Keyed Orthonormal Latent Scrambling for Wireless Image Transmission with Deep JSCC

Abstract

Deep joint source–channel coding (JSCC) enables learned wireless image transmission while exposing transmitted representations to unintended receivers. A useful protection layer must connect a reproducible keyed interface to legitimate image quality, experimentally measured leakage and explicit protocol costs. We integrate packet-specific orthonormal latent scrambling with deep JSCC, establish its legitimate-channel equivalence under isotropic Gaussian noise and known scalar fading, and evaluate it using independently trained codecs, adaptive inference attacks and resource-matched protection mechanisms. Across six codecs, legitimate reconstruction achieves a structural similarity index measure (SSIM) of 0.8365–0.8401 at a signal-to-noise ratio (SNR) of 12 dB, while SSIM-selected attackers at 20 dB attain 0.1309–0.1310 against an image-prior score of 0.1307; natural-image-trained tile and context attackers also remain close to their prior on 24 native-resolution Kodak frames. Larger learning budgets, noiseless observations and joint inference from up to 16 repeated transmissions quantify the empirical protection of the tested interface, while fading, transform-reuse and authenticated-header experiments identify its operating conditions and costs.

1. Introduction

Wireless image transmission increasingly combines learned representations with physical-layer processing. Deep joint source–channel coding (JSCC) learns an encoder that maps image pixels directly to continuous channel symbols and a decoder that reconstructs the image from noisy observations. This encoder–decoder pair, termed a codec, can provide a gradual change in reconstruction quality as the signal-to-noise ratio (SNR) varies, making it attractive for links with tight latency requirements and uncertain channel conditions [1]. Confidentiality is a further design objective: an unintended receiver may use the transmitted representation to reconstruct an image or infer its class even when the legitimate reconstruction task remains the same.

Several approaches integrate protection into learned image transmission. Deep joint source–channel and encryption coding (DeepJSCEC) combines JSCC with the encryption of quantized representations and evaluates chosen-plaintext adversaries [2]. Xu et al. integrate visual protection into image JSCC [3], while Fu and Suto use chaotic maps to shuffle latent positions and assess deep known-plaintext attacks [4]. Artificial-noise methods allocate transmission resources to degrade eavesdropper reception [5]. Privacy-aware JSCC also considers private-attribute inference alongside image reconstruction, including evaluations on the ten-class CIFAR-10 color-image benchmark and the CelebFaces Attributes dataset [6]. These studies establish reconstruction and semantic inference as complementary aspects of protection. Active attacks provide a further perspective on the security of semantic decisions [7].

Secret linear transforms also have a substantial foundation in compressed encryption. Yu combines a renewable bipolar keystream with public unitary factors in an undersampled sensing operator, analyzing noisy distinguishability and selected recovery attacks [8]. Bianchi et al. characterize the privacy properties of one-time random projections and distinguish Gaussian ensembles from structured non-Gaussian constructions [9]. Rachlin and Baron examine secrecy in compressed sensing [10], and Cambareri et al. quantify known-plaintext recovery under sensing-matrix reuse [11]. Together, these works establish transform renewal, source statistics and reuse as central considerations.

A specific integration gap remains at the continuous deep-JSCC interface: the keyed transform, legitimate-channel behavior, attack sensitivity and protocol cost need to be specified and assessed together. This requires connecting a reproducible packet-dependent transform to the actual learned representation, comparing protection mechanisms under fixed codec weights, and separating protection during training from scrambling during transmission. An image-independent reconstruction prior, informative controls, domain-relevant attack fitting and explicit learning budgets provide concrete reference points for this assessment.

We address this gap with a keyed orthonormal layer acting on the compressed latent produced by an image codec. A shared secret key and a public nonce, a packet identifier used once under that key, select a norm-preserving transform. The intended receiver regenerates and inverts it before learned decoding. The evaluation combines paired codec training, independently fitted reconstruction and inference attacks, natural-image attack training, and common-codec protection comparisons at equal reserved transmission resources. The same framework supports native-resolution reconstruction through tiled inference. Privacy is assessed empirically through the information recovered by the specified adversaries, with model families, budgets and observation access stated explicitly. Table 1 summarizes representative approaches across learned image transmission and compressed encryption, distinguishing their protection mechanisms, legitimate recovery procedures and evaluation objectives.

Table 1. Representative approaches to protection in learned image transmission and compressed encryption. The comparison summarizes mechanisms and evaluation objectives.

Work	Protection Mechanism	Legitimate Recovery	Evaluation Focus
Tung and Gündüz [2]	Public-key encryption of quantized learned representations.	Decryption and soft latent estimation followed by a neural decoder.	Chosen-plaintext security and reconstruction under channel noise.
Xu et al. [3]	Learned image-domain visual protection coupled with JSCC.	Neural decoding in the protected domain followed by learned deprotection.	Visual-protection strength and reconstruction quality.
Fu and Suto [4]	Chaotic-map shuffling of latent positions.	Inverse shuffling followed by the trained image decoder.	Deep known-plaintext attacks and image reconstruction.
Letafati et al. [6]	Adversarial representation learning with a privacy–utility objective.	Neural image decoder trained jointly with the privacy-aware encoder.	Image reconstruction and private-attribute inference with multiple eavesdroppers.
Yu [8]	Renewable secret signs in partial-unitary compressed sensing.	Sparse reconstruction from undersampled measurements.	Noisy indistinguishability and chosen-plaintext keystream recovery.
Present study	Packet-dependent orthonormal mixing of continuous learned latents.	Exact inverse transformation followed by a neural decoder.	Legitimate-channel equivalence, adaptive reconstruction and class inference, transform reuse and coded-header cost.

The contributions are fourfold:

• A fully specified keyed latent interface, including parameter generation, nonce allocation, inversion and public validation vectors, that integrates directly with continuous image JSCC.
• A legitimate-channel analysis establishing exact decoder-input equivalence under isotropic additive white Gaussian noise (AWGN) and known scalar fading together with source-statistic and transform-reuse analyses.
• A controlled empirical assessment across independently trained codecs, semantic-defense settings, metric-aligned attacker selections, larger fitting budgets, higher-quality interceptions, joint packet inference and natural-image-trained context attacks.
• Common-codec protection benchmarks, fading and multipath measurements, and explicit computation and communication accounting for persistent nonce allocation and authenticated metadata.

Section 2 presents the construction and its analytical properties. Section 3 describes the data, training, attacks and evaluation procedures. Section 4 reports the findings, Section 5 discusses their implications and future directions, and Section 6 concludes the paper.

2. Keyed JSCC Framework

2.1. Source, Receivers and Observation Interface

Figure 1 shows the transmitter, intended receiver and passive observer. Alice transmits a red–green–blue (RGB) image $\mathbf{x}\in {[0,1]}^{h_x\times w_x\times 3}$, where $h_x$ and $w_x$ are its height and width. The encoder $f_{\theta }$, with learned weights $\theta$, produces a latent vector $\mathbf{z}=f_{\theta }\left(\mathbf{x}\right)\in {\mathbb{R}}^N$ of N real coordinates. Bob reconstructs the image using decoder $g_{\varphi }$ with weights $\varphi$. Alice and Bob share secret key K and use a public packet nonce n that is unique under K.

Figure 1. Keyed image transmission and evaluated observation interface. (a) Alice encodes and normalizes an image, then applies the packet-specific orthonormal transform. Bob regenerates the same parameters from the shared key and public nonce, inverts the transform and decodes the image. Eve receives her own noisy observation and the public nonce for reconstruction and class inference. Dashed purple paths carry secret-dependent parameters, dotted amber paths carry public metadata, and solid arrows carry continuous payloads. Blue, teal and orange regions identify Alice, Bob and Eve, respectively. (b) Two diagonal sign masks, fixed Hadamard mixing and a permutation implement the transform and its inverse. Section 2.4 specifies parameter generation.

Eve knows the codec architecture and weights, parameter-generation algorithm, channel model and transmitted nonce. Known images and their intercepted packets supply supervised fitting pairs. Her reconstruction model is ${\widehat{\mathbf{x}}}_E=h_{\psi }({\mathbf{r}}_E,n)$, where $\psi$ denotes its weights and ${\mathbf{r}}_E$ is her noisy packet observation. Her classifier $q_{\omega }(c\mid {\mathbf{r}}_E,n)$, with weights $\omega$, estimates the probability of image class $c\in \{1,\dots ,C\}$, where C is the number of classes. Other fitted heads estimate explicitly defined image attributes. Repeated-observation attacks receive a set ${\left\{({\mathbf{r}}_{E,j},n_j)\right\}}_{j=1}^J$ of J independently transformed transmissions of the same image. This is a passive known-plaintext interface with a public encoder and transform family; secret keys are withheld from the attacker models.

The empirical threat model comprises the model families, fitting data, optimization budgets and packet-access conditions in Section 3.5. Reconstruction, class-label inference and attribute inference are separate measured tasks. Confidentiality is assessed empirically for this finite attacker suite; the exact analytical guarantees concern energy preservation and legitimate decoder-input equivalence under the stated channel assumptions. Nonce uniqueness is a prerequisite: reuse restores a stationary linear observation map and exposes the recovery mechanism in Section 2.5. Metadata modification and replay are considered separately through authenticated receiver processing in Section 3.12.

