Deep Joint Source Channel Coding for Privacy-Aware End-to-End Image Transmission

Babak Hossein Khalaj; Deniz G\"und\"uz; Ecenaz Erdemir; Hamid Behroozi; Mehdi Letafati; Seyyed AmirHossein Ameli Kalkhoran

REVIEW 3 major objections 5 minor 43 references

Deep Joint Source Channel Coding for Privacy-Aware End-to-End Image Transmission

T0 review · 3 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper proposes a privacy-aware DeepJSCC system in which a single training loss combining MSE, SSIM, and an adversarial cross-entropy term keeps image reconstruction faithful while preventing multiple eavesdroppers from inferring…

desk verdict A useful, well-executed empirical extension of single-Eve privacy-aware DeepJSCC to multiple colluding/non-colluding eavesdroppers and fading channels, but the reported privacy numbers are lower bounds measured by the adversary family it was trained against, and Eq. (8) has a notation typo that makes the printed loss constant. read the letter →

arxiv 2412.17110 v2 pith:TFP2A63L submitted 2024-12-22 cs.IT eess.SPmath.IT

Mehdi Letafati , Seyyed Amirhossein Ameli Kalkhoran , Ecenaz Erdemir , Babak Hossein Khalaj , Hamid Behroozi , Deniz Gündüz This is my paper · ORCID

classification cs.ITeess.SPmath.IT MSC 94A1594A29

keywords DeepJSCCjointsource-channelcodingprivacyfunnelwiretapchanneladversarialneuralnetworksinformationleakagestructuralsimilarityindexprivacy-utilitytrade-off

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that a data-driven joint source-channel coding system can keep image reconstruction accurate for a legitimate receiver while denying multiple eavesdroppers access to designated private attributes, without assuming known or i.i.d. source statistics. It generalizes the privacy-funnel and wiretap-coding ideas into a multi-objective loss trained as a minimax game: Alice and Bob minimize distortion plus the eavesdroppers' ability to classify the secret, while each eavesdropper tries to maximize that ability. Experiments on CIFAR-10 and CelebA report that the scheme restrains adversarially trained eavesdroppers for both colluding and non-colluding settings and for common or distinct secrets, with better SSIM and lower mutual-information leakage than earlier DeepJSCC baselines. If correct, this makes privacy-aware wireless image transmission practical in non-asymptotic, unknown-statistics settings where classical information-theoretic guarantees do not apply.

What carries the argument

The load-bearing mechanism is the adversarial likelihood compensation (ALC) training objective, Eq. (8): $$L_{AB}^{\text{ALC}} = \frac{1}{N_T}\sum_{j=1}^{N_T}\left(d(u_j,\hat{u}_j) + \frac{1}{M}\sum_{i=1}^{M} w_i H\left(q_{\Theta_{E,i}}($s_i^{{(j)}}$|$z_i^{{(j)}}$), \bar{p}_L\right)\right),$$ with distortion $d(u,\hat{u}) = \Delta_{\text{MSE}} + \alpha\Delta_{\text{SSIM}}$. The cross-entropy term is the variational surrogate for the mutual-information leakage $I(S_i;Z_i^k)$ used in the paper's objective, and ALC replaces the one-hot target with the uniform distribution so that training pushes each eavesdropper's softmax output toward equiprobable guesses. This single formula, trained in alternation with the adversarial classifiers, is what carries the privacy-utility trade-off.

What would settle it

Train the proposed encoder on CIFAR-10 or CelebA, then evaluate an eavesdropper that is not limited to the paper's DNN architecture, for example a much larger transformer-based classifier or one that first reconstructs the image and then classifies the private attribute, and compare its accuracy and mutual-information estimate at the same wiretap SNR. If the stronger eavesdropper's accuracy rises substantially above the reported adversarial accuracy, the claimed privacy level would not hold for arbitrary adversaries.

Watch

Extended reading notes

Core claim

The central discovery is that privacy can be engineered into a DeepJSCC pipeline entirely through the loss function. The legitimate encoder-decoder is trained to minimize a distortion term $\Delta_{\text{MSE}} + \alpha\Delta_{\text{SSIM}}$ plus a weighted adversarial cross-entropy term; rather than encouraging the eavesdropper's predicted posterior to match the true one-hot label, adversarial likelihood compensation drives it toward the uniform distribution $\bar{p}_L$, maximizing the adversary's uncertainty. The eavesdroppers are trained in alternation to minimize cross-entropy to the true secret, forming a GAN-like minimax game. The paper reports that this restrains adversarial accuracy, lowers the mutual-information leakage estimate, and still yields high SSIM at the legitimate receiver, with the privacy-utility trade-off tunable through the weight $w$.

Load-bearing premise

The load-bearing premise is that the eavesdropper's trained classifier is a faithful stand-in for any possible eavesdropper, and that Alice knows which attributes each adversary wants and what channels they see; a stronger or different eavesdropper could extract more than the reported numbers.

