Selective Encryption: Concepts & Applications

• Selective encryption is a method that targets only the most information‐rich components (e.g., syntax elements, ROIs, model parameters) to achieve security while lowering computation costs.
• It applies importance metrics like visual entropy, gradient significance, or PCA selection to decide which parts to encrypt, thereby preserving format compliance and bitrate constraints.
• Applications span codec-integrated video encryption, federated learning model protection, and policy-based selective disclosure, demonstrating measurable gains in efficiency and controlled data access.

Selective encryption is the practice of encrypting only a subset of a representation rather than the entire object. In the literature, the selected subset may consist of syntax elements in a compressed video bitstream, regions of interest in an image, chosen model parameters, gradient coordinates, principal-component features, token spans in text, disclosures in a credential, or cells in an encrypted stream. The stated objectives vary by domain, but recurrent themes are reduction of computation and latency, preservation of format-compliance or constant bitrate, support for hierarchical or attribute-based access control, and explicit privacy–utility tuning in distributed learning systems (Fotovvat et al., 2021, Paul, 2020, Tian et al., 2021, Gu et al., 6 Aug 2025).

1. Definitions and taxonomy

A 2020 survey of selective image encryption distinguishes three orthogonal classification axes: spatial-domain, frequency-domain, and hybrid methods; ROI-based and non-ROI-based methods; and block-based, bit-plane-based, and coefficient-based methods (Paul, 2020). In that survey, full-image encryption is described as applying a cryptographic transform to every pixel or coefficient, whereas selective image encryption exploits unequal visual or semantic importance across the representation.

Subsequent work broadens the same idea beyond images. In VVC video coding, selective encryption refers to encrypting only a subset of syntax elements in a compressed bitstream rather than the entire coded data (Fotovvat et al., 2021). In CNN model protection, it refers to encrypting only carefully chosen model parameters so that unauthorized users obtain severely degraded inference while authorized users can receive partial decryption quotas and hence hierarchical service levels (Tian et al., 2021). In federated learning, the selected object is commonly a subset of gradient coordinates or model parameters, with the encryption ratio treated as a tunable variable in the privacy–utility trade-off (Gu et al., 6 Aug 2025). In credential and stream systems, the selected unit may be a disclosure or cell protected under a policy-specific token, so that different requesters recover different cleartext subsets (2505.09034, Perillo et al., 2019).

This range of definitions suggests that selective encryption is not tied to a single substrate. What remains stable across domains is the decision to localize cryptographic protection onto information-bearing components that are considered disproportionately important.

2. Selection principles and cryptographic mechanisms

The dominant design principle is to hide the greatest perceptual or inferential information with minimal encrypted data. In one VVC scheme, three syntax-element classes are chosen because they carry high visual information entropy: luma Intra Prediction Modes, Motion Vector Differences, and residual signs. The same work reports measured entropies of $H(\mathrm{IPM}) \approx 5.8$ bits per CU, $H(\mathrm{MVD}) \approx 3.2$ bits per MV, and $H(\mathrm{signs}) \approx 1.2$ bits per coefficient sign (Fotovvat et al., 2021).

In machine learning, the selection rule is usually expressed as an importance score. A systematic FL study defines a significance-scoring function $s_i$ over gradient coordinates $g^{(i)}$, then encrypts only the top-$p\%$ coordinates: $$m_i = \begin{cases} 1, & \text{if } s_i \text{ is among the top-}pm\text{ scores},\ 0, & \text{otherwise.} \end{cases}$$ The same study evaluates four metrics—Sensitivity, Product Significance, Gradient Magnitude, and Parameter Magnitude—and reports that no single strategy is universally optimal across all attack scenarios (Gu et al., 6 Aug 2025). A different CNN-protection line formulates selection as an $L_0$-regularized optimization over Bernoulli mask probabilities $p_i$, then encrypts the top $\phi^l$ weights per layer after ranking by the learned $H(\mathrm{MVD}) \approx 3.2$0-scores (Tian et al., 2021). HADES instead uses PCA and chooses the smallest $H(\mathrm{MVD}) \approx 3.2$1 such that the cumulative explained-variance ratio $H(\mathrm{MVD}) \approx 3.2$2, then encrypts $H(\mathrm{MVD}) \approx 3.2$3 while leaving the remaining components in plaintext (Kaynak et al., 22 Jun 2026).

The cryptographic back-end is correspondingly heterogeneous. Reported primitives include AES-CTR for syntax-element scrambling in VVC (Fotovvat et al., 2021), CP-ABE combined with per-tile AES-GCM for 360 video (Usmani et al., 7 May 2025), CKKS-based selective homomorphic encryption for federated tuning (Liu et al., 27 May 2025), a chaotic Henon map combined with XOR over segmentation masks in medical imaging (Prakash et al., 2024), and AES-128 plus RSA in selective attribute masking for social-media text (Vijay et al., 2022). The field therefore couples a stable selection idea with domain-specific cryptographic realizations.

