A privacy-enhanced image compression method

Abstract

The application discloses a privacy-enhanced image compression method, comprising: constructing a semantic-frequency atlas based on frequency domain features and a sensitive mask, and locating a semantic unit set; performing spectral domain structure adjustment on the frequency domain features, and performing entropy alignment generation combined with an entropy model to obtain adjusted frequency domain features, parameterized semantic differences and dual compensation; applying reversible dual decomposition to the adjusted frequency domain features to obtain common latent features and dual latent features; using the entropy model, entropy-encoding the common latent features into a main bit stream, and jointly entropy-encoding the dual latent features, the parameterized semantic differences and the dual compensation into a secure bit stream; combining an access key to generate a protected header containing access control information, and packaging the main bit stream, the secure bit stream and the protected header into a container code stream. The application can effectively shield machine semantic recognition at the public end, while supporting authorized ends to accurately recover semantics at a low code rate cost, and realizing multi-level access control of the same code stream.

Description

Technical Field

[0001] This invention belongs to the field of image compression, and in particular to a privacy-enhancing image compression method. Background Technology

[0002] In applications such as cloud storage, network transmission, social media, and intelligent surveillance, while image data is efficiently compressed, its inherent sensitive semantic information (such as faces, license plates, and text) also faces the risks of automatic recognition and privacy leakage. Therefore, researching how to effectively shield machine semantic extraction while ensuring high compression rates and human visual usability, and providing a controllable authorization recovery mechanism, has become an important topic in the field of digital media security and privacy computing.

[0003] Currently, research on this problem mainly focuses on two directions. One is privacy-preserving methods based on adversarial perturbations. These methods add carefully designed, imperceptible noise to the pixel space of an image, causing deep learning models (such as classifiers or detectors) to make mistakes in their recognition results. The other is semantically aware image compression methods. These methods introduce semantic or visual saliency maps during the encoding process, and differentiate bit allocation or quantization for different regions based on the importance of the content. Their main goal is to optimize the subjective visual quality of the human eye at the same bit rate, especially the sharpness of the region of interest.

[0004] However, existing technical solutions still face deep-seated technical bottlenecks in balancing privacy, recoverability, and compression efficiency. The main problems with these solutions include the shallowness of the perturbation operation and the high entropy of the recovered information. Summary of the Invention

[0005] The purpose of this invention is to provide a privacy-enhancing image compression method to solve the aforementioned problems existing in the prior art.

[0006] Technical solution: A privacy-enhancing image compression method, comprising:

[0007] Acquire and construct a semantic-frequency map based on frequency domain features and sensitivity masks to locate the set of semantic units on which machine-recognizable semantics depend;

[0008] Based on the set of semantic units, the frequency domain features are adjusted in spectral domain structure, and entropy alignment is performed in combination with the pre-configured entropy model to obtain the adjusted frequency domain features, parameterized semantic difference and dual compensation.

[0009] Apply invertible dual decomposition to the adjusted frequency domain features to obtain common latent features and dual latent features;

[0010] Using the entropy model, the entropy of common latent features is compiled into the main bitstream, and the joint entropy of dual latent features, parameterized semantic difference and dual compensation is compiled into a secure bitstream;

[0011] A protected header containing access control information is generated by combining a preset access key, and the main bit stream, security bit stream, and protected header are encapsulated into a container bit stream.

[0012] Beneficial effects: This invention can effectively shield machine semantic recognition on the public end, while supporting the authorized end to accurately recover semantics at a low bitrate cost, and realize multi-level access control of the same bitstream. Attached Figure Description

[0013] Figure 1 This is a flowchart illustrating the steps of a privacy-enhancing image compression method provided in an embodiment of this application.

[0014] Figure 2 A flowchart illustrating the steps for adjusting the spectral domain structure provided in this application embodiment.

[0015] Figure 3 A flowchart illustrating the steps involved in providing a set of location semantic units in an embodiment of this application.

[0016] Figure 4 A flowchart illustrating the steps for generating a protected header containing access control information, as provided in an embodiment of this application. Detailed Implementation

[0017] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0018] It should be noted that the terms include and have, and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or units is not necessarily limited to those steps or units that are explicitly listed, but may include other steps or units that are not explicitly listed or that are inherent to such process, method, product, or device.

[0019] The study found that most perturbation schemes operate in the pixel domain or shallow feature domain. This approach is constrained by continuous manifolds, making it difficult to alter the deep semantic features upon which machine recognition relies. Furthermore, the perturbation effect is easily attenuated after compression, scaling, and other transformations. Moreover, they do not address the frequency domain structure and phase coupling relationships upon which machine recognition models depend, resulting in insufficient robustness in privacy shielding. Additionally, to achieve authorized recovery, these schemes must preserve the original information or pixel-level residuals in some form, leading to an information theory paradox: the recovered data itself (especially noise-like residuals) has extremely high information entropy, resulting in an exceptionally large secure bitstream for storing and transmitting this information. This contradicts the goal of compression and makes achieving an adaptive balance between privacy effects and total bitrate difficult.

[0020] Specifically, with the development of machine vision and visual-language models (VLP), the automatic extraction capability of image semantics has been significantly enhanced, bringing the risk of privacy leakage. Existing technical solutions, such as pixel-domain perturbation-based methods, are constrained by the smoothness limitations of continuous manifolds and alignment models, making it difficult to change machine-recognizable semantics, and the perturbation effect is easily decayed or pulled back. Other solutions that use generative replacement face the information theory paradox: if replacement content is directly generated in the pixel domain, either the information is irreversible (legitimate users cannot recover it), or it needs to carry high-entropy pixel residuals (leading to expansion of the security bitstream), making it difficult to balance privacy, recoverability, and compression efficiency. In addition, existing dual-stream compression schemes mostly use static bitrate partitioning, lacking closed-loop feedback and adaptive adjustment capabilities for privacy protection effects, and their permission management is usually implemented at the business layer, failing to be strongly bound to the bitstream syntax and decoding path, resulting in security and efficiency bottlenecks.

[0021] like Figure 1 As shown, a privacy-enhancing image compression method is proposed, including the following steps:

[0022] By acquiring and constructing a semantic-frequency map based on frequency domain features and a sensitive mask, the set of semantic units on which machine-recognizable semantics depend can be located.

[0023] In other words, the frequency domain features and sensitivity mask of the input image are obtained, and a semantic-frequency map is constructed based on the frequency domain features and sensitivity mask to locate the set of semantic units on which machine-recognizable semantics depend.

