blocks and encrypted blocks, especially in the case of highly textured clear blocks (Fig. 5 bottom row) and relatively homogeneous encrypted blocks or encrypted blocks with a pattern (Fig. 6 bottom row). Furthermore, note that we cannot use a threshold to discriminate clear and encrypted blocks, because some encrypted blocks have a higher probability to be clear (p clear () values) than some clear blocks. In order to make a comparison with current state-of-the-art methods, Fig. 7 illustrates results obtained from approaches based on a local entropy analysis and which exploits the property that if a block is clear then it has a lower Shannon entropy value than an encrypted block. Fig. 7.a illustrates a reconstructed image using a method of correction based on the zero-order entropy without quantization. We can note that there are a lot of blocks which are incorrectly decrypted (3, 662, i.e. 22.35%) and the PSNR value with the original image is low (14.89 dB). Fig. 7.b. is obtained using the best parameters proposed in [START_REF] Puteaux | Noisy encrypted image correction based on Shannon entropy measurement in pixel blocks of very small size[END_REF], which are distance map entropy and a quantization on 8 grey-levels. With these optimal parameters, we can see that results are not as good as those obtained with our new proposed method. Indeed, seven blocks (0.04%) remain incorrectly decrypted, which means four more than with our proposed approach in this paper (PSNR = 41.84 dB). However, we can note that there are two incorrectly decrypted blocks with our proposed approach, Fig. 3.b, which are correctly decrypted using [START_REF] Puteaux | Noisy encrypted image correction based on Shannon entropy measurement in pixel blocks of very small size[END_REF] as illustrated in Fig. 7.b. This means that a combination of these two approaches could improve the correction efficiency. We also compared our proposed method with a standard error correcting approach based on Reed-Solomon (RS) codes [START_REF] Morelos-Zaragoza | The art of error correcting coding[END_REF], as presented in Table II. Reed-Solomon codes are denoted as RS(n,k) with symbols of m bits (for greylevel images, m = 8 bits). The RS encoder takes as input k symbols of m bits and adds parity symbols to build a codeword of n symbols of m bits. During the decoding step, up to t = n-k 2 erroneous symbols can be corrected, with no information on error location. For a grey-level image with a size of 512 × 512 pixels, in order to be able to correct 1 bit per block of 4 × 4 pixels, RS(255, 251) codes with symbols of 8 bits are used. Indeed, with such parameters, up to t = 2 bytes (16 bits) among 16 blocks of 4 × 4 pixels (n = 251 16 × (4 × 4)) can be corrected. In Table II, by using RS codes, we can see that the format compliance property is not achieved and this would increase the data size by 1.56%. Conversely, our proposed error correction approach keeps the data in the intended format and preserves the original size, for the same amount of corrected bits per block.

Finally, the proposed approach has been applied on 100 images of 512 × 512 pixels, which means that 1, 638, 400 blocks of 4 × 4 pixels have been analyzed. On average, more than 99.95% of the blocks have been correctly reconstructed. Note that even if some blocks are incorrectly reconstructed, image quality remains high compared to the original one, as indicated by a PSNR > 40 dB).

IV. CONCLUSION

In this paper, we have shown that a fine-tuned CNN is efficient to infer if a block of pixels is clear or not. However, the simple use of a CNN is not sufficient to correct noisy encrypted images. For this purpose, in our proposed approach, we develop a new algorithm which is composed of two main steps: corrupted pixel block identification and localization first, then analysis and correction. In the first step of our method, directly from a noisy decrypted image, one can make the distinction between clear blocks and probable incorrectly decrypted ones. At the end of this step, a location map of probable incorrectly decrypted blocks can be obtained in an automatic way, which is not possible with conventional methods using error correction codes (ECC). During the second step of our approach, the configurations associated to each probable incorrectly decrypted block are analyzed. Our finetuned CNN computes, for each configuration, the probability to be a clear block and the configuration which achieves the highest score is considered as the expected block of the original image. At the end of the process, almost all blocks are correctly decrypted and the reconstructed image is very similar to the original one, according to the obtained results in terms of PSNR. Moreover, our proposed approach is formatcompliant and does not expand the original data size. With traditional ECC, if we would like to preserve the original size and to be format-compliant, then the quality of the final image will decrease.

