DNA-AdCrypt: A Carbon-Aware DNA-Inspired Adaptive Encryption Scheme for Energy-Efficient Security of MRI Scans

Abstract

Medical images such as Magnetic Resonance Imaging (MRI) scans consist of various confidential data that can hamper the privacy of the patient if leaked. Organizations have to abide by various international standards in order to ensure the safe storage and transmission of medical data. Strong encryption is a solution; however, conventional full-image encryption which treats every pixel as equally sensitive results in high computational costs. The resulting energy and carbon emissions pose an environmental challenge. Adaptive selective encryption secures images based on the sensitivity of different portions, resulting in lower carbon emissions. However, these claims have rarely been validated in existing studies covering both real adaptive detection performance and fair energy accounting. To alleviate these issues, this study presents DNA-AdCrypt, a carbon-aware deoxyribonucleic acid (DNA)-inspired tiered encryption system to secure MRI scans. The approach is simulated on brain tumors based on the Ultralytics MRI scan dataset. Fine-tuned You Only Look Once (YOLO) detectors are used to segment the scans into three domains, based on which the strength of the cryptosystem changes. YOLOv8n outperforms other variants, with the highest mAP50 (0.538) and mAP50-95 (0.396). In addition, DNA-Adcrypt reduces the encryption time by up to ≈49% and remains competitive in per-image energy against different simulated ciphers. This study puts forward a design intended to generalize for different modalities in order to promote a greener deployable medical security standard, with brain tumor MRI as an initial validated case.

1. Introduction

Medical images are among the most data-intensive and privacy-sensitive content types in modern healthcare systems. Every Magnetic Resonance Imaging (MRI) and Computed Tomography (CT) scan consists of diagnostic information as well as the clinical footprint of the corresponding patient. Data leakage could expose the patient to identity theft and insurance fraud, potentially affecting their personal life and medical situation. These images become more exposed as hospitals increasingly digitize records and share images over cloud platforms, edge devices, and sister organizations [1]. In 2025 alone, breaches in healthcare data affecting more than 500 individuals were reported at a record pace, with over 700 such large incidents recorded. Over 100 million patient records were affected [2], with an average cost of USD 7.42 million per incident. Unlike a stolen credit card, which can be canceled and reissued, a compromised medical record cannot be reissued; once leaked, it can easily reach the black market, which can also aid in nationwide medical attacks [3]. These scenarios necessitate the security of medical scans.

Traditional text-based encryption algorithms such as Advanced Encryption Standards-256 (AES-256) are not a preferred choice for image encryption. They fall short due to the properties of images, including large size, pixel correlations, etc. On the other hand, chaotic maps and deoxyribonucleic acid (DNA)-based cryptosystems are gaining attraction as they combine DNA encoding, permutations, and diffusion to exploit the characteristics of images for complex transformations [4]. Traditional approaches rely on a single layer of security; however, they are prone to cryptanalysis and various architectural limitations. This inclines the focus towards multilayer security, ensuring that the weakness of a single layer does not affect other layers and the radius of damage is limited. Although multilayer cryptosystems increase the security and cyber resilience of the image, improper design of a multilayered cryptosystem can increase computational cost per image [5], affecting both the financial and environmental aspects. Waste of energy by medical devices and the release of carbon as a byproduct is not a minor inefficiency, as it directly affects battery life, processing speed, and real-time responsiveness, especially in commodity hardware and edge devices. This is an open issue for conventional cryptosystems that tend to encrypt the full image irrespective of what level of sensitive information the pixel holds [6]. For example, encrypting the brain region as well as background pixels that hold no medical information at all with the same strong cipher is a waste of computational resources. This creates a genuine trade-off that full-image approaches rarely acknowledge. Using a strong cipher for full encryption of medical images generates an additional carbon footprint. Selective encryption based on the region of interest is a solution that encrypts the different portions of an image using ciphers of varying strength based on medical importance. In this approach, adaptiveness is an important factor which should be taken into account. However, existing studies tend to overlook this issue, particularly when considering green environmental practices.

To alleviate these issues, this study presents DNA-AdCrypt, a carbon-aware DNA-inspired adaptive cryptosystem for securing medical images. A fine-tuned You Only Look Once (YOLO) model, specifically YOLOv8n, was used to segregate MRI scans into three distinct layers, each mapped with its own level of security. A DNA-inspired encryption scheme built on a chaotic logistic-map keystream combined through a bitwise XOR operation is used for the strongest region of interest. The proposed approach is simulated around brain tumors for a practical evaluation using the publicly available Ultralytics brain tumor MRI scan dataset. YOLOv8n was compared against different YOLO variants under similar environmental conditions for a fair evaluation. It outperformed other variants, with the highest mean IoU, recall, and various other metrics on a Hungarian-matched detection style. It achieved up to ≈12.4% less encryption-only energy consumption and carbon emission than full-image encryption with the strongest cipher, alongside a substantially larger ≈49% reduction in encryption time. It also achieved near-ideal image security metrics as backed by a statistical analysis. Various other analyses demonstrate the suitability of the suggested approach for building green and sustainable deployable medical devices.

The remaining portions of this investigation are classified into the following sections: Section 2 summarizes the existing studies and highlights potential research gaps; Section 3 explains the proposed approach in detail; Section 4 analyzes the efficacy of the approach using various simulation-based experiments; and Section 5 concludes the work.

2. Related Works

Early image encryption was performed through traditional cryptographic algorithms such as AES, Rivest–Shamir–Adleman (RSA), etc., for both encryption and decryption [7]. In order to increase security against sophisticated attacks, researchers later incorporated chaotic maps due to their high sensitivity to initial conditions and randomness [8]. DNA encoding and biological operations were also integrated for efficient data representation and encryption [9,10]. Artificial Intelligence (AI) has been integrated into image encryption frameworks to optimize cipher parameters and architectural resilience [11].

Panchikkil et al. [12] developed an adaptive encryption scheme based on Reversible Data Hiding (RDH). The embedding of patients’ sensitive information differs for each block, and is based on the Most Significant Bit (MSB) prediction error approach. Similarly, Yang et al. [13] developed a cloud-based privacy-preserving medical image storage scheme that focuses on low energy consumption. It uses a hybrid image encryption approach along with RDH on encrypted images to reduce storage overhead. Qiang Lai et al. [14] presented a medical image encryption approach by integrating integer wavelet transform with DNA encoding; their approach uses a random DNA operation along with permutation and DNA-base shuffling, relying on specialized DNA cubes for improved confusion. Similarly, Minocha et al. [15] developed Iterative Cosine Operator-based Hippopotamus Optimization (ICO-HO) to find the most suitable parameter for a piecewise linear chaotic map, then used the piecewise chaotic map to secure medical images. Kumaran et al. [16] developed a hybrid medical image encryption approach by integrating DNA computing and elliptical curve cryptography, with the former used to achieve randomness and the latter to achieve confidentiality.

