Robust Loss-Weight Optimization for Medical Image Encryption via Bayesian UR-CycleGAN

Nowadays, the rapid development of Electronic Healthcare (e-healthcare) is both possible and popular. E-healthcare refers to an internet-based system that enables patients to access services from expert clinicians worldwide [1]. Transmission of medical images over a network is always vulnerable to attack [2]. Since medical images contain patients' confidential information, ensuring their safe storage and transmission between workstations and the Picture Archiving and Communication System (PACS), and over the internet, has become a critical issue for medical applications in real-world settings [2, 3].

Imaging Machines such as brain Magnetic Resonance Imaging (MRI), computed tomography (CT), X-rays, and dermatoscopes, etc. [4]. To secure the confidentiality, integrity, and authenticity of medical images, several encryption and decryption techniques can be used, such as the Data Encryption Standard (DES) and the Advanced Encryption Standard (AES). In these two encryption techniques, the same key is used for both encryption and decryption. DES uses a 64-bit block size, whereas AES uses 128-, 192-, and 256-bit block sizes. However, image sizes are larger than block sizes, which can lead to security issues due to slackness or disorganization [5]. Furthermore, Chaos-based image encryption techniques are widely used. Chaos-based image encryption is highly sensitive to initial conditions; a slight change in the input results in significant changes to the output. While the sensitivity to the initial condition is mainly advantageous in the encryption process, it also presents challenges in key management and error propagation [6].

Recently, deep learning techniques have been widely used to encrypt and decrypt medical images using neural networks that learn complex, convoluted patterns across multiple layers with nonlinear activation functions. Deep generative models are utilized to provide an understanding of unsupervised data. For image encryption, deep learning is just beginning to emerge. In this field, generative adversarial network (GAN) has proven to be a powerful tool for generating images. This adaptability reassures us of their effectiveness in developing advanced encryption algorithms [7]. CycleGAN, a type of deep generative model, is designed to generate images across different modalities and to perform mappings that differ from those observed in the real training images, which is known as the image-to-image translation task [8]. It is an unsupervised model that learns to transform images from two distinct domains using unpaired training data [9].

It uses a deep convolutional neural network (CNN) to learn a mapping between two image domains, allowing it to perform tasks such as style transfer, super-resolution, domain adaptation, and image-to-image synthesis [4].

Unlike conventional techniques, the CycleGAN function does not require paired training data, enabling it to handle constrained data availability while still improving image quality and feature preservation. It has two main components: the Generator G and the discriminator D. The Generator G plays a critical role in the CycleGAN function, transforming images from the original domain to the target domain. This process is complemented by the discriminator D, which distinguishes between real images (from the target domain) and fake images (generated by the G) [4].

In practical healthcare environments, medical images are frequently transmitted via telemedicine platforms and stored in cloud-based healthcare infrastructure.

Therefore, the proposed encryption framework is designed to secure medical image transmission and storage by providing both image confidentiality and high reconstruction fidelity for diagnostic purposes.

A critical issue in CycleGAN-based medical image encryption is the need for a more systematic approach to selecting the appropriate loss weights. In CycleGAN, loss weights (λ) control the relative impact of each loss term, such as cycle-consistency, structural similarity, gradient preservation, and uniformity regularization within the overall objective function. Most existing approaches rely on fixed or experimentally chosen values of the loss weights (λ) without analyzing how these parameters relate to the dataset. This paper introduces a new architecture that combines a CycleGAN with a Bayesian optimization (BO) algorithm to address the challenge of selecting optimal loss weight combinations. By balancing exploitation and exploration within high-dimensional search spaces, the BO algorithm optimizes the loss-weight parameters of the CycleGAN objective function.

The methodology followed in designing the proposed UR-CycleGAN and its architectural model, ensuring that every aspect is thoroughly considered, is presented in this section.

