{"id":"9cbab901-e6cc-4bf9-9d62-c42414552b58","arxiv_id":"2509.04787","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":3,"one_line_summary":"An encrypted semantic image transmission scheme that appends modulo-256 encryption and a super-resolution post-processor to NTSCC, evaluated on 25 Urban100 images.","lead":"This paper adds modulo-256 encryption to a semantic image communication system and uses a super-resolution network at the receiver to repair degraded images. The authors report better reconstruction at low signal-to-noise ratios than unencrypted transmission, but the security claim is asserted rather than proven and the comparison omits essential baselines.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Eq. (10) is not a defined inverse for real-valued JSCC outputs; without explicit normalization/quantization to [0,256), encryption is not invertible, so neither security nor the low-SNR performance comparison is grounded.","rationale":"The reader's weakest assumption is exactly where I also locate the central failure. Eq. (10) is presented as an encryption/decryption pair, but the manuscript never defines the domain of s. The abstract and conclusion claim both stable security and better low-SNR performance than unencrypted NTSCC; each claim requires that the receiver can actually undo the encryption. Because s is the output of a neural JSCC encoder, it is real-valued, and the paper gives no quantization or range normalization. If s is not confined to [0,256) and converted to integer bytes, the modulo operation is non-injective and the receiver cannot recover the encoder output. The phrase 'normalized feature tensors' is not a specification: normalization to what range, with what dtype, and with what inverse operation is absent. The security argument adds a second error: semantic security does not follow from pseudorandomness of the key alone; for Eq. (10) to be a secure cipher, the key and plaintext must live in a compatible finite group, typically uint8 bytes, and the key must be uniform and not reused. For continuous s, the fractional part survives encryption, which both leaks information and is inconsistent with the claimed indistinguishability. A secondary concern is the missing super-resolution-only baseline: without 'NTSCC + SR' the paper cannot attribute the low-SNR gains to the SR module. However, that issue would matter only after the encryption pipeline is shown to be invertible. The proposed check settles the invertibility question directly by inspecting real encoder outputs and measuring decryption error on the noiseless path. As submitted, the paper's results are unsupported, so the reader's REJECT verdict is appropriate, and my stress test does not change it.","tokens_in":8125,"tokens_out":6457,"duration_ms":61520,"concrete_test":"Run the claimed NTSCC encoder on the 25 Urban100 test images and dump the tensor s that enters Eq. (10). Without adding any new normalization, check (a) whether every s(i) lies in [0,256) and is an integer, and (b) for each image compute s_dec = ((s + KEY) mod 256 - KEY) mod 256 and measure max|s_dec - s|. If any entry falls outside [0,256) or the max error is nonzero, Eq. (10) is not an invertible encryption and the reported PSNR curves cannot be reproduced as described. If the authors intended an undocumented quantization or normalization, that step must be stated and the test rerun with it; bit-exact recovery after decryption is necessary for the system to work.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section II-B defines s_enc(i) = (s(i) + KEY(i)) mod 256 with KEY(i) a uint8 integer, but s(i) is an unquantized, real-valued JSCC channel symbol from Eq. (2) that is later transmitted through an AWGN channel. The paper mentions 'normalized feature tensors' but never specifies the normalization range, a quantization step, or the decryption formula. If s is continuous and not confined to [0,256), the modulo operation is non-injective: values differing by 256 produce the same s_enc, and the receiver cannot recover the encoder output. Even within [0,256), encrypting by adding an integer key modulo 256 leaves the fractional part of s unchanged, so the ciphertext leaks a deterministic function of the plaintext. The security argument also conflates pseudorandomness of the key with semantic security of the encryption scheme; a uniform key and a well-defined message group (typically quantized bytes) are required for Eq. (10) to provide indistinguishability. This is not a minor implementation detail: the decoder F_d in Eq. (6) operates on the decrypted vector, and without an invertible encryption step the entire reconstruction pipeline cannot function as described. Both the claimed 'stable security' and the low-SNR performance advantage over NTSCC depend on this unspecified invertibility.