  This paper investigates the security vulnerabilities of
adversarial-example-based image encryption by executing data reconstruction
(DR) attacks on encrypted images. A representative image encryption method is
the adversarial visual information hiding (AVIH), which uses type-I adversarial
example training to protect gallery datasets used in image recognition tasks.
In the AVIH method, the type-I adversarial example approach creates images that
appear completely different but are still recognized by machines as the
original ones. Additionally, the AVIH method can restore encrypted images to
their original forms using a predefined private key generative model. For the
best security, assigning a unique key to each image is recommended; however,
storage limitations may necessitate some images sharing the same key model.
This raises a crucial security question for AVIH: How many images can safely
share the same key model without being compromised by a DR attack? To address
this question, we introduce a dual-strategy DR attack against the AVIH
encryption method by incorporating (1) generative-adversarial loss and (2)
augmented identity loss, which prevent DR from overfitting -- an issue akin to
that in machine learning. Our numerical results validate this approach through
image recognition and re-identification benchmarks, demonstrating that our
strategy can significantly enhance the quality of reconstructed images, thereby
requiring fewer key-sharing encrypted images. Our source code to reproduce our
results will be available soon.