Manish et al. [17] used a Deep Convolutional Generative Adversarial Network (DCGAN) and Virtual Planet Domain (VPD) for securing medical images. A deep learning framework was used to develop a decoy image, which was then used to generate keys and other components for encryption. Similarly, Qu et al. [18] used a heterogeneous coupled neuron model that shows the coexistence of different chaotic attractors. These chaotic properties are used for medical image compression and encryption. The difference in energies of the attractors is quantified by evaluating the Hamilton energy function.

Zhu et al. [19] used YOLOv11 to detect lesion Region of Interests (ROI) and then combine them into a multi-level bit-plane arrangement. Scrambling and other operations were then conducted at each level for an intermediate encryption ROI image. Liu et al. [20] developed a combined two-stage medical image encryption and cross-institutional data sharing approach that incorporates both cloud- and blockchain-based storage.

Problem Motivation

Table 1. Comparison of prior adaptive/selective medical image encryption studies.

Study	AI-Guided ROI	Adaptive Scope	Energy/Carbon Reported
Panchikkil et al. [12]	No (block-wise MSB error)	No—security only	No
Yang et al. [13]	No	No—storage-cost only, not energy	No
Lai & Hua [14]	No	No	No
Minocha et al. [15]	No	No—parameter search only	No
Kumaran et al. [16]	No	No	No
Qu et al. [18]	No	No	No
Zhu et al. [19]	Yes (YOLOv11)	Partial—bit-plane levels	No
This work	Yes (6 fine-tuned YOLO variants)	Yes—3-tier pixel coverage	Yes—energy, carbon, region provenance

summarizes the research gap we address here. From the research works reviewed above, it can be observed that the primary focus is on securing images, even if this means stacking more layers or computational steps. DNA computing and chaotic maps are widely used in various studies to produce unpredictable images. Various researchers, including Rout et al. [21], have presented solutions involving chaotic systems, fractal geometry, DNA computing, and reversible matrix operations to secure medical images. Although some works cover adaptiveness, their main focus is on security first. For example, ICO-HO was used in [15] to find the best parameter ciphers to improve security. In these approaches, the whole image is treated as equally sensitive, i.e., the encryption settings change, but not their scope. No work evaluates whether every pixel deserves the same level of protection in the first place. In addition, energy and carbon cost per image are barely discussed. We take inspiration from [13], where the authors showed that their methods have low storage requirements and allow for efficient image transmission. However, they did not report energy consumption or estimate the carbon footprint of running their scheme. Only a limited number of studies have explicitly addressed the environmental cost of cryptographic operations. Özpinar and Serengil demonstrated that different partially homomorphic encryption algorithms can have different energy and carbon footprints in cloud environments. This highlights that cryptographic design itself can influence sustainability. Similarly, El-Hajj et al. [22] investigated the advancement of cryptographic algorithms while reducing energy consumption. Following a similar course of investigation, Alshammari [23] proposed a low-carbon framework that combines lightweight cryptography with energy-efficient intrusion detection and carbon-aware scheduling. These works primarily focus on different domains and different aspects of protection; in addition, they do not investigate whether the protection level can be adapted according to the sensitivity of individual regions of the focused domains, e.g., pixels within a medical image. Thus, an important gap remains in jointly considering what needs to be encrypted, how strongly it needs to be protected, and when it should be processed from the perspective of carbon emissions. In order to address these gaps, this study presents an AI-guided tiered selective encryption pipeline using a fine-tuned YOLO detector, drawing inspiration from the detection strategies in [19,22]. In our approach, a DNA-inspired chaotic cipher is applied based on the sensitivity of the image portion. The proposed approach reduces estimated carbon emissions by ≈12.4% compared to the baseline and provides a much larger reduction in encryption time, highlighting the transition towards green computing.

3. Methodology

Applying the strongest cipher to the entire frame is computationally wasteful when not every portion of the image carries the same sensitivity. To alleviate these issues, our proposed DNA-AdCrypt combines AI-based tumor detection with a tiered selective encryption scheme. As a result, a single MRI slice is protected based on how sensitive each of its regions is, instead of encrypting the entire image at one fixed strength.

Figure 1 highlights the broad working steps of the proposed approach. For every input image, a fine-tuned YOLO detector first locates the tumor bounding box. This box is treated as the ROI. The remaining pixels are then split into two further tiers using Otsu thresholding on the grayscale image: brain tissue outside the ROI, and the background outside the skull. Each tier is encrypted with a cipher of different strength. The ROI receives the strongest cipher that consists of permutation, DNA-inspired substitution, and bidirectional chaining. The tissue receives a medium cipher that consists of DNA substitution only. The background portion receives the lightest cipher, consisting of plain keystream XOR. All cipher components use a shared logistic map key, which ensures that the decryption is lossless.

3.1. Dataset and Detector Fine-Tuning

Six YOLO variants (YOLOv5n, YOLOv5s, YOLOv8n, YOLOv8s, YOLOv9c, and YOLO11n) were fine-tuned independently on the Ultralytics brain tumor dataset [24]. This dataset contains two classes, negative and positive. It was selected for experimentation because it is specifically designed for object detection, making it well suited for evaluating YOLO models. Unlike classification datasets that only indicate whether a tumor is present, this dataset also provides bounding box annotations. This makes it well suited for YOLO, allowing the model to learn both the presence and precise location of brain tumors in medical scans. Pretrained COCO weights were used as the starting point. Fine-tuning was conducted for 50 epochs, with a batch size of 16. The dataset was pre-split into training and testing portions with 893 and 223 images, respectively. All the images were of size 512 × 512 pixels.

3.2. Region-of-Interest Extraction and Tiered Segmentation

For a given grayscale image I, the fine-tuned detector is run at a confidence threshold $\tau$ (selected per model) to obtain a set of predicting bounding boxes. If at least one box is predicted, the union of these boxes forms the ROI mask. The mask is denoted as $M_{\mathrm{roi}}$. If the detector predicts no box for an image, a classical fallback is used. Otsu’s method is applied to I, the largest external contour is found, and its bounding rectangle becomes the ROI. This fallback keeps the training pipeline intact and prevents failure due to missed detections. Because it targets a coarser non-tumor-specific region (often close to the whole skull), every downstream measurement records which of the two sources produced the ROI for a given image. Once $M_{\mathrm{roi}}$ has been fixed, Otsu thresholding is applied to the image again in order to separate brain tissues from the dark background of the MRI. The result is presented in two tiers, as shown in Equations (1) and (2), where $M_{\mathrm{fg}}$ represents the Otsu foreground mask. All three masks are disjoint in nature. Otsu thresholding was selected for this coarse split because it is parameter-free and deterministic as well as cheap to compute; it is not intended to replace anatomically aware segmentation but to provide a three-way confidentiality split at negligible extra cost.