Editorial extensions

If this is right

If the central claim holds, the same DeepJSCC backbone can be made privacy-aware for multiple eavesdroppers simply by changing the training loss, without adding encryption, steganography, or extra processing modules.
The scheme generalizes across channel models: trained on Rayleigh fading, it retains similar performance on AWGN and Nakagami-$m$ links, so the privacy guarantee does not require exact knowledge of the channel statistics.
The privacy-utility trade-off is controllable through the scalar weight $w$, letting a network designer choose an operating point on the SSIM-versus-leakage curve.
Colluding eavesdroppers that combine their individual logits gain some accuracy, but the reported gain saturates as the wiretap SNR grows, suggesting a structural limit on what the adversaries can extract.
With $w=0$, the same architecture approaches lossless reconstruction, which isolates the reported cost of privacy to roughly a 15% SSIM reduction in the tested settings.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

A consequence the paper leaves implicit is that the reported leakage numbers are tied to the specific adversarial DNN family used in training; a stronger eavesdropper that first reconstructs the image and then classifies the private attribute could extract more information than the reported mutual-information estimates suggest.
The uniform-posterior push of ALC is a general privacy mechanism, so one could test whether the same loss transfers to other sensitive attributes, such as identity, location, or medical markers, and to other modalities such as video or audio.
Because the minimax game is played under complete information about each side's strategy, an asymmetric-information adversary using reinforcement learning or meta-learning could behave differently; the paper itself lists this as a future direction, and a natural test would be to measure leakage against such an adversary.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The paper is a solid empirical extension of the single-Eve privacy-aware DeepJSCC line to a more realistic multiple-Eve setting. The new bits are genuine: colluding and non-colluding Eves, per-Eve private attributes, Rayleigh/Nakagami/AWGN channels, and an SSIM-based distortion term. The experimental package is the main asset—CIFAR-10, CelebA, Kodak generalization, ablations over the privacy weight and SSIM weight, and a clear minimax training procedure. The authors are also honest about their assumptions (known sensitive attributes and Eve channel models) and about the limits of their evaluation. This is a legitimate step beyond [16] and [17], not a rehash.

The soft spots are real but addressable. First, Eq. (8) as written is constant: under the paper's own convention H(p,q)=-E_p[log q], the term H(q, bar_p_L) equals log L. The intended objective is clearly H(bar_p_L, q), which pushes the adversary's output toward uniform. Second, the reported mutual information leakage in Eq. (13) is computed with the same class of adversarial DNN used in training. That gives a lower bound on true leakage, not a certificate. A stronger Eve—deeper network, joint processing across colluding Eves, or reconstruct-then-classify—could do strictly better than the numbers in Fig. 6(a). The paper hedges by saying "adversarially-trained eavesdroppers" in places, but the abstract and figures invite a stronger reading. For a journal version, I'd want an independent leakage estimator or at least a stronger-adversary ablation, not just the training adversary's cross-entropy. Third, no code or data are released, so the 20%/10% improvements over benchmarks can't be checked; that's not fatal, but it matters for a paper whose claims are empirical.

Who is this for? Researchers working on secure or private semantic communications, or on DeepJSCC variants. They'll find the multi-Eve setup and fading-channel generalization useful. The paper deserves a serious referee: the idea is plausible, the experiments are suggestive, and the flaws are fixable. My recommendation: send it to review with a request to fix Eq. (8), clarify the ordering in Eq. (13), add an independent leakage evaluation against a stronger adversary, and consider releasing code. With those changes, it would be a solid contribution.

Referee Report

3 major / 5 minor

Summary. The paper proposes a privacy-aware DeepJSCC scheme for image transmission from a legitimate transmitter-receiver pair to Bob in the presence of multiple eavesdroppers. The authors formulate a multi-objective optimization that trades reconstruction distortion against mutual-information leakage to the eavesdroppers, then implement the encoder, decoder, and adversarial classifiers with DNNs and train them in an alternating minimax fashion. Experiments on CIFAR-10, CelebA, and Kodak compare the scheme with prior DeepJSCC and secure-communication baselines, reporting SSIM, adversarial accuracy, and a mutual-information leakage metric under AWGN, Rayleigh, and Nakagami-m channels.

Significance. If the training objective were implemented as intended, the paper would offer a practical, data-driven privacy-utility trade-off for DeepJSCC with multiple colluding or non-colluding eavesdroppers, without assuming known source statistics. The experimental coverage is broad: multiple datasets, multiple eavesdroppers, common and distinct secrets, several channel models, and ablation studies on the loss hyperparameters. The architectural modifications (GDN/IGDN layers, SSIM in the distortion) appear sensible and the generalization test to Kodak is a useful addition. However, the central training and evaluation equations contain a systematic cross-entropy order error that makes the printed objectives non-implementable, and the reported privacy metric is a variational lower bound rather than a certificate of privacy. These issues are load-bearing for the main claims.

major comments (3)