2.2. Orthonormal Mixing and Power Normalization

Let $N=2^r$ for a positive integer r. Let $H\in {\mathbb{R}}^{N\times N}$ be the normalized Sylvester Walsh–Hadamard matrix, satisfying $H^{\top }H=I_N$, where ⊤ denotes transposition and $I_N$ is the N-dimensional identity matrix. The key and nonce generate two sign vectors ${\mathbf{d}}_{1,K,n},{\mathbf{d}}_{2,K,n}\in {\{-1,+1\}}^N$ and permutation matrix $P_{K,n}\in {\{0,1\}}^{N\times N}$ with one unit entry in each row and column. For mask index $j\in \{1,2\}$, $\mathrm{diag}\left({\mathbf{d}}_{j,K,n}\right)$ places the sign vector on a diagonal. Define the transform in Equation (1):

$$S_{K,n}=P_{K,n}{D}_{2,K,n}H{D}_{1,K,n},D_{j,K,n}=\mathrm{diag}\left({\mathbf{d}}_{j,K,n}\right).$$

(1)

Each factor is orthogonal: its columns and rows form orthonormal bases. Thus, the composite preserves the Euclidean norm ${\parallel ·\parallel }_2$ and has the inverse given in Equation (2):

$$S_{K,n}^{\top }{S}_{K,n}=I_N,S_{K,n}^{-1}=S_{K,n}^{\top }=D_{1,K,n}{H}^{\top }{D}_{2,K,n}{P}_{K,n}^{\top }.$$

(2)

The fast Walsh–Hadamard transform (FWHT) requires $O\left(N\log N\right)$ arithmetic operations; sign application and permutation each require $O\left(N\right)$ operations. Here, $O(·)$ denotes asymptotic operation-count order. The layer has no trainable parameters.

For target average power $P_0>0$ per real symbol, normalize the encoder output before transmission as in Equation (3):

$$\mathbf{u}={\mathcal{N}}_{ϵ}\left(\mathbf{z}\right)=\sqrt{{\displaystyle \frac{P_0}{\max (\parallel \mathbf{z}{\parallel }_2^2/N,ϵ)}}}\mathbf{z},\tilde{\mathbf{s}}=S_{K,n}\mathbf{u},ϵ={10}^{-6}.$$

(3)

The positive guard $ϵ$ makes normalization well-defined at zero. For ${\parallel \mathbf{z}\parallel }_2^2/N\ge ϵ$, the transmitted energy is $\parallel \tilde{\mathbf{s}}{\parallel }_2^2=N{P}_0$. The implementation uses 32-bit floating-point arithmetic (float32) for normalization and mixing.

Bob and Eve receive the independent AWGN observations in Equation (4):

$${\mathbf{r}}_B=\tilde{\mathbf{s}}+{\mathbf{w}}_B,{\mathbf{r}}_E=\tilde{\mathbf{s}}+{\mathbf{w}}_E,{\mathbf{w}}_j\sim \mathcal{N}(\mathbf{0},{\sigma }_j^2{I}_N),j\in \{B,E\}.$$

(4)

Here, $\mathcal{N}(\mathbf{0},{\sigma }_j^2{I}_N)$ is a zero-mean Gaussian distribution with independent coordinates of equal variance ${\sigma }_j^2$, which are termed isotropic noise. The normalized AWGN interface uses $P_0=1$ and ${\sigma }_j^2={10}^{-{\rho }_j/10}$, where ${\rho }_j$ is the receiver’s SNR in decibels (dB). Resource comparisons separately adjust active-symbol power under a common reserved-energy budget. Bob applies the decoder in Equation (5):

$${\widehat{\mathbf{x}}}_B=g_{\varphi }\left(S_{K,n}^{\top }{\mathbf{r}}_B\right).$$

(5)

2.3. Legitimate-Channel Equivalence

Proposition 1

(Normalization and decoder-input law). For any realized orthogonal matrix S and latent $\mathbf{z}$, Equation (6) holds:

$${\mathcal{N}}_{ϵ}\left(S\mathbf{z}\right)=S{\mathcal{N}}_{ϵ}\left(\mathbf{z}\right).$$

(6)

Consequently, for $\mathbf{u}={\mathcal{N}}_{ϵ}\left(\mathbf{z}\right)$ and ${\mathbf{r}}_B=S\mathbf{u}+{\mathbf{w}}_B$, Equation (7) gives the decoder input:

$$S^{\top }{\mathbf{r}}_B=\mathbf{u}+{\mathbf{w}}_B^{\prime },{\mathbf{w}}_B^{\prime }\sim \mathcal{N}(\mathbf{0},{\sigma }_B^2{I}_N).$$

(7)

For fixed codec weights and equal noise variance, the conditional input distribution of Bob’s decoder therefore equals that of normalized unscrambled JSCC.

Proof. 

Orthogonality preserves ${\parallel \mathbf{z}\parallel }_2$ and hence the normalization factor, including its guard. The transformed noise ${\mathbf{w}}_B^{\prime }=S^{\top }{\mathbf{w}}_B$ remains Gaussian with covariance $S^{\top }\left({\sigma }_B^2{I}_N\right)S={\sigma }_B^2{I}_N$. Substitution gives Equation (7).    □

This result establishes the legitimate utility property for the correctly inverted payload at equal SNR. It also permits sampling Bob’s training noise directly after inversion. Numerical inversion and normalization checks accompany the implementation.

The same argument extends conditionally to a known, nonzero complex scalar fading coefficient a. Pair the real coordinates into complex symbols and let $A_a$ be the real matrix representing multiplication by a. Equalization precedes transform inversion. For received vector $\mathbf{y}=A_{a}S\mathbf{u}+\mathbf{w}$, with $\mathbf{w}\sim \mathcal{N}(\mathbf{0},{\sigma }^2{I}_N)$, the equalized and inverted input is given by Equation (8):

$$S^{\top }{A}_a^{-1}\mathbf{y}=\mathbf{u}+{\mathit{\eta }}_a,{\mathit{\eta }}_a\mid a\sim \mathcal{N}\left(\mathbf{0},{\displaystyle \frac{{\sigma }^2}{{\left|a\right|}^2}}{I}_N\right).$$

(8)

Here, $\left|a\right|$ denotes complex magnitude. Thus, known scalar Rayleigh or Rician fading preserves equality with the corresponding equalized identity interface, which is conditional on the gain. Averaging over gains produces the same fading-dependent noise mixture in both interfaces.

For a general real channel matrix A and linear receiver W, both of size $N\times N$, define the residual matrix $E_A=WA-I_N$. Equation (9) gives the decoder input and noise covariance:

$$S^{\top }W(AS\mathbf{u}+\mathbf{w})=\mathbf{u}+S^{\top }{E}_{A}S\mathbf{u}+S^{\top }W\mathbf{w},\mathrm{Cov}\left(S^{\top }W\mathbf{w}\right)={\sigma }^2{S}^{\top }W{W}^{\top }S.$$

(9)

The covariance operator is denoted by Cov. Estimated channel gains, incomplete synchronization and frequency-selective equalization can leave signal distortion and colored noise. Matched receiver experiments quantify the resulting distortion and noise for these channel conditions. The distortion norm obeys $\parallel S^{\top }{E}_A{S\mathbf{u}\parallel }_2\le \parallel E_A{\parallel }_2{\parallel \mathbf{u}\parallel }_2$, where the matrix norm is the induced spectral norm.

2.4. Key-to-Transform Protocol

The protocol uses a uniformly generated 32-byte master key and a 12-byte public nonce. The practical allocator uses a 32-bit sender identifier followed by a durable 64-bit counter under an explicit key-generation identifier. Senders have distinct identifiers under a shared key; reserved counter ranges survive restarts and are never rolled back. A key is replaced before exhaustion or state rollback. Section 3.12 specifies allocation and receiver synchronization. The keyed-hash message authentication code (HMAC) supplies the underlying primitive for the HMAC-based extract-and-expand key derivation function (HKDF) [12]. HKDF uses SHA-256, which is the 256-bit Secure Hash Algorithm. Its outputs key the Advanced Encryption Standard (AES) with a 256-bit key in counter (CTR) mode [13,14].

For purpose label $\mathsf{\ell }\in \{\mathtt{sign}\mathtt{1},\mathtt{sign}\mathtt{2},\mathtt{permutation}\}$, derive the 48-byte string in Equation (10):

$$T_{\mathsf{\ell }}={\mathrm{HKDF}}_{\mathrm{SHA}256}\left(K;\mathrm{salt}=n,\mathrm{info}=v\parallel \mathrm{BE32}\left(N\right)\parallel \mathsf{\ell },48\right).$$

(10)

The symbol ‖ denotes byte concatenation, BE32 is unsigned four-byte big-endian encoding, and v is the byte encoding of JSCC-ORTHO-HKDF-AESCTR-v1 followed by a zero byte. The label and tag use the American Standard Code for Information Interchange (ASCII). The first 32 bytes of $T_{\mathsf{\ell }}$ form the AES key; its final 16 bytes initialize the 128-bit counter, which increments in big-endian order with wrap rejected. Encrypting zero bytes yields a purpose-specific pseudorandom stream.

Each sign stream consumes N bits, least-significant bit first within a byte, and maps bit $a\in \{0,1\}$ to $1-2a$. The permutation stream drives a descending Fisher–Yates shuffle. For current index-range size b, accept a big-endian unsigned 32-bit word a only when Equation (11) holds:

$$a<L_b,L_b=2^{32}-\left(2^{32}\mathrm{mod}b\right),$$

(11)

then select index $a\mathrm{mod}b$. Every index has $L_b/b$ accepted preimages, making the sampling unbiased for uniform stream words. Purpose labels separate the three parameter streams. Their computational pseudorandomness relies on the standard HKDF/HMAC and AES assumptions. Public validation vectors, primitive known-answer tests, permutation checks and transform-inversion tests specify the implementation byte for byte.