$$\begin{array}{cc}\hfill M_{\mathrm{tissue}}& =M_{\mathrm{fg}}\setminus M_{\mathrm{roi}}\hfill \end{array}$$

(1)

$$\begin{array}{cc}\hfill M_{\mathrm{bg}}& =M_{\mathrm{fg}}^c\setminus M_{\mathrm{roi}}\hfill \end{array}$$

(2)

3.3. Tiered Encryption and Decryption Scheme

All ciphers in the approach are keyed by a single logistic map, as defined in Equation (3). The logistic map uses a fixed operating point $(x_0,r)=(0.6137,3.9901)$, which was selected because it lies in the chaotic regime of the map (r close to 4). As a result, it produces a keystream with good statistical randomness. The map is iterated for a warm-up period of 200 steps before any output is used. This ensures that the sequence has moved well away from the fixed seed, discarding initial transients. This particular operating point was fixed empirically rather than being searched. For r values close to the upper boundary of the chaotic band (typically $r\gtrsim 3.99$), the logistic map exhibits a near-uniform invariant density and a Lyapunov exponent bounded well away from zero, both of which are necessary preconditions for the resulting keystream to pass standard randomness diagnostics. The specific value $x_0=0.6137$ was chosen to be far from the map’s unstable fixed points and short-period windows, which persist even within the nominally chaotic regime. This was done in order to avoid an accidental low-period keystream. The warmed-up outputs are then scaled and reduced modulo 256 to form a per-pixel keystream byte sequence. Two fixed 8-bit constants, 137 and 214, are used as the Initialization Vectors (IV) for the ROI tier’s two chaining passes. These constants act as the nonce-like seed for the chain, ensuring that the first symbol in each pass has a defined predecessor. In addition, a second independent logistic sequence is used to generate the permutation used in the ROI tier, which is obtained by shifting the seed by a fixed offset before iterating. It is used so that the substitution keystream and the order of permutation are not derived from the same intermediate state.

$$x_{n+1}=r{x}_n(1-x_n)$$

(3)

Algorithm 1 summarizes ROI-tier encryption. Pixels in the background are the least sensitive, as they contain no anatomical information. They are encrypted with a single XOR pass against the logistic keystream, as defined in Equation (4).

$$c_i=m_i\oplus k_i,i\in M_{\mathrm{bg}}$$

(4)

Pixels that represent tissues receive a medium-strength cipher. Each byte is first split into four 2-bit DNA-inspired symbols, i.e., one symbol per pair of bits. The keystream bytes are split in the same way. The two symbol streams are XORed pairwise before being packed back into bytes, as defined in Equation (5). This adds substitution at the symbol level relative to the background tier. It does not apply permutation and uses no chaining, which keeps it cheaper than the ROI cipher.

$$c_i=\mathrm{pack}\left(\mathrm{split}\left(m_i\right)\oplus \mathrm{split}\left(k_i\right)\right),i\in M_{\mathrm{tissue}}$$

(5)

The ROI tier uses the strongest cipher, as it contains the information about the tumor region. Three operations are applied in sequence: pixel permutation, DNA-symbol substitution, and a two-pass (bidirectional) XOR chain. The pixel values inside $M_{\mathrm{roi}}$ are flattened into a 1D array, then reordered using a permutation derived from the second logistic sequence. Reordering the pixels prior to substitution and chaining removes the correlation of each output’s pixel’s position from its original spatial neighbors. The permuted array is DNA-encoded and then XORed against the logistic keystream symbol-by-symbol. The substituted symbol stream is then passed through two XOR-chain operations. This ensures that a change in one input pixel affects other output pixels as well, rather than only its own position. The forward chain is a cumulative COR over the sequence, as defined in Equation (6).

$$c_i^{\left(1\right)}=\left(\underset{j\le i}{⨁}{m}_j\right)\oplus {\mathrm{IV}}_F$$

(6)

The above equation is computed in closed form with a vectorized prefix-XOR (numpy.bitwise_xor.accumulate) rather than a Python loop, which keeps the operation linear in the number of pixels. The forward chain can only propagate information to positions that appear later in the sequence. As a result, information from future positions cannot influence the earlier ones. A second pass is then performed in the reverse direction. This backward pass performs the same operation as the previous sequence, allowing information to flow from later positions back to earlier ones. The two IVs, ${\mathrm{IV}}_F$ and ${\mathrm{IV}}_B$, are distinct fixed constants, so the two passes are not trivially self-canceling. Using both passes means that a single changed input pixel can influence almost every output pixel in the tier. Algorithm 2 summarizes the decryption steps. To decrypt an image, the exact same steps as used for encryption are performed backwards.

Algorithm 1 ROI-tier encryption

Require: plaintext values $\mathbf{m}$ (flattened ROI pixels), key $(x_0,r)$, IVs ${\mathrm{IV}}_F,{\mathrm{IV}}_B$

Ensure: ciphertext values $\mathbf{c}$

1: $\pi \leftarrow$PermutationIndices($\left|\mathbf{m}\right|,x_0,r$)     ▹ from the shifted logistic sequence   2: ${\mathbf{m}}^{\prime }\leftarrow \mathbf{m}\left[\pi \right]$                         ▹ permute   3: $\mathbf{k}\leftarrow$LogisticKeystream($\left|\mathbf{m}\right|,x_0,r$)   4: $P\leftarrow \mathrm{split}\left({\mathbf{m}}^{\prime }\right)$,    $K\leftarrow \mathrm{split}\left(\mathbf{k}\right)$            ▹ byte → four 2-bit symbols   5: $M\leftarrow P\oplus K$                             ▹ substitution   6: $C_1\leftarrow$ForwardChain$(M,{\mathrm{IV}}_F)$                   ▹ prefix-XOR   7: $C_2\leftarrow$BackwardChain$(C_1,{\mathrm{IV}}_B)$                 ▹ suffix-XOR   8: $\mathbf{c}\leftarrow \mathrm{pack}\left(C_2\right)$   9: return $\mathbf{c}$

Algorithm 2 ROI-tier decryption

Require: ciphertext values $\mathbf{c}$, key $(x_0,r)$, IVs ${\mathrm{IV}}_F,{\mathrm{IV}}_B$