3. Codec-integrated video selective encryption

Compressed video has been a primary site for selective encryption because codec syntax creates sharply uneven information density. One VVC design inserts an SE block immediately before CABAC binarization and encrypts luma IPMs, MVDs, and residual signs using AES-CTR with per-CU IV derivation based on $H(\mathrm{MVD}) \approx 3.2$4 (Fotovvat et al., 2021). On 8 test sequences under RandomAccess and $H(\mathrm{MVD}) \approx 3.2$5, that scheme reports a $H(\mathrm{MVD}) \approx 3.2$6 to $H(\mathrm{MVD}) \approx 3.2$7 bit rate increase, a runtime overhead of $H(\mathrm{MVD}) \approx 3.2$8 to $H(\mathrm{MVD}) \approx 3.2$9 encoding time on VVenC, SSIM dropping from $H(\mathrm{signs}) \approx 1.2$0 to $H(\mathrm{signs}) \approx 1.2$1, VMAF from $H(\mathrm{signs}) \approx 1.2$2 to $H(\mathrm{signs}) \approx 1.2$3, and EDR greater than $H(\mathrm{signs}) \approx 1.2$4 for encrypted frames.

A second VVC framework pursues two stricter constraints: format-compliance and constant bitrate. It operates inside the entropy encoder after binarization and before context modeling/arithmetic coding, and limits encryption to bypass-coded suffix bins whose flipping neither changes parsing nor alters total bitstream length (Gautier et al., 2021). The encrypted syntax includes transform-coefficient remainders and sign flags, MVD sign and magnitude, merge and triangle direction parameters, chroma intra-prediction candidates, and SAO parameters. Experimental results under VTM 6.0 report an encryption space of $H(\mathrm{signs}) \approx 1.2$5 to $H(\mathrm{signs}) \approx 1.2$6 of the bitstream, average anchor PSNR at $H(\mathrm{signs}) \approx 1.2$7 dropping from $H(\mathrm{signs}) \approx 1.2$8 dB to $H(\mathrm{signs}) \approx 1.2$9 dB, SSIM from $s_i$0 to $s_i$1, VMAF from $s_i$2 to $s_i$3, and decoder overhead of about $s_i$4 at $s_i$5.

Related HEVC and H.264/AVC work adapts the same general idea to older standards. An H.264/AVC scheme encrypts only I-slice NAL payloads with AES-128 while leaving SPS/PPS and P/B data unmodified, aiming to preserve syntactic compliance, although that paper does not report numerical throughput or distortion results (Abomhara et al., 2022). A later HEVC ROI framework introduces three tunable levels: Level 1 encrypts only bypass-mode elements with $s_i$6 bitrate overhead, Level 2 adds regular-mode elements with roughly $s_i$7 to $s_i$8 bitrate increase, and Level 3 adds edge-based coefficient scrambling with roughly $s_i$9 to $g^{(i)}$0 bitrate increase; the same work reports average ROI IoU values of about $g^{(i)}$1 to $g^{(i)}$2 (Zhang et al., 9 Nov 2025).

These codec-specific studies establish that selective encryption is not merely partial post-processing. In standardized video, it is often an intra-codec transformation constrained by syntax validity, entropy-coder behavior, and rate-distortion consequences.

4. ROI-centric image, medical, immersive, and remote-sensing systems

In still-image systems, the selected subset is usually an ROI rather than a syntax element. SISA defines a four-stage architecture: RoI detection, prioritization, selective alteration, and metadata embedding. It detects objects using Mask-R-CNN, YOLO, and face/text detectors, then either applies Gaussian blur or AES-CFB encryption to the top-$g^{(i)}$3 regions covering a user-selected area fraction $g^{(i)}$4 (Gaherwar et al., 2021). On 1920×1080 images, the reported mean times over 50 runs are 850 ms for full encryption, 460 ms for SISA selective encryption, and 120 ms for SISA blur; decryption time falls from about 900 ms to about 500 ms.

A medical-imaging variant replaces object detectors with 3D segmentation. A binary ROI mask $g^{(i)}$5 is obtained from a Med3D-pretrained 3D ResNet-50 and thresholded at $g^{(i)}$6; only voxels with $g^{(i)}$7 are encrypted with a Henon-map-generated transformation matrix through bitwise XOR (Prakash et al., 2024). In the reported CT-brain experiments, the ROI fraction is $g^{(i)}$8, giving a retrieval speed improvement of around $g^{(i)}$9 compared with full-image encryption; decryption is lossless with RMSE $p\%$0, PSNR $p\%$1, UQI $p\%$2, and SSIM $p\%$3.