2.5. Reuse and Source-Statistic Analysis

To analyze transform reuse, let m known normalized latents form $U=[{\mathbf{u}}_1,\dots ,{\mathbf{u}}_m]\in {\mathbb{R}}^{N\times m}$ and let their noiseless transformed observations form $V=[{\mathbf{v}}_1,\dots ,{\mathbf{v}}_m]=SU$. If U has full row rank N, the reused matrix is identified by Equation (12):

$$S=V{U}^{\top }{\left(U{U}^{\top }\right)}^{-1}=V{U}^{†},$$

(12)

where † denotes the Moore–Penrose pseudoinverse. In noise, this expression gives the least-squares estimate. An orthogonal Procrustes estimate instead minimizes ${\parallel V-QU\parallel }_F^2$ over matrices Q satisfying $Q^{\top }Q=I_N$, where ${\parallel ·\parallel }_F$ is the Frobenius norm, which is the square root of the sum of squared matrix entries. If $V{U}^{\top }=L\Sigma R^{\top }$ is a singular value decomposition, with orthogonal factors $L,R$ and nonnegative diagonal singular-value matrix $\Sigma$, the estimate is $\widehat{S}=L{R}^{\top }$. The public encoder supplies the latent side of these known-image pairs. Unique nonces index separate parameter-stream derivations for ordinary packets; the reuse control deliberately holds one matrix fixed.

Proposition 2

(Source dependence of coordinate statistics). For $N\ge 2$, the family $S=P{D}_{2}H{D}_1$ maps two equal-energy latent vectors to distinguishable noiseless coordinate-magnitude distributions for every choice of signs and permutation.

Proof. 

Let ${\mathbf{e}}_i,{\mathbf{e}}_j$ be distinct standard basis vectors. The vectors in Equation (13)

$${\mathbf{u}}^{\left(1\right)}=\sqrt{N{P}_0}{\mathbf{e}}_i,{\mathbf{u}}^{\left(2\right)}=\sqrt{N{P}_0/2}({\mathbf{e}}_i+{\mathbf{e}}_j)$$

(13)

both have energy $N{P}_0$. Every entry of H has magnitude $N^{-1/2}$, so $S{\mathbf{u}}^{\left(1\right)}$ has N coordinates of magnitude $\sqrt{P_0}$. Two orthogonal Hadamard columns agree in half their signs and differ in half; $S{\mathbf{u}}^{\left(2\right)}$ therefore has $N/2$ zero coordinates and $N/2$ of magnitude $\sqrt{2P_0}$. Consequently, the fourth-order coordinate sums satisfy Equation (14):

$${\displaystyle \sum _{k=1}^N}{\left(S{\mathbf{u}}^{\left(1\right)}\right)}_k^4=N{P}_0^2,{\displaystyle \sum _{k=1}^N}{\left(S{\mathbf{u}}^{\left(2\right)}\right)}_k^4=2N{P}_0^2.$$

(14)

The fourth-order coordinate statistic separates these ambient-domain inputs. □

The same statistic connects the transform family to learned latent distributions. For a fixed normalized $\mathbf{u}$, define $q_k={\sum }_{i=1}^N{u}_i^k$, $v_E=q_2/N+{\sigma }_E^2$, and $\overline{r_E^k}=N^{-1}{\sum }_i{r}_{E,i}^k$. Averaging over independent equiprobable signs (Rademacher variables) in $D_1$ and Gaussian channel noise gives the fourth- and sixth-moment identities in Equations (15) and (16), respectively:

$$\begin{array}{cc}\hfill \mathbb{E}[\overline{r_E^4}\mid \mathbf{u}]& =3v_E^2-2q_4/N^2,\hfill \end{array}$$

(15)

$$\begin{array}{cc}\hfill \mathbb{E}[\overline{r_E^6}\mid \mathbf{u}]& =15v_E^3-30v_E{q}_4/N^2+16q_6/N^3.\hfill \end{array}$$

(16)

Here, $\mathbb{E}$ denotes expectation. At unit average latent power, Equation (15) becomes $3{(1+{\sigma }_E^2)}^2-(2/N)\overline{u^4}$, where $\overline{u^4}=q_4/N$. These ideal-family conditional moments motivate coordinate-order-invariant attackers and diagnostics on the actual encoder output.

3. Evaluation Methodology

3.1. Datasets and Partitions

CIFAR-10 contains 50,000 training and 10,000 test RGB images of $32\times 32$ pixels in ten classes [15]. A stratified split with seed 20261015 allocates 45,000 training images to fitting and 5000 to validation with 500 validation images per class. The six codecs and their attackers share these source-image partitions. The reporting set consists of 3600 official test images at zero-based indices 6400–9999. It is shared across experiments and repeatedly evaluated under the specified conditions. Fitting, feature scaling and model selection use the training-derived partitions; the experimental configuration is fixed before reporting-set evaluation.

Natural-image attacker fitting uses the official DIVerse 2K resolution dataset (DIV2K) with 800 training and 100 validation frames [16,17]. Kodak supplies 24 reporting frames of $768\times 512$ or $512\times 768$ pixels [18], which are divided into 384 non-overlapping $32\times 32$ tiles per frame. Frames are reconstructed before scoring. A separate seed-42 reference codec connects the natural-image and supporting interface experiments to a fixed representation. Its checkpoint was selected on the first 6400 CIFAR test images, which are excluded from the common reporting set. The six paired codecs use training-derived validation selection exclusively. Reference-codec details and the CIFAR-to-Kodak attack-transfer controls appear in Supplementary Materials S1; the domain-trained natural-image experiment is specified in Section 3.8.

3.2. Codec Architecture and Training

The codec maps an image’s 3072 real pixel components to $N=256$ real payload symbols, which is a dimension ratio of $1/12$. The real coordinates represent the in-phase and quadrature (I/Q) components of 128 complex channel uses. Table 2 specifies the residual convolutional neural network (CNN). Group normalization (GN) uses eight channel groups; the sigmoid-weighted linear unit (SiLU) activation maps a scalar t to $t/(1+e^{-t})$. Layer normalization, denoted LayerNorm, normalizes a sample’s latent features and learns an affine rescaling.

Table 2. Encoder–decoder architecture. A residual block contains two $3\times 3$ convolutions, which are each preceded by GN and SiLU. Channel counts are shown by arrows.

Stage	Operations
Encoder	$3\to 64$ convolution and residual block; three stride-2 stages $64\to 128\to 256\to 256$, each followed by a residual block; GN/SiLU; flatten $256\times 4\times 4$; linear $4096\to 256$; LayerNorm(256).
Decoder	Linear $256\to 4096$; reshape to $256\times 4\times 4$; GN/SiLU and residual block; three nearest-neighbor upsampling stages with convolution/residual blocks $256\to 256\to 128\to 64$; output $64\to 3$ convolution and sigmoid.

For an image with $d_x=3h_x{w}_x$ components, define mean squared error (MSE) as $d_x^{-1}{\parallel \widehat{\mathbf{x}}-\mathbf{x}\parallel }_2^2$. Let $U_C\left(c\right)=1/C$ be the uniform class distribution. The online training classifier, with weights $\xi$, has unnormalized scores, or logits, $a_c$, which produce probabilities $p_{\xi }\left(c\right)=e^{a_c}/{\sum }_{j=1}^C{e}^{a_j}$ through softmax normalization. The codec minimizes the objective in Equation (17), with the defense penalty defined in Equation (18):

$$\begin{array}{cc}\hfill {\mathcal{L}}_{\mathrm{codec}}& =\mathbb{E}\mathrm{MSE}({\widehat{\mathbf{x}}}_B,\mathbf{x})+\lambda {\mathcal{L}}_{\mathrm{def}},\hfill \end{array}$$

(17)

$$\begin{array}{cc}\hfill {\mathcal{L}}_{\mathrm{def}}& =\mathbb{E}{D}_{\mathrm{KL}}\left(U_C\parallel p_{\xi }(·\mid {\mathbf{r}}_E,n)\right)=\mathbb{E}\left[-{\displaystyle \frac{1}{C}}{\displaystyle \sum _{c=1}^C}\log p_{\xi }(c\mid {\mathbf{r}}_E,n)\right]-\log C,\hfill \end{array}$$

(18)

averaged over fitting images and observations. Here, $\lambda \ge 0$ weights semantic defense, and $D_{\mathrm{KL}}(p\parallel q)={\sum }_{c}p\left(c\right)\log [p\left(c\right)/q\left(c\right)]$ is Kullback–Leibler (KL) divergence. Logarithms in losses are natural with units of nats. The implemented loss clips log probabilities to $[-30,0]$ for numerical stability; Equation (18) gives the unclipped objective.

Three random seeds, 1001, 1002 and 1003, each initialize two codecs with $\lambda =0$ and $0.2$. Each pair shares initialization, image order, standardized noise draws, key fixtures and nonce allocations. This use of common random numbers makes the two training conditions directly comparable under the same random conditions. The arms are separate transmission experiments, each with unique nonces; seed blocks have distinct keys. Each codec trains for 30 epochs (complete passes through its fitting images) with batch size 128, Adam with decoupled weight decay (AdamW) [19], learning rate $2\times {10}^{-4}$, weight decay ${10}^{-4}$ and gradient-norm clipping at 1. A checkpoint is the stored set of model weights; the checkpoint minimizing validation MSE under a fixed channel draw is retained.