Ensure: plaintext values $\mathbf{m}$

1: $C_2\leftarrow \mathrm{split}\left(\mathbf{c}\right)$   2: $C_1\leftarrow$BackwardChainInverse($C_2,{\mathrm{IV}}_B$)        ▹ undo the last pass first   3: $M\leftarrow$ForwardChainInverse($C_1,{\mathrm{IV}}_F$)   4: $\mathbf{k}\leftarrow$LogisticKeystream($\left|\mathbf{c}\right|,x_0,r$)   5: $K\leftarrow \mathrm{split}\left(\mathbf{k}\right)$   6: $P\leftarrow M\oplus K$                       ▹ undo substitution   7: ${\mathbf{m}}^{\prime }\leftarrow \mathrm{pack}\left(P\right)$   8: $\pi \leftarrow$PermutationIndices($\left|\mathbf{c}\right|,x_0,r$)   9: $\mathbf{m}\leftarrow {\mathbf{m}}^{\prime }\left[{\pi }^{-1}\right]$                    ▹ undo permutation 10: return $\mathbf{m}$

4. Results and Discussion

Various simulation-based experiments are conducted to evaluate the efficacy and applicability of the proposed approach. A wide range of performance metrics, including correlation analysis, entropy, and error analysis during pixel reconstruction, are used to quantify performance. In addition, energy and carbon costs are evaluated for different stages of the pipeline, helping to quantify the cost of running AI models before ciphers instead of the standalone ciphers. This type of analysis is largely absent from existing studies. Each stage is wrapped with a hardware-level energy tracker that measures power drawn at one-second intervals. The total energy consumed ($E_{\mathrm{kWh}}$) and total estimated emissions ($M_{\mathrm{kg}}$) are reported for each stage using the local machine’s measured or assumed grid carbon intensity. Given $n_{\mathrm{ops}}$ total operations in a stage (number of images times number of repeats), per-image figures are derived using Equations (7) and (8). In addition, wall-clock time, CPU utilization change, and resident memory change are recorded alongside energy for each stage using standard process monitoring utilities.

$$\begin{array}{cc}\hfill E_{\mathrm{J}/\mathrm{img}}& ={\displaystyle \frac{E_{\mathrm{kWh}}\times 3.6\times {10}^6}{n_{\mathrm{ops}}}}\hfill \end{array}$$

(7)

$$\begin{array}{cc}\hfill M_{{\mathrm{gCO}}_2\mathrm{e}/\mathrm{img}}& ={\displaystyle \frac{M_{\mathrm{kg}}\times 1000}{n_{\mathrm{ops}}}}\hfill \end{array}$$

(8)

4.1. Experimental Setup

All experiments are conducted in Google Colab using a Tesla T4 GPU. No high-RAM or other features of Colab Pro were used. Python3 and its various libraries were used for implementation. This setup was selected in order to provide ease of reproduction and validation without the need for dedicated hardware. Each measurement stage is tracked with CodeCarbon, configured with cloud_provider=“gcp” because Colab’s VMs run on Google Cloud Platform (GCP) infrastructure. The GCP instance metadata service is used to detect the region automatically, as the Colab backend region can vary between sessions. The CodeCarbon emission log is maintained for each measurement stage, and records the regional grid emission factor (kg CO₂/kWh) used for that run. The reported energy consumption in Joules per image is calculated from CPU and GPU power measurements collected at one-second intervals; therefore, the energy values are independent of the grid region. On the other hand, the calculated carbon emissions (gCO₂e) depend on the regional emission factor; as a result, they should not be assumed to be directly transferable for deployment regions and should be recalculated using the emission factor of the target grid. YOLO models were trained on the entire training set, and their classification performance was evaluated on the entire test set. All models were evaluated under similar environmental conditions to ensure a fair evaluation.

4.2. Detection Performance

Table 2. Custom Hungarian-matched detection accuracy on the full 223-image test set at each model’s $F_1$-optimal confidence threshold.

Model	Conf. Thr.	Mean IoU	Det. Rate@0.5	TP	FP	FN
YOLOv5n	0.50	0.667	0.759	183	35	58
YOLOv5s	0.30	0.691	0.801	193	56	48
YOLOv8n	0.50	0.743	0.846	204	25	37
YOLOv8s	0.50	0.714	0.813	196	44	45
YOLOv9c	0.35	0.757	0.867	209	83	32
YOLO11n	0.40	0.591	0.668	161	64	80

reports the Hungarian-matched detection accuracy at each model’s own $F_1$-optimal confidence threshold.

Table 3. Official Ultralytics val() metrics on the validation split.

Model	Precision	Recall	mAP50	mAP50-95
YOLOv5n	0.467	0.849	0.507	0.362
YOLOv5s	0.438	0.817	0.509	0.358
YOLOv8n	0.444	0.883	0.538	0.396
YOLOv8s	0.439	0.837	0.529	0.381
YOLOv9c	0.463	0.844	0.510	0.376
YOLO11n	0.471	0.850	0.498	0.352

presents Ultralytics’ own val() metrics for the same weights.

Table 4. Classification diagnostics on Hungarian-matched boxes for the full 223-image test set.

Model	Precision	Recall	F1	Accuracy	ROC-AUC
YOLOv5n	0.408	0.636	0.497	0.536	0.606
YOLOv5s	0.361	0.833	0.504	0.389	0.487
YOLOv8n	0.404	0.770	0.530	0.505	0.562
YOLOv8s	0.435	0.711	0.540	0.531	0.491
YOLOv9c	0.333	0.373	0.352	0.507	0.540
YOLO11n	0.338	0.429	0.378	0.447	0.509

presents the classification diagnostics over the full 223-image test set. Ground-truth boxes are taken directly from the dataset’s YOLO-format label files and converted to pixel coordinates. Prediction boxes are matched to ground-truth boxes using a one-to-one Hungarian assignment based on an intersection-over-union (IoU) cost matrix. This approach finds the best unique match between predictions and ground-truth boxes. As a result, each prediction can be assigned to at most one ground-truth box. This prevents a single prediction from being matched to multiple targets. A match is only accepted if its IoU is at least 0.5. As different fine-tuned models can have different optimal operating points, the confidence threshold is not fixed at a single value for all models; instead, various candidate thresholds are evaluated for each model and the threshold that maximizes performance is selected for that model. All classification metrics are computed on Hungarian-matched pairs. In addition, Ultralytics’ own validation routine is run for each model to obtain standard precision, recall, mAP50, and mAP50-95.

YOLOv9c achieved the highest mean IoU and detection rate of 0.757 and 0.867, respectively, on the full test set. This highlights its larger backbone capacity and parameter count, which allow it to fit tighter boxes when it detects a tumor. However, it also produced the highest false positives at 83, 3× more than YOLOv8n. In addition, it achieved the lowest precision and recall among all variants. YOLO11n and YOLOv5s also had high error rates and slightly lower accuracy; on the other hand, YOLOv8n produced the fewest false positives while achieving the second-highest detection rate of 0.846 and the highest recall of 0.770, and achieved various other competitive metrics. Altogether, these results make it the most conservative and reliable detector for the tiered pipeline. The smaller and shallower architecture of YOLOv8n also makes it suitable on a dataset of this size. YOLOv8s and YOLOv8n achieved the two highest F1 scores (0.540 and 0.530), highlighting the “n”/“s” YOLOv8 family as the strongest choice among the six variants when tested on the complete held-out split. This result is also consistent with their leading mAP50/mAP50-95 in Table 3. Each false positive causes the strongest cipher to be unnecessarily applied to healthy tissue; thus, a low false positive rate is valuable regardless of the raw IoU score. The ROC-AUC of every model sits around 0.5, with YOLOv8s achieving 0.630. This should not be interpreted as architectural weakness; since AUC is computed only on the matched-prediction confidence scores, a low AUC here reflects weak confidence calibration between two classes rather than poor localization.