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes SREC, an encrypted semantic image transmission system that combines NTSCC-based joint source-channel coding with a modulo-256 encryption step applied to the encoded feature vector and a residual-dense-network (RDN) super-resolution post-processor at the receiver. The authors claim that, over AWGN channels with 16QAM, QPSK, and BPSK modulation, SREC can stably guarantee security against eavesdroppers while also achieving higher PSNR than unencrypted NTSCC at low SNR. Experiments are reported on the Urban100 dataset, with NTSCC as the semantic extraction and JSCC network. The central contributions are the encryption-integrated semantic communication scheme and the introduction of super-resolution to compensate for encryption- and channel-induced distortion, especially under low SNR.","tokens_in":8596,"tokens_out":5001,"duration_ms":47204,"significance":"If the claims were correct, the paper would provide a lightweight encryption layer for semantic communication that is compatible with JSCC and a super-resolution-based performance boost at low SNR. These would be useful for practical wireless semantic systems. However, the security mechanism as specified is mathematically ill-defined: modulo-256 addition on real-valued encoded features is not invertible, and no quantization or normalization is specified. The performance evaluation also lacks an NTSCC+SR baseline, so the reported gains over NTSCC cannot be attributed to the SREC design rather than to the super-resolution post-processor alone. The paper provides no code, no formal proofs, and no error bars, and the security argument is an unsupported transfer from a citation rather than a derivation.","major_comments":[{"comment":"The encryption operation in Eq. (10), s_enc(i) = (s(i) + KEY(i)) mod 256, is not invertible for the real-valued JSCC output s defined in Eq. (2). Since s(i) is a continuous channel symbol and KEY(i) is an integer in [0,255], the modulo operation either requires s(i) to be confined to [0,256) and quantized to a discrete alphabet, or it is non-injective: values of s(i) that differ by 256 map to the same ciphertext, and the fractional part of s(i) is left unchanged by integer addition, leaking a deterministic function of the plaintext. The manuscript never specifies the normalization range, a quantization step, or the corresponding decryption formula, even though the decoder F_d in Eq. (6) operates on the decrypted vector. This makes the entire reconstruction pipeline undefined as written and invalidates both the security and the low-SNR performance claims.","section":"Section II-B, Eq. (10)"},{"comment":"The paper states that because pseudorandom sequences cannot be distinguished from random sequences in polynomial time, the encryption in Eq. (10) is semantically secure, citing [22]. This conflates the pseudorandomness of the key with the confidentiality of the encryption scheme; a pseudorandom key does not, by itself, imply semantic security of the encryption transformation unless the message space, key distribution, and encryption operation satisfy appropriate definitions (for example, a one-time pad over a finite group). No formal security model, reduction, or adversary definition is provided, and the non-invertibility issue for real-valued inputs compounds this problem. A concrete security analysis and, ideally, quantitative evidence that an eavesdropper cannot reconstruct meaningful content are needed to support the 'stably guarantee security' claim.","section":"Section II-B, security claim"},{"comment":"The performance comparison does not include an NTSCC+SR baseline. The reported gains of SREC over NTSCC and over encrypted NTSCC at low SNR, such as the 3.0 dB improvement for QPSK at 4 dB SNR, may be entirely due to the super-resolution post-processor rather than to the combined SREC design. Without a baseline that applies the same RDN super-resolution module to unencrypted NTSCC output, the claim that SREC itself 'achieve better transmission performance' than unencrypted NTSCC is not supported. Adding this ablation is necessary to attribute the improvement to the proposed scheme.","section":"Section III-B.1, Figs. 3 and 4"}],"minor_comments":[{"comment":"The text preceding Eq. (24) refers to the final super-resolution image as I_HR, while Eq. (24) defines I_SR = add_mean(F_final); these notations should be made consistent throughout