[0024] This embodiment demonstrates the localization of privacy enhancement processing. Specifically, the frequency domain features of the input image are obtained. These frequency domain features are obtained by applying a frequency domain transformation (such as Discrete Cosine Transform, DCT, wavelet transform, or reversible coupled subband transform) to the input image or its latent features, characterizing the information distribution of the image at different frequencies, spatial locations (blocks), and phases. Simultaneously, a sensitive mask is also required, which identifies regions in the image that require privacy protection, such as faces, license plates, and text. Based on these two inputs, a semantic-frequency map model is constructed to establish a mapping relationship between the semantic information (machine-recognizable semantics) indicated by the sensitive mask and the specific components of the frequency domain features (such as specific frequency bands, block indices, and phase combinations). Through this map, the frequency domain components that contribute most to the machine recognition task can be precisely located; the set of these components constitutes the semantic unit set.

[0025] In some alternative implementations, the sensitive mask can be provided in advance by the user or automatically inferred and generated by the encoder's built-in weakly supervised segmentation model or object detection model when it is missing. Meanwhile, the choice of frequency domain transform is flexible; preferably, using a reversible transform (such as a reversible coupled subband) can reduce information loss during license recovery.

[0026] Based on the set of semantic units, the frequency domain features are adjusted in spectral domain structure, and entropy alignment is generated in combination with a pre-configured entropy model to obtain the adjusted frequency domain features, parameterized semantic difference, and dual compensation.

[0027] In other words, based on the set of semantic units, the frequency domain features are adjusted in the spectral domain to obtain the adjusted frequency domain features; the adjusted frequency domain features and the pre-configured entropy model are combined to perform entropy alignment generation to obtain parameterized semantic difference and dual compensation.

[0028] Specifically, for a set of semantic units, spectral domain structure adjustments are performed on these units in the frequency domain space. This is an operation distinct from pixel domain perturbation and may include suppressing the energy of specific units, replacing the spectrum of specific units, or rearranging the indexes of specific units. This can disrupt the coupling relationship between the amplitude spectrum and phase spectrum upon which machine recognition depends while maintaining overall visual observability. After adjustment, the adjusted frequency domain features are obtained, which, when used to generate a public view, lack key machine-recognizable cues. Simultaneously, to enable authorized users to recover the adjusted semantics, the high-entropy original spectrum or pixel residuals are not directly preserved. Instead, entropy alignment generation is performed, aiming to optimize the joint objective. Optionally, a key objective in the joint objective is to minimize the encoding length of the recovered information under an entropy model (such as a pre-trained probabilistic model). This process generates two key low-entropy information components: parameterized semantic difference, a low-dimensional parameter used to describe the adjusted semantic information (e.g., identity vectors, deformation parameters, or texture codebook indices), rather than high-dimensional pixel differences; and dual compensation, which are the compensation coordinates in the dual latent feature space required to aid reversible recovery.

[0029] Apply invertible dual decomposition to the adjusted frequency domain features to obtain common latent features and dual latent features.

[0030] In this embodiment, the adjusted information is separated in the latent space. Latent features typically refer to the abstract representation (denoted as Y) extracted by the encoder from the image. Specifically, an invertible dual decomposition is applied to the adjusted frequency domain features (which are essentially also latent features). This invertible dual decomposition is a mathematically invertible transformation, such as an invertible coupling transformation. This transformation splits the information of the input feature Y into two mutually orthogonal or decoupled parts: one part is the common latent feature (denoted as Yp), which aggregates all visual information used to construct the common view; the other part is the dual latent feature (denoted as Zc), which aggregates the compensation coordinates and lateral information necessary for authorized recovery. Since the transformation is invertible, as long as both the common latent feature Yp and the dual latent feature Zc are present, the adjusted frequency domain features before decomposition can be recovered losslessly.

[0031] Using the entropy model, the entropy of common latent features is compiled into the main bitstream, and the joint entropy of dual latent features, parameterized semantic difference, and dual compensation is compiled into a secure bitstream.

[0032] In this embodiment, dual-stream compression is performed. The two latent information streams are encoded using the same or compatible entropy model used in the above steps. Specifically, the common latent feature Yp is entropy-encoded to generate the main bitstream B. mainThis bitstream is publicly available or low-privilege readable and is used to decode and generate a public view free of sensitive semantics. Simultaneously, the minimum sufficient information set required for authorized recovery—the dual latent features Zc, the parameterized semantic difference Δ, and the dual compensation Zs—is jointly entropy encoded to generate a secure bitstream B. sec The bitstream is encrypted or requires high-privilege access to read.

[0033] A protected header containing access control information is generated by combining a preset access key, and the main bit stream, security bit stream, and protected header are encapsulated into a container bit stream.

[0034] Specifically, a protected header is generated by combining the access key used during encoding (e.g., the public key of a symmetric or asymmetric key pair). This header contains access control information used for decoding and verifying permissions. The public main bitstream, the protected secure bitstream, and the protected header are encapsulated together according to a predetermined format to form a single container bitstream. The container bitstream is the final output of the encoding end and can be distributed and stored. After receiving the container bitstream, the decoding end parses the protected header, determines its own permissions based on the locally held key, and decides how to read and combine the main bitstream and the secure bitstream, thereby achieving multi-level view access control.

[0035] This embodiment provides a novel framework for deep coupling compression, semantic masking, and access control. Instead of operating in the pixel domain, it operates at the frequency domain level, targeting machine-recognizable semantic units to perform spectral domain structure adjustments, thus rewriting the machine's recognition cues. It introduces entropy-aligned generation, compressing authorized recovery information into low-entropy parameterized semantic differences and dual compensations, rather than high-entropy pixel residuals, resolving the information theory paradox. It employs reversible latent dual decomposition to separate public and authorized information into different latent spaces and uses adaptive quotas for entropy encoding. Access permissions, addressing information, and authentication tags are written into the protected header to achieve strong binding between permissions and bitstream syntax, ultimately realizing multi-level access control within a single container bitstream.

[0036] like Figure 3 As shown, in an exemplary embodiment, locating a set of semantic units includes:

[0037] Based on frequency domain features and sensitivity masks, semantic heatmaps are obtained through semantic attribution mapping.

