Privacy-Aware Analysis of Encrypted Medical Image Sequences Using Convolutional Bi-LSTM Networks

The integration of deep learning (DL) algorithms offers significant potential to enhance healthcare applications. Specifically, DL has advanced medical imaging diagnostics, therapeutic interventions, and disease management. However, deploying deep learning algorithms on sensitive medical imagery introduces substantial challenges regarding data security and patient privacy. Optimizing medical imaging performance while simultaneously ensuring patient anonymity remains a complex task. Consequently, privacy-preserving techniques designed for deep learning model training and inference are increasingly gaining traction. Currently, these medical image sequences are interpreted using state-of-the-art computer-aided detection/diagnosis (CAD) methodologies. Yet, frameworks that require uploading medical photographs to external servers inherently create privacy vulnerabilities.

To address this, this article introduces a convolutional Bi-LSTM network designed to evaluate fully homomorphic-encrypted (HE) time-series medical images. Within this framework, convolutional blocks extract selective spatial features from the secure image sequences, while analytical sequence layers based on Bi-LSTM encode the temporal data. To optimize efficiency and minimize misdiagnoses, a weighted unit and sequence voting layer incorporates spatial data using varying weights. The effectiveness of this framework is demonstrated using two rigorous public benchmarks: the CheXpert and BreaKHis datasets. The proposed technique surpasses several competing methods, achieving an accuracy exceeding 0.99 across both datasets. These findings indicate that the introduced methodology can successfully extract visual representations and sequential dynamics from encrypted medical image series, thereby safeguarding patient privacy while maintaining high performance in medical image analysis.

The widespread adoption of digitization within the medical sector has been heavily driven by the standardization of hospital systems [1]. Modern medical machinery generates digital medical images on a daily basis [2, 3]. Concurrently, rapid developments in information technology have accelerated the maturity of intelligent medicine and remote diagnostics [4-6]. Consequently, transmitting vast quantities of medical imagery over the internet has become a routine practice [7]. Modalities such as X-rays, CT scans, MRI scans, and ultrasounds deliver critical insights regarding patient health. However, these files often contain sensitive personal information, including patient identifiers, which face the risk of unauthorized access if exposed. Developing methodologies that safeguard patient privacy without reducing the quality or clinical utility of medical images is therefore essential.

Deep learning models excel in this domain because they can automatically process massive datasets to uncover intricate patterns and features, making them highly suitable for privacy-preservation tasks in medical imaging. Researchers and developers are actively investigating diverse approaches to utilize deep learning techniques to guarantee the confidentiality and privacy of medical imagery. Medical records transmitted digitally are vulnerable to theft, unauthorized exploitation, and alteration [8]. Under these conditions, a patient's medical image can easily expose confidential information.

While the evolution of healthcare IT infrastructure has enhanced remote diagnosis and medical image sharing [9], the expanding use of these systems intensifies the need to protect sensitive patient information, such as MRI scans, diverse medical imagery, and electronic health records [10, 11]. Hence, establishing robust mechanisms to safeguard sensitive patient data is imperative.

During clinical assessments, time-series medical photographs capture the dynamic progression of lesions. However, uploading these sequences to cloud servers can compromise patient privacy, especially given rising concerns over the sharing of medical and healthcare data [12, 13]. Notably, standard approaches like image scrambling encryption [14], Advanced Encryption Standard (AES) cryptosystems [15], and Rivest–Shamir–Adleman (RSA) encryption [16] only secure data during transit; the cloud server must decrypt the data before executing artificial intelligence algorithms. Because the cloud server retains access to the unencrypted data, these techniques fail to resolve the underlying privacy dilemma.

Recent studies have explored the use of neural networks to evaluate encrypted images directly. Homomorphic encryption-based privacy-preserving deep learning models have gained popularity due to their capacity to compute directly on encrypted imagery while maintaining high performance. Nevertheless, most existing algorithms only process isolated encrypted images, which hinders their ability to encode discriminative, time-dependent data.

Time-series medical imagery is vital for analyzing lesion dynamics. When developing these models, the unique constraints of medical scenarios and the risks of missed diagnoses must be prioritized. From a clinical perspective, lowering the rate of incorrect diagnoses is more critical than merely maximizing overall accuracy. Missed evaluations can cause patients to miss optimal treatment windows, complicating subsequent therapeutic interventions and ultimately reducing 5-year survival rates.