3.1 Composite loss function design

The CycleGAN can learn a mutual mapping between original and cipher images, enabling both encryption and decryption. The CycleGAN framework consists of two generators (G and F) and two discriminators (D_x and D_y). Generator G encrypts the image, while Generator F decrypts it. Discriminator D_y is used to discriminate between the target and the cipher images, while discriminator D_x is used to distinguish the source and the reconstructed images. The main objective of generator G is to ensure closeness between the generated ciphertext image and the target domain image as much as possible.

On the other hand, the objective of generator F is the same, but for the generated plaintext and original plaintext images. In this work, LSGAN replaces the BCE with a least-squares loss, which generally stabilizes training and produces less blurriness in generated images. The following equation shows a least-squares loss [10].

$\begin{gathered}\mathcal{L}_{a d v}=E_{x \sim p_x}\left[\left(D_y(G(X))-1\right)^2\right]+E_{y \sim p_y}\left[\left(D_x(F(Y))-1\right)^2\right]\end{gathered}$     (1)

where, X is the real image in domain X, Y is real image in domain Y, and G refers to the generator that translates image from X domain to Y domain. F denotes the generator that translates image from Y domain to X domain, D_y is the discriminator for domain Y, distinguishes real Y image from G(X), and D_x is the discriminator for domain X which distinguishes real X image from F(Y).

The main objective is to keep the difference between the original and the reconstructed images as small as possible to achieve the decryption process. This loss is called cycle consistency loss. Without cycle consistency, generators could map all inputs to the same output. We can calculate this loss using the following equation [10]:

$\mathcal{L}_{\text {cycle}}=\lambda \mathrm{E}_{x \sim p_{\text {data}(x)}}\|F(G(X)-X)\|_1+\lambda \mathrm{E}_{y \sim p_{\text {data}(y)}}\|G(F(Y)-Y)\|_1$           (2)

where, $\|.\|_1$ represents L1 paradigm, and $\lambda$ is a hyperparameter used to control the impact of the cycle consistency loss.

SSIM loss plays a key role in improving the quality of the decrypted image. It serves as a metric for further assessing the perceptual similarity between the original and decrypted images. It captures structural similarity such as luminance, contrast, and texture. By using gradients influenced by local image statistics, SSIM guides the model in a crucial task: preserving spatial relationships. This encourages the model to retain the structural information between the original and reconstructed images. The SSIM loss can be expressed as [12]:

$\mathcal{L}_{\text {SSIM}}=1-\operatorname{SSIM}\left(X, F_{Y \rightarrow X}\left(G_{x \rightarrow Y}(X)\right)\right)$        (3)

The gradient loss function is used to ensure consistent edge sharpness. It penalizes structural inconsistency with a strong focus on edge and gradient alignment between real and reconstructed images. The Schar filter is used to compute edge gradients and to maintain edge and sharpness details, thereby enhancing the method's precision.

$\begin{gathered}\mathcal{L}_{\text {Gradient}}=0.7 \frac{1}{N} \sum_{i, j}\left|M_{\text {real}}(i, j)-M_{\text {gen}}(i, j)\right|+ 0.3 \frac{1}{N} \sum_{i, j}\left|\theta_{\text {real}}(i, j)-\theta_{\text {gen}}(i, j)\right|\end{gathered}$                (4)

where, $M_{\text {real}}$ refers to the gradient magnitude map of the real image from the Scharr filter, $M_{\text {gen}}$ means the gradient magnitude map of the generated image from the Scharr filter, N means the total number of pixels, $\theta_{\text {real}}$ denotes the gradient orientation map of real image, and $\theta_{\text {gen}}$ denotes the gradient orientation map of generated image.

The conventional loss function of Cycle-GAN does not clearly apply a structured, uniform intensity distribution. This results in images exhibiting a Gaussian distribution of histogram values, making them susceptible to statistical attacks. To address this vulnerability, a regularization term is proposed to enhance CycleGAN performance. Specifically, it calculates the Pearson’s chi-squared (χ²) divergence between the normalized histogram of cipher images and a uniform target distribution, weighted by λ uniformity, and then incorporates this into the generator loss. This approach significantly improves the security of image encryption. The new loss function is shown below [16].

