Privacy-Shielded Image Compression: Defending Against Exploitation from Vision-Language Pretrained Models

First of all, we greatly appreciate your thorough review and helpful suggestions. Below, we address your concerns one by one, and we hope our responses fully clarify each point. If any misunderstanding remains, we sincerely welcome further clarification or suggestions.

Q.1 Incorporate more quality metrics.

Ans.: Thanks for your suggestion. We have further evaluated the perceptual quality using additional metrics, including SSIM, LPIPS, NIQE, and CLIPIQA. The results corresponding to Fig. 4 of our manuscript can be found at the following link. https://pic1.imgdb.cn/item/67eb75140ba3d5a1d7e8f36d.png It should be noted that the NIQE curves appear somewhat irregular and produce unusual results compared to the other four metrics. Given that NIQE is a no-reference IQA method with known instability in certain scenarios, it may not accurately reflect the actual perceptual quality in this case.

Q.2: Perform the PSIC scheme on other LIC models.

Ans.: We appreciate your insightful suggestion. We have implemented the PSIC in two cutting-edge LIC models (ELIC, and MLIC++). To ensure a fair comparison, all training settings strictly follow those described in our original manuscript. The corresponding results can be found in below table.

These results demonstrate the effectiveness of the PSIC method on other LIC models, as it achieves perceptual quality comparable to the baseline model while offering remarkable encryption efficiency in terms of ASR.  Due to time constraints, we will include more comprehensive results on additional LIC models across multiple BPP points in the supplementary material of our revised paper. We appreciate your understanding.

Q.3 Lacking citation of BAvAFT and compare with recent works (Yu et al. 2023, 2024).

Ans.: We apologize for the confusion caused by the missing citation for BAvAFT. In fact, BAvAFT originates from the papers you mentioned (Yu et al., 2023, 2024. The 2024 version is an extension of the 2023 version, and we employed the latest version in our manuscript). We will properly cite both works in the revised version to avoid confusion and to give appropriate confirmation.

Q.4. Ablation study on CLTG module.

Ans.: We provide an ablation study on CLTG. We remove all CLTG modules and train only the compression backbone using UAEO-based loss function:$λ_1 L_2(x, \widehat{x}) + λ_2 L_{UC} (\widehat{x}) + r$, $\widehat{x}$ is the reconstructed image, $r$ is the bitrate. We performed the comparison at a BPP level of 0.20, and the results are provided below.

As shown, removing CLTG leads to a PSNR drop of 1.59 dB at the same ASR level.

Q.5. Ablation study on multi-stage training strategy.

Ans.: We further conduct an additional ablation study on the proposed multi-stage training strategy. In particular, we omit Stage 2 and instead train the model using the settings from Stage 1 until convergence (an additional 100 epochs). We present the comparison results regarding encryption performance (encrypted version) and perceptual quality (full version) below.

The effectiveness of the multi-stage training strategy is readily apparent, as it improves encryption performance by about 72% in terms of the average ASR.

Q.6: Provide more visual comparisons

Ans.: Thanks for your kind suggestions. We have provided four extra groups of visual compression in addition to Fig. 5, which can be observed in the following links. https://pic1.imgdb.cn/item/67eb9c9c0ba3d5a1d7e9030c.jpg

Q.7 Provide a supplemental material.

Ans.: We appreciate this constructive suggestion and will incorporate the following in the supplementary material:

a) Extended ablation studies on the CLTG module and the multi-stage training strategy across multiple BPP points;

b) Comprehensive evaluations demonstrating the implementation of PSIC on other baseline LIC models, along with multiple perceptual quality metrics;

c) Additional visual examples generated by the PSIC method, the compression baseline, and the employed BAvAFT method in the supplementary material;

d) A detailed introduction to the Dempster-Shafer Theory, along with the derivation process of the employed evidence extractor.

First of all, we deeply appreciate your kind suggestions and positive feedback on our work, which have greatly encouraged us. We hope our responses below adequately address your concerns.

Q.1: Discuss the challenges of extending to other data types.

Ans.: Thanks for your insightful comments. Based on our experience, we believe the proposed PSIC scheme can be readily extended to different data types, especially video. In particular, end-to-end video compression follows a frame-by-frame pipeline, with a framework similar to image compression. Hence, the CLTG module, UAEO function, and associated optimization strategy can be directly integrated.

Meanwhile, certain adjustments are indeed necessary to handle domain-specific structures (e.g., temporal dependencies). Specifically, in the video compression process, the bitstream for a given frame must be reconstructed and used as a contextual prior for compressing the subsequent frame, thereby removing temporal redundancy. Taking both compression and encryption needs into consideration, we recommend decoding the bitstream into the full version, as it retains more similarity to the next frame.

Q.2: Discuss the UAEO’s contribution against more sophisticated attacks.

Ans.: Thanks for your suggestions. The UAEO potentially enhances the robustness of the PSIC method against sophisticated attacks, e.g., model inversion, by explicitly leveraging the uncertainty within VLP models and incorporating this uncertainty into corresponding constraints or loss functions. Specifically, UAEO employs Dempster-Shafer Theory to identify image-text pairs with high uncertainty (low confidence), guiding the embedding of targeted yet nearly invisible adversarial patterns during the image compression process. This approach potentially complicates an attacker's ability to reconstruct sensitive semantic information, thereby offering stronger privacy protection.