In future work, we will try to use neighboring blocks in order to perform a better correction of the blocks with a low probability to be clear at the end of the process. Moreover, we are also interested in increasing the training database of the fine-tuned CNN before the second step of our method, using blocks which are identified as clear during the first step (light learning). Indeed, we suppose that adding the reconstructed blocks of the original image will help to improve the efficiency of the prediction.

Algorithm 2 :

 2 Analysis and correction of a block that is probably incorrectly decrypted. Data: A block B of the list L, classifier (FT-CNN). Result: Reconstructed block B clear . B clear ← D AES (B); p clear (B clear )max ← p clear compute(B clear , FT-CNN); for i = 0 to 127 do B dec i ← D AES (B bi ); p clear (B dec i ) ← p clear compute(B dec i , FT-CNN); if p clear (B dec i ) > p clear (B clear )max then p clear (B clear )max ← p clear (B dec i ); B clear ← B dec i ; return B clear ;

Fig. 2 .

 2 Fig. 2. Illustration of the problem of noisy encrypted image decryption: a) Original Lena image (512 × 512 pixels, 256 grey-levels), b) Encrypted image, using the AES algorithm in ECB mode with blocks of 4 × 4 pixels (PSNR with the original image = 8.56 dB), c) Noisy encrypted image, BER = 2.6 × 10 -3 (PSNR with the original image = 8.55 dB, PSNR with the encrypted image = 33.91 dB), d) Directly decrypted image (PSNR with the original image = 16.33 dB, 83.58% of correctly reconstructed blocks).

Fig. 3 .

 3 Fig. 3. Example of our method in two steps: a) Identification and localization of all probably incorrectly decrypted blocks from the directly decrypted image in Fig. 2.d, b) Analysis and correction of the noisy encrypted image in Fig. 2.c using the proposed method (PSNR with the original image = 45.66 dB, 99.98% of correctly reconstructed blocks).

Fig. 4 .

 4 Fig. 4. Associated probability to be in clear for each block of a part of the: a) Reconstructed image using the proposed method (Fig. 3.b), b) Original image in clear (Fig. 2.a).

Fig. 5 .

 5 Fig. 5. Examples of clear blocks: top row) Inferred as Clear after the identification and localization step, middle row) With 0 < p clear () < 1, and considered as expected blocks of the original image after the analysis and correction step, bottom row) With 0 < p clear () < 1, and considered as encrypted after the analysis and correction step.

Fig. 6 .

 6 Fig. 6. Examples of encrypted blocks: top row) Inferred as Not clear after the identification and localization step, middle row) With 0 < p clear () < 1, and considered as encrypted after the analysis and correction step, bottom row) With 0 < p clear () < 1, and considered as the expected blocks of the original image after the analysis and correction step.

Fig. 7 .

 7 Fig. 7. Correction of the noisy encrypted image in Fig. 2.c using local Shannon entropy measurement in blocks of 4 × 4 pixels: a) Reconstructed image using zero-order entropy and without quantization, i.e. by considering 256 grey-levels (PSNR with the original image = 14.89 dB, 77.65% of correctly reconstructed blocks), b) Reconstructed image using distance map entropy and quantization, i.e. by considering 8 grey-levels [10] (PSNR with the original image = 41.84 dB, 99.96% of correctly reconstructed blocks).

Algorithm 1: Identification and localization of blocks that are probably incorrectly decrypted.

	Data: Noisy encrypted blocks B, classifier FT-CNN.
	Result: List L of blocks B of the noisy encrypted image which
	have to be analyzed and corrected.
	L ← [ ];
	foreach block B do
	B dec ← D AES (B);
	p clear (B dec ) ← p clear compute(B dec , FT-CNN);
	if p clear (B dec ) = 1 then
	L.append(B);
	return L;

TABLE II COMPARISON

 II BETWEEN USAGE OF RS(255,251) ERROR CORRECTING CODES AND PROPOSED METHOD OF NOISY ENCRYPTED IMAGE CORRECTION.