$\mathcal{L}_{\text {uniformity }}=E_{x \sim p_x}\left[\sum_{k=1}^K \frac{\left(O_K(G(X))-E_K\right)^2}{E_K}\right], E_K=\frac{1}{K}$     (5)

where, $O_K$ refers to the observed normalized frequency in the k-th histogram bin of the cipher image $G(x), E_K$ denotes the expected frequency in bin k under the uniform distribution.

By using Pearson’s chi-squared (χ²) divergence, the proposed loss term penalizes deviations from a uniform intensity distribution while the expected distribution is uniform across all histogram bins.

The main idea of this proposed approach is to remove intensity-based patterns from the ciphertext domain that may be exploited by malicious attacks, thereby improving encryption robustness. This regularization is applied especially to the cipher images, decoupling it from the reconstruction pathway. This approach applies adversarial loss, cycle-consistency loss, SSIM, and gradient loss to maintain semantic and structural fidelity in the reconstructed images.

The overall objective for the generator combines adversarial training with multiple regularization terms to balance image realism, reconstruction fidelity, perceptual similarity, edge consistency, and statistical uniformity, as defined in the following loss function:

$\begin{gathered}\mathcal{L}_{\text {cycleGAN}}=\mathcal{L}_{\text {adv}}+\lambda_{\text {cycle}} \mathcal{L}_{\text {cycle}}+\lambda_{\text {SSIM}} \mathcal{L}_{\text {SSIM}}+ \lambda_{\text {Gradient}} \mathcal{L}_{\text {Gradient}}+\lambda_{\text {uniformity}} \mathcal{L}_{\text {uniformity}}\end{gathered}$        (6)

where,$\lambda_{\text {cycle}}, \lambda_{\text {SSIM}}, \lambda_{\text {Gradient}}$, and $\lambda_{\text {uniformity}}$ are hyperparameters that control the influence of each corresponding loss term in the total generator objective. For two discriminators, the overall objective function is to discriminate between real and fake images. The combined discriminator loss is as follows [10, 17]:

$\mathcal{L}_{D_x}=0.5\left[\begin{array}{c}E_{x \sim P \text {data}(x)}\left[\left(D_x(X)-1\right)^2\right]+E_{y \sim P \text {data}(y)}\left[\left(D_x(F(y))-0\right)^2\right]\end{array}\right]$          (7)    

$\mathcal{L}_{D_y}=0.5\left[\begin{array}{c}\mathrm{E}_{y \sim P \text { data}(y)}\left[\left(D_y(Y)-1\right)^2\right]+ \mathrm{E}_{x \sim P \text { data}(x)}\left[\left(D_y(G(X))-0\right)^2\right]\end{array}\right]$              (8)   

$\mathcal{L}_D=\mathcal{L}_{D_x}+\mathcal{L}_{D_y}$        (9)

where, $\mathcal{L}_D$ is the overall discriminator loss, $\mathcal{L}_{D_x}$ is the discriminator loss for distinguishing real image and generated image in domain $X$, and $\mathcal{L}_{D_y}$ is the discriminator loss for distinguishing real and generated images in domain $Y$.

3.2 Architecture details of CycleGAN

The CycleGAN architecture consists of two generators and two discriminators for bidirectional image translation between two domains, as shown in Figure 1. The generator network consists of an encoder, residual blocks, and a decoder. The generator network specifications are given in Table 2.

​

Figure 1. Framework structure of CycleGAN

Table 2. Encryption network structure

The main goal of the encoder is to encode images into a form that captures semantic content and supports firm texture mixing while remaining invertible. It consists of three down-sampling blocks, each involving a 2D convolutional layer (with 4 × 4 kernels, stride 2, and padding 1), instance normalization, and a leaky ReLU activation. The encoder structure increases feature abstraction while decreasing spatial resolution, starting from 64 to 256 filters.