Additionally, as UAEO primarily focuses on mechanisms related to representation-level information, further complementary defense strategies could potentially be incorporated to strengthen the overall security guarantees of PSIC. Potential enhancements include adopting differential privacy techniques (e.g., “Gaussian differential privacy”, JRSS2022) to introduce controlled data obfuscation, employing multi-modal encryption methods for broader protection against cross-modal inference threats (e.g., “BadCLIP: Trigger-Aware Prompt Learning for Backdoor Attacks on CLIP”, CVPR2024), and regularly conducting security audits combined with adversarial retraining, which may help continuously maintain or further enhance robustness over time.

Q.3: Discuss the trade-offs between encryption efficiency and compression performance.

Ans.: Thanks for your comments. To illustrate the trade-offs between encryption and compression performance, we present how these metrics evolve during the second training stage, where the encoder is frozen (i.e., the resulting bitstreams remain unchanged). Specifically, we obtained checkpoints (bpp=0.13) at different epochs, and evaluated their encryption efficiency and compression performance. All test settings are identical to those described in our manuscript.

As you insightfully noted, there are indeed trade-offs between these two inherently conflicting objectives: increasing encryption efficiency comes at the expense of compression performance. Nevertheless, with the help of our CLTG module, PSIC achieves a favorable balance—maintaining compression performance comparable to standard codecs while providing significantly improved encryption strength.

Q.4: Compare PSIC with JPEG or WebP.

Ans.: Thanks for your suggestions. The comparison results on the Kodak testing set are shown below. For a fair comparison of file size (indicated by bpp), we adjusted the quantization parameters of JPEG and WebP to achieve the same PSNR (25.85 dB) as our PSIC. Our PSIC runs on an NVIDIA 3090 GPU, while JPEG and WebP are run on an Intel Xeon Silver 4310 CPU.

Q.5 Discuss the CLTG module’s generalization capacity.

Ans.: Thanks for your insightful suggestions. First, we would like to point out that the generalization performance of the CLTG module is CLOSELY TIED to the target DOWNSTREAM mode. To ensure strong generalization, we adopt the CLIP model as the target, as it has been trained on a large-scale dataset (4 billion text-image pairs). As a result, the proposed PSIC method exhibits promising generalization ability across a variety of tasks. In our experiments, the test sets used for image classification, facial attribute analysis, and image captioning were entirely UNSEEN during training, yet our method achieved strong performance in both compression and encryption metrics.

First of all, we would like to express our sincere gratitude for your responsible and constructive comments, which have been very helpful in further improving the quality of our manuscript. Below, we summarize your concerns into five key points and address them one by one. We hope our responses satisfactorily address all of your concerns. If there is any misunderstanding on our part, we would greatly appreciate any further clarification or additional suggestions.

Q.1: Ablation study on the CLTG module.

Ans.: We provide an ablation study on CLTG. We remove all CLTG modules and train only the compression backbone using UAEO-based loss function:$λ_1 L_2(x, \widehat{x}) + λ_2 L_{UC} (\widehat{x}) + r$, $\widehat{x}$ is the reconstructed image, $r$ is the bitrate. For a fair comparison, we adjusted the values of $\lambda_1$ and $\lambda_2$ so that the ablated version achieves the same ASR level as the full version. Due to the time constraint, we only provide comparison results at 0.20 BPP points shown below, and we will complete the ablation study in our revised paper.

As shown, the CLTG module’s effectiveness is evident: it significantly boosts the perceptual quality (1.59dB PSNR) at the same ASR level.

Q.2: Ablation study on the multi-stage training strategy.

Ans.: We follow the nice suggestion to look into the effect of our multi-stage training strategy. In particular, we omit Stage 2 and instead train the model using the settings from Stage 1 until convergence (an additional 100 epochs). We present the comparison results regarding encryption performance (encrypted version) and perceptual quality (full version) below.

As we stated in our manuscript, Stage 2 emphasizes enhancing the capacity for divergent representation. Without this stage, encryption performance would decrease by about 72% on average in terms of ASR.

Q.3 More effective compression baselines.

Ans.: Thanks for your constructive comments. We have implemented the PSIC scheme in two cutting-edge LIC models (ELIC, and MLIC++). Due to time constraints, we are currently providing comparison results at a single BPP point (see below). All training configurations were kept strictly consistent with those in our manuscript to ensure fair comparisons. We will include comprehensive results on additional LIC baselines (including TIC) across multiple BPP points in the supplementary material of our revised paper. We appreciate your understanding.

As shown, the proposed PSIC scheme can be readily integrated into different LIC models, demonstrating strong effectiveness in both encryption and compression performance.

Q.4 Applicability to other VLP models.

Ans. : Following your insightful suggestion, we have adopted another milestone VLP model, ALIGN (“Scaling up visual and vision-language representation learning with noisy text supervision”, ICML2021), as the target. Specifically, we restructured the UAEO optimization function based on ALIGN, and trained the entire framework at a single BPP point (bpp = 0.13). The corresponding results are presented below, demonstrating the strong applicability of the proposed PSIC method to other VLP models.

Thank you for your thorough review. We will definitely incorporate your suggestions into our revised manuscript, and we will carefully proofread the manuscript to eliminate any typos or grammatical issues.