4.3. ROI Extraction and Tier Coverage

Table 5. Otsu fallback usage rate over the full 223-image held-out test set.

Model	Fallback Images	Fallback Rate
YOLOv5n	42	18.8%
YOLOv5s	30	13.5%
YOLOv8n	25	11.2%
YOLOv8s	28	12.6%
YOLOv9c	24	10.8%
YOLO11n	65	29.1%

shows how often each model’s detector produced no box at all on the full held-out set. This situation forces the pipeline into Otsu’s largest-contour fallback. Fallback usage does not correlate straightforwardly with detection accuracy for every algorithm: YOLOv9c achieved the lowest fallback rate of 10.8%, closely followed by YOLOv8n with 11.2%, while YOLO11n fell back most often at 29.1%. This result also aligns with its weaker detection metrics discussed earlier. Since a fallback ROI is traced from the whole skull rather than the tumor, this rate directly bounds how often the strongest cipher is applied to a coarser non-tumor-specific region. Figure 2 visualizes this gap in region size.

YOLOv5s achieved the lowest fallback rate of 4% along with the second-most false positives. On the other hand, YOLOv8n emerged as the strongest detector, although it fell back on 8% of images. This is an expected result, as fallback is only triggered by false negative results, i.e., a genuine miss with zero predicted boxes. As such, it is different from the failure mode for a false positive.

Table 6. Mean tier coverage as a fraction of the frame on the full 223-image test set.

Model	ROI Share	Tissue Share	Background Share
YOLOv5n	0.063	0.148	0.789
YOLOv5s	0.052	0.156	0.793
YOLOv8n	0.046	0.160	0.794
YOLOv8s	0.050	0.157	0.793
YOLOv9c	0.043	0.162	0.796
YOLO11n	0.096	0.125	0.779

presents the average share of the frame assigned to each tier, averaged for both YOLO-detection and Otsu fallback ROIs together. Figure 2 visualizes the split between them. Among all six models, the ROI tier stays small with 3–5% of the frame. Similarly, tissues and background have 18–19% and 77%, respectively. This confirms the primary claim behind the tiered design of the proposed scheme: the strongest and most expensive cipher only has to run on a small slice of each image, while the rest of the frame is covered by the cheap background cipher. YOLOv5n has the largest ROI share of 0.050, which YOLO11n’s ROI share nearly doubles with 0.096. This is consistent with the highest fallback rate mentioned earlier, as a fallback ROI traced from the whole skull contour is usually far larger than a genuine tumor box.

4.4. Computational and Carbon Cost

Table 7. Inference-only cost per image averaged over five repeats on the full 223-image test set.

Model	Time (s)	Energy (J)	Carbon (mgCO2e)	ROI Ratio Detected
YOLOv5n	0.0124	0.795	0.077	0.063
YOLOv5s	0.0126	1.309	0.127	0.052
YOLOv8n	0.0117	0.808	0.078	0.046
YOLOv8s	0.0134	1.404	0.136	0.050
YOLOv9c	0.0339	3.012	0.292	0.043
YOLO11n	0.0143	0.968	0.094	0.096

and

Table 8. Trends in encryption-only cost per image on the full 223-image test set.

Strategy/Model	Time (s)	Energy (J)	Carbon (mgCO2e)	Avg. ROI Ratio
Full-frame baseline	0.1099	4.590	—	1.000
YOLOv5n (tiered)	0.0564	4.215	0.409	0.063
YOLOv5s (tiered)	0.0567	4.165	0.404	0.052
YOLOv8n (tiered)	0.0555	4.152	0.403	0.046
YOLOv8s (tiered)	0.0551	4.108	0.398	0.050
YOLOv9c (tiered)	0.0546	4.019	0.390	0.043
YOLO11n (tiered)	0.0560	4.085	0.396	0.096

presents the inference-only and encryption-only cost per image. Both are measured with the CodeCarbon tracker. All the models were evaluated under similar environmental conditions to ensure a fair evaluation. The full-frame baseline incurs the highest overhead because the entire image is encrypted with the strongest cipher before transmission, while energy consumption and carbon emissions decrease by ≈8.2–12.4% for all simulated models. On the full 223-image set, YOLOv9c shows the lowest tiered encryption cost of 4.019 J. This is consistent with its smallest average ROI ratio of 0.043. A smaller ROI tier means that less of the frame is run through the most expensive and secure cipher. However, YOLOv9c’s own inference cost is over 3.5× higher than YOLOv8n’s. This highlights a shortfall that cannot be easily overlooked. On the other hand, considering this cost, YOLOv8n stands out as the cheapest model and the most practical choice for deployment. YOLOv8n is the most accurate model on the metrics and provides a favorable per-image tradeoff, requiring only 0.0555 s per image. Although YOLOv9c is slightly faster with 0.0546 s encryption time, its classification performance is not on par with that of YOLOv8n. YOLOv9c consumes ≈3.2% less energy and emits ≈3.2% less carbon than YOLOv8n while also delivering lower classification metrics, as shown in Figure 3 and Figure 4. This efficiency is primarily due to its smaller average ROI ratio of 0.043, compared with 0.046 for YOLOv8n, which reduces the number of pixels requiring encryption. Although YOLOv9c has a larger architecture than YOLOv8n, its lower encryption cost demonstrates that the computational overhead is also influenced by the amount of image content selected for encryption.

Table 9. Statistical significance of encryption time reduction for the tiered approach versus full-frame encryption (paired against the shared full-frame mean, $n=500$ samples per model).