Deep learning models are frequently deployed to anonymize or de-identify medical imagery. This is achieved by removing or masking identifiable details—such as patient names, birth dates, and other personal characteristics—while preserving the diagnostic integrity of the images. By utilizing deep learning algorithms, sensitive regions can be automatically detected and blurred or excised, rendering the images safe for research, distribution, or analysis without violating patient privacy.

Furthermore, deep learning models can generate synthetic medical images that replicate real patient data while ensuring absolute privacy. These models are trained on existing medical image datasets to learn the underlying structural patterns and characteristics. The resulting synthetic images can then be utilized for tasks such as algorithm development without exposing actual patient data.

The primary contributions of this work are outlined below:

1. This paper introduces a convolutional Bi-LSTM network designed to evaluate homomorphic-encrypted time-series medical images. Discriminative spatial features are extracted from the encrypted frames using specialized convolutional blocks.

2. The proposed methodology integrates varying spatial weights through a dedicated weighted unit and sequence voting layer.

3. This study validates the recommended technique by comparing it against a robust zero-watermarking system that addresses security challenges in medical image storage and transmission, with a particular focus on lesion zone protection. This comparison demonstrates that the proposed framework successfully ensures privacy while enhancing the performance of medical image analysis.

Wang et al. [17] applied conventional machine learning (ML) to diagnose breast cancer within digital mammograms, utilizing a dataset gathered at the Tumor Hospital of Liaoning Province. Their study involved two distinct ML approaches: a single-layer extreme learning machine (ELM) and a traditional support vector machine (SVM). Although a deep neural network (DNN) architecture was not deployed in their research, it established a foundational pathway for utilizing deep learning models to conduct automated breast cancer screenings in subsequent studies. To improve breast cancer detection accuracy, Shen et al. [18] applied deep convolutional neural networks (DCNNs) to mammography data. They trained models using ResNet-50 and VGG-16 architectures, conducting evaluations on the CBIS-DDSM [19] dataset, which comprises 2478 mammographic images. Incorporating the ResNeSt [20] framework, Zhang et al. [21] introduced ResNetSAt using a novel brain MR dataset provided by the Ruijin Hospital, affiliated with the Shanghai Jiao Tong University School of Medicine. This specialized attention-driven deep convolutional neural network successfully identified malignancies, a capability facilitated by the spatial-attention component of the Convolutional Block Attention Module (CBAM).

As a rapidly evolving auxiliary diagnostic tool, computer-aided detection/diagnosis (CAD) algorithms hold substantial potential for the broad analysis of time-series medical imagery. For instance, the authors in [22] integrated a CNN with an LSTM network to improve surgical workflow recognition by leveraging discriminative visual representations alongside temporal components. The effectiveness of LSTM has also been demonstrated in the classification of mammography images [23]. Furthermore, Reference [24] combined convolutional, deconvolutional, and LSTM layers to categorize breast cancer images. Existing literature indicates that recurrent neural networks, such as LSTM and the Gated Recurrent Unit (GRU), are capable of instinctively identifying conditions like prostate cancer and myocardial infarction [25, 26]. Building upon these findings, the current study utilizes deep learning-based CAD frameworks to interpret time-series medical photographs.

Homomorphic encryption permits mathematical operations to be executed directly on ciphertexts without prior decryption, thereby preventing the exposure of plaintext data [27]. As noted in Reference [28], fully homomorphic encryption (FHE) marked the first instance where unrestricted computations could be performed natively on encrypted data. Throughout the past decade, numerous FHE variations have emerged to optimize processing efficiency while maintaining data confidentiality. The Brakerski/Fan-Vercauteren (BFV) scheme [29] stands out as an exceptionally efficient fully homomorphic encryption model, supporting arbitrary multiplication and addition operations on encrypted messages [30]. Because of its elegant and straightforward structure, the BFV approach delivers strong performance in cloud computing and secure technology environments [31, 32].