Section II-C.","section":"Section II-C, Eq. (24)"},{"comment":"The caption has a typographical error: 'performance ar the receiver' should read 'performance at the receiver'.","section":"Figure 1 caption"},{"comment":"The text 'Throught simulation analysis' should be 'Through simulation analysis'.","section":"Section III"},{"comment":"The sentence 'We select the DIV2K dataset as the training set and validation set respectively' is ambiguous; the authors should specify which subsets of DIV2K are used for training and validation.","section":"Section III-A, datasets"},{"comment":"Algorithm 1 lists channel coefficient h and noise power sigma as inputs, but the pseudocode does not use them; either remove them from the input list or explain their role.","section":"Algorithm 1"},{"comment":"The 'baseline scheme-eavesdropper curve' is mentioned but never defined; the authors should describe what baseline is used, what the eavesdropper knows, and what metric is reported for the eavesdropper's reconstruction.","section":"Section III-B.1"},{"comment":"All simulation results are reported as single PSNR values without error bars, confidence intervals, or multiple-seed experiments; given the small test set (25 images) and the stochastic training process, some measure of variability should be reported.","section":"Section III-B, general"}],"recommendation":"reject","confidential_remarks":"The paper's core encryption mechanism is not well-defined for the real-valued features it is applied to, the security argument is an unsupported transfer from the literature, and the performance evaluation cannot separate the super-resolution contribution from the proposed system. These problems are load-bearing for both headline claims, and a meaningful revision would require redefining the system, redoing the security analysis, and adding the missing baselines. I do not see a path to publication for the manuscript in its current scope."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: the system combination is new, the SR post-processor does real work at low SNR, but the encryption step is not a defined inverse for real-valued JSCC features, so both security and performance claims are ungrounded as written. The paper needs a do-over on the crypto side and one missing baseline.\n\nThe paper puts NTSCC together with a modulo-256 add-on encryption and an RDN-based SR module. That exact pipeline appears to be new, and the component choices are reasonable for the stated goal of lightweight protection plus low-SNR recovery. The empirical story at 4 dB is coherent: SREC beats plain NTSCC by 2–3 dB under QPSK and BPSK. I believe the gain is mostly from SR, not encryption, but the direction is sensible. Credit where due: it is a straightforward engineering composition, not a hoax, and it is honestly tested against NTSCC and encrypted NTSCC.\n\nThe load-bearing flaw is real. Equation (10) defines s_enc(i) = (s(i) + KEY(i)) mod 256, with KEY in [0,255]. But s(i) is a real-valued JSCC channel symbol. There is no stated normalization to [0,256), no quantization step, and no decryption formula. For arbitrary real s, the map is non-injective, so the receiver cannot recover the encoder output. Even if s were confined to [0,256), adding an integer key modulo 256 leaves the fractional part untouched, so the ciphertext leaks a deterministic function of the plaintext; that is not semantic security. The citation to [22] does not help, because that scheme operates on quantized image bytes, not on unquantized neural features. The sentence that pseudorandomness implies semantic security for Equation (10) is exactly the conflation the stress-test note describes.\n\nThe performance evaluation also misses the baseline that would separate the two design choices: NTSCC plus SR without encryption. Without it, the claimed low-SNR gains could be entirely due to the SR post-processor. The paper reports PSNR on 25 Urban100 images, with no error bars and no quantitative eavesdropper distortion metric; the eavesdropper curves are visual only. That is thin, but it is not the main problem.