The nonce is represented by six public 16-bit chunks, which are each scaled to $[0,1]$. The online semantic classifier is a multilayer perceptron (MLP), which is a dense feed-forward network. It embeds six nonce features through $6\to 64\to 32$ layers and concatenates them with 256 observed symbols, which is followed by $288\to 256\to 256\to 10$ SiLU layers. It receives two cross-entropy updates per codec update, where the cross-entropy for observed class label Y is $-\log p_{\xi }(Y\mid {\mathbf{r}}_E,n)$. Its weights are held fixed during the codec-gradient calculation. Both defense-weight arms execute this online-classifier schedule. Bob’s training noise is sampled after inversion using Equation (7); evaluation executes the forward channel and inverse transform.

3.3. Experimental Designs

Table 3 summarizes the designs and their comparison units. Fixed codec weights isolate changes to the observation interface, attacker procedure and receiver; paired training isolates the additional defense-loss term.

Table 3. Experimental designs, fitting data and comparison units. All reporting images are excluded from fitting and validation selection.

Design	Fitting and Selection	Conditions	Unit
Paired codecs	Three seed pairs, $\lambda =0/0.2$; 45,000/5000 fitting/validation images.	Fixed learned weights for subsequent interface tests.	Training-seed pair.
Primary attacks	17 candidates and four stationary controls per codec; 30 epochs; metric and loss selections.	Unique-nonce, identity and fixed-transform observations at 20 dB.	Source image; six codecs.
Budget and observation access	Two seed-1001 arms; 30/60/120-epoch budgets; fresh high-SNR and packet-set models.	20/30/40 dB and noiseless; 1–16 packets; binary labels and three attributes.	Source image; keys/draws explicit.
Natural-image attacks	DIV2K fitting/validation frames; two starts for tile and context models.	All 24 Kodak frames; adjacent four-tile context and identity controls.	Complete frame.
Channel and reuse	Four fixed codecs; matched receiver/channel draws; known pairs from fitting images.	Seven fading/synchronization scenarios; 1–4096 reused-map pairs.	Source image; draw and subset.
Protection references	Common seed-1001 codecs, train-only quantizers; matched-SNR compact attackers.	Equal reserved uses and nominal energy; keyed, AES-GCM and linear-BFV mechanisms.	Source image; resource profile.
Protocol	Persistent sender/receiver state; explicit error-detection/authentication tests.	Header simulation, groups of 1/8/32/128 and component timing.	Header trial, group or timed batch.

3.4. Metrics, Selection and Uncertainty

The peak signal-to-noise ratio (PSNR) is $-10{\log }_{10}\left[M^{-1}{\sum }_{i=1}^M{\mathrm{MSE}}_i\right]$ at unit image range, where M is the number of scored images. The structural similarity index measure (SSIM) compares local means, variances and covariance [20]. The primary RGB score uses an $11\times 11$ Gaussian window of standard deviation 1.5 pixels, population moments and constants $0.{01}^2$ and $0.{03}^2$. It averages over valid window centers and channels without clipping. Each $32\times 32$ image has $22\times 22$ valid centers. Secondary zero-padded scoring uses all centers, nonnegative variance guards and final scalar clipping to $[0,1]$. Predicted pixels are limited to $[0,1]$ before scoring; the zero-padded implementation additionally clips its final scalar score to $[0,1]$. Supplementary Materials S1 includes an independent float64 reference comparison.

Reconstruction checkpoints and model families maximize validation valid-window SSIM. Ten-class inference maximizes validation top-1 accuracy, which is the proportion of correct maximum-probability decisions. Binary inference maximizes balanced accuracy, the mean of the two class recalls, and also reports the area under the receiver operating characteristic curve (AUROC). Attribute regressors minimize validation MSE after fitting-set standardization. Loss-selected checkpoints are retained separately: image MSE for reconstruction and cross-entropy for classification. Training objectives and checkpoint criteria are therefore recorded independently. A tied maximum validation metric is resolved by the executed deterministic checkpoint-update policy; every selected checkpoint attains that maximum within its available budget.

For scalar observations $t_i$, define the between-class variance fraction by Equation (19):

$${\eta }^2={\displaystyle \frac{{\sum }_{c=1}^C{m}_c{({\mu }_c-\mu )}^2}{{\sum }_i{(t_i-\mu )}^2}},$$

(19)

where $m_c$ is the number of observations in class c, ${\mu }_c$ is that class’s mean and $\mu$ is the overall mean. It is a descriptive diagnostic of class dependence for a specified statistic.

An image-independent prior uses fitting images only. CIFAR candidates include the mean image, mean RGB color and fixed gray levels, which are selected on validation images. Attribute and class-prior estimates likewise use fitting labels or images. Packet-conditioned outcomes are reported alongside these references. The coefficient of determination $R^2$ compares attribute squared error with the reporting-set variance with zero corresponding to a reporting-mean predictor. Balanced accuracy and AUROC have 0.5 as their binary chance reference.

Conditional 95% confidence intervals (CIs) resample paired source images for CIFAR and complete frames for Kodak. The paired SSIM–prior contrasts use 5000 percentile-bootstrap resamples, seed 20261030; Kodak summaries use 10,000 frame resamples with the recorded seed. A Wilson interval describes one fixed classifier’s correct/incorrect outcomes. Separate codec seeds, keys and noise draws are shown explicitly; repeated measurements of one source image are not counted as independent images. Descriptive maxima over tested candidates are labeled separately from validation-selected outcomes. These intervals condition on learned models and recorded channels and are pointwise without correction for searching across candidate results.

3.5. Attacker Fitting and Metric-Aligned Selection

The attack experiments use the public encoder, the specified transform family, the intercepted symbols and the public nonce. The challenge key is withheld from the prediction models. For each of the six codecs, 45,000 CIFAR-10 training images provide fitting pairs and 5000 disjoint training images provide validation pairs. The same 3600 reporting images are scored for each codec. Feature means and scales are estimated from fitting images. Cached fitting uses one key-generated packet per fitting image. Public-family fitting generates independent sign masks, permutations and channel noise whenever an image is presented, while validation and reporting use packets generated by the keyed protocol. These complementary fitting procedures assess both learning from recorded observations and learning statistical regularities of the public transform family.

The primary suite contains ten class-label predictors and seven image reconstructors. The class-label predictors comprise five raw-symbol MLPs, four invariant-feature MLPs spanning cached and public-family fitting, and one permutation-invariant DeepSets model, which pools shared element embeddings through order-independent mean, maximum and standard-deviation operations [21]. Reconstruction uses three raw-symbol MLPs and four CNNs: cached fitting with and without nonce features, and public-family fitting with 32 or 256 channels. Invariant inputs combine 256 sorted signed values, 256 sorted magnitudes and 15 statistics: mean, standard deviation, minimum, maximum, second through sixth raw moments, negative-coordinate fraction and quantiles 0.10, 0.25, 0.50, 0.75 and 0.90. The CNN fusion input also retains the 256 raw coordinates. Architecture dimensions and activation functions are listed in Supplementary Materials S1; the larger CNN has approximately seven million trainable parameters. Nonce features are the six scaled public chunks defined above. Four additional stationary controls fit a classifier and a reconstructor to identity transmission and to a fixed reused transform.

All primary candidates complete 30 fitting epochs without early stopping. They use AdamW, batch size 256, weight decay ${10}^{-4}$ and gradient-norm clipping at 1. Learning rates are ${10}^{-3}$ for classifiers and $2\times {10}^{-4}$ for reconstructors. Classification optimizes cross-entropy (CE), whereas reconstruction optimizes pixel MSE. At each epoch, validation records both the optimization loss and the reporting metric. The primary reconstruction checkpoint and candidate maximize validation SSIM using valid windows; the primary classifier checkpoint and candidate maximize validation accuracy. Separate checkpoints and candidate selections minimize validation MSE or CE for the selection-criterion comparison. All primary candidate fitting and architecture selection finish before reporting predictions are evaluated.

Image-independent reconstruction candidates comprise the fitting-mean image, its spatially averaged color and nine constant gray images. Their validation-selected predictions establish prior performance under the same metrics. A fitting-set class-frequency predictor provides the corresponding class prior. These references are fixed before reporting-set evaluation.

3.6. Budget, Channel-Quality and Joint-Observation Attacks

Budget and observation-access experiments use the matched seed-1001 codec pair with defense weights $\lambda =0$ and $0.2$. A 256-channel CNN, a residual invariant-feature MLP of width 512, and an enlarged DeepSets classifier each train for 120 epochs with attacker seeds 811 and 812. Checkpoints maximizing the relevant validation metric within the first 30, 60 and 120 epochs provide the budget comparison along the same optimization trajectory.

Independent fresh fits adapt the same three architectures to Eve’s SNRs of 20, 30 and 40 dB and to a noiseless observation. Each fit uses 60 epochs and attacker seed 821. The selected checkpoint is evaluated under three keys and two independent noise draws per key; the noiseless case uses one draw per key. Ranges across these conditions describe the sampled key and channel variation.

A packet-set classifier and reconstructor jointly process 1, 2, 4, 8 or 16 observations of the same source image, which are each transmitted with an independent fresh transform and independent channel noise. A shared packet encoder precedes permutation-invariant mean, maximum and standard-deviation pooling. The packet count is sampled uniformly from the five prescribed values during each minibatch. Fitting lasts 60 epochs with attacker seed 831, and each count has its own validation-metric-selected checkpoint. This experiment uses a 20 dB Eve channel.