Immersive 360° streaming introduces an additional spatial-adaptive dimension. An ABE-based tiled framework defines encryption levels $p\%$4 over $p\%$5-frame subsets and a viewport-adaptive policy $p\%$6 based on tile importance weights $p\%$7 (Usmani et al., 7 May 2025). On CloudLab, the reported cache CPU savings relative to HTTPS are $p\%$8 to $p\%$9 for HTTP-ABE-allI+P and $$m_i = \begin{cases} 1, & \text{if } s_i \text{ is among the top-}pm\text{ scores},\ 0, & \text{otherwise.} \end{cases}$$0 to $$m_i = \begin{cases} 1, & \text{if } s_i \text{ is among the top-}pm\text{ scores},\ 0, & \text{otherwise.} \end{cases}$$1 for HTTP-ABE-MajorP, with L2 caches seeing up to $$m_i = \begin{cases} 1, & \text{if } s_i \text{ is among the top-}pm\text{ scores},\ 0, & \text{otherwise.} \end{cases}$$2 savings and authorized-client VMAF remaining comparable to HTTPS at about $$m_i = \begin{cases} 1, & \text{if } s_i \text{ is among the top-}pm\text{ scores},\ 0, & \text{otherwise.} \end{cases}$$3 to $$m_i = \begin{cases} 1, & \text{if } s_i \text{ is among the top-}pm\text{ scores},\ 0, & \text{otherwise.} \end{cases}$$4.

A different remote-sensing line emphasizes attack-driven evaluation rather than only throughput. Tilewise Domain-Separated Selective Encryption derives per-tile subkeys using HKDF with explicit domain separation and evaluates reconstruction probes under chosen-plaintext attack settings (Sun et al., 27 Feb 2026). That work reports that standard image-cipher metrics such as ciphertext entropy, histogram uniformity, correlation, NPCR, and UACI do not preclude transfer attacks, and shows reduced cross-tile transfer under per-tile separation, particularly for the linear probe.

5. Model and update protection in deep learning and federated learning

Selective encryption has become a central efficiency device in ML security because full cryptographic protection of model parameters or gradients is often computationally heavy. In CNN protection, Probabilistic Selection Strategy learns importance scores for weights and Distribution Preserving Random Mask encrypts the selected set while preserving layer-wise Gaussian statistics. On VGG19, the reported result is that merely encrypting $$m_i = \begin{cases} 1, & \text{if } s_i \text{ is among the top-}pm\text{ scores},\ 0, & \text{otherwise.} \end{cases}$$5 of convolutional-layer parameters reduces accuracy to $$m_i = \begin{cases} 1, & \text{if } s_i \text{ is among the top-}pm\text{ scores},\ 0, & \text{otherwise.} \end{cases}$$6, whereas competing strategies require about $$m_i = \begin{cases} 1, & \text{if } s_i \text{ is among the top-}pm\text{ scores},\ 0, & \text{otherwise.} \end{cases}$$7 encrypted; the same framework also supports $$m_i = \begin{cases} 1, & \text{if } s_i \text{ is among the top-}pm\text{ scores},\ 0, & \text{otherwise.} \end{cases}$$8 hierarchical service levels with accuracy recovery in discrete steps (Tian et al., 2021).

In federated learning, several works formalize selective encryption as partial protection of gradient or parameter coordinates. A 2025 study defines the selectively encrypted gradient $$m_i = \begin{cases} 1, & \text{if } s_i \text{ is among the top-}pm\text{ scores},\ 0, & \text{otherwise.} \end{cases}$$9 by encrypting indices in a set $L_0$0 with ratio $L_0$1, proves a Bayesian Cramér–Rao lower bound on reconstruction error, and derives spectral perturbation bounds showing that covariance-spectrum distortion scales as $L_0$2 (Huang et al., 24 Sep 2025). Its experiments on LeNet, MobileNetV3, and ResNet-18 report increasing reconstruction MSE as $L_0$3 grows, with no recovery at $L_0$4.