Six residual blocks were composed of two convolutional layers (stride-1), ReLU activation, and instance normalization, connected via skip connections, serving as the core transformation layers. Residual connections alleviate vanishing gradients and retain high-frequency details, such as lesion boundaries in medical imagery.

The decoder is composed of three up-sampling blocks that employ transposed convolutions (4 × 4 kernels, stride 2) with ReLU activation and instance normalization, culminating in a final convolution layer with tanh activation to generate 128 × 128 × 3 output images. The objective of the decoder is to synthesize ciphertext images at the target resolution that are indistinguishable as natural to the discriminator.

Table 3. Discriminator structure

Unlike conventional GAN discriminators, the discriminator network in this implementation, as shown in Table 3, follows a multi-scale Patch GAN architecture with four convolutional layers, where each layer, except the last one, employs 4 × 4 convolutions with stride 2, instance normalization, and leaky ReLU, progressively increasing filter depth from 64 to 512. The final layer utilized a stride-1 convolution without normalization.

A discriminator network distinguishes an input image as either a real or a fake image generated by the Generator network. An Adam optimizer with β₁ = 0.5 and β₂ = 0.999 is used to optimize both networks, a standard choice for stabilizing GAN training and reducing oscillations. A learning rate of 2 × 10⁻⁴ is chosen based on empirical findings in CycleGAN literature, balancing convergence speed and training stability.

In this work, the ISIC Challenge Dataset [18] and the Brain Tumor Detection MRI Dataset [19] have been used.

The datasets contain no personally identifiable information, and all handling complied with HIPAA, GDPR, and official usage protocols. This dataset choice instills confidence in the model's performance.

This section shows the empirical evaluation of the proposed Bayesian UR-CycleGAN framework for medical image encryption. The effectiveness of the optimized loss-weight algorithm is assessed in terms of both reconstruction quality and encryption security. Additionally, comparative results against fixed and manually tuned loss weights are used to demonstrate the advantages of the proposed optimization approach. On the other hand, robustness is evaluated under different attack scenarios.

5.1 Analysis of optimal loss weights

This section reports the experimental results for the proposed BO of UR-CycleGAN loss weights. The main goal is to achieve a balanced trade-off between reconstruction quality and encryption security. The results highlight the selected optimal loss-weight configuration and describe how these values directly influence the system’s performance metrics for both reconstruction quality and encryption security. Figure 3 illustrates the result of the optimization objective across evaluations. Each blue point represents the objective value obtained for a specific loss-weight configuration. The BO algorithm used 60 evaluation points. The red marker denotes that the optimal solution occurs at evaluation 57, achieving a minimum objective value of 0.22329.

​

Figure 3. Objective function values obtained during the Bayesian optimization (BO) over 60 evaluations

The optimization criterion explicitly targets configurations that minimize the discrepancy between reconstruction quality and encryption security. This design ensures that neither objective is improved at the expense of the other, which is the core goal of the proposed optimization framework. The optimal loss weights are reported in Table 5.

Table 5. Optimum values of $\lambda$ parameters using Bayesian Optimization (BO)

Figure 4 illustrates the convergence of the BO algorithm, showing a rapid decrease in the objective function value from initial evaluations, followed by stabilization in later evaluations. The blue curve represents the minimum observed objective value obtained from the actual evaluations, while the green curve denotes the minimum objective value estimated by the Gaussian Process (GP) surrogate model. Moreover, the mean gap between observed and estimated objective values across 60 evaluations demonstrates the GP model's reliability. Therefore, additional optimization budget may increase computational cost with only marginal performance improvement.

Figure 4. The convergence behavior of the Bayesian optimization (BO) over 60 evaluations

From the experimental results, we conclude that the cycle consistency loss plays an important role in stabilizing the bidirectional mapping and significantly influences image reconstruction quality. Still, it does not constrain the structural details, texture, or perceptual fidelity of the reconstructed image. So this is the main role of the SSIM loss $\lambda_{\text {SSIM}}$. In practice, SSIM plays a very significant role in reconstruction quality, while the cycle loss contributes only when SSIM is strong enough to provide a meaningful structural prior. Consequently, the impact of $\lambda_{\text {cycle}}$ becomes visible only when $\lambda_{\text {SSIM}}$ is adequately appropriate; otherwise, its contribution remains peripheral. The gradient loss weight $\lambda_{\text {Gradient}}$ has only a very minor influence on both reconstruction quality and security.

