Available at: https://digitalcommons.calpoly.edu/theses/3421
Date of Award
8-2026
Degree Name
MS in Computer Science
Department/Program
Computer Science
College
College of Engineering
Advisor
Sumona Mukhopadhyay
Advisor Department
Computer Science
Advisor College
College of Engineering
Abstract
Artificial intelligence systems make useful predictions by taking in data and returning a classification, recommendation, or decision. Obtaining that prediction, however, requires sharing the data first. This creates a fundamental privacy challenge in machine learning: users must expose their data to receive a valuable prediction. Machine learning systems increasingly rely on cloud-based image classification for this reason, transmitting images from edge devices to remote servers rather than running large models locally. This creates a conflict between the accuracy a classifier requires and the privacy a data owner wants. Traditional encryption destroys the image structure on which a classifier depends, while cryptographic approaches such as homomorphic encryption require restructuring or retraining the classifier itself. Recoverable Privacy-Preserving Image Classification (RIC) addresses this problem by transforming each image into a noise-like adversarial example that a pretrained classifier can still label correctly, while authorized users can recover the original image. However, RIC's cover generation relies on a pseudorandom number generator with a small, finite seed space, limiting its key-based security guarantees.
This thesis replaces RIC's pseudorandom cover with noise drawn from chaotic and hyperchaotic dynamical systems: a 3D Lorenz system and 4D Rössler, 4D Chen, and 5D Maxwell-Bloch systems. Each system's parameters serve as the cryptographic key. Only the cover-generation stage is changed; the encoder, decoder, classifier, and adversarial optimization remain untouched. Thus, any change in behavior is a downstream effect of the noise source rather than a result of tuning the objective to produce a particular outcome. The comparison is conducted independently on three image datasets, SVHN, an ImageNet subset, and HAR5 human-activity images, so that encryption strength and reconstruction quality can be evaluated together at each image size.
The results indicate that hyperchaotic noise, and 4D Rössler noise specifically, provides a consistent and measurable benefit over pseudorandom noise. Rössler 4D outperforms the pseudorandom baseline in encryption strength on all three datasets tested, reducing plaintext-ciphertext structural similarity by 31% on SVHN, 38% on HAR5, and 64% on the ImageNet subset. It also outperforms the baseline in reconstruction quality on two of the three datasets, reaching the baseline's final quality 25 to 40 epochs sooner in each case. In addition, it increases key sensitivity: on SVHN, the divergence ratio under an incorrect decryption key rises from approximately 462x to approximately 1,395x. No other condition, chaotic or otherwise, matches this level of consistency.
Lorenz 3D provides the clearest illustration of why a single strong result should not be generalized into a rule. It is the best-performing condition on HAR5 but the worst-performing condition on the ImageNet subset, despite both datasets using the same image resolution. This pattern occurs for both reconstruction quality and encryption strength, ruling out image size alone as an explanation and cautioning against treating the winner on any one dataset as a general recommendation. Together, these findings show that the noise source in adversarial encryption is a meaningful downstream design choice. Among the systems tested, 4D Rössler provides the clearest overall advantage, rather than chaotic noise being beneficial simply by virtue of being chaotic.