[Section III-C, Eq. (8)] Under the paper's own convention H(p,q) = -E_p[log q], the ALC term H(q_{Theta_E,i}(s|z), \bar p_L) equals log L, because \bar p_L is the uniform distribution. Thus the adversarial likelihood compensation term in Eq. (8) is a constant, independent of all trainable parameters, and training with this loss reduces to distortion-only training. Since ALC is described as the mechanism that confuses the eavesdroppers, this is a load-bearing error. The intended objective appears to be H(\bar p_L, q_{Theta_E,i}) (or equivalently KL(q||uniform)), and the equation and all experiments depending on it need to be corrected or re-run.
[Section III-B, Eq. (9) and Section IV, Eq. (13)] The adversary loss in Eq. (9) and the mutual-information estimator in Eq. (13) use H(q_{Theta_E,i}, epsilon_{s_i}). With epsilon_{s_i} as a one-hot vector and the paper's definition H(p,q) = -E_p[log q], this quantity is infinite whenever q places any probability on a class other than the true label, so it cannot be the implemented cross-entropy loss. The standard classification cross-entropy is H(epsilon_{s_i}, q_{Theta_E,i}) = -log q_{Theta_E,i}(s_i|z_i). As printed, both the adversary update and the leakage evaluation are not implementable; the arguments of H must be reversed throughout.
[Section IV, Eq. (13)] Even after correcting the cross-entropy order, the quantity H(S_i) - H(epsilon_{s_i}, q_{Theta_E,i}) is a variational lower bound on I(S_i; Z_i^k), not an equality, unless q_{Theta_E,i} equals the true posterior p_{S_i|Z_i^k}. Because the classifier used for evaluation is trained within the same adversary family used in the minimax game, the reported 'information leakage' is an upper bound on privacy, not a lower bound: a richer adversary (deeper network, joint processing across colluding Eves, or reconstruct-then-classify) could obtain strictly higher leakage. The paper should either report an independent MI estimator or state explicitly that the metric is a variational lower bound for the trained adversary class and evaluate against a held-out stronger adversary to support the claim that eavesdroppers are 'restrained'.

minor comments (5)

[Section III-B, Eq. (6)] The minimax formulation in Eq. (6) is written as 'minimize L(Omega_A, Omega_B, Theta_E,1, ...)' even though the adversary parameters are maximized inside the loss; it should be written as min over (Omega_A, Omega_B) and max over Theta_E,i to match the described alternating game.
[Section IV-B, Remark 5] Remark 5 states that higher values of w favor utility and lower values prioritize privacy, but the surrounding text and Fig. 8 show the opposite: larger w gives lower leakage and lower utility. This should be corrected.
[Section IV-A, colluding setup description] The colluding ensemble combination is first written with coefficients phi_i, but the text then says 'omega_i's are learned'; please unify the notation.
[Section IV-A, Fig. 6] The comparison against reference [15] uses DeepJSCC-f, which has a feedback link; the paper should clarify whether the benchmark uses feedback, since otherwise the comparison is not apples-to-apples for a one-shot transmission system.
[Section II-A] There is a typo: 'Depp-JSCC' should be 'DeepJSCC'.

Circularity Check

1 steps flagged · score 6.0 of 10

Privacy leakage is measured by the very adversarially trained classifier used in training: Eq. (13) replaces the max over q in the variational MI identity with the trained q, so the reported leakage is a lower bound against a fixed adversary family, not an independent privacy certificate.

fitted input called prediction [Section IV, Eq. (13), with variational identity Eq. (2) and adversary loss Eq. (9)]
"To quantify the level of privacy, we evaluate the information leakage characterized via the mutual information metric. Accordingly, with a similar approach to what proposed in (2), we use the following approximation for mutual information leakage I(Si, Zk i ) ≈ H(Si) − H (qΘE,i (si|zi), εsi) , (13)"

Eq. (2) gives I(S;Z)=H(S)+max_q E[log q], tight only at the true posterior. Eq. (13) evaluates leakage with the fixed trained classifier q_Theta_E,i instead of the max. That classifier is exactly the network trained to minimize H(q, epsilon_s) in Eq. (9) and counter-trained by Alice's ALC loss in Eq. (8). Thus the reported 'mutual information leakage' is H(S) minus the system's own cross-entropy training objective for a particular adversary family, not an independent measurement; a stronger adversary can achieve strictly higher true I(S;Z). The paper itself limits claims to 'adversarially-trained eavesdroppers' and defers model-agnostic bounds and advanced adversary strategies to future work.