Model	t-Statistic	t-Test p	Wilcoxon p	Time Reduction
YOLOv5n	$-38.51$	$1.4\times {10}^{-151}$	$5.0\times {10}^{-81}$	46.6%
YOLOv5s	$-43.66$	$1.6\times {10}^{-172}$	$5.5\times {10}^{-83}$	49.4%
YOLOv8n	$-42.71$	$8.9\times {10}^{-169}$	$1.6\times {10}^{-82}$	49.1%
YOLOv8s	$-40.13$	$2.6\times {10}^{-158}$	$1.7\times {10}^{-80}$	48.2%
YOLOv9c	$-40.63$	$2.1\times {10}^{-160}$	$2.3\times {10}^{-81}$	47.8%
YOLO11n	$-35.52$	$9.8\times {10}^{-139}$	$4.1\times {10}^{-78}$	45.8%

conducts a statistical analysis and evaluates whether the reduction in encryption time achieved by the proposed tiered framework is statistically significant over the baseline. The t-statistic measures how far the average tiered encryption system lies from the baseline’s time in units of standard error. A large negative value indicates that the tiered time is consistently and substantially below the baseline, not just lower by chance. The t-test p and Wilcoxon p are two independent ways of asking the same question. The t-test assumes that the 500 paired timing samples are roughly normally distributed; on the other hand, the Wilcoxon signed rank test makes no assumptions, instead checking the sign and rank of each paired difference. Thus, agreement between the two represents a stronger result than either alone. Both fall below ${10}^{-78}$, far past the usual 0.05 cutoff. This shows that the results are statistically significant rather than random variation. The “time reduction” column evaluates how much faster tiered encryption is compared to full-frame encryption in terms of percentage of the baseline time. Evaluated as a simple relative difference of the two mean times, it shows that the encryption time is reduced by nearly 45–49%. Assuming that cost scales purely with pixel count, encrypting only 3–5% of the frame at full strength and the rest at much cheaper ciphers should save closer to 90% of the time, not half. The logistic-map keystream and the ROI permutation index are generated using sequential Python loops rather than vectorized NumPy operations. Both processes iterate once per encrypted pixel, irrespective of the image tier. As a result, the loop overhead remains nearly constant on a per-pixel basis and contributes a shared computational cost for all tiers. The reduction in encryption time achieved by shrinking the ROI is partially masked by this implementation overhead. YOLOv5s results in the largest cut of 49.4%, which shows that it can perform encryption almost twice as fast as the baseline. Similarly, YOLO11n cuts the time by nearly 1.85×. This speed difference signifies that tiered encryption reliably provides close to a 2× speed-up over encrypting the whole frame irrespective of which of the six detectors manages the pipeline. Other statistics confirm these findings as well; both the paired t-test and the Wilcoxon signed-rank test produce small p-values, indicating that the observed reductions are highly significant.

To quantify the performance of the proposed model relative to other ciphers in terms of energy consumption, a comparative analysis is conducted using four ciphers: AES-256-CBC, ChaCha20, Triple DES (3DES)-CBC, and Blowfish-CBC. These four ciphers are selected because they represent ciphers from different families and operating points, allowing for a comprehensive analysis. AES-256-CBC represents a fast cipher, which usually represents the hardware-accelerated (AES-NI) case. ChaCha20 represents a software-only stream cipher used as the TLS 1.3 default on hardware without AES-NI, such as many mobile and ARM devices. 3DES-CBC represents a deliberately slower legacy block cipher of the type still used in some embedded and payment systems. Blowfish-CBC represents a different block size (64-bit, versus AES/DES’s distinct designs) and key schedule family. Collectively, these ciphers span a realistic range of deployable systems for comparison rather than a single favorable data point. Asymmetric ciphers were intentionally excluded from this comparison to enable fair comparison, as asymmetric schemes work on small payloads (keys, hashes, digital signatures, etc.) and are orders of magnitude slower per byte than symmetric ciphers by design. As a result, the comparison would be unfair in terms of throughput and energy. All four simulated ciphers use a fixed non-secret key/IV for reproducibility, which is appropriate because the focus of this experiment is on throughput and energy rather than enhanced security. All algorithms were simulated under identical measurement environments, and the YOLO variants were rerun to ensure a consistent and reliable basis for comparison with the proposed model and baseline methods.

Table 10. Encryption-only cost of four classical ciphers on the full 223-image test set (five repeats).

Cipher	Time (s)	Energy (J)	Carbon (mgCO2e)
AES-256-CBC	0.0007	0.685	0.066
ChaCha20	0.0009	0.679	0.066
3DES-CBC	0.0091	0.959	0.093
Blowfish-CBC	0.0022	0.677	0.066

presents the encryption-only cost for the simulated ciphers. Figure 5 visualizes the metrics for all three categories of ciphers per YOLO model: full-frame DNA baseline, classical ciphers, and tiered DNA. It can be observed that the classical ciphers are cheaper than the DNA full-frame baseline (4.590 J) at the raw throughput level; on the other hand, ChaCha20 and Blowfish require 0.7 J/image, and 3DES also stays below 1 J/image. This gap is expected, since classical ciphers apply one linear substitution pass with no per-tier segmentation, DNA re-encoding, permutation, or bidirectional chaining; therefore, a comparison using raw throughput alone would understate what the proposed scheme provides. The more meaningful comparison is between tiered DNA-AdCrypt (3.9–4.2 J) and the full-frame cost of classical ciphers, provided in Table 8. If a classical cipher were applied selectively to the ROI, tissue, and background tiers using the same reduced pixel counts as DNA-Adcrypt, its energy consumption would likely fall within a broadly comparable range. This confirms that the computational overhead reported by this paper is attributable to the multi-layer ROI cipher’s stronger security construction (permutation, substitution, and bidirectional diffusion)as opposed to an inefficient implementation relative to standard practice.

Since the reported energy consumption is measured directly on the experimental hardware, the measured energy per image is independent of the grid emission factor assumed for a deployment location. In order to examine the effect of geographical variation in electricity generation,

Table 11. Estimated YOLOv8n tiered-encryption carbon emissions under different national electricity grid carbon intensities, using the measured energy consumption of 4.152 J/image.

Grid/Country	Grid Carbon Intensity (gCO2/kWh)	Estimated Carbon (mgCO2e/img)
France	21.7	0.025
United States	384	0.443
Germany	344	0.397
India	708	0.817

converts the YOLOv8n tiered encryption energy consumption of 4.152 J/image (Table 8) into estimated carbon emissions using national electricity grid carbon intensity factors. This conversion follows Equation (8), with the corresponding national grid factor used in place of the emission factor associated with the experimental measurement. As a result, the encryption pipeline does not need to be re-executed for each region; the computational energy remains fixed, while only the energy-to-carbon conversion factor changes.

An evaluation on four countries was conducted. These countries were selected to ensure comprehensive coverage of substantially different electricity grid carbon intensity regimes. Among the selected countries, France represents a very low-carbon electricity system dominated by low-carbon generation; the United States represents a large electricity market with intermediate carbon intensity; and India represents a rapidly growing market with comparatively higher carbon intensity, similar to Germany. This selection allows the same measured computational energy consumption to be evaluated across low-, intermediate-, and high-carbon electricity systems. The resulting analysis shows the sensitivity of absolute carbon emissions to deployment location. The grid carbon intensity values for France are taken from the French Transmission System Operator RTE, which reported a 2024 average electricity generation carbon intensity of 21.7 gCO₂e/kWh [25]. For the remaining countries, we considered Ember’s Yearly Electricity Data as reported in the Global Electricity Review 2025 [26]. These sources use country-level electricity generation intensity; as a result, they provide a location-dependent estimate rather than a direct re-measurement of the experimental workload.