3.7. Additional Inference Targets and Statistical Diagnostics

Two direct inference tasks complement ten-class labels. A binary predictor distinguishes animals (bird, cat, deer, dog, frog and horse) from vehicles (airplane, automobile, ship and truck). Its fitting loss uses inverse-frequency class weights estimated from fitting labels, and validation selection maximizes balanced accuracy. AUROC additionally measures the ranking of vehicle probabilities.

A three-output regressor predicts mean luminance, mean chroma range and finite-difference luminance energy. For unit-range red, green and blue pixel values, luminance is $0.299R+0.587G+0.114B$; chroma range is $\max (R,G,B)-\min (R,G,B)$. The first two targets average these quantities over pixels. The third averages the squared horizontal and vertical luminance differences with equal weight for the two directions. Target normalization and the constant-mean reference use fitting images only. Validation selection minimizes mean normalized squared error, and reporting gives each target’s MSE and coefficient of determination $R^2$. Both direct tasks use public-family fitting, 60 epochs, a 20 dB Eve channel, and attacker seeds 841 and 842.

Distribution diagnostics record the second, fourth and sixth coordinate moments, the signed mean and negative-coordinate fraction of each reporting latent and its scrambled observations. The same diagnostics are evaluated without channel noise and at 20 dB. Class-conditional distributions and the between-class variance fraction ${\eta }^2$ connect these observable statistics to the tested invariant-aware predictors. Retained codec-training records provide the online classifier’s CE and the KL divergence from the uniform class distribution to its predicted distribution. Figures summarize independent codec seeds and key/noise draws using their observed ranges. Paired reconstruction-versus-prior intervals use 5000 bootstrap resamples of original reporting images; they condition on the fitted models, selected checkpoints and recorded packet realizations.

3.8. Natural-Image Attack Fitting and Native-Resolution Evaluation

The natural-image experiment fits fresh reconstruction attackers on DIV2K [16]. Its 800 training frames and 100 validation frames have disjoint file and decoded-pixel hashes. We extract 50,000 training crops and 5000 validation crops of $64\times 64$ native pixels. Each crop comprises four adjacent $32\times 32$ codec tiles; the encoder operates independently on each tile. Kodak’s 24 complete frames are reserved for reporting with no resizing or selection using their reconstruction scores.

The tile attacker receives each noisy latent packet and its public nonce features independently; the context attacker jointly receives all four packets, nonce features and tile positions. Both concatenate each packet’s raw coordinates, sorted signed coordinates and sorted magnitudes. A shared projection and residual convolutional decoder predict either each tile independently (tile attacker) or all four adjacent tiles jointly (context attacker). A matching context model fitted to unscrambled latent observations provides an identity control. All models contain 1,093,827 trainable parameters. Input normalization uses training images and independently generated public-family observations.

Training samples fresh sign masks, permutations and independent 20 dB noise at each tile presentation. Validation and Kodak reporting use the actual key-derived transform and nonce interface. Each keyed family has two initializations, seeds 801 and 802; the identity control uses seed 801. Models train for 60 epochs with batch size 64, AdamW, learning rate $2\times {10}^{-4}$ with cosine decay, weight decay ${10}^{-4}$ and gradient-norm clipping at 5. The MSE training objective is accompanied by validation SSIM at every epoch. Each checkpoint and the initialization within each family are selected by maximum validation SSIM before Kodak reporting. A fit comprises three million crop presentations, or twelve million tile-observation presentations, across the 50,000 training crops.

Both the seed-42 codec and the seed-1001 codec with $\lambda =0.2$ are evaluated with fixed weights. Bob uses 12 dB and Eve uses 20 dB. A training-only mean $64\times 64$ crop supplies an image-independent prior. Predicted contexts are assembled into complete native-resolution Kodak frames before calculating MSE, dataset PSNR and valid-window SSIM. Paired confidence intervals resample the 24 complete frames 10,000 times, retaining within-frame dependence.

3.9. Fading, Multipath and Synchronization

The $N=256$ real payload coordinates are mapped to 128 complex symbols by $s_k=({\tilde{s}}_k+\mathrm{i}{\tilde{s}}_{k+128})/\sqrt{2}$ for $k=1,\dots ,128$, where ${\mathrm{i}}^2=-1$. The complex symbols have unit mean energy. Flat Rayleigh and Rician links use one complex channel gain per packet; the Rician line-of-sight-to-scattered power ratio is 6 dB. We compare perfect channel state information (CSI) with CSI estimated from a known pilot. For a perfectly known scalar complex gain $h\ne 0$, scalar equalization followed by conversion back to real coordinates gives $S_{K,n}\mathbf{u}+{\mathbf{w}}_h$, where ${\mathbf{w}}_h$ is isotropic real Gaussian noise with variance ${\sigma }_B^2/{\left|h\right|}^2$. Applying the inverse gives $\mathbf{u}+S_{K,n}^{\top }{\mathbf{w}}_h$. Thus, the decoder-input law equals that of the corresponding unscrambled fading link. The unconditional noise is a fading-dependent scale mixture.

A frequency-selective link uses three taps at delays of 0, 1 and 3 samples, with relative mean powers of 0, $-3$ and $-6$ dB, normalized to unit total mean power. The sample rate is 1 MHz and the propagation delay is three samples. A constant carrier-frequency offset (CFO) of 175.12 Hz corresponds to the maximum kinematic frequency shift at 15 m/s and a 3.5 GHz carrier. Taps remain fixed within each packet. This setting evaluates a Doppler-related frequency offset alongside multipath; time-varying scattering is a separate channel model. Tapped-delay analyses motivate an explicit treatment of delay and synchronization [22].

The receiver uses a 64-symbol repeated preamble, 128 pilot symbols, zero padding and an eight-sample timing search. Scalar zero-forcing equalization is used for flat fading; single-carrier frequency-domain minimum mean squared error equalization is used for multipath. Perfect synchronization, estimated synchronization and an uncorrected timing/CFO control are evaluated. Framing occupies 336 complex samples in the flat link and 348 in the multipath link before the public nonce header. Identity and keyed transmissions share channel, noise, pilot and equalizer realizations. Estimated CSI and frequency-selective equalization are evaluated numerically with their residual distortion and colored noise.

The seven channel configurations are tested at payload SNRs of 0, 5, 10, 15, 20 and 30 dB with three independent draws and 3600 holdout images per draw. The three codecs trained with $\lambda =0.2$ and the paired seed-1001 codec with $\lambda =0$ retain their fixed weights.

3.10. Recovery Under Transform Reuse

A controlled reuse experiment holds one transform fixed and supplies the observer with known images and their corresponding noisy packets at 20 dB. The public encoder produces the target latents. For $m\in \{1,2,4,8,16,32,64,128,192,256,512,4096\}$ fitting pairs, a least-squares inverse maps intercepted observations back to normalized latents. A singular value decomposition implements the pseudoinverse with relative singular-value cutoff ${10}^{-6}$. Three independently chosen, nested fitting subsets are used, while reconstruction is evaluated on the separate holdout. Matrix rank and condition number are recorded; the latter is the ratio of the largest to smallest retained singular value. A correct-inverse receiver supplies a reference. A separate control averages repeated noisy observations of one identical plaintext, which provides one transformed vector rather than a set of independent latent directions.

3.11. Protection References Under Equal Reserved Resources

We compare protection mechanisms using the paired seed-1001 codecs and common fitting, validation and holdout images. The references are AES-256 in Galois/Counter Mode (GCM) [23], applied to 4- or 8-bit quantized latents, and an independently implemented linear encryption mechanism informed by DeepJSCEC [2]. The latter is denoted the linear-BFV reference, following the Brakerski–Fan–Vercauteren family of constructions. It uses plaintext modulus $t=16$, ciphertext modulus $q=4093$, message dimension 256, auxiliary dimensions 192 and 192, and rounded Gaussian randomness with standard deviation one. Both ciphertext components are transmitted, including the 192-coordinate public side component. These parameters specify an experimental operating point rather than a security-matched cryptographic parameter set; the comparison evaluates the mechanism on a common frozen codec rather than reproducing the complete trained DeepJSCEC system.

Per-coordinate quantizer limits are the 0.1st and 99.9th percentiles of fitting latents. AES-GCM includes a 96-bit nonce and 128-bit authentication tag and uses uncoded 16-ary quadrature amplitude modulation (QAM). The linear-BFV reference uses 4096-QAM and hard decisions. AES authentication failures produce the fitting-set mean image. Quantization-only decoding supplies a reference for quantization distortion. The keyed layer is evaluated with a 128-bit error-detection header or 256-bit authenticated metadata at group sizes $B=1$ and $B=32$.

Every operating point reserves 640 or 1024 complex channel uses per image and the same nominal total transmit energy. Active symbols use the reserved energy; unused channel uses are idle. Header, tag and ciphertext expansion contribute to active uses, including the partial final group. Actual mean transmitted energy is recorded alongside the nominal allocation. This resource model permits differing peak powers. Bob’s nominal SNR ranges from 5 to 40 dB; Eve’s is fixed at 20 dB before the corresponding active-symbol power adjustment.