full rationale

The core optimization chain is internally consistent: the variational identity in Eq. (2) is mathematically correct, and replacing MI with a cross-entropy surrogate is a standard, clearly stated modeling choice. The main circularity is in the evaluation. The paper fits the eavesdropper networks to minimize H(q, epsilon_s) (Eq. 9), simultaneously trains the encoder to inflate that same cross-entropy (Eq. 8), and then reports the resulting cross-entropy as 'mutual information leakage' via Eq. (13). Because Eq. (13) uses a particular q instead of the max over q, it is a lower bound on true MI, so the privacy numbers in Fig. 6(a) and the abstract's MI-leakage comparisons are measures of performance against the paper's own adversary class, not absolute guarantees. The adversarial accuracy results and SSIM results provide partially independent evidence that the scheme does confuse the trained adversary family, so this is partial, not total, circularity; the score reflects that the central privacy metric reduces to the training objective while utility and accuracy claims remain externally checkable. Separately from circularity, Eq. (8) as printed is inert under the paper's own convention H(p,q) = -E_p[log q], because H(q_Theta_E,i, bar_p_L) equals the constant log L; the intended ALC objective must have been H(bar_p_L, q). This is a correctness or typo issue rather than a circularity issue, but it reinforces that the privacy mechanism's printed loss cannot have produced the reported effect as written. No load-bearing self-citation chain or uniqueness-imported-from-authors pattern was found; prior work [16], [17] is used only to motivate the variational surrogate and ALC, and the experiments include external benchmarks and datasets.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The method introduces no new physical entities. The load-bearing upstream elements are the variational MI approximation and a known adversarial threat model. Two hyperparameters (w and alpha) are tuned on validation data, and the privacy metric is the same cross-entropy proxy used in training.

free parameters (3)

privacy weight w = w=5 on CIFAR-10; w=10 default and grid {0,10,50,100} on CelebA
Controls the trade-off between distortion and leakage in Eqs. (6)-(8). The paper states the values of w and alpha were chosen empirically after training over combinations on a validation set.
SSIM weight alpha = 0.1
Tuned by validation grid search. Larger alpha improves SSIM but also increases adversarial accuracy (Fig. 7), so the reported operating point is a fitted choice.
training SNRs of legitimate and adversarial links = Gamma_L^train=20 dB, Gamma_E^train=15 dB
Fixed training hyperparameters in Table I. They are hand-chosen conditions and influence how well the learned encoder generalizes to the tested SNR range.

assumptions (4)

standard math Variational bound I(S;Z)=H(S)+max_q E[log q(s|z)] in Eq. (2) is valid, and the trained adversarial DNN approximates the maximizing q.
The KL nonnegativity identity is standard, but replacing the true posterior by a DNN classifier in Eqs. (6) and (13) is an approximation that can only lower-bound true leakage.
domain assumption The legitimate system knows the number of eavesdroppers, the private attribute each one targets, and the eavesdroppers' channel models.
Stated in Section II-B: 'we are assuming that we know the sensitive attribute each eavesdropper is interested in and their channel models.' This limits the abstract's claim of operation under unknown statistics.
domain assumption Known parametric channel models (AWGN, Rayleigh, Nakagami-m) are sufficient for training and for evaluating generalization.
The channels are treated as differentiable non-trainable layers (Section II-A). Training on synthetic channel samples assumes the real environment is captured by these models.
domain assumption CIFAR-10 and CelebA are representative of the source image distribution for the intended deployment.
The method is data-driven. The paper itself notes out-of-distribution generalization to richer datasets is future work (Section V).

how reviews work

0 comments

Cite this review

Pith. "Pith review of Deep Joint Source Channel Coding for Privacy-Aware End-to-End Image Transmission." pith.science (2026). https://pith.science/paper/TFP2A63L

@misc{pith2026241217110,
  author       = {Pith},
  title        = {Pith review of: Deep Joint Source Channel Coding for Privacy-Aware End-to-End Image Transmission},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/TFP2A63L}},
  note         = {Machine review of arXiv:2412.17110}
}

read the original abstract

Deep neural network (DNN)-based joint source and channel coding is proposed for privacy-aware end-to-end image transmission against multiple eavesdroppers. Both scenarios of colluding and non-colluding eavesdroppers are considered. Unlike prior works that assume perfectly known and independent identically distributed (i.i.d.) source and channel statistics, the proposed scheme operates under unknown and non-i.i.d. conditions, making it more applicable to real-world scenarios. The goal is to transmit images with minimum distortion, while simultaneously preventing eavesdroppers from inferring certain private attributes of images. Simultaneously generalizing the ideas of privacy funnel and wiretap coding, a multi-objective optimization framework is expressed that characterizes the tradeoff between image reconstruction quality and information leakage to eavesdroppers, taking into account the structural similarity index (SSIM) for improving the perceptual quality of image reconstruction. Extensive experiments on the CIFAR-10 and CelebA, along with ablation studies, demonstrate significant performance improvements in terms of SSIM, adversarial accuracy, and the mutual information leakage compared to benchmarks. Experiments show that the proposed scheme restrains the adversarially-trained eavesdroppers from intercepting privatized data for both cases of eavesdropping a common secret, as well as the case in which eavesdroppers are interested in different secrets. Furthermore, useful insights on the privacy-utility trade-off are also provided.

Figures

Figures reproduced from arXiv: 2412.17110 by the authors.