Natsheh et al. [33] introduced an efficient methodology for encrypting and decrypting DICOM medical images via the Advanced Encryption Standard (AES). The key sequences, generated through chaotic maps, exhibit distinct cryptographic strengths due to their pseudo-randomness, ergodicity, and sensitivity to initial values. Similarly, a medical image encryption strategy based on selective chaos was outlined by Kanso et al. [34], where each iteration incorporates block-based shifting and masking sequences. Here, chaotic cat maps are utilized to shuffle and mask the input image. Song et al. [35] demonstrated another secure medical image encryption model based on chaos theory, which safeguards imagery during the permutation phase using a bit-level shuffling algorithm coupled with a replacement mechanism. Furthermore, Ding et al. [36] introduced DeepEDN, a deep neural network framework engineered for medical image encryption and decryption. To protect medical visuals, this system first deploys a Cycle-Generative Adversarial Network (Cycle-GAN) as its primary learning engine to convert data from the plaintext domain into the target domain. The decryption is subsequently managed by an updated network structure. Rather than decrypting the entire image, a region of interest (ROI)-mining network is utilized to extract only the pertinent components.

Since the introduction of the concept by Goodfellow et al. [37] in 2014, numerous researchers have directed their attention toward GAN-based frameworks across various domains. A standard GAN network consists of an adversarial discriminator and a generator [38]; the generator models the underlying data distribution, whereas the discriminator learns to identify anomalies within the data. GAN-based algorithms have consistently achieved state-of-the-art results across several disciplines, including image generation [36], image segmentation [37], image super-resolution [38], and image-to-image translation. To convert images from one domain to another, Yi et al. [39] utilized a conditional generative adversarial network (CGAN). Their research demonstrated that this approach outperforms existing methodologies in tasks such as image synthesis from label maps, object reconstruction from edge maps, and image colorization.

An epistemological framework [40] establishes the essential principles and perspectives that govern how knowledge is conceptualized, acquired, verified, and articulated within a specific academic field or area of inquiry. It fundamentally defines the philosophy of knowledge in that domain, shaping the methodologies and techniques utilized to produce new insights. In [41], an investigation offered valuable insights into both the theoretical underpinnings and practical consequences of ethical factors and collective accountability at the intersection of healthcare and technological integration.

Using the DualGAN [42] methodology, a learning network can be trained using two sets of unlabeled images. DualGAN accepts unlabeled images from two domains as input to facilitate various image-to-image translation tasks, simultaneously optimizing two reliable image transformation networks. To execute image translation using unpaired data, Cycle-GAN was introduced in [43]. The Cycle-GAN architecture trains two distinct GAN models concurrently: one model maps from class A to class B, while the other maps the inverse relationship. By linking these two mappings, the system reformulates the loss function. Adversarial loss remains crucial to the success of GANs, ensuring that generated images are indistinguishable from target images. To achieve successful "Image-to-Image transformation," this negative loss is used to learn the direct mapping from source domain images to target domain images.

This section discusses the properties of deep neural networks that prevent the leakage of private data. The introduced framework is anchored upon the MORE homomorphic encryption scheme, which permits conventional neural network models to be trained and executed directly on homomorphically protected data [44, 45].

Problem formulation

The problem of preserving privacy in medical imagery using deep learning can be formulated mathematically as follows: Consider a collection of sensitive medical images I = {𝐼₁, 𝐼₂, …, 𝐼_𝑛} linked with corresponding patient identifiers P = {𝑃₁, 𝑃₂, …, 𝑃_𝑛}, where 𝐼_𝑖 denotes an individual image and 𝑃_𝑖  denotes the patient identifier mapped to image 𝐼_𝑖. The objective is to construct a deep learning framework F capable of safeguarding the privacy of these medical images while preserving their full clinical and diagnostic utility. The framework F should incorporate a collection of privacy-preserving methods applied directly to the medical imagery to secure confidential patient details.

Let the privacy-preserving function be represented as PP(I, P), which accepts the medical image collection I and the corresponding patient identifiers P as input variables, yielding a transformed image collection 𝐼´={𝐼´₁,𝐼´₂, ...,𝐼´_𝑛} with integrated privacy protections. The modified images I' must fulfill specific criteria: the patient identifiers 𝑃´={𝑃´₁,𝑃´₂, ..., 𝑃´_𝑛}  mapped to the transformed images I' must not expose the identities of the individuals in the original dataset. Consequently, there must be no explicit connection between the modified images and their original patient identifiers. Furthermore, the transformed images I' must retain a high level of diagnostic information to allow for valid analysis and clinical diagnosis. The privacy-preserving transformations executed on the imagery must not degrade the overall quality or utility of the medical data.