\n\nWho is this for? Someone working on secure JSCC image transmission who wants a clear example of how not to borrow a crypto primitive. As a reference contribution it is not ready. I would not cite it in its current form. I would still send it to peer review rather than desk-reject, because the flaw is specific and fixable: specify a quantized representation, prove invertibility, and add the NTSCC+SR baseline. With those changes there may be a modest but useful paper.","headline":"The pipeline is new and the low-SNR SR gain is plausible, but the modulo-256 encryption is not invertible on unquantized real-valued features, so the security claim fails as written.","tokens_in":8908,"tokens_out":3126,"would_cite":false,"duration_ms":28357,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that modulo-256 encryption of JSCC-encoded semantic features, paired with a super-resolution decoder, can deliver secure image transmission that outperforms unencrypted joint source-channel coding at low SNR.","keywords":["semantic communication","joint source-channel coding","modulo-256 encryption","super-resolution","wireless security","image transmission","AWGN channel","PSNR"],"falsifier":"Take a real feature tensor $s$ from the learned JSCC encoder on the test set and apply Eq. (10) directly without a disclosed normalization/quantization step; if the receiver cannot recover $s$ exactly from $(s + \\mathrm{KEY}) \\bmod 256$ because values lie outside $[0, 256)$, the central invertibility assumption fails.","tokens_in":7977,"feed_emoji":"🖼️","tokens_out":6275,"duration_ms":50419,"temperature":0.7,"pith_summary":"The paper proposes SREC, a secure semantic image-transmission scheme that encrypts the output of a joint source-channel encoder with a modulo-256 addition of a pseudorandom key, then applies a super-resolution network at the receiver. The central claim is that this combination preserves the security benefit of encryption while actually improving reconstructed image quality at low signal-to-noise ratios compared with unencrypted JSCC. If true, it would give a lightweight way to protect semantic features from eavesdroppers without sacrificing—and in some regimes improving—transmission performance. The evidence comes from AWGN simulations on a standard image super-resolution test set with three modulation formats, where the super-resolution module lifts PSNR most when channel noise is high.","feed_headline":"Encrypted images get clearer at low SNR with super-resolution","feed_subtitle":"Modulo-256 encrypted semantic features plus a residual dense network beat unencrypted JSCC at low signal-to-noise ratios.","key_machinery":"The two load-bearing components are modulo-256 encryption and a Residual Dense Network (RDN) for super-resolution. Encryption acts element-wise on the JSCC output vector $s$ as $s_{\\mathrm{enc}}(i) = (s(i) + \\mathrm{KEY}(i)) \\bmod 256$, with KEY a pseudorandom uint8 tensor shared over a secure channel; the security argument is that pseudorandom sequences are indistinguishable from random in polynomial time, so the encrypted features hide content. The RDN, built from residual dense blocks with channel attention and global feature fusion, is applied to the decoded image to recover high-frequency detail and semantic information lost to channel noise and to the encryption/decryption round-trip. The interaction between the two is what carries the argument: encryption introduces bit-error sensitivity, and the super-resolution network repairs exactly that damage at low SNR.","core_discovery":"On the paper's own terms, the discovery is that the error amplification introduced by adding a modulo-256 encryption/decryption layer on top of JSCC can be more than compensated by a super-resolution reconstruction module at the receiver. At a representative low SNR of 4 dB, SREC with QPSK modulation reconstructs images with 3.0 dB higher PSNR than unencrypted NTSCC and 4.6 dB higher than encrypted NTSCC without super-resolution; with BPSK the gains are 2.2 dB and 6.4 dB. At higher SNR, the super-resolution gain shrinks and can become negative, because the network's inferred details are less accurate than directly transmitted details when the channel is clean. The paper also claims that an eavesdropper with full model knowledge but without the key cannot restore image content, since the encrypted feature tensor is pseudorandom-looking.","pith_inferences":["A testable extension would be to apply the same modulo-256 encryption to other learned source-channel codecs (e.g., deep JSCC for video or speech) and check whether a super-resolution-style post-processor recovers the same low-SNR gains; the mechanism suggests it would, since the decoder-side repair is agnostic to the codec's internal representation.","The paper's security argument is asymptotic (polynomial indistinguishability), but the practical threat model is a keyless eavesdropper who knows the model; a concrete known-plaintext attack using the statistical structure of the learned codec's features would clarify whether the modulo addition provides more than obfuscation.","If the normalization/quantization step needed to make the feature