**Figure 2.** Proposed deep neural networks at Alice (encoder) and Bob (decoder). The notation [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗

**Figure 3.** Implemented DNN at each of the adversaries for extracting sensitive [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗

Figures from the paper (10 more)

**Figure 4.** Figure 4: Privacy-utility trade-off over CIFAR-10. different datasets of CIFAR-10 [38] and CelebA [39], respectively. We examine the performance over both AWGN and complex fading (Rayleigh and Nakagami-m) communication channels for different channel SNRs and 4 antennas (unless …

**Figure 5.** Figure 5: Adversarial accuracy vs. SNR (ΓE) for Rayleigh fading, AWGN, and Nakagami-m (with m = 3) channels. are two completely separated sets of images, containing 50000 and 10000 images, respectively, associated with 10 classes. Adversaries wish to infer a common secret S from…

**Figure 6.** Figure 6: Performance evaluation during inference. [PITH_FULL_IMAGE:figures/full_fig_p010_6.png]

**Figure 7.** Figure 7: Effect of α and w on the privacy-utility trade-off quality of adversarial links, i.e., increasing ΓE, the accuracy of adversaries increases by at most 10%. This can be observed from (14), where higher values for ΓE results in having lessdistorted (less noisy) observat…

**Figure 8.** Figure 8: Privacy-utility trade-off over CelebA dataset [PITH_FULL_IMAGE:figures/full_fig_p011_8.png]

**Figure 9.** Figure 9: Adversarial accuracy in terms of F1 score over CelebA dataset. [PITH_FULL_IMAGE:figures/full_fig_p011_9.png]

**Figure 10.** Figure 10: Reconstruction quality of the legitimate destination vs. the eaves [PITH_FULL_IMAGE:figures/full_fig_p012_10.png]

**Figure 11.** Figure 11: Reconstructed CelebA images at Bob and each Eve. For each [PITH_FULL_IMAGE:figures/full_fig_p012_11.png]

**Figure 12.** Figure 12: The training process and ablation studies. The cross-entropy, SSIM, and MSE metrics are visualized from left to right. [PITH_FULL_IMAGE:figures/full_fig_p014_12.png]

**Figure 13.** Figure 13: Generalization performance of our scheme (pre-trained on CIFAR-10 dataset) evaluated over Kodak dataset and compared with different benchmarks. [PITH_FULL_IMAGE:figures/full_fig_p014_13.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

43 extracted references · 40 canonical work pages

[16]

Adversarial networks for secure wireless communications,

T. Marchioro, N. Laurenti, and D. G ¨und¨uz, “Adversarial networks for secure wireless communications,” 2020 IEEE Int. Conf. Acoust. Speech Signal Process (ICASSP), Barcelona, Spain, May 2020, pp. 8748–8752

work page 2020
[17]

Privacy-aware communica- tion over a wiretap channel with generative networks,

E. Erdemir, P. L. Dragotti and D. G ¨und¨uz, “Privacy-aware communica- tion over a wiretap channel with generative networks,” IEEE Int. Conf. Acoust. Speech Signal Process. (ICASSP), Marina Bay Sands, Singapore, May 2022, pp. 2989–2993

work page 2022
[1]

Secure deep-JSCC against multiple eaves- droppers,

S. A. Ameli Kalkhoran, M. Letafati, E. Erdemir, B. H. Khalaj, H. Behroozi and D. G ¨und¨uz, “Secure deep-JSCC against multiple eaves- droppers,” 2023 IEEE Global Communications Conference (GLOBE- COM 2023), Kuala Lumpur, Malaysia, Dec. 2023, pp. 3433-3438

work page 2023
[2]

Cellular- connected wireless virtual reality: Requirements, challenges, and solu- tions,

F. Hu, Y . Deng, W. Saad, M. Bennis, and A. H. Aghvami, “Cellular- connected wireless virtual reality: Requirements, challenges, and solu- tions,” IEEE Comm. Mag. , vol. 58, no. 5, pp. 105–111, May 2020

work page 2020
[3]

Wireless image re- trieval at the edge,

M. Jankowski, D. G ¨und¨uz, and K. Mikolajczyk, “Wireless image re- trieval at the edge,” IEEE J. Sel. Areas Comm. , vol. 39, no. 1, pp. 89– 100, Jan. 2021

work page 2021
[4]

Deep learning for hardware-impaired wireless secret key generation with man- in-the-middle attacks,

M. Letafati, H. Behroozi, B. H. Khalaj, and E. A. Jorswieck, “Deep learning for hardware-impaired wireless secret key generation with man- in-the-middle attacks,” 2021 IEEE Global Communications Conference (GLOBECOM), Madrid, Spain, Dec. 2021, pp. 1–6

work page 2021
[5]

Learning-based secret key generation in relay channels under adversarial attacks,

—–, “Learning-based secret key generation in relay channels under adversarial attacks,” IEEE Open Journal of V ehicular Technology, vol. 4, pp. 749-764, Sep. 2023

work page 2023
[6]