[0038] Specifically, a pre-trained semantic attribution model (e.g., a model based on class activation maps (CAM) or gradient-weighted class activation maps (Grad-CAM)) is used to analyze which pixel regions in the input image contribute the most to one or more specific machine-recognizable semantics (e.g., face category, specific text recognition results). The analysis results are output as a semantic heatmap, where the highlighted areas represent pixel regions that contribute highly to the target semantics.

[0039] The semantic heatmap is aggregated to the frequency band, block, and phase dimensions of the frequency domain features to screen out high-contribution regions.

[0040] In this embodiment, a mapping from pixel space to frequency domain space is implemented. It can be understood that frequency domain features (such as DCT blocks or wavelet subbands) spatially correspond to pixel blocks in the original image. The contribution (energy) of each pixel on the semantic heatmap is aggregated to the corresponding dimension of its corresponding frequency domain block or subband. For example, the heatmap energy of a 16×16 pixel block can be weighted by averaging or max pooling and then assigned to the corresponding 16×16 DCT coefficient block. This quantifies how much semantic energy each frequency domain component (specific frequency band, specific block, specific phase) carries. When the aggregated semantic energy of a certain frequency domain component exceeds a preset aggregation threshold, it is selected as a high-contribution region or a semantic unit candidate.

[0041] Assess the cross-class decision boundary margin, energy density, and phase alignment of high-contribution regions to determine the set of semantic units.

[0042] In this embodiment, candidate units are further screened and refined. Specifically, cross-class decision boundary margin is used to measure the difficulty of confusing the classifier's decision; units with small margins (i.e., units close to the decision boundary) are preferred adjustment targets. Energy density is used to measure the contribution of the unit to the visual reconstruction quality; units with excessively high energy density (such as low-frequency principal components) may be downgraded to protect visual quality. Phase alignment is used to measure the phase structure within or between units; machine recognition models typically rely heavily on this structure. By comprehensively evaluating these indicators (e.g., through weighted summation), a comprehensive score can be calculated for each candidate unit, and the units with the highest scores are ultimately determined as the semantic unit set. Simultaneously, this comprehensive score or its ranking is saved as unit priority. Optionally, the semantic unit set can be located by establishing a three-dimensional mapping relationship between the semantic heatmap and frequency domain features (band-block-phase). The semantic units in the semantic unit set are defined as band-block-phase combinations in the frequency domain features that contribute more than a preset threshold to a specific machine recognition task.

[0043] As a preferred embodiment, after determining the set of semantic units, the method further includes generating spectral consistency constraints. Specifically, these constraints are generated not based on semantic heatmaps, but rather on the boundary information of sensitive masks and visual coherence rules (e.g., the phase of a natural image should change continuously in space, and there should be no obvious jumps at block boundaries). The resulting spectral consistency constraint data defines the maximum allowed phase difference, energy difference, etc., between blocks during spectral structure adjustment to prevent the introduction of obvious visual artifacts during the adjustment process.

[0044] In one possible implementation, spectral domain structure adjustment is performed on the frequency domain features, including:

[0045] Before performing spectral domain structure adjustment, a structure adjustment plan is generated. The generation of the structure adjustment plan aims to optimize the overall objective, which is determined by balancing the following factors: the expected compensation code rate based on the entropy model, the common end misleading benefit calculated based on cross-class decision boundary margin and recognition purity, and the spectral domain consistency cost derived from phase continuity and block boundary smoothing constraints.

[0046] In this embodiment, the structural adjustment plan is a sequence of operations to be executed, specifying in detail which unit in the semantic unit set should be addressed, what operation (such as suppression, replacement, or rearrangement) should be performed, and the order of execution. The plan is generated to optimize the synthesis objective. Specifically, the synthesis objective is determined by balancing the following factors: the expected compensated code rate E estimated based on the entropy model. i Common-end misleading revenue U calculated based on cross-class decision boundary margin and identification purity. i ; and the spectral domain consistency cost C derived from the phase continuity and block boundary smoothness constraints (i.e., spectral domain consistency constraints). i Preferably, the integrated objective can be expressed as minimizing the cost function, for example: minΣ(α*E i -β* U i +γ* C i ); where i traverses all semantic units to be adjusted; E i This refers to the estimated bit cost required in the secure bitstream to recover the i-th unit at the authorized end; this value is estimated by the entropy model. i This refers to the privacy protection benefit (i.e., the ability to confuse the machine) that can be obtained by adjusting the i-th unit; this value is derived from indicators such as decision boundary margin; C i This refers to the visual artifact cost that adjusting the i-th unit might cause (i.e., the penalty for violating consistency constraints). α, β, and γ are trade-off coefficients used to balance the importance of these three factors. Solving the optimization problem (e.g., using a greedy algorithm or dynamic programming) yields the optimal structural adjustment plan.

[0047] In some alternative implementations, the structural adjustment plan is also generated based on the priority order of the semantic unit set, with high-priority units being adjusted in the spectral domain first.

[0048] In other words, units with higher priority are included in the adjustment plan first, or are given higher weight in the optimization objectives.

[0049] In a further embodiment, after generating the structure adjustment plan, the spectral domain structure adjustment is performed according to the plan. For example... Figure 2 As shown, the spectral domain structure adjustment includes:

[0050] The execution unit suppression applies energy shaping and phase dealignment to the amplitude and phase spectra of a preset target subband to decouple machine-identifiable cues.

[0051] In this embodiment, unit suppression applies energy shaping and phase dealignment to the amplitude and phase spectra of the target subband (i.e., the frequency domain position corresponding to the semantic unit). For example, the amplitude value of a specific semantic unit (such as the DCT coefficient corresponding to the high-frequency texture of a face) is set to zero or a minimum value, or its phase is rotated by a random angle (such as +π / 2) to decouple machine-recognizable cues.

[0052] The unit replacement is performed by retrieving a spectrum-compatible replacement unit from a spectrum sample library and performing energy spectrum matching and phase correction.

[0053] In other words, the unit replacement retrieves one or more spectrally compatible (e.g., with similar energy distribution and statistical characteristics) replacement units from a pre-built spectral sample library, performs energy spectrum matching and phase correction, and then replaces the original semantic units. For example, the spectral blocks of a face region are replaced with spectral blocks of bark or cloth from a texture library, making it impossible for the machine to recognize it as a face, but it still appears as a natural texture to the human eye.

[0054] Alternatively, an index rearrangement can be performed, which performs a permutation or grouping rearrangement on a specified subband or block index to disrupt the local self-similar structure.