vector integer-valued is lossy, the reported PSNR gains may change when that step is made explicit; re-running the experiments with disclosed quantization is a direct way to bound the real-world trade-off.","The crossover behavior suggests a channel-adaptive policy: use the super-resolution module only when the estimated channel SNR is below a threshold; this could be formalized as a decision rule with a small side-information overhead."],"forward_implications":["If the claim holds, image-oriented semantic communication systems can add confidentiality with a cheap arithmetic operation plus a standard super-resolution decoder, rather than relying on heavyweight cryptography.","The observed crossover—super-resolution helps at low SNR but can hurt at high SNR—implies that a practical system should switch off or down-weight the SR module when channel conditions are good.","Because the security argument depends only on the pseudorandomness of the key and not on the channel code, the same encryption layer could be attached to other JSCC architectures and still provide the same eavesdropper resistance.","The performance gain at low SNR is modulation-dependent (largest for BPSK, smallest for 16QAM), so modulation selection and SR activation should be co-designed with the encryption layer."],"supporting_citations":[{"why":"Supplies the nonlinear transform source-channel coding network used as the semantic extraction and JSCC backbone in all experiments.","marker":"[25]"},{"why":"Provides the Residual Dense Network architecture adopted for the super-resolution reconstruction module.","marker":"[23]"},{"why":"Basis for the claim that modulo-256 encryption is semantically secure because pseudorandom sequences are indistinguishable from random in polynomial time.","marker":"[22]"},{"why":"Provides the standard image super-resolution test set used to evaluate reconstruction quality.","marker":"[20]"},{"why":"Source of the modulo-256 encryption idea applied to feature tensors in an encryption-then-compression context.","marker":"[21]"}],"fun_headline_variants":["SREC: encrypted semantic images get sharper at low SNR via super-resolution","Modulo-256 encryption plus super-resolution sharpens low-SNR semantic images","Encryption overhead offset by super-resolution at low SNR in semantic images","SREC: secure semantic communication with super-resolution for low-SNR images","SREC's super-resolution improves low-SNR image quality despite encryption"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the real-valued features output by the JSCC encoder can be normalized and quantized into integer bytes in the range 0–255 so that the modulo-256 addition in Eq. (10) is invertible after decryption; the paper does not specify this step, and for arbitrary real features the modulo operation is not invertible.","fun_headline_variants_meta":{"raw":{"variants":["SREC: encrypted semantic images get sharper at low SNR via super-resolution","Modulo-256 encryption plus super-resolution sharpens low-SNR semantic images","Encryption overhead offset by super-resolution at low SNR in semantic images","SREC: secure semantic communication with super-resolution for low-SNR images","SREC's super-resolution improves low-SNR image quality despite encryption"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000803,"raw_usage":{"total_tokens":3487,"prompt_tokens":864,"completion_tokens":2623,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":480,"completion_tokens_details":{"reasoning_tokens":2528}},"tokens_in":480,"tokens_out":2623,"duration_ms":19024,"temperature":1.0,"reasoning_tokens":2528,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T16:26:24.730163+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a real feature tensor $s$ from the learned JSCC encoder on the test set and apply Eq. (10) directly without a disclosed normalization/quantization step; if the receiver cannot recover $s$ exactly from $(s + \\mathrm{KEY}) \\bmod 256$ because values lie outside $[0, 256)$, the central invertibility assumption fails.","supporting_citations":[{"cited_title":"Scalable coding of encrypted images,","cited_arxiv_id":null,"evidence_quote":"Basis for the claim that modulo-256 encryption is semantically secure because pseudorandom sequences are indistinguishable from random in polynomial time."},{"cited_title":"A novel encryption-then-lossy-compression scheme of color images using customized residual dense spatial network,","cited_arxiv_id":null,"evidence_quote":"Source of the modulo-256 encryption idea applied to feature tensors in an encryption-then-compression context."}],"review_version":2}