This is because the model relies on the cycle-consistency loss and the structural SSIM loss, while the gradient term contributes only a small local smoothing effect. A small uniformity loss weight ( $\lambda_{\text {uniformity}}$ ≈ 1) demonstrates the best balance between security and reconstruction quality. At this low value, the uniformity term gently improves histogram uniformity without disrupting the natural randomness produced by the adversarial generator, allowing NPCR and entropy to remain high.

As shown in Table 6, BO outperformed Random Search under the same optimization budget of 60 evaluations and within the same search space range. The lower objective value achieved by BO confirms its superior ability to identify the optimal loss-weight hyperparameter configuration.

Table 6. Comparison of random search and Bayesian optimization (BO)

5.2 Experimental evaluation of the optimized CycleGAN framework

This section evaluates the UR-CycleGAN framework with and without BO.

5.2.1 Quality of recovered image

PSNR serves as a metric to evaluate the quality of an image relative to the original. A higher PSNR value indicates superior image quality. Conversely, a lower PSNR value highlights the difference between the encrypted and original images. PSNR is calculated using the formula provided in Eq. (14) [20].

PSNR $=10 \log _{10}\left(2^n-1\right)^2 / M S E$        (14)

where, n is the number of bits per pixel. MSE is the mean squared error. The value of $P S N R \in[0, \infty]$ [20].

The SSIM is a technique used to assess the similarity between two images. SSIM incorporates a description of structural information and perceived image quality, including luminance, contrast, and structural comparison. SSIM is calculated using the formula in Eq. (15) [4].

SSIM $=[l(x, y)]^\alpha[c(x, y)]^\beta[s(x, y)]^\gamma$            (15)

where, $\alpha, \beta$, and $\gamma$ are the positive constants that must be greater than zero. $l(x, y)$ represents the brightness evaluation, $c(x, y)$ indicates the contrast comparison, and $s(x, y)$ denotes the structure comparison [4].

Table 7 quantitatively compares the heuristic and optimized hyperparameters for the loss weight. Optimization increases average PSNR from 28.65 dB to 34 dB, substantially enhancing reconstruction quality. The SSIM metric increases from 0.85 to 0.90, indicating enhanced preservation of structural and perceptual features. The average PSNR and SSIM values are computed over the entire test set of medical images, consisting of 200 images. For each test image, PSNR and SSIM are computed between the original and reconstructed images.

Table 7. Average Peak Signal-to-Noise Ratio (PSNR) and Structural Similarity Index (SSIM) values of reconstructed image

Such quantitative gains are particularly crucial in medical imaging, where anatomical accuracy and visual consistency are imperative. Importantly, this enhancement in quality is achieved without compromising the encryption performance, as the statistical properties of the encrypted images, such as entropy, remain stable, as well as a uniform histogram distribution. This confirms that the proposed optimization approach effectively improves reconstruction quality while preserving the system's security characteristics. Figure 5 shows examples of the original image, the reconstructed image without optimization, and the reconstructed image obtained with optimum hyperparameter values.

Figure 5. Assessment of the reconstructed image with/without optimization using Peak Signal-to-Noise Ratio (PSNR), Structural Similarity Index (SSIM)

5.2.2 Information entropy

It is a metric of image randomness used to verify the security of the proposed UR-CycleGAN. It demonstrates the distribution values of the encrypted image. It is 8 for an 8-bit image when all values are equally probable. Information entropy is close to 8 for highly random image information. The entropy of the proposed method is calculated using Eq. (16).