Separate width-512 MLPs are fitted for reconstruction and ten-class inference at each distinct effective Eve SNR. Training uses 45,000 fitting packets and 40 epochs; validation SSIM and accuracy select checkpoints. Keyed observations include the continuous payload and public nonce. Digital observations include hard-demodulated ciphertext and public side information. Cryptographic-operation central processing unit (CPU) timings are recorded separately from channel uses and reconstruction metrics.

3.12. Nonce Persistence and Authenticated Metadata

A practical nonce comprises a 32-bit sender identifier and a 64-bit increasing counter. Devices sharing one key generation use distinct sender identifiers. A SQLite transaction durably reserves a counter range before any corresponding payload is transmitted; unused reservations are consumed after interruption. Packet loss leaves the counter unchanged at its advanced value, and a freshly encoded retransmission reserves a fresh counter. Key rotation establishes a new state namespace. This construction assumes persistent local storage and replacement of the key if an older counter state is restored.

The authenticated group header contains version, direction, count and slot-mapping fields of eight bits each, a 32-bit sender identifier and a 64-bit base counter. Slot $j\in \{0,\dots ,B-1\}$ uses counter $\mathrm{base}+j$. A domain-separated HKDF-SHA256 key authenticates the 128-bit metadata with a 128-bit truncated HMAC-SHA256 tag. Authentication precedes updates to a persistent 4096-counter replay window. The reference error-detection header comprises a 96-bit nonce, 16-bit count and 16-bit cyclic redundancy check (CRC). Extended Hamming (8,4) coding and quadrature phase-shift keying (QPSK) require 128 complex symbols for this header and 256 for authenticated metadata. Group sizes are 1, 8, 32 and 128. Metadata authentication covers header integrity and replay; the continuous payload retains its separately defined observation interface.

Functional checks exercise restart persistence, unused reservations, sender separation, counter exhaustion, dropped groups, header tampering and replay rejection. Header decoding uses soft maximum-likelihood Hamming-word decisions followed by CRC or tag verification. Each of nine SNR settings between 0 and 20 dB uses 20,000 independent noise trials with binomial uncertainty intervals. CPU microbenchmarks use batches of 1 and 128 with 40 repetitions. Parameter generation, transforms, authentication, coding, durable reservations and replay updates are timed separately. Sums of component medians give a derived processing cost per tile and per 384-tile frame; codec, radio, queueing and retransmission delays are outside these component timings.

3.13. Computation and Reproducibility

The experiment platform is a Windows 11 workstation with a 64-bit CPU providing 24 logical processors and an NVIDIA RTX 5080 graphics processing unit (GPU) with approximately 16 GiB of GPU memory. The software environment comprises PyTorch 2.8.0, CUDA 12.8 and NumPy 2.2.6. Eight CPU threads are used. Codec training uses automatic mixed precision with the bfloat16 (BF16) format; attack fitting and transform operations use float32. The six stored codecs, source/configuration hashes, input-asset hashes, fitting/validation partitions and model-selection records identify the executed computations. Scientific outputs are separate from synthetic software checks.

CPU component benchmarks use this Windows 11 workstation at batch sizes 1 and 128, after warm-up. Timed components include parameter generation, transforms, authentication, coding, decoding and durable state operations. Per-image batch figures are amortized medians. Sums of separately measured components and extrapolations to a 384-tile frame are derived accounting rather than measurements of end-to-end radio latency. The protocol and baseline summaries retain raw timing samples and exact component definitions. Public key fixtures serve reproduction only; operational deployments require independently generated secret keys.

4. Results

4.1. Legitimate Reconstruction and Paired Codec Training

The six codecs in three paired training-seed comparisons retain a legitimate valid-window SSIM of 0.83654–0.84007 and dataset PSNR of 24.476–24.521 dB at 12 dB Bob SNR, which is averaged over three keys and three channel draws. Validation selects epoch 30 for both seed-1001 arms and epoch 29 for both seed-1002 and seed-1003 arms. The seed-wise Bob SSIM changes for $\lambda =0.2$ minus 0 are $+0.0008413$, $-0.0005508$ and $+0.0002233$. Their mean is $+0.0001713$. Supplementary Materials S1 gives the training traces and complete paired utility records.

The retained online classifier’s final-five-epoch CE averages are 2.30281–2.30287 compared with $\log 10=2.302585$ for uniform predictions. The uniform-target KL penalty averages 0.000523–0.000625 across the six cases. Supplementary Figure S2 gives those histories and the latent-statistic distributions.

4.2. Metric-Aligned Reconstruction and Class-Label Inference

Table 4 reports the primary-suite selections for all six codecs. SSIM-selected reconstructors attain valid-window scores of 0.130886–0.131046 compared with 0.130714 for the fitting-mean-image prior. Their paired improvements range from $1.72\times {10}^{-4}$ to $3.32\times {10}^{-4}$; the 95% conditional bootstrap intervals exclude zero for five codecs. The corresponding MSE values, 0.061859–0.061920, exceed the prior’s 0.061846. MSE-selected reconstruction scores range from 0.130171 to 0.130794. Figure 2 shows the selection-criterion comparison and the stationary controls.

Table 4. Eve’s primary-suite results at 20 dB. Each column uses the checkpoint and candidate selected by the indicated validation criterion. The last column compares the SSIM-selected reconstruction with the fitting-mean-image prior (0.130714); brackets give paired 95% bootstrap intervals, which are conditional on the fitted models and recorded packets.

		Reconstruction SSIM		Accuracy (%)		$\Delta$ SSIM (${10}^{-4}$)
Seed	$\mathbf{\lambda }$	By SSIM	By MSE	By Accuracy	By CE	Versus Prior [95% CI]
1001	0	0.13100	0.13079	10.64	10.56	2.84 [1.86, 3.80]
1001	0.2	0.13098	0.13058	10.44	10.42	2.62 [1.55, 3.68]
1002	0	0.13097	0.13075	8.61	10.03	2.55 [1.58, 3.53]
1002	0.2	0.13105	0.13079	9.94	10.42	3.32 [2.35, 4.35]
1003	0	0.13089	0.13017	10.08	10.42	1.72 [−0.05, 3.48]
1003	0.2	0.13095	0.13071	8.81	10.92	2.32 [1.24, 3.42]

Figure 2. Primary attacker selection and stationary controls across three codec seeds and two defense weights. (a,b) Each bar uses the checkpoint and model selected by the indicated validation criterion. The dotted reconstruction reference is the image-independent fitting-mean prior. (c,d) Independently fitted predictors observe identity transmission, a reused transform or a unique nonce per packet. All reconstruction scores use valid windows.

Accuracy-selected primary classifiers score 8.61–10.64%, while CE-selected classifiers score 10.03–10.92%. The fitting-frequency predictor scores 10.11%, and the balanced ten-class chance reference is 10%. Across individual primary candidates, the largest observed reporting accuracy is 11.28%, which is obtained by the cached invariant-feature classifier with attacker seed 61 for codec seed 1001 and $\lambda =0$. This descriptive maximum is distinct from the validation-selected suite result. Identity and fixed-transform controls attain a reconstruction SSIM of 0.8135–0.8168 and class accuracy of 54.19–56.17%.

4.3. Attacker Budget and Observation Access

Table 5 summarizes the specified fitting budgets, observation conditions and inference tasks, and Figure 3 shows the budget, channel-quality, joint-observation and additional-inference results. For the four large-CNN trajectories, the validation-SSIM-selected checkpoint remains the same when the maximum fitting budget increases from 30 to 60 and 120 epochs. Their reporting SSIM ranges from 0.131015 to 0.131091. Budgeted invariant and DeepSets classifiers attain reporting accuracy of 8.97–10.69% across the two defense weights, two attacker seeds and three budgets.

Table 5. Ranges across the specified attack budgets, observation conditions and inference tasks for codec seed 1001. Reconstruction uses valid-window SSIM. Classification uses ten-class accuracy except for the explicitly marked binary task. Ranges describe evaluated conditions; they are not confidence intervals.

Attack Setting	$\mathit{\lambda }$	Eve SSIM	Accuracy (%)	Evaluation Scope
Budget, 30–120 epochs	0	0.13102–0.13105	9.83–10.69	Two attacker seeds
20/30/40 dB and noiseless	0	0.13080–0.13103	9.31–10.69	Three keys; two noisy draws
1–16 fresh packets per image	0	0.13112–0.13122	9.39–10.00	Same-image joint inference
Animal/vehicle inference	0	—	49.76–50.09	Balanced accuracy; two seeds
Budget, 30–120 epochs	0.2	0.13106–0.13109	8.97–10.50	Two attacker seeds
20/30/40 dB and noiseless	0.2	0.13088–0.13111	8.83–11.03	Three keys; two noisy draws
1–16 fresh packets per image	0.2	0.13126–0.13128	9.61–9.94	Same-image joint inference
Animal/vehicle inference	0.2	—	48.59–49.77	Balanced accuracy; two seeds

Figure 3. Budget and observation-access inference experiments for codec seed 1001; blue denotes $\lambda =0$ and orange $\lambda =0.2$. Shaded bands match the colors of their respective curves. (a) Large-CNN reconstruction versus fitting budget; shading spans two attacker seeds. (b,c) Fresh high-SNR fits; shading spans the sampled keys and noise draws. In (c), solid curves use the invariant MLP and dashed curves use DeepSets. (d) Joint inference from fresh packets of one image: solid curves show accuracy on the left axis and dashed curves show reconstruction on the right axis. (e) Animal/vehicle balanced accuracy: dots are two attacker seeds and horizontal segments are their means. (f) Attribute MSE improvement relative to the fitting-mean reference; markers average two attacker seeds and bars span their range. Dotted lines mark the relevant image prior, chance level or zero improvement.