[0055] For example, in a DCT block containing 64 coefficients, the positions of coefficients 5 through 10 are swapped with those of coefficients 20 through 25 to disrupt the local self-similar structure or fixed spectral pattern upon which the machine recognition model relies.

[0056] It should be noted that all spectral domain structure adjustment operations are performed directly in the frequency domain space of the compressed domain, without needing to be converted back to the pixel domain, thus maintaining high efficiency. In other words, cell suppression, cell replacement, and index rearrangement are all performed directly in the frequency domain space of the compressed domain, without needing to be converted to the pixel domain.

[0057] Preferably, performing spectral domain structure adjustment further includes: generating a boundary consistency record, wherein the boundary consistency record contains cross-block phase offsets, energy balance parameters, and index mapping relationships. In other words, the boundary consistency record is a log that details which operations were performed on which blocks, such as cross-block phase offsets, energy balance parameters, or index mapping relationships.

[0058] In a further embodiment, performing spectral domain structure adjustment also includes:

[0059] After performing unit suppression, unit replacement, or index rearrangement, continuity repair is applied to block boundaries and phases based on the semantic unit set. The continuity repair includes performing cross-block phase alignment to meet spectral domain consistency constraints, and employing spectral domain window fusion and edge spectral attenuation to suppress block effects and checkerboard artifacts.

[0060] In this embodiment, visual artifacts that may be introduced by coarse adjustments are eliminated. Preferably, continuity restoration is performed based on boundary consistency records. Specifically, cross-block phase alignment is performed according to the boundary consistency records, i.e., the boundaries of adjacent blocks are checked, and if their phase difference exceeds the threshold defined by the spectral consistency constraint, they are smoothed by interpolation or callback to satisfy the spectral consistency constraint; and spectral window fusion and edge spectral attenuation are employed, for example, applying a Hamming window or Gaussian window in the frequency domain to the edges of the adjusted block, so that its energy and phase can smoothly transition with the surrounding unadjusted blocks, thereby suppressing block effects and checkerboard artifacts. The final output is the adjusted frequency domain feature Y. after .

[0061] Optionally, the steps of spectral domain structure adjustment include: performing unit-level spectral domain structure adjustment at the spectral location of the semantic unit set, thereby disrupting machine-recognizable cues by changing the coupling relationship between the amplitude spectrum and the phase spectrum.

[0062] In an exemplary embodiment, entropy alignment generation is performed in conjunction with a pre-configured entropy model to obtain parameterized semantic difference and dual compensation, specifically including:

[0063] In the region after spectral domain structure adjustment, naturalization generation and statistical reshaping are performed to obtain parameterized semantic difference and dual compensation. The naturalization generation and statistical reshaping aim to optimize the joint objective, which is dominated by the expected compensation bitrate estimated by the entropy model, and jointly constrains the naturalness, contextual consistency and region-aware quality of the generated content.

[0064] In this embodiment, the information theory paradox is resolved, namely, avoiding the transmission of high-entropy pixel residuals for license restoration. Specifically, the region with adjusted spectral domain structure corresponds to the region corresponding to the suppressed, replaced, or rearranged semantic units. The joint objective is the expected compensation code rate estimated by the entropy model (i.e., E[-log Q(z)]). s )]) dominates, of which z s This refers to the dual-side compensation component required for authorized recovery, where Q() is the entropy model and E[] is the expectation function. The objective aims to minimize the number of bits required to recover the information. Simultaneously, the joint objective also jointly constrains the naturalness of the generated content (e.g., through the discriminator loss L). GAN ), context consistency (e.g., L1 or L2 loss L), ctx (Constraint adjustment of the smooth transition between the region and the surrounding region) and region perception quality (e.g., through perception loss L)perc region This ensures that the generated content is semantically reasonable. Preferably, the joint optimization objective can be expressed as: min (E[-log Q(z)) s )] +λ GAN * L GAN +λ ctx * L ctx +λ perc * L perc region ); where λ GAN , λ ctx , λ perc These are the balancing weights for each loss. By optimizing this objective, the system can restore the necessary information z for authorization while ensuring the public view appears visually natural (i.e., the adjusted area looks like a natural, but information-sensitive, texture, not an artifact). s The code is compressed into the low-probability region of the entropy model, thereby minimizing the compensation code rate. Through the above entropy alignment generation process, two core parts of license recovery information are extracted: parameterized semantic difference Δ and dual compensation Zs.

[0065] It should be noted that the parameterized semantic difference is extracted as a low-dimensional parameter to replace the high-entropy pixel residual; the low-dimensional parameter is selected from: identity-related parameters, deformation parameters, attribute parameters or texture codebook index.

[0066] In other words, the information entropy of low-dimensional parameters is lower than that of the corresponding pixel-level residuals. Specifically, low-dimensional parameters include, but are not limited to: identity-related parameters (e.g., in a face privacy protection scenario, this parameter could be a 512-dimensional face recognition feature vector), deformation parameters (e.g., affine transformation matrix parameters describing facial expressions or object poses), attribute parameters (e.g., category labels describing gender, age, and color), or texture codebook indices (e.g., index numbers pointing to pre-shared texture libraries, which indicate the spectral units used for replacement).

[0067] Dual compensation records the compensation coordinates in the dual latent feature space necessary for accurate recovery within the subsequent reversible dual decomposition framework. In summary, the parameterized semantic difference and dual compensation together constitute the minimum sufficient information set for authorized recovery, which will be jointly encoded into the secure bitstream.

[0068] Optionally, the entropy alignment generation steps include: performing entropy alignment generation with the optimization objective of minimizing the joint encoding length of dual compensation and parameterized semantic difference under the entropy model.

[0069] According to one aspect of this application, using an entropy model, the entropy of common latent features is compiled into a main bitstream, and the joint entropy of dual latent features, parameterized semantic difference, and dual compensation is compiled into a secure bitstream, specifically including:

[0070] Based on the set bitrate budget and the obtained public misleading index, the bitrate quotas of the main bitstream and the security bitstream are dynamically adjusted and adaptively allocated.