Jamming- resilient frequency hopping-aided secure communication for Internet-of- Things in the presence of an untrusted relay,

M. Letafati, A. Kuhestani, H. Behroozi and D. W. K. Ng, “Jamming- resilient frequency hopping-aided secure communication for Internet-of- Things in the presence of an untrusted relay,” IEEE Trans. on Wireless Comm., vol. 19, no. 10, pp. 6771–6785, Oct. 2020

work page 2020

Show all 43 references

[7]

Hardware- impaired PHY secret key generation with man-in-the-middle adver- saries,

M. Letafati, H. Behroozi, B. H. Khalaj, and E. A. Jorswieck, “Hardware- impaired PHY secret key generation with man-in-the-middle adver- saries,” IEEE Wireless Comm. Lett., vol. 11, no. 4, pp. 856–860, Apr. 2022

2022
[8]

Wireless-powered cooperative key generation for e-health: A reservoir learning approach,

—–, “Wireless-powered cooperative key generation for e-health: A reservoir learning approach,” 2022 IEEE 95th V ehicular Technology Conference (VTC-Spring), Helsinki, Finland, Jun. 2022, pp. 1–7

2022
[9]

A lightweight secure and resilient transmission scheme for the Internet-of-Things in the presence of a hostile jammer,

M. Letafati, A. Kuhestani, K. -K. Wong and M. J. Piran, “A lightweight secure and resilient transmission scheme for the Internet-of-Things in the presence of a hostile jammer,” IEEE Internet of Things J. , Sep. 2020

2020
[10]

Context-aware security for 6G wireless: The role of physical layer security,

A. Chorti, A. N. Barreto, S. Kopsell, M. Zoli, M. Chafii, P. Sehier, G. Fettweis, and H. V . Poor, “Context-aware security for 6G wireless: The role of physical layer security,” IEEE Communications Standards Magazine, vol. 6, no. 1, pp. 102–108, Mar. 2022

2022
[11]

On learning-assisted content-based secure image transmission for delay- aware systems with randomly-distributed eavesdroppers,

M. Letafati, H. Behroozi, B. H. Khalaj, and E. A. Jorswieck, “On learning-assisted content-based secure image transmission for delay- aware systems with randomly-distributed eavesdroppers,” IEEE Trans. Comm., vol. 70, no. 2, pp. 1125–1139, Feb. 2022

2022
[12]

Content-based medical image transmission against randomly- distributed passive eavesdroppers,

—–, “Content-based medical image transmission against randomly- distributed passive eavesdroppers,” IEEE Int. Conf. Comm. Workshop (ICCW), Montreal, Canada, Jun. 2021, pp. 1–7

2021
[13]

Joint source–channel coding: Fundamentals and recent progress in practical designs,

D. G ¨und¨uz, M. A. Wigger, T. -Y . Tung, P. Zhang, and Y . Xiao, “Joint source–channel coding: Fundamentals and recent progress in practical designs,” Proceedings of the IEEE, pp. 1-32, Nov. 2024, doi: 10.1109/JPROC.2024.3477331

2024
[14]

Deep joint source- channel coding for wireless image transmission,

E. Bourtsoulatze, D. Burth Kurka, and D. G ¨und¨uz, “Deep joint source- channel coding for wireless image transmission,” IEEE Trans. Cogn. Comm. Netw., vol. 5, no. 3, pp. 567–579, Sep. 2019

2019
[15]

DeepJSCC-f: Deep joint source-channel coding of images with feedback,

D. B. Kurka and D. G ¨und¨uz, “DeepJSCC-f: Deep joint source-channel coding of images with feedback,” IEEE Journal on Selected Areas in Information Theory , vol. 1, no. 1, pp. 178–193, May 2020

2020
[18]

Deep joint source-channel coding for semantic communications,

J. Xu, T. -Y . Tung, B. Ai, W. Chen, Y . Sun, and D. G¨und¨uz, “Deep joint source-channel coding for semantic communications,” IEEE Communi- cations Magazine, vol. 61, no. 11, pp. 42-48, Nov. 2023

2023
[19]

Flexible design of finite blocklength wiretap codes by autoencoders,

K. -L. Besser, C. R. Janda, P. -H. Lin, and E. A. Jorswieck, “Flexible design of finite blocklength wiretap codes by autoencoders,” in Proc. IEEE Int. Conf. Acoust., Speech, Sig. Proc. , pp. 2512–2516, May 2019

2019
[20]

Wiretap code design by neural network autoencoders,

K. -L. Besser, P. -H. Lin, C. R. Janda, and E. A. Jorswieck, “Wiretap code design by neural network autoencoders,” IEEE Trans. Inf. F orensics Secur ., vol. 15, pp. 3374–3386, Oct. 2019

2019
[21]

Deep learning based wiretap coding via mutual information estimation,

R. Fritschek, R. F. Schaefer, and G. Wunder, “Deep learning based wiretap coding via mutual information estimation,” in Proceedings of the 2nd ACM Workshop on Wireless Security and Machine Learning (WiseML’20), NY , USA, Jul. 2020, pp. 74–79