The results show that identical computational energy consumption can result in different absolute carbon emissions depending on the electricity grid at the deployment location. For the considered regions, the estimated carbon impact varies from ≈0.025 mgCO₂e/image in France to 0.817 mgCO₂e/image in India; therefore, the absolute carbon footprint of the same encryption workload should not be treated as universally transferable in deployment sites. On the other hand, the percentage reductions reported throughout this paper (e.g., ≈8.2–12.4% for tiered encryption relative to full-frame encryption) represent relative savings associated with the computational workload. This can be interpreted independently of the selected regional grid factor.

4.5. Security Diagnostics

Table 12. Security diagnostics on the ROI-tier cipher region.

Model	Entropy (Bits)	${\mathit{\chi }}^2$ p-Value	Mean Corr.	Lossless
YOLOv5n	7.899	0.492	0.0007	Yes
YOLOv5s	7.909	0.469	0.0007	Yes
YOLOv8n	7.906	0.518	0.0006	Yes
YOLOv8s	7.904	0.538	0.0006	Yes
YOLOv9c	7.893	0.530	0.0006	Yes
YOLO11n	7.904	0.518	0.0007	Yes

summarizes the cipher quality on the ROI tier of the tiered cipher, evaluated on 100 randomly selected images. Figure 6 visualizes the state of a randomly selected test image at different stages of the proposed tiered encryption process. Every model presents essentially the same picture, since an identical cipher construction and key were used. The input pixels differ due to their ROIs. The Shannon entropy, for which the ideal value is 8, ranges from 7.89 to 7.91 bits. Every ${\chi }^2$ test yields $p>0.46$, above the usual 0.05 significance level. As a result, the distribution of the cipher’s pixel value cannot be distinguished from uniform noise in this test. Correlation values are the mean of horizontal, vertical, and diagonal adjacent-pixel correlation on the whole cipher frame. The mean adjacent-pixel correlation is also close to zero for every model, unlike a usual MRI slice in which neighboring pixels are highly correlated. All 100 images are decrypted back to the original byte-for-byte for every model, i.e., losslessly. Error metrics such as the Mean Squared Error (MSE) and Mean Absolute Error (MAE) are observed to be zero. Figure 7 indicates the exact inverse reconstruction in practice.

Table 13. Key sensitivity NPCR/UACI for five sample images, full-frame cipher, and key perturbation ${10}^{-10}$.

Image	NPCR (%)	UACI (%)
val_1 (44).jpg	99.617	33.461
val_1 (131).jpg	99.603	33.408
val_1 (65).jpg	99.620	33.476
val_1 (100).jpg	99.612	33.507
val_1 (14).jpg	99.622	33.412
Mean	99.615	33.453

presents the key sensitivity test conducted for five randomly selected images. The plaintext was fixed and $x_0$ was perturbed by ${10}^{-10}$, yielding near-ideal results for Number of Changing Pixels Rate (NPCR) and Unified Averaged Changed Intensity (UACI) at ≈99.6% and ≈33.4%, respectively. This shows that the keystream itself is highly sensitive to the key. A ${10}^{-10}$ change in $x_0$ produces an essentially unrelated cipher. Thus, when combined with a ≈104-bit keyspace, brute force or nearby key attacks become highly difficult.

Table 14. Composite whole-cipher plaintext sensitivity for 10 images × 30 trials per model.

Model	NPCR (%)	UACI (%)	Entropy (Bits)
YOLOv5n	1.94	0.014	7.9991
YOLOv5s	0.62	0.004	7.9991
YOLOv8n	0.40	0.005	7.9991
YOLOv8s	1.37	0.014	7.9991
YOLOv9c	0.54	0.003	7.9991
YOLO11n	0.76	0.014	7.9991

and Figure 8 present the whole-cipher plaintext sensitivity analysis for ten images with 30 trials per model. This analysis extends the sensitivity analysis to the actual deployed output. Unlike ROI evaluation, a single input pixel is perturbed anywhere in the frame (not restricted to the ROI). The full tiered cipher is then reapplied and metrics such as NPCR and UACI are evaluated over the entire composite ciphertext. YOLOv8n achieves the lowest NPCR of 0.40%, indicating that a single-pixel modification in the input image results in a highly localized change in the corresponding composite ciphertext image. The UACI of 0.005% further indicates limited propagation of the pixel-level change in unrelated image regions. Despite this controlled propagation, the entropy of 7.9991 bits shows that the encrypted image maintains strong statistical randomness despite avoiding unnecessary diffusion of a localized pixel modification. Although YOLOv5n achieves the highest NPCR of 1.94%, it lacks reliable performance compared to other models, including YOLOv8n. A lower NPCR does not inherently indicate weaker encryption when the scheme is intentionally designed to apply different encryption operations to different image tiers. The composite NPCR is slightly lower than the metrics for the ROI tier alone, which is expected due to the architectural design. Since the three tiers are encrypted independently, a single perturbed pixel can only influence the encrypted values within its own tier. A background/tissue-tier perturbation stays confined to essentially one output byte, since those two tiers use non-diffusive substitution rather than a chaining pass. Composite NPCR can be approximately related to the ROI-tier NPCR and the fraction of pixels occupied by the ROI. For example, for YOLOv9c, ≈49.6$\%\times 0.043\approx 2.1\%$ is close to the measured 0.54%–1.37% range for models. This tier isolation design reduces the blast radius, which is one of the core advantages of DNA-Adcrypt. Perturbation in one image tier does not propagate into other tiers. This is further supported by the composite entropy at 7.9991 for all models, which shows that the complete encrypted image stays indistinguishable from noise.

Table 15. ROI tier-only plaintext sensitivity for multiple trials (10 images × 30 trials).

Model	Mean NPCR (%)	Mean UACI (%)
YOLOv5n	50.06	0.92
YOLOv5s	48.55	0.61
YOLOv8n	47.29	0.70
YOLOv8s	52.42	0.83
YOLOv9c	49.58	0.76
YOLO11n	48.72	0.50

presents further insight into the diffusion behavior. A mean NPCR of 47.3–52.4% is achieved for ROI tier-only multi-trial analysis. The bidirectional chain increases error propagation compared with the forward-only design. However, since both passes use linear XOR operations, affected positions can cancel each other when an even number of changes occurs along the accumulation path. As a result, the practical average diffusion stays close to one-half instead of approaching the ideal ≈99.6% level observed under full-frame key sensitivity (Table 13). This behavior aligns with the algebraic limitation discussed earlier, as a purely linear diffusion layer has an inherent cancellation property that cannot be eliminated simply by adding more linear chaining passes.