[0071] Preferably, the bitrate quota is adaptively allocated to achieve an optimization objective: minimizing the total bitrate while ensuring that the total bitrate of the main bitstream and the security bitstream does not exceed the bitrate budget and that the common misleading index is not lower than a preset common misleading effectiveness threshold. Specifically, this optimization objective is to minimize the total bitrate (the bitrate R of the main bitstream) while satisfying two core constraints. main +Secure bitstream bitrate R sec The two core constraints are: the main bitstream B. main With secure bitstream B sec The total bitrate does not exceed the bitrate budget R budget (i.e. R) main +R sec ≤R budget Furthermore, the Public Misleading Index (PMI) is not lower than the preset threshold for the effectiveness of public misleading information (i.e., PMI ≥ τ). e For example, a misleading validity threshold τ can be set. e A value of 0.8 indicates that the effectiveness of privacy blocking must be at least 80%.

[0072] Preferably, the method further includes an evaluation step: before performing adaptive allocation of code rate quotas, performing an inverse transformation on the adjusted frequency domain features, evaluating the recognition offset stability of the adjusted frequency domain features on the visual-language model, and generating a common misleading index.

[0073] Specifically, an inverse transform, such as inverse DCT or inverse subband transform, is performed on the adjusted frequency domain features to obtain a temporary common view image. This temporary common view is then input into one or more pre-defined visual-language models (VLP) or object recognition models (e.g., CLIP model, face recognition model) to evaluate the stability of the recognition result's offset relative to the original image, generating a Common Misleading Index (PMI). The PMI is a quantitative indicator used to measure the effectiveness of privacy masking. For example, the PMI can be a Boolean value (1 indicates recognition failure, 0 indicates recognition success) or a continuous value. For instance, if the original image is input into a face recognition model and returns a confidence score of 0.99 for identity A, while the adjusted temporary common view is input into the same model and returns a confidence score of 0.1 for identity A, then the PMI can be quantified as an offset of 0.89. The PMI will serve as a hard constraint for subsequent bitrate allocation.

[0074] In an optional embodiment, the bitrate quota is adaptively allocated by increasing the bitrate quota of the secure bitstream as the dimensionality of the parameterized semantic difference increases or the complexity of the dual latent features increases. That is, when the dimensionality of the parameterized semantic difference increases, for example, from protecting only the identity vector to additionally protecting the deformation parameters, the encoder will automatically increase the secure bitstream B. sec The bitrate quota is adjusted to ensure that these authorized recovery messages can be fully encoded. Accordingly, the main bitstream B... main The quota may be compressed (e.g., by increasing the quantitative level), as long as the final public misleading indicator, the PMI, still meets the misleading effectiveness threshold τ. e That's fine. Conversely, if the Public Misleading Index (PMI) significantly exceeds the threshold (e.g., reaches 0.95), the system can appropriately reduce the compression rate of the main bitstream (i.e., increase the B...). main Quotas) are used to provide better visual quality of the public view while meeting privacy requirements, thereby achieving a dynamic balance between total bitrate, public quality, and privacy security.

[0075] In one possible embodiment of this application, obtaining common latent features and dual latent features includes:

[0076] Based on the adjusted frequency domain features, a reversible coupling transformation is used to aggregate common visual information into common latent features, and to aggregate the compensation coordinates required for authorized recovery into dual latent features.

[0077] In other words, obtaining the common latent features and dual latent features is achieved through an invertible coupling transformation. This transformation is a mathematically one-to-one invertible mapping that adjusts the frequency domain features Y. after The information it carries is separated into two decoupled potential spaces.

[0078] Specifically, the reversible coupling transformation aggregates common visual information—the visual structure, texture, and background information necessary for decoding the common view—into a common latent feature Yp. Simultaneously, it aggregates the compensation coordinates and lateral information required for authorized recovery (i.e., overcoming semantic masking) into a dual latent feature Zc. The common latent feature is encoded into the public main bitstream, while the dual latent feature is encoded into the secure bitstream as part of the authorized information. Due to the reversibility of the transformation, the authorized decoder, after simultaneously obtaining the common latent feature Yp and the dual latent feature Zc, can losslessly recover the adjusted frequency domain feature Y through the inverse transformation. after This is the foundation for achieving accurate semantic restoration.

[0079] As a preferred implementation, the reversible coupling transformation also satisfies the Jacobi stability constraint to control the mapping condition number and ensure numerical stability.

[0080] In this embodiment, the Jacobian stability constraint controls the stretching and distortion of the invertible coupled transformation by imposing an upper bound on the condition number of the Jacobian matrix of the invertible mapping. This ensures numerical stability during the transformation process and improves robustness to noise and recompression (e.g., transcoding or slight corruption of the container bitstream during transmission).

[0081] like Figure 4 As shown, in a further embodiment, generating a protected header containing access control information includes:

[0082] Based on the access key, write the permission bits, key identifier and authentication encryption tag into the protected header;

[0083] An index mapping for decoding multi-level views is simultaneously written into the protected header. This index mapping records the segment offsets and lengths corresponding to different permissions in the secure bitstream.

[0084] Specifically, the protected header PSEI contains information necessary for access control, including: a key identifier to identify the key level; an authentication encryption tag (e.g., generated via AES-GCM mode) to verify data integrity and origin; and permission bits to identify different access levels. As a preferred, security-enhancing implementation, a counter or timestamp can also be added to the protected header to prevent replay attacks, i.e., to prevent attackers from intercepting and repeatedly sending old bitstreams. Additionally, the hash value of the secure bitstream can be written for fast integrity verification at the decoding end. Optionally, an index mapping for decoding multi-level views is also written to the protected header. This index mapping is a data structure that records details of the secure bitstream B. sec The physical storage locations of different data segments are recorded, for example, the segment offsets and lengths corresponding to different permissions (such as restricted access or full access). After verifying permissions through the key, the decoding end does not need to download and decrypt the entire secure bitstream. Instead, it can perform precise addressing based on this index mapping and read only the specific data segments within its permission range, thus achieving efficient and secure hierarchical reading. The main bitstream (usually as the plaintext layer), the secure bitstream (as the protected layer), and the protected header are encapsulated according to a predetermined syntax structure to form the final container bitstream.

[0085] In one embodiment of this application, a decoding step is also included:

[0086] Parse the protected header in the container stream.

[0087] In this embodiment, the decoder receives the container stream and obtains the access key provided locally by the user. The decoder uses the local key K to attempt to decrypt and verify the authentication encryption tag in the protected header. If verification fails (incorrect key or data tampering), the decoding process terminates. If verification succeeds, the decoder further reads the permission bits in the header to determine the access level of the current key K. In a preferred embodiment, the decoder also checks whether the counter or timestamp in the header is within a valid window to prevent replay attacks.