$H(x)=-\sum_{i=1}^n p\left(x_i\right) \log _2 p\left(x_i\right)$        (16)

where, $p\left(x_i\right)$ is the pixel probability in the encrypted image [4]. As shown in Table 8, the entropy values of the encrypted image remain relatively stable before and after optimization, indicating that its statistical randomness is preserved while the reconstruction quality is significantly improved.

Table 8. Comparison of average entropy values with/without Bayesian Optimization (BO) and existing image encryption method

The optimization process significantly improved reconstruction quality by adjusting the associated loss weights, including the cycle-consistency and SSIM terms. In contrast, the optimum value of the uniformity loss weight remained very close to its manually selected value. Therefore, only marginal changes in entropy were observed.

5.2.3 Correlation coefficient analysis

The correlation, a key factor in the effectiveness of encryption, measures adjacent pixel values in the image. In a plaintext image, adjacent pixels are firmly correlated. This correlation is crucial, as attackers can exploit it to deduce the next gray-scale pixel value. The correlation of the cipher image demonstrates the encryption model's strength in disrupting correlations of the original image. A good encryption scheme results in an encrypted image in which the correlation between adjacent pixels is reduced, thereby providing robustness against statistical attacks. As shown in Table 9, the results indicate that the correlation between adjacent pixels in the cipher images is significantly reduced in all directions (horizontal, vertical, and diagonal) following optimization. This pronounced reduction suggests that the optimized model produces more decorrelated ciphertext, thereby enhancing resistance to statistical and correlation-based attacks. Figure 6 shows the correlation in detail.

Table 9. Correlation values of cipher images with/without Bayesian optimization (BO) and existing image encryption method

Figure 6. Pixel correlations (Horizontal, vertical and diagonal) for original image (a-c) and analogous cipher images (d-f)

5.2.4 Histogram analysis of an encrypted image

In prior work, the histograms of cipher images generated by CycleGAN without uniformity regularization appear to follow a Gaussian distribution, reflecting statistical regularities. As shown in Figure 7, these smooth, bell-shaped histograms reflect structured intensity patterns that may maintain information from the original images. The integration of the proposed uniform histogram loss term into the CycleGAN objective function is a significant aspect. Compared with the uniform histograms of the encrypted outputs from the proposed UR-CycleGAN shown in Figure 8, the influence of the uniformity-regularized loss on eliminating such statistical traces becomes obvious. This emphasizes that the encryption process disrupts pixel value distributions, contributing to enhanced protection against histogram-based analysis.

Figure 7. Histogram of encrypted images without uniformity regularization loss function

​

Figure 8. Histogram of encrypted images with uniformity-regularized loss

Table 10 demonstrates the impact of the proposed uniformity regularization loss term on the histogram of cipher images. After incorporating the proposed uniformity loss, the average chi-square value decreases substantially to approximately 599. This reduction confirms that the proposed loss term effectively reduces statistical information that statistical attacks could exploit.

Table 10. Average Chi-square values of encrypted image

5.2.5 Security analysis under differential attacks

Chosen-plaintext attacks are used to test the encryption algorithm's sensitivity to small changes in the plaintext. The attacker tries to make a small change to the plaintext image, then encrypts the original and modified images with the same key, to find the relationship between the plaintext image and the encrypted image of the modified image. If a small change in the plaintext image can cause a huge change in the ciphertext image, this type of attack usually fails to take effect. This means the encryption algorithm is resistant to a chosen-plaintext attack. NPCR is used to measure system resistance against differential attacks. The ideal value of NPCR is 100%. The definition of NPCR can be represented mathematically [21]:

$N P C R=\frac{\sum_{i=0}^W \sum_{j=0}^H D(i, j)}{W \times H}$        (17)

where, W denotes the image width, and H represents the image height.

$D(i, j)=\left\{\begin{array}{l}1, D_1(i, j) \neq D_2(i, j) \\ 0, D_1(i, j)=D_2(i, j)\end{array}\right.$            (18)

To evaluate the encryption model's sensitivity, the original medical image and its modified version (with only one pixel changed) are encrypted using the same keys. NPCR is used to compare two encrypted images, and the experimental results are 97.84%, demonstrating a substantial enhancement in diffusion strength compared with NPCR values before using the optimization strategy, which are 92.163%.