4.6. Resilience Against Common Image Perturbations

Table 16. Robustness of the tiered cipher against common image perturbations; results are shown per model and per attack.

Model	Perturbations	Entropy After	NPCR vs. Clean (%)	UACI vs. Clean (%)	Decryption MSE	Decryption PSNR (dB)
YOLOv5n	Gaussian noise	7.885	95.65	3.05	2953.5	13.43
	Salt & pepper	7.882	1.97	1.00	394.0	22.18
	JPEG (Q = 50)	7.796	97.52	5.72	4909.7	11.22
	Crop occlusion	7.915	0.99	0.50	220.0	24.71
YOLOv5s	Gaussian noise	7.864	95.63	3.05	2918.3	13.48
	Salt & pepper	7.883	1.97	0.98	381.7	22.31
	JPEG (Q = 50)	7.784	97.53	5.72	4908.4	11.22
	Crop occlusion	7.919	0.99	0.50	217.4	24.76
YOLOv8n	Gaussian noise	7.872	95.64	3.05	2934.7	13.46
	Salt & pepper	7.894	1.98	0.99	389.4	22.23
	JPEG (Q = 50)	7.796	97.52	5.72	4909.7	11.22
	Crop occlusion	7.915	0.99	0.50	94.7	28.37
YOLOv8s	Gaussian noise	7.885	95.68	3.05	2925.4	13.47
	Salt & pepper	7.908	1.98	1.00	394.4	22.17
	JPEG (Q = 50)	7.752	97.50	5.71	4920.4	11.21
	Crop occlusion	7.930	0.99	0.49	209.9	24.91
YOLOv9c	Gaussian noise	7.876	95.66	3.06	2955.9	13.42
	Salt & pepper	7.905	1.97	0.99	386.8	22.26
	JPEG (Q = 50)	7.751	97.52	5.72	4924.7	11.21
	Crop occlusion	7.918	0.99	0.50	217.1	24.76
YOLO11n	Gaussian noise	7.883	95.65	3.05	2929.8	13.46
	Salt & pepper	7.906	1.97	0.99	387.1	22.25
	JPEG (Q = 50)	7.805	97.50	5.69	4914.5	11.22
	Crop occlusion	7.928	0.99	0.49	212.4	24.86

summarizes the resilience against four common image perturbations. These perturbations and their values were selected because they represent common widely-studied real-world distortions that can significantly affect system performance. These attacks include:

• Gaussian noise ($\sigma$ = 10.0): Adds zero-mean Gaussian noise with standard deviation $\sigma$ = 10.0 to every pixel, then clips back to [0, 255].
• Salt-and-pepper noise (corrupted pixel fraction = 0.02): Results in 2% of pixels being corrupted; half of this 2% is set to 255 (salt) and the other half to 0 (pepper), so out of every 10,000 pixels, ≈100 are white and 100 are black.
• JPEG compression (quality = 50): The images is re-encoded as a JPEG at quality = 50 using OpenCV, then decoded.
• Crop occlusion (frac = 0.1): Blacks out a random rectangle covering 10% of both height and width (frac = 0.1), i.e., a patch that is roughly 1% of the total image area (0.1 × 0.1). The rectangle’s top left corner position is chosen randomly for each run (random.randint).

The four attacks were observed to disturb the cipher to different degrees. Gaussian noise and JPEG touch every pixel; as a result, they increase NPCR vs. clean to 95–98% while reducing encryption PSNR to 11–13 dB. These results are expected, since neither attack respects tier boundaries. On the other hand, salt-and-pepper and crop occlusion are observed to disturb only a small patch. As a result, NPCR vs. clean stays under 2% and PSNR recovers to 22–25 dB. YOLOv8n is observed to stand out in terms of crop-occlusion results, with 94.7 MSE and 28.37 dB PSNR, ≈2.2× lower than the next-best YOLOv8s model at 209.9. This results is due to the occlusion rectangle being placed randomly for each run; for YOLOv8n, it landed almost entirely in the cheaply encrypted background tier rather than clipping the tumor region. This also shows an advantage of tiered design; since tiers are encrypted independently, the damage is confined to one tier and does not propagate into the others. Among the four attacks, the entropy following the attack remains close to the clean cipher value of about 7.9 bits, except for the JPEG scenario, as shown in Figure 9. In this case, the entropy drops to around 7.78 bits, which is due to the quantization that JPEG applies rather than to any weakness specific to this cipher.

From the above simulation-based experiments, YOLOv8n is observed to be the best-performing detector. It achieves the highest recall, mAP50, and mAP50-95 as well as the fewest false positives among all six variants. It also achieves the best F1 and accuracy with the lowest inference and energy cost per image. This makes it an energy-efficient and generally good outcome for a design motivated by the perspective of green computing. Notably, the fixed-point selection is a manual empirically verified choice instead of an optimized one; an optimized set of parameters could be found through bio-inspired optimization techniques using an explicit function (e.g., maximizing keystream entropy or minimizing adjacent pixel correlation) [15]. Integrating such a bio-inspired search to select $(x_0,r)$ per deployment or even per image represents a natural extension that could strengthen DNA-AdCrypt.

5. Conclusions and Future Work

This work has presented an energy-aware AI-guided adaptive encryption scheme for securing brain tumor MRI scan images. A fine-tuned YOLO detector localizes the tumor region, then a DNA-inspired chaotic cipher encrypts the image in three tiers: the strongest encryption on the tumor region, medium encryption on the rest of the brain tissue, and light encryption on the background region. The proposed approach was trained and evaluated on the Ultralytics brain tumor MRI dataset. Among six fine-tuned detector variants, YOLOv8n achieved the best overall balance between classification metrics and computational efficiency, producing the highest recall, mAP50, and mAP50-95 along with the fewest false positives on the complete test set. In addition, it resulted in up to ≈9.5% less encryption-only energy consumption and carbon emissions than the baseline, a smaller margin than the time savings alone would suggest, reflecting the fixed per-pixel loop overhead. Various other analyses also demonstrate the efficacy of the proposed approach. However, the savings did not scale as steeply as the ROI tier’s small size would suggest. The overhead of DNA-Adcrypt over the simulated ciphers is attributable to its additional independent security layers rather than an inefficient implementation. Strengthening the proposed approach to standardize the NPCR and other metrics for perturbed images while keeping the computational cost lower is an open challenge. The design could also be further validated and extended by a strong cross-dataset analysis of different types of medical scans. Replacing the linear XOR chaining with a nonlinear diffusion step could close the NPCR gap and vectorize the keystream, while optimizing the parameters through a bio-inspired optimization could help to attain higher efficiency and represents another fruitful research direction.