[0088] It performs hierarchical reading based on the permission bits and index mapping in the protected header, and reconstructs the public view, restricted view, or full view.

[0089] In this embodiment, multi-level access is implemented, which can be divided into the following three cases: Case 1: Reconstructing the public view. If the decoding end does not provide a key, or the permission bit corresponding to the provided key K is marked as the lowest public access level, the decoder will ignore the secure bitstream. The decoder only performs anti-entropy coding and inverse frequency domain reconstruction (e.g., inverse DCT or inverse subband transform) on the main bitstream, and finally reconstructs the public view. Due to the adjustment of the spectral domain structure, this public view is visually natural, but the machine (such as a VLP model) cannot extract the protected sensitive semantics from it (e.g., facial features have been destroyed or replaced). Case 2: Reconstructing the restricted view. If the permission bit corresponding to the provided key K is marked as restricted access (e.g., doctor's key), the decoder accurately locates and reads only the data subset corresponding to the restricted access level in the secure bitstream according to the index mapping in the protected header. This subset may contain some parameterized semantic differences (e.g., allowing the recovery of lesion areas in medical images, but not allowing the recovery of patient identity parameters). The decoder combines the main bitstream and the subset of the secure bitstream, performs a partial inverse dual transformation and parameterized reprojection, and finally reconstructs the restricted view. Case 3: Complete View Reconstruction. If the permission bits corresponding to the provided key K are identified as having the highest full access (e.g., a data administrator key), the decoder reads the entire contents of the main bitstream and the secure bitstream according to the index mapping. The decoder performs a complete reversible dual inverse transformation (combining the common latent feature Yp and the dual latent feature Zc) and reprojects all parameterized semantic differences and dual compensations, thus precisely reversing all operations. Finally, the decoder reconstructs a complete view that is semantically and visually consistent with or highly faithful to the original input image before encoding.

[0090] According to one aspect of this application, a privacy-enhancing image compression method specifically comprises: at the encoding end, compressing the input image and dividing it into a main bitstream B. main and secure semantic flow B secThe main bitstream preserves the basic visual structure, while the secure semantic stream contains information for recovering additional semantics or data for controlling perturbations. The specific implementation steps at the encoding end include: acquiring the input image x to be compressed and feeding it into a sensitive region detection module to obtain a sensitive mask M. This mask M identifies high-privacy-risk regions in the image, such as faces, license plates, and text regions. The input image x is then fed into the encoder E. θ Extract latent features y. Perform two parallel privacy-preserving steps: First, sensitive region generative replacement. Based on the mask M, the sensitive regions corresponding to the latent features y are input into the generative model G() (e.g., a Generative Adversarial Network (GAN) or a diffusion model) for semantic redrawing. The original sensitive content is replaced with visually natural content that differs in semantic information (e.g., a synthetic, non-existent face). The training objective L of this generative model is... gen It is a composite loss, which can be expressed as: L gen =λ GAN * L GAN +λ perc * L perc region +λ ctx * L context ; where L GAN It is an adversarial loss mechanism used to ensure the visual naturalness of the generated region; L perc region It is a region-aware loss, used to ensure that the generated regions meet the semantic goal of anonymization; L context The first is context loss, used to force the generated region to remain compatible and smooth with its surrounding context (such as edges and colors). The second is conditional feature perturbation injection. This injects implicit perturbations into latent features, targeting the VLP model, causing it to interfere with the semantics extracted by the VLP model in the reconstructed public view. This perturbation is preferably generated using an optimization strategy based on semantic uncertainty. Specifically, this strategy defines an evidence extractor Θ(·) to measure the VLP model's performance on image-text pairs (x, y, x, y). i , t j Matching evidence, such as: e ij =exp(tanh(sim(F VLP (x i ), F VLP (t j )) / s));where sim(·,·) represents the cosine similarity, and s is the temperature factor; F VLP (x i ) is the image x i Feature representation in the Visual Language Pre-trained Model (VLP), F VLP (t j ) is text t jFeature representation in the VLP model. Based on this, the normalized uncertainty mass u is calculated using Dempster-Shafer theory. ij = (e ij b ) / (Σ j=1 K (e ij b + 1)), where e ij b To match evidence e ij The power of is used to enhance or adjust the strength of evidence; K is the total number of candidate texts. Uncertainty quality u ij This measures the uncertainty of the model's confidence in the pairing decision. The optimizer selects the text index n with the highest uncertainty within the batch. i = arg min u in The optimization objective of the perturbation is to reduce the encryption loss L. enc , is defined as: L enc (x i )=-log(exp(sim(F VLP (x hat_e ), F VLP (t ni )) / s)) / ( Σ j=1 K exp(sim(F VLP (x hat_e ), F VLP (t j )) / s));where x hat_e It is a reconstructed encrypted (public) view after perturbation. The goal of the loss function is to force the encrypted view x to be reconstructed. hat_e In the VLP feature space, it is incorrectly pulled toward the most uncertain text t. ni This achieves semantic misleading of the true match. The above generative substitution and perturbation injection can be fused into the latent feature y to obtain the fused latent representation y'. Entropy model and quantization unit Q Φ ( ) Compresses and partitions the fused latent representation y' to obtain the main bitstream B. main (Carrying the basic visual structure) and secure semantic flow B sec (Carrying compensation information for restoring the original semantics, or trigger data for controlling the perturbation mode).

[0091] During the encoding phase, the overall training objective is an adaptive multi-objective optimization function, which can be expressed as: min R + λ D * L rec +λ E * E[Lenc (x)] +λ G * E[L gen [(x, M)]; where R is the rate loss E[-log Q]; Φ (y hat )],y hat L represents the result of processing latent feature y using an entropy model and quantization units. rec It is visual reconstruction distortion (e.g., a combination of mean squared error or perceptual loss), L enc and L gen These are the encryption loss and the generation loss, respectively. The weights (λ) are adjusted alternately or dynamically during training. D , λ E , λ G It can achieve a balance between compression efficiency, visual quality, and privacy protection.