This improvement confirms that the optimized model is more sensitive to small changes in plaintext, leading to widespread variations in the ciphertext. Consequently, the optimized system exhibits stronger resistance to chosen-plaintext attacks, as it better satisfies the avalanche property required for secure encryption.

A chosen-ciphertext attack (CCA) is a cryptanalysis model in which the attacker can obtain information by decrypting chosen ciphertexts. Using this information, the attacker can attempt to recover the secret decryption key.

In CCA, the attacker can access the decryption model. In this experiment, the ciphertext image is the input to the decryption model. NPCR is used to measure the difference between two decrypted images. When the input ciphertext image is modified by a single pixel, the NPCR between the two decrypted images is 92.30%. The NPCR value decreases slightly from 94.83% before optimization to 92.30% after optimization. This slight reduction may be attributed to the lower uniformity-loss weight, which decreases excessive statistical randomness in the encrypted domain.

By reducing the influence of the uniformity constraint, the optimized model becomes less sensitive to ciphertext perturbations during decryption, resulting in more controlled error propagation. This behavior suggests improved reconstruction stability under ciphertext perturbation.

In a ciphertext-only attack, the adversary has access only to a string of ciphertexts (encrypted medical images) without any knowledge of the corresponding plaintexts. In this proposed model, the key space, which can be expressed as $\left(2^{32}\right)^{11,313,160}$, is challenging for attackers to break down the proposed algorithm.

5.2.6 Robustness against adversarial attacks

The proposed encryption framework is evaluated using Projected Gradient Descent (PGD), a strong gradient-based adversarial attack. This attack perturbs a clean example X for T steps with a smaller step size. After each perturbation, PGD projects the adversarial example back onto X's $\varepsilon$-ball if it exceeds it, ensuring it remains within a set distance of the original input [22].

$x^i=x^{i-1}+\alpha \operatorname{sign}\left(\nabla_x l\left(h\left(x^{i-1}\right)\right), y\right)$        (19)

where, $\alpha$ is the step size, and $\mathrm{x}^{\mathrm{i}}$ is the adversarial example at the $i$-th step ($x^0=x$). The step size is usually set to $\varepsilon / T \leq \alpha<\varepsilon$ for overall T steps of perturbations. $\nabla_x l$ denotes the gradient of the loss function with respect to the input image $x . h(x)$ denotes the output of the model given input image $x . \mathrm{y}$ is the ground-truth class label.

We evaluate the stability of the encryption/decryption process under adversarial conditions and analyze the impact of loss-weight optimization on system resilience.

Table 11. Comparison of the baseline and optimized configurations

Table 11 shows that BO increases system robustness to PGD attacks. It reduces the proportion of images that fail reconstruction under adversarial perturbations. The observed attack success rate indicates that adversarial degradation primarily causes structural distortion rather than pixel-level errors. This means that perceptual integrity is more affected than raw intensity values. After optimization, the number of images with structural reconstruction failure drops significantly. This confirms that BO enhances resistance to adversarial perturbations while preserving encryption robustness and reconstruction quality.

To assess the stability of the proposed method under the stochastic nature of CycleGAN training, the model was trained in two independent runs within identical experimental settings.

The mean and standard deviation values of PSNR, SSIM, and entropy are summarized in Table 13. The results from the two independent runs suggest a limited performance variability, providing preliminary evidence of the robustness of the proposed framework.

All experiments were conducted in MATLAB using an 11th Gen Intel Core i7-1165G7 CPU, 16 GB RAM, and an NVIDIA GeForce MX450 GPU (2 GB). The CycleGAN training took approximately 58 minutes over 700 epochs, while BO took approximately 65 hours and was performed only once during the offline hyperparameter search stage.

Table 13. Stability analysis