2020
[22]

Deep joint source-channel and encryption coding: Secure semantic communications,

T. -Y . Tung and D. G ¨und¨uz, “Deep joint source-channel and encryption coding: Secure semantic communications,” 2023 IEEE International Conference on Communications (ICC), Rome, Italy, May 2023, pp. 5620–5625

2023
[23]

Deep joint source- channel coding for image transmission with visual protection,

J. Xu, B. Ai, W. Chen, N. Wang and M. Rodrigues, “Deep joint source- channel coding for image transmission with visual protection,” IEEE Transactions on Cognitive Communications and Networking, vol. 9, no. 6, pp. 1399-1411, Dec. 2023

2023
[24]

Wireless image transmission with semantic and security awareness,

M. Zhang, Y . Li, Z. Zhang, G. Zhu and C. Zhong, “Wireless image transmission with semantic and security awareness,” IEEE Wireless Communications Letters, vol. 12, no. 8, pp. 1389–1393, Aug. 2023

2023
[25]

Secure semantic com- munication for image transmission in the presence of eavesdroppers,

S. Tang, C. Liu, Q. Yang, S. He, and D. Niyato, “Secure semantic com- munication for image transmission in the presence of eavesdroppers,” arXiv preprint arXiv:2404.12170, Apr. 2024

2024 arXiv
[26]

Is semantic communication secure? A tale of multi-domain adversarial attacks,

Y . E. Sagduyu, T. Erpek, S. Ulukus and A. Yener, “Is semantic communication secure? A tale of multi-domain adversarial attacks,” IEEE Communications Magazine, vol. 61, no. 11, pp. 50–55, Nov. 2023

2023
[27]

Density modeling of images using a generalized normalization transformation,

J. Ball ´e, V . Laparra, and E. P. Simoncelli, “Density modeling of images using a generalized normalization transformation,” in 4th International Conference on Learning Representations (ICLR 2016) , 2016

2016
[28]

On joint coding for watermarking and encryption,

N. Merhav, “On joint coding for watermarking and encryption,” IEEE Trans. Info. Theory , vol. 52, no. 1, pp. 190-205, Jan. 2006

2006
[29]

From the information bottleneck to the privacy funnel,

A. Makhdoumi, S. Salamatian, N. Fawaz, and M. M ´edard, “From the information bottleneck to the privacy funnel,” in Proc. of IEEE Information Theory Workshop (ITW) , 2014

2014
[30]

Multiob- jective Signal Processing Optimization: The way to balance conflicting metrics in 5G systems,

E. Bj ¨ornson, E. A. Jorswieck, M. Debbah, and B. Ottersten, “Multiob- jective Signal Processing Optimization: The way to balance conflicting metrics in 5G systems,” IEEE Signal Processing Magazine , vol. 31, no. 6, pp. 14–23, Nov. 2014

2014
[31]

Bot- tlenecks CLUB: Unifying information-theoretic trade-Offs among com- plexity, leakage, and utility,

B. Razeghi, F. P. Calmon, D. G ¨und¨uz, and S. V oloshynovskiy, “Bot- tlenecks CLUB: Unifying information-theoretic trade-Offs among com- plexity, leakage, and utility,” IEEE Transactions on Information F oren- sics and Security, vol. 18, pp. 2060–2075, Mar. 2023

2023
[32]

Privacy-preserving adversarial networks

A. Tripathy, Y . Wang, and P. Ishwar, “Privacy-preserving adversarial networks” 57th Annual Allerton Conference on Communication, Control, and Computing (Allerton) , pp. 495-505, Sep. 2019

2019
[33]

Delving deep into rectifiers: Surpassing human-level performance on imagenet classification,

K. He, X. Zhang, S. Ren, and J. Sun, “Delving deep into rectifiers: Surpassing human-level performance on imagenet classification,” IEEE Int’l Conf. Comput. Vision (ICCV) , pp. 1026–1034, Dec. 2015

2015
[34]

Layer normalization,

J. L. Ba, J. R. Kiros, and G. E. Hinton, “Layer normalization,” 2016, arXiv:1607.06450. [Online]. Available: https://arxiv.org/abs/1607.06450

2016 arXiv
[35]

Learning to generate images with perceptual similarity metrics,

J. Snell, K. Ridgeway, R. Liao, B. D. Roads, M. C. Mozer, and R. S. Zemel, “Learning to generate images with perceptual similarity metrics,” 2017 IEEE International Conference on Image Processing (ICIP) , pp. 4277–4281, Sep. 2017

2017
[36]

Loss functions for image restoration with neural networks,

H. Zhao, O. Gallo, I. Frosio, and J. Kautz, “Loss functions for image restoration with neural networks,” IEEE Transactions on Computational Imaging, vol. 3, pp. 47–57, Mar. 2017

2017
[37]