[0092] The decoding process is as follows: The decoding end receives the main bit stream B. main and (optional) secure semantic flow B sec The user-provided access key k is then sent to the key verification module to obtain the access permission identifier β. Permissions are divided into three levels: public access β... e (Without a key or with a public key), restricted access β r (With intermediate key), and full access to β f (With advanced key). Generate the corresponding disturbance control signal τ based on the access permission identifier β. β This control signal is used to trigger decoder D. Ψ The condition processing path within ( ). For example, the public pattern β e The corresponding τ β It will mask all semantic compensation signals; restricted mode β r The corresponding τ β Partial semantic recovery will be enabled; full mode β f The corresponding τ β This will activate the full inverse perturbation and semantic compensation. Decoder D Ψ ( ) combined with the main bitstream B main Optional secure semantic flow B sec and control signal τ β Reconstruct the final image view, i.e., x hat =D Ψ (B main B sec , τ β Depending on the permission β, the decoding end ultimately outputs the corresponding level of image version: public view x hat_e It hides sensitive content and is semantically misleading to the VLP model; Restricted Semantic View xhat_r It presents some necessary semantic information; the complete view x hat_f It restored the complete content to be consistent with the original image.

[0093] In another embodiment of this application, obtaining the adjusted frequency domain features, parameterized semantic difference, and dual compensation can also involve: reading the frequency domain features, semantic unit set, unit priority, spectral consistency constraints, bitrate budget, and entropy model to generate a structure adjustment plan. Specifically, suppose the semantic discrimination model provides similarity components s between the sample and several candidate texts or target semantics. i Define cross-boundary margin m i With recognition purity ρ i And normalize to obtain the unit-level public terminal misleading benefit U i For each semantic unit's candidate processing type, the expected coding length of the required dual-side information is estimated based on the entropy model, denoted as the compensated expected code rate E. i = E[-log Q(z s The phase continuity, block boundary smoothing, and index modification cost derived from the spectral domain consistency constraint are collectively denoted as the consistency cost C. i Solve the synthesis objective under the bitrate budget constraint: minΣ(α*E) i -β* U i +γ* C i); where α, β, and γ are tradeoff coefficients; output structure adjustment plan (including processing type for each semantic unit: unit suppression, unit replacement, index rearrangement; execution order and local constraints). Based on the structure adjustment plan, unit-level spectral domain structure adjustment is performed on the frequency domain features to obtain the initially adjusted frequency domain features and boundary consistency records. Specifically, energy shaping and phase dealignment are performed on the amplitude and phase spectra of the target sub-band to decouple machine-recognizable cues while maintaining background statistical stability in non-target regions; spectrum-compatible replacement units are retrieved from the spectrum sample library, and energy spectrum matching and phase correction are performed to ensure visual naturalness after replacement without restoring the original recognizable cues; permutation or group rearrangement is performed on specified sub-bands or block indices to break local self-similar structures and periodic patterns; boundary consistency records are generated, recording cross-block phase shifts, energy balance parameters, and index mappings to provide constraints for subsequent continuity repair. The initially adjusted frequency domain features, boundary consistency records, and spectral consistency constraints are read to complete the energy and phase continuity repair of the spectral domain boundaries, resulting in the adjusted frequency domain features. Specifically, the phases of adjacent blocks are aligned according to the phase offset recorded by the boundary consistency to meet the spectral consistency constraint; spectral window fusion and edge spectral attenuation are applied near the boundary to suppress block effects and checkerboard artifacts; background consistency is checked on the energy statistics of the repaired sub-bands, and low-frequency energy is fine-tuned if necessary to maintain overall visual stability, and the adjusted frequency domain features are output. The adjusted frequency domain features and entropy model are read, and naturalization generation and statistical reshaping are performed in the adjusted region to extract the minimum and sufficient authorization restoration parameters, obtain parameterized semantic difference and dual compensation, and update the statistics of the adjusted frequency domain features to fit the low-entropy prior. Specifically, with the expected compensation bitrate as the main objective, optimization is performed in conjunction with visual naturalness and context consistency constraints: min (E[-log Q(z)) s )] +λ GAN * L GAN +λ ctx * L ctx +λ perc *L perc region The process involves extracting parameterized semantic differences and representing recoverable information as low-dimensional parameters (e.g., identity-related parameters, deformation parameters, attribute parameters, or texture codebook indices) rather than pixel residuals, ensuring low entropy and low bitrate in the authorization side information load. Lateral potential elements that need to be supplemented within the reversible dual framework are recorded for steady-state restoration of the authorization path, producing dual compensation. The adjusted frequency domain features are inversely transformed to obtain a temporary common graph, which is used to evaluate the recognition offset stability of the visual-language model and obtain a common misleading index.

[0094] In another embodiment of this application, the encapsulation into a container bitstream further includes: reading the adjusted frequency domain features, separating the common path and dual path through a reversible coupling transformation to obtain common latent features and dual latent features. Specifically, a one-to-one reversible mapping is constructed so that the licensing side can accurately return to the latent coordinates consistent with the common path after obtaining dual information; the visible content of the common end is concentrated into the common latent features; the compensation coordinates necessary to overcome semantic masking are concentrated into the dual latent features, reducing the dispersion of information on the licensing side. By imposing constraints on the Jacobian range of the reversible mapping, the mapping condition number is controlled, improving robustness to recompression and noise. The common latent features, dual latent features, parameterized semantic difference, dual compensation, common misleading index, entropy model, and bitrate budget are read to generate the main bitstream, the secure bitstream, and the index mapping. Specifically, a quota target is defined: in the main bitstream B main With secure bitstream B sec The total bitrate does not exceed the bitrate budget R budget Under the constraint that the Public Misleading Index (PMI) is not lower than the preset threshold for public misleading effectiveness, the total bitrate R is minimized. main + R sec ;where R main R is the encoding length for common latent features. sec The joint encoding length of (dual latent features, parameterized semantic difference, dual compensation) is estimated by an entropy model. When the dimension of the parameterized semantic difference increases or the complexity of the dual latent features rises, the security bitstream quota is increased; when the common end misleading is stable, the proportion of the main bitstream is increased to meet visual quality requirements. The main bitstream is obtained by entropy encoding of the common latent features; the security bitstream is obtained by joint entropy encoding of (dual latent features, parameterized semantic difference, dual compensation); an index mapping is generated, recording permission bits, segment offsets, and lengths for precise addressing of the protected header. The main bitstream, security bitstream, index mapping, and access key are read to generate a protected header and encapsulate it into a container bitstream. Specifically, permission bits, key identifiers, counters, timestamps, and security bitstream hashes are written to the header, and an integrity label is generated using authentication encryption; the main bitstream is used as the plaintext layer, and the security bitstream as the protected layer, together with the protected header, are encapsulated into a container bitstream. The index mapping and the protected header segment positions, lengths, and permissions are checked to verify the validity of the authentication encryption label.