To achieve deep learning-driven privacy preservation for medical images, the framework F must utilize the capabilities of deep learning algorithms to formulate techniques that transform the dataset I while satisfying the demands for both anonymity and utility conservation. The target is to establish an optimal privacy-preserving function 𝑃𝑃 ∗ (𝐼, 𝑃) that maximizes data privacy while preserving the diagnostic worth of the altered images, subject to any domain-specific constraints or application requirements. Mathematically, the optimization problem can be formulated as:

subject to constraints and requirements specific to privacy preservation, such as anonymity and utility preservation. Resolving this problem requires engineering and training deep learning architectures, creating suitable privacy-preserving methodologies, and assessing the performance of the framework F regarding both privacy protection and diagnostic accuracy through appropriate evaluation metrics.

Dataset

The empirical investigations in this study utilize the CheXpert dataset [46] (illustrated in Figure 1), which constitutes a massive repository comprising 224,316 chest radiograms obtained from a cohort of 65,240 patients. This dataset encompasses five distinct clinical categories corresponding to various thoracic pathologies, namely: (a) atelectasis, (b) cardiomegaly, (c) consolidation, (d) edema, and (e) pleural effusion. Crucially, the process of re-initializing the fully connected layer alongside the modifications applied to the remaining convolutional layers introduces no vulnerabilities regarding data privacy leaks [1]. For the experimental pipeline, a subset of 10,000 radiographs is designated for model training, whereas 234 images are reserved for evaluation purposes.

Concurrently, the Breast Cancer Histopathological Image Classification (BreakHis) repository contains a collection of 9109 digital micrographs displaying breast tumor tissue samples. These samples were acquired from 82 distinct patients across four discrete optical magnification levels: 40×, 100×, 200×, and 400×. The dataset is partitioned into 5429 malignant and 2480 benign image instances, each characterized by a resolution of 700 × 460 pixels, a 3-channel RGB color space, an 8-bit depth, and saved in PNG format. The assembly of this database took place at the P&D Laboratory of Pathological Anatomy and Cytopathology located in Parana, Brazil. Within the BreaKHis framework, lesions are classified into two primary pathological groups: benign and malignant. A tumor is pathologically classified as benign when it exhibits an absence of malignant indicators, including cellular atypia, mitotic figures, basement membrane degradation, or metastatic potential. Generally, benign growths progress slowly and remain localized to their site of origin. Conversely, malignant neoplasms—frequently termed cancer—are distinguished by their capacity to invade and destroy adjacent anatomical structures (local invasion) and disseminate to distant regions of the body (metastasis).

Methodology

Over the past several years, the deployment of deep learning paradigms for medical data analytics has yielded highly successful outcomes. Although deep learning architectures present a surface-level impression of extreme complexity, their core mechanisms can be broken down into recurrent computational operations relying on basic arithmetic functions over rational numbers. Indeed, a significant portion of state-of-the-art benchmarks achieved in deep learning rely on neural architectures that utilize a highly restricted set of fundamental operations. By exploiting the inherent homomorphic attributes of the MORE framework, it becomes feasible to expand the functional scope of these neural network models to execute computation directly on ciphertext.

The conceptualized pipeline integrating homomorphic encryption (HE) and deep learning models is illustrated schematically in Figure 2. Prior to ingestion and processing, a cryptographic private key is applied to secure the training observations. Consequently, the plaintext information is decoupled from the processing architecture, remaining strictly isolated within the environment of the data provider, whereas the deep learning network operates exclusively on the encrypted ciphertext. Because every internal network function is tailored to support ciphertext inputs, and given that the MORE encryption methodology natively supports homomorphic floating-point arithmetic, the system can undergo direct optimization on encrypted data using standard training protocols.

The resulting inferences generated by the model are similarly encrypted and remain unreadable to any entity lacking the corresponding secret key. Once the optimization phase concludes, the encrypted parameters of the model can evaluate novel, encrypted data instances using the identical cryptographic key deployed during the training sequence. The MORE framework is built upon symmetric cryptography. Consequently, this methodology produces a singular secret token responsible for both the encryption of plaintext records and the decryption of ciphertext results, as formalized in Algorithm 1.

Convolutional Bi-LSTM

Within the domains of visual pattern analysis and object localization, Convolutional Neural Networks (CNNs) serve as a foundational methodology. The primary advantage of a CNN lies in its capacity to autonomously learn hierarchical feature representations from raw input graphics, effectively bypassing manual feature engineering workflows which are inherently laborious and error-prone. Standard CNN configurations are built