Freshly fitted high-SNR and noiseless attackers attain reconstruction SSIM of 0.130797–0.131106 and class accuracy of 8.83–11.03% across the sampled keys and noise draws. For joint inference from 1 to 16 fresh packets of the same image, the packet-set classifiers score 9.39–10.00% and the reconstructors attain SSIM of 0.131119–0.131277.

Animal/vehicle predictors attain balanced accuracy of 48.59–50.09% and AUROC of 48.96–49.89%. The three attribute regressors attain $R^2$ values between $-3.55\times {10}^{-4}$ and $1.34\times {10}^{-4}$. Their fitting-mean-reference MSEs are 0.015085 for luminance, 0.006401 for chroma range and $2.0522\times {10}^{-5}$ for finite-difference luminance energy. Supplementary Materials S1 provide the per-target results, optimization histories and statistical diagnostics.

4.4. Fading, Multipath and Transform Reuse

Figure 4 summarizes legitimate reconstruction and the reuse experiment with paired keyed-minus-identity differences shown beneath panels (a–d). Across the three $\lambda =0.2$ codecs and three draws, the 20 dB perfect-CSI Rayleigh SSIM averages are 0.84533 for keyed transmission and 0.84522 for identity transmission. For estimated multipath synchronization, the corresponding averages are 0.75376 and 0.75400. The seed-1001 $\lambda =0.2$ codec yields 0.84628 versus 0.84621 under perfect-CSI Rayleigh fading, 0.75391 versus 0.75396 under estimated multipath synchronization, and 0.54101 versus 0.54231 with timing/CFO left uncorrected. Supplementary Figure S4 reports the differences for each codec and channel draw.

Figure 4. Legitimate-channel evaluation and transform-reuse recovery. (a–d) Identity and keyed reconstruction, averaged over the three $\lambda =0.2$ codecs and three channel draws. Solid lines with hollow circles denote identity transmission; dashed lines with crosses denote keyed transmission. The narrow strips show mean keyed-minus-identity SSIM ($\Delta \mathrm{SSIM}$, displayed in units of ${10}^{-3}$) with colors identifying receiver settings. Perfect and estimated receivers use the specified pilot and synchronization procedures. (e) Known-image recovery for the paired seed-1001 codecs at 20 dB; shading spans the three fitting subsets and dotted lines show correct-inverse reconstruction. (f) Condition numbers of the fitted observation designs; lines show subset medians and shading their ranges. In (e,f), blue and orange denote $\lambda =0$ and $\lambda =0.2$; each matching band spans the minimum and maximum over the three fitting subsets.

Under transform reuse, the seed-1001 $\lambda =0.2$ inverse fit reaches mean SSIMs of 0.24874, 0.49775, 0.68467 and 0.78694 with 16, 64, 128 and 192 known pairs, respectively. At 256 pairs, SSIM ranges from 0.23271 to 0.40441 across the three fitting subsets with condition numbers from 2086 to 7234. At 512 and 4096 pairs, the mean SSIMs are 0.85722 and 0.86165, respectively, against 0.86283 with the correct inverse. The paired $\lambda =0$ codec gives 0.85626 and 0.86044 at 512 and 4096 pairs. Repeated observations of one identical plaintext show the recorded noise-averaging trend while the design rank remains at most one.

4.5. Resource-Matched Protection References

Figure 5 reports reconstruction, tested inference, active transmission uses and computation. For the seed-1001 $\lambda =0.2$ codec, 640 reserved uses and Bob SNR 10 dB, authenticated keyed transmission with $B=32$ yields SSIM 0.85785 compared with 0.85829 for identity transmission. At 20 dB, the values are 0.86633 and 0.86638; the AES 4-bit, AES 8-bit and linear-BFV references yield 0.86130, 0.86549 and 0.03628, respectively. At 40 dB, the linear-BFV reference yields 0.84345. AES 4-bit and 8-bit packet-success fractions at 15 dB are 0.85583 and 0.00111; at 20 dB, they are 1.00000 and 0.99778.

Figure 5. Common-codec protection comparison. (a,b) Bob’s reconstruction for the seed-1001 $\lambda =0.2$ codec at equal reserved channel uses and nominal energy. Digital references use the stated quantizers and uncoded modulation. (c,d) Matched multilayer-perceptron attacks for the paired codecs at 640 reserved uses and nominal Eve SNR 20 dB; dotted lines mark the mean-image SSIM and ten-class chance accuracy. (e) Actual active uses, including metadata and ciphertext expansion; the first three bars are keyed transmission with the indicated header and group size. (f) Measured CPU operation medians at batch 128; keyed costs include parameter generation and mixing, while AES and linear-BFV costs cover encryption/decryption. Durable state and framing costs are reported separately.

For the same resource allocation, Eve’s matched-MLP SSIMs are 0.12718 for authenticated keyed transmission with $B=32$, 0.12185 and 0.12197 for the AES references, 0.12707 for linear BFV, and 0.83125 for identity transmission. The fitting-set mean-image SSIM is 0.13071. Class accuracies are 9.11%, 9.92%, 10.03%, 10.31% and 55.72%, respectively. Eve’s nominal SNR is fixed while Bob’s SNR varies.

Authenticated keyed transmission requires 384 active complex uses at $B=1$ and 136.04 at $B=32$, including the partial final group. AES 4-bit, AES 8-bit and linear BFV require 312, 568 and 448 active uses. Batch-128 median AES 4-bit encryption and decryption times are 0.00133 and 0.00418 ms per image; linear-BFV times are 0.03041 and 0.01486 ms. Keyed parameter generation plus transform execution takes 0.13072 ms at the sender and 0.13161 ms at the receiver.

4.6. Natural-Image Reconstruction

Table 6 reports the native-resolution Kodak measurements for attackers fitted on DIV2K crops. With the seed-1001 codec, Bob attains 27.2316 dB PSNR and 0.8056 SSIM. The mean prior attains 13.0189 dB and 0.4491 compared with 13.0184 dB and 0.4487 for the validation-selected tile attacker and 13.0130 dB and 0.4485 for the selected context attacker. The identity context control attains 28.2819 dB and 0.8400. With the seed-42 codec, Bob attains 24.9792 dB and 0.7095, while the tile and context attackers attain SSIM values of 0.4488 and 0.4487; the identity context control attains 26.7265 dB and 0.7835.

Table 6. Native-resolution Kodak reconstruction after fitting attackers on independent natural-image crops. Tile and context predictors are selected by validation SSIM.

Codec	Predictor	PSNR (dB)	SSIM
Seed 42	Mean prior	13.0189	0.4491
	Bob	24.9792	0.7095
	Tile attacker	13.0180	0.4488
	Context attacker	13.0183	0.4487
	Identity control	26.7265	0.7835
Seed 1001, $\lambda =0.2$	Mean prior	13.0189	0.4491
	Bob	27.2316	0.8056
	Tile attacker	13.0184	0.4487
	Context attacker	13.0130	0.4485
	Identity control	28.2819	0.8400

Figure 6 reports whole-frame uncertainty intervals, paired prior contrasts and validation curves. For the seed-1001 codec, the selected tile and context attackers have mean SSIM differences from the prior of $-0.000379$ and $-0.000636$ with paired 95% frame-bootstrap intervals $[-0.000452,-0.000304]$ and $[-0.000785,-0.000498]$, respectively. The Bob–prior SSIM gap is 0.3565 $[0.3185,0.3965]$ for seed 1001 and 0.2605 $[0.2252,0.2971]$ for seed 42. Across all keyed natural-image fits, the validation SSIM range over the final ten epochs is between $3.3\times {10}^{-5}$ and $1.2\times {10}^{-4}$. Figure 7 shows the predetermined Kodak frame 7 for the seed-1001 codec.

Figure 6. Natural-image attack evaluation. (a,d) Whole-frame SSIM and dataset PSNR on 24 Kodak frames; bars show 95% whole-frame bootstrap intervals. (b) Paired SSIM differences from the training-only prior with 95% intervals. (c) DIV2K validation curves for the seed-1001 codec and attacker seed 801. Tile and context predictors in (a,b,d) are selected by validation SSIM.

Figure 7. Predetermined Kodak frame 7 with codec seed 1001 and $\lambda =0.2$. Bob uses 12 dB; both domain-fitted attacks and the identity control use 20 dB. All panels cover the same spatial extent. Panels (c–e) show the training-only mean-image prior and the separately fitted tile and context predictions; their similarity is consistent with their measured near-prior reconstruction scores.

4.7. Metadata Reliability and Processing Cost

Figure 8 reports header decoding, group overhead and component timing. At header SNR 6 dB, failure fractions are 0.0140 for the CRC reference and 0.0263 for authenticated metadata. At 8 dB, they are 0.00005 and 0.00010. No failures occur in 20,000 trials per scheme at SNRs of 10 dB and above; the corresponding one-sided 95% upper bound is approximately $1.50\times {10}^{-4}$. No incorrect header is accepted in the noise trials. All functional persistence, sender-separation, exhaustion, loss, tampering and replay checks pass.