TensorFlow: Large-scale machine learning on het- erogeneous systems,

M. Abadi et al. , “TensorFlow: Large-scale machine learning on het- erogeneous systems,” software available from tensorflow.org. [Online]. Available: https://www.tensorflow.org/
[38]

Learning multiple layers of features from tiny images,

A. Krizhevsky, “Learning multiple layers of features from tiny images,” University of Toronto, Tech. Rep., 2009

2009
[39]

Deep learning face attributes in the wild,

Liu, Z., Luo, P., Wang, X., Tang, X., “Deep learning face attributes in the wild,” in Proc. Int’l Conf. on Computer Vision (ICCV) , Dec. 2015

2015
[40]

Adam: A method for stochastic optimization,

D.P. Kingma and L.J. Ba, “Adam: A method for stochastic optimization,” 2015 International Conference on Learning Representations (ICLR), San Diego, May 2015, pp. 1–13

2015
[41]

Conditional denoising diffusion probabilistic models for data reconstruction enhancement in wireless communications,

M. Letafati, S. Ali, and M. Latva-Aho, “Conditional denoising diffusion probabilistic models for data reconstruction enhancement in wireless communications,” IEEE Transactions on Machine Learning in Commu- nications and Networking, vol. 3, pp. 133-146, 2025

2025
[42]

Diffusion model-aided data reconstruction in cell-free massive MIMO downlink: A computation-aware approach,

—–, “Diffusion model-aided data reconstruction in cell-free massive MIMO downlink: A computation-aware approach,” IEEE Wireless Com- munications Letters, vol. 13, no. 11, pp. 3162-3166, Nov. 2024

2024
[43]

Denoising diffusion probabilistic models for hardware-impaired communications,

—–, “Denoising diffusion probabilistic models for hardware-impaired communications,” 2024 IEEE Wireless Communications and Networking Conference (WCNC), Dubai, United Arab Emirates, 2024, pp. 1-6

2024

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.

[1] [16]

Adversarial networks for secure wireless communications,

T. Marchioro, N. Laurenti, and D. G ¨und¨uz, “Adversarial networks for secure wireless communications,” 2020 IEEE Int. Conf. Acoust. Speech Signal Process (ICASSP), Barcelona, Spain, May 2020, pp. 8748–8752

work page 2020

[2] [17]

Privacy-aware communica- tion over a wiretap channel with generative networks,

E. Erdemir, P. L. Dragotti and D. G ¨und¨uz, “Privacy-aware communica- tion over a wiretap channel with generative networks,” IEEE Int. Conf. Acoust. Speech Signal Process. (ICASSP), Marina Bay Sands, Singapore, May 2022, pp. 2989–2993

work page 2022

[3] [1]

Secure deep-JSCC against multiple eaves- droppers,

S. A. Ameli Kalkhoran, M. Letafati, E. Erdemir, B. H. Khalaj, H. Behroozi and D. G ¨und¨uz, “Secure deep-JSCC against multiple eaves- droppers,” 2023 IEEE Global Communications Conference (GLOBE- COM 2023), Kuala Lumpur, Malaysia, Dec. 2023, pp. 3433-3438

work page 2023

[4] [2]

Cellular- connected wireless virtual reality: Requirements, challenges, and solu- tions,

F. Hu, Y . Deng, W. Saad, M. Bennis, and A. H. Aghvami, “Cellular- connected wireless virtual reality: Requirements, challenges, and solu- tions,” IEEE Comm. Mag. , vol. 58, no. 5, pp. 105–111, May 2020

work page 2020

[5] [3]

Wireless image re- trieval at the edge,

M. Jankowski, D. G ¨und¨uz, and K. Mikolajczyk, “Wireless image re- trieval at the edge,” IEEE J. Sel. Areas Comm. , vol. 39, no. 1, pp. 89– 100, Jan. 2021

work page 2021

[6] [4]

Deep learning for hardware-impaired wireless secret key generation with man- in-the-middle attacks,

M. Letafati, H. Behroozi, B. H. Khalaj, and E. A. Jorswieck, “Deep learning for hardware-impaired wireless secret key generation with man- in-the-middle attacks,” 2021 IEEE Global Communications Conference (GLOBECOM), Madrid, Spain, Dec. 2021, pp. 1–6

work page 2021

[7] [5]

Learning-based secret key generation in relay channels under adversarial attacks,

—–, “Learning-based secret key generation in relay channels under adversarial attacks,” IEEE Open Journal of V ehicular Technology, vol. 4, pp. 749-764, Sep. 2023

work page 2023

[8] [6]

Jamming- resilient frequency hopping-aided secure communication for Internet-of- Things in the presence of an untrusted relay,

M. Letafati, A. Kuhestani, H. Behroozi and D. W. K. Ng, “Jamming- resilient frequency hopping-aided secure communication for Internet-of- Things in the presence of an untrusted relay,” IEEE Trans. on Wireless Comm., vol. 19, no. 10, pp. 6771–6785, Oct. 2020

work page 2020