[0095] In summary, the privacy-enhancing image compression method of this application includes: constructing a semantic-frequency map based on frequency domain features and a sensitive mask to locate the set of semantic units on which machine-recognizable semantics depend; performing spectral domain structure adjustment on the frequency domain features according to the set of semantic units, and performing entropy alignment generation in conjunction with an entropy model to obtain the adjusted frequency domain features, low-entropy parameterized semantic difference, and dual compensation; applying reversible dual decomposition to the adjusted frequency domain features to obtain common latent features and dual latent features; using an entropy model, compiling the entropy of the common latent features into a main bitstream, and compiling the joint entropy of the dual latent features, parameterized semantic difference, and dual compensation into a secure bitstream; generating a protected header containing access control information and index mapping in conjunction with an access key, and encapsulating the main bitstream, secure bitstream, and protected header into a single container bitstream.

[0096] This invention eliminates pixel perturbation and operates directly in the frequency domain. By constructing a semantic-frequency map, it can accurately locate the set of key semantic units upon which the machine recognition model depends. Furthermore, by performing spectral domain structure adjustments (such as unit suppression, replacement, and index rearrangement), it directly disrupts the coupling relationship between the amplitude and phase spectra upon which machine recognition depends. This results in a structural and deep semantic masking, achieving stronger robustness to compression and transformation. By proposing entropy-aligned generation and parameterized semantic difference, it no longer preserves high-entropy pixel-level residuals but refines the recovered information into low-dimensional, low-entropy parameters (such as identity vectors, deformation parameters, or texture codebook indices) and dual compensation. This reduces the load on the secure bitstream, achieving accurate semantic recovery at a minimal bitrate cost, effectively resolving the contradiction between compression efficiency and recoverability. Furthermore, by introducing a common misleading index as feedback, it achieves adaptive dual-stream quotas, forming a closed-loop optimization system. This system can dynamically minimize the total bitrate while satisfying constraints on privacy protection strength (common misleading index not lower than a threshold) and total bitrate budget, thus solving the efficiency bottleneck caused by static partitioning. Meanwhile, by combining reversible dual decomposition and a protected header with write index mapping, efficient and secure multi-level access control is achieved in a single container bitstream.

[0097] The preferred embodiments of the present invention have been described in detail above. However, the present invention is not limited to the specific details in the above embodiments. Within the scope of the technical concept of the present invention, various equivalent transformations can be made to the technical solutions of the present invention, and these equivalent transformations all fall within the protection scope of the present invention.

Claims

1. A privacy-enhancing image compression method, characterized in that, include: Acquire and construct a semantic-frequency map based on frequency domain features and sensitivity masks to locate the set of semantic units on which machine-recognizable semantics depend; Based on the set of semantic units, the frequency domain features are adjusted in spectral domain structure, and entropy alignment is performed in combination with the pre-configured entropy model to obtain the adjusted frequency domain features, parameterized semantic difference and dual compensation. Apply invertible dual decomposition to the adjusted frequency domain features to obtain common latent features and dual latent features; Using a pre-configured entropy model, the common latent feature entropy is compiled into the main bitstream, and the dual latent features, parameterized semantic difference, and dual compensation joint entropy are compiled into a secure bitstream. A protected header containing access control information is generated by combining the preset access key, and the main bit stream, security bit stream and protected header are encapsulated into a container bit stream; Perform spectral domain structure adjustments, including: The execution unit suppression applies energy shaping and phase dealignment to the amplitude and phase spectra of a preset target sub-band to decouple machine-identifiable cues. The unit replacement is performed by retrieving a spectrum-compatible replacement unit from a spectrum sample library and performing energy spectrum matching and phase correction. Alternatively, perform index rearrangement, which performs replacement or grouping rearrangement on a specified subband or block index to disrupt the local self-similar structure; Performing spectral domain structure adjustments also includes: After performing unit suppression, unit replacement, or index rearrangement, continuity repair is applied to block boundaries and phases based on the semantic unit set. The continuity restoration includes: performing cross-block phase alignment to meet spectral domain consistency constraints, and employing spectral domain window fusion and edge spectral attenuation to suppress block effects and checkerboard artifacts; Obtaining the parameterized semantic difference and dual compensation includes: In the region after spectral domain structure adjustment, naturalization generation and statistical reshaping are performed to obtain parametric semantic difference and dual compensation. The naturalization generation and statistical reshaping aim to optimize a joint objective, which is dominated by the expected compensated bitrate estimated by the entropy model and jointly constrains the naturalness, contextual consistency and region-aware quality of the generated content. Obtain common latent features and dual latent features, including: Based on the adjusted frequency domain features, a reversible coupling transformation is used to aggregate common visual information into common latent features, and to aggregate the compensation coordinates required for authorized recovery into dual latent features.

2. The method according to claim 1, characterized in that, Perform spectral domain structure adjustment on frequency domain features, including: Before performing spectral domain structure adjustments, a structure adjustment plan is generated; the generation of the structure adjustment plan aims to optimize the overall objective, which is determined by balancing the following factors: The expected compensation rate is estimated based on the entropy model, the common-end misleading benefit is calculated based on cross-class decision boundary margin and recognition purity, and the spectral domain consistency cost is derived from phase continuity and block boundary smoothness constraints.

3. The method according to claim 1, characterized in that, The set of semantic units for location includes: Based on frequency domain features and sensitivity masks, semantic heatmaps are obtained through semantic attribution mapping. The semantic heatmap is aggregated to the frequency band, block and phase dimensions of the frequency domain features to screen out high contribution regions; Assess the cross-class decision boundary margin, energy density, and phase alignment of high-contribution regions to determine the set of semantic units.

4. The method according to claim 1, characterized in that, The parameterized semantic difference is extracted into low-dimensional parameters to replace the high-entropy pixel residuals; the low-dimensional parameters are selected from: identity-related parameters, deformation parameters, attribute parameters or texture codebook indexes.

5. The method according to claim 1, characterized in that, Generate a protected header containing access control information, including: Based on the access key, write the permission bits, key identifier and authentication encryption tag into the protected header; An index mapping for decoding multi-level views is simultaneously written into the protected header. This index mapping records the segment offsets and lengths corresponding to different permissions in the secure bitstream.

Images