Figure 8. Metadata reliability, overhead and implementation costs. Blue and orange identify CRC and authenticated headers in (a,b), and batches of 1 and 128 in (c,d), respectively. (a) Failure fractions from 20,000 trials per SNR and scheme; shading of the matching color shows 95% binomial intervals for nonzero fractions and downward triangles mark one-sided upper bounds when no failure is observed. (b) Complete-group header uses relative to payload uses. (c) Measured component medians; durable reservations are amortized over the batch, and each receiver replay update processes one authenticated header. (d) Derived sums of component medians for 384 tiles, including state persistence and authenticated framing; codec and radio processing are excluded.

For complete groups, CRC header overhead relative to 128 complex payload uses is $100/B$ percent; the authenticated metadata overhead is $200/B$ percent. The authenticated overhead is therefore 6.25% at $B=32$ and 1.5625% at $B=128$. Table 7 separates measured component medians from derived processing sums. At batch 128, sender and receiver parameter generation plus both transforms sum to 0.26233 ms per tile. Including durable state, authenticated headers and coding gives derived sums of 0.55863 ms per tile at $B=32$ and 0.37889 ms at $B=128$, which is equivalent to 214.51 and 145.49 ms per 384-tile frame.

Table 7. CPU component medians and derived processing costs on the Windows 11 workstation specified in Section 3.13. Component entries are milliseconds per tile, except authentication/replay, which is per header. Derived totals include the specified authenticated header and durable state; they are sums of component medians rather than directly measured end-to-end latency.

Component or Derived Sum	Batch 1	Batch 128
Sender parameter generation	0.13130	0.12782
Receiver parameter regeneration	0.13200	0.12874
Forward transform	0.02460	0.00290
Inverse transform	0.02470	0.00287
Durable nonce reservation	7.30795	0.05665
Authentication and durable replay (per header)	7.12895	7.66068
Derived authenticated total per tile, $B=32$	7.84377	0.55863
Derived authenticated total per tile, $B=128$	7.67636	0.37889
Derived total per 384-tile frame, $B=32$	3012.01	214.51
Derived total per 384-tile frame, $B=128$	2947.72	145.49

5. Discussion

5.1. Meaning of the Empirical Privacy Measurements

The construction combines an exact legitimate inverse with low reconstruction and inference performance for the tested packet observers. The principal evidence is task-specific: valid-window SSIM remains close to an image-independent prior, ten-class accuracy is close to the ten-class reference, binary animal/vehicle inference is close to chance, and the three attribute regressors explain little reporting-set variance. These outcomes describe empirical resistance under the stated public-encoder, known-plaintext and finite-budget interface. They support an experimentally characterized protection layer with the scope of each task retained explicitly.

Metric-aligned selection makes the measured task explicit. SSIM-selected reconstructors have small positive differences from the fitting-image prior even where their MSE is worse. These criteria describe complementary aspects of reconstruction quality. A small SSIM gain can reflect both the predictor’s generic image prior and observation-dependent information. Reporting SSIM, MSE, paired prior contrasts, alternative validation selections and informative identity/reuse controls makes the measured effect assessable within the stated observation interface.

For class label Y and observation $R_E=({\mathbf{r}}_E,n)$, let $p(c\mid R_E)$ denote the true conditional class distribution. Any fitted classifier q satisfies the identity in Equation (20):

$$\mathbb{E}[-\log q(Y\mid R_E)]=\mathsf{H}(Y\mid R_E)+{\mathbb{E}}_{R_E}{D}_{\mathrm{KL}}\left(p(·\mid R_E)\parallel q(·\mid R_E)\right),$$

(20)

where $\mathsf{H}$ is conditional Shannon entropy. Thus, poor fitted inference can reflect both uncertainty in the observation and approximation or optimization error. The budget sweeps, public-family resampling, nonlinear invariant features, high-SNR/noiseless tests and stationary positive controls increase the sensitivity of the specified evaluation. Together, these measurements quantify inference performance for the documented attacker families, fitting budgets and packet-access conditions.

5.2. Scrambling, Defense Training and Joint Observations

The paired $\lambda =0/0.2$ experiment identifies transmission-side scrambling as the principal mechanism associated with the observed protection in this setup. The extra training penalty changes outcomes by small amounts of mixed direction across seeds. Its online classifier already produces nearly uniform class probabilities under scrambling: the final-epoch cross-entropy is close to $\log 10$, and the uniform-target KL penalty is small in both arms. This is consistent with limited additional signal from this auxiliary head and with the small measured marginal benefit. The comparison supports the zero-weight setting as a simple operating choice for the specified codec and observation model.

The source-statistic analysis motivates invariant-aware attacks under fresh packet transforms. Sign mixing attenuates source-dependent fourth moments, while the structured family retains statistical distinctions for some equal-energy inputs. Higher-order statistics can also be estimated more accurately from repeated observations. The measured 1–16-packet tests explicitly give Eve several fresh-nonce transmissions of the same image. The DIV2K-fitted context models exploit four adjacent tiles and their relative positions, while their identity controls recover useful natural-image detail. These experiments address repeated observations and local spatial dependence within stated access bounds. Whole-frame learned priors, arbitrary cross-packet collections and substantially larger optimization budgets remain distinct evaluation settings.

5.3. Channel Conditions and Transform Reuse

Known scalar fading preserves the legitimate decoder-input law conditional on the gain because equalization restores the signal before inverse mixing and leaves isotropic, gain-scaled noise. Estimated equalization and frequency-selective receivers instead produce the residual term and covariance in Equation (9). The matched fading and multipath curves show how the layer interacts with those receivers while preserving fixed codec weights. Their close keyed/identity outcomes quantify incremental scrambling cost under the tested receiver, while the lower performance of the unsynchronized control identifies synchronization as a separate system requirement. The Doppler-related frequency-offset model uses packet-constant taps; time-varying scattering and measured radio channels would broaden the physical assessment.

Nonce renewal is essential to the observation interface. Reusing one transform creates a common linear map that known-image latents can identify, and partial reconstruction becomes useful well before full matrix recovery. The recovery curve is nonmonotonic near a square noisy fitting system because conditioning changes; the high-quality reconstruction at 512 pairs characterizes the measured codec, noise and fitting subsets. Even two reused observations preserve common-map relationships, so an implementation should treat any detected reuse as a protocol fault. With distinct nonces, each known pair has its own linear map. The shared-key structure and retained source statistics motivate the public-family, higher-budget and joint-observation tests used to assess this interface.

5.4. Comparative Value and Practical Deployment

The common-codec benchmark isolates the transmission mechanism. Continuous keyed mixing retains gradual reconstruction behavior and exact inversion without latent quantization; the digital AES references exhibit the expected interaction of packet authentication, uncoded modulation errors and quantization. AES encryption and decryption have lower measured CPU cost than key-to-transform parameter generation on the Windows 11 workstation specified in Section 3.13. The linear-BFV reference illustrates ciphertext expansion and high-order modulation sensitivity under its stated parameters. These operating curves quantify the utility, inference and resource tradeoffs of the specified common-codec mechanisms. Forward-error-corrected digital links, soft ciphertext estimation, jointly trained comparators and cryptographic parameter choices can change the tradeoff. AES-GCM authenticates its digital payload, while the keyed protocol authenticates the public metadata.

The nonce protocol links the mathematical interface to crash and replay handling. Durable counter reservation precedes transmission, unused reservations are burned, and the receiver authenticates before updating its replay state. Packet identities remain explicit after packet loss, and the persistent counter continues monotonically across gaps. A fresh encoding reserves a fresh nonce; a byte-identical retransmission retains its identity and is subject to duplicate rejection. Sender identifiers are provisioned uniquely within a key generation, and restoring older persistent state requires key replacement. These assumptions are operational requirements alongside external packet/slot framing. Authenticated metadata provide header integrity and replay protection. Payload authentication, availability and resistance to jamming are complementary link services.

Grouping reduces header use and amortizes durable state operations. It also increases buffering delay and the number of images affected by a lost group header. At an application arrival rate of $r_p$ payloads per second, collecting B equally spaced payloads can add up to $(B-1)/r_p$ seconds of group-formation waiting time. This analytical estimate complements the measured component timings. The measured component medians and their derived frame totals show that state persistence can dominate the arithmetic transform. Precomputation, batched reservations and persistent-state engineering provide direct optimization paths. Measuring codec, queueing, synchronization and radio delays would complete the end-to-end latency budget.

5.5. Evaluation Boundaries

The evidence conditions on six fixed codecs, the documented fitting budgets, the specified class and image attributes, and the sampled keys/channels. Natural-image models use DIV2K fitting and validation with Kodak reporting, and joint context spans four tiles. The reporting images recur across experimental conditions; conditional intervals preserve their source identity, while three paired seeds describe training variation. The protection comparison uses uncoded hard-decision digital transmission with adapted common-codec mechanisms, and its compact digital attackers discard demodulator soft information. These conditions delimit the reported operating points. Broader learned representations, full-stream attackers, coded comparator links, rollback-resistant state and time-varying physical channels are concrete extensions of the evaluation.

6. Conclusions

This paper specifies packet-dependent keyed orthonormal scrambling for continuous deep-JSCC image representations. Exact inverse mixing preserves the legitimate decoder-input law under isotropic AWGN and known scalar fading. A controlled six-codec study connects that utility property to metric-aligned inference evaluation, larger attack budgets, higher-quality interceptions and repeated packets. Natural-image-trained tile and context attackers provide a domain-relevant Kodak evaluation, while common-codec protection references quantify reconstruction, processing and transmission costs. Reuse recovery, realistic receiver tests and authenticated persistent nonce handling identify the conditions under which the interface operates. The resulting contribution is a reproducible construction and an experimentally delimited assessment of its privacy–utility tradeoff.