A complementary empirical study evaluates significance metrics against optimization-based and analytical inversion attacks on LeNet, CNN, BERT, and GPT-2, and identifies gradient magnitude as a generally effective metric against optimization-based inversions while also reporting that no single selective-encryption strategy is universally optimal across all attack scenarios (Gu et al., 6 Aug 2025). That conclusion is echoed by a growing diversification of system designs. FAS encrypts only a small $L_0$5-fraction of high-risk parameters with FHE and protects the rest through differential privacy and bitwise scrambling, reporting up to $L_0$6 speedup over applying FHE to all parameters (Korkmaz et al., 22 Jan 2025). SHE-LoRA selectively encrypts negotiated subsets of sensitive LoRA columns under CKKS and reports reductions of $L_0$7 in communication overhead and $L_0$8 in encryption computation overhead relative to its baseline (Liu et al., 27 May 2025). HADES encrypts only PCA-selected features under multiparty homomorphic encryption, trains a plaintext branch on the remaining features, and reports accuracy matching vanilla FL within $L_0$9 to $p_i$0 together with up to $p_i$1 bandwidth savings (Kaynak et al., 22 Jun 2026). TT-SEAL moves the same logic into TT-decomposed edge models, encrypting $p_i$2 to $p_i$3 of parameters while reducing the AES share of end-to-end latency from $p_i$4 to $p_i$5 on ResNet-18 (Min et al., 24 Feb 2026).

Across these systems, selective encryption functions less as a single algorithm than as a budgeted allocation mechanism: cryptographic effort is concentrated on coordinates, features, columns, or TT cores judged to have the highest privacy sensitivity or robustness relevance.

6. Access control, selective disclosure, and encrypted streams

A separate line of work treats selective encryption as a mechanism for fine-grained release semantics rather than primarily a workload reduction device. Secure Selective Stream considers a multi-writer setting in which mutually untrusted data sources upload encrypted rows into a public stream while a Data Owner issues tokens that permit subscribers to select and decrypt only authorized cells (Perillo et al., 2019). The construction is built from Amortized Orthogonality Encryption and yields ciphertext size proportional to the unencrypted data, with encryption and decryption linear in the row size.

In credentials, a CP-ABE extension of SD-JWT encrypts each disclosure $p_i$6 under its own policy $p_i$7, places the resulting ciphertexts into a Holder-signed bundle, and allows a Verifier to recover only those disclosures whose attributes satisfy the corresponding policies (2505.09034). The reported measurements show near-linear behavior in the number of disclosures: SD-JWT generation remains roughly constant at 4–6 ms, while encryption rises from 150.5 ms for 5 disclosures to 561.4 ms for 20, and decryption from 137.9 ms to 488.8 ms.

Selective attribute masking in text applies the same principle at token level. In #maskUp, a transformer-based NER pipeline identifies sensitive entities, AES-128 encrypts only the tagged spans, and RSA protects the per-user symmetric key for authority-side recovery (Vijay et al., 2022). On 30 real-world posts, that work reports encryption time dropping from 2038.5 ms for full-message AES to 211.6 ms for selective masking, with memory use falling from 1.406 kB to 0.553 kB.

These systems demonstrate that selective encryption can encode authorization structure directly into the cryptographic object. The selected subset is not merely the “important” subset in an information-theoretic sense; it is the subset that a policy intends to reveal, with the remainder left opaque.

7. Evaluation criteria, misconceptions, and open directions

Evaluation practice is highly domain-dependent. Media papers emphasize perceptual and coding metrics such as PSNR, SSIM, VMAF, EDR, NPCR, UACI, bitrate overhead, cache hit rate, and rebuffer ratio (Fotovvat et al., 2021, Usmani et al., 7 May 2025). Learning papers use reconstruction MSE, LPIPS, ROUGE-1, Wasserstein embedding distance, substitute-model accuracy, transfer ratios, and end-to-end runtime or bandwidth (Gu et al., 6 Aug 2025, Min et al., 24 Feb 2026). Access-control systems emphasize token correctness, latency scaling with the number of disclosures or stream cells, and the asymmetry between public ciphertext access and authorized cleartext recovery (Perillo et al., 2019, 2505.09034).

One recurring misconception is that strong ciphertext randomness metrics are sufficient evidence of security. Remote-sensing results explicitly argue that entropy, histogram uniformity, correlation, NPCR, and UACI do not preclude structural transfer attacks when secret-dependent transformations are reused across tiles or frames (Sun et al., 27 Feb 2026). Another misconception is that a single significance metric is universally optimal; federated-learning evaluations instead report architecture- and attack-dependent behavior, with gradient magnitude effective in many optimization-based settings but not universally best (Gu et al., 6 Aug 2025).

Open problems reported across the literature include side-channel attacks that may infer encrypted-index sets in model protection (Tian et al., 2021), adaptive $p_i$8 scheduling and hybrid quantum-resilient HE strategies in FL (Huang et al., 24 Sep 2025), multi-key or threshold HE as an alternative to single-key assumptions in federated tuning (Liu et al., 27 May 2025), stronger ML-based distinguishers and authenticated encryption in remote sensing (Sun et al., 27 Feb 2026), and efficiency improvements for CP-ABE in real-time selective disclosure (2505.09034). This suggests that the central research question is no longer whether partial encryption can be efficient, but under what threat models, syntax constraints, and policy semantics a reduced encrypted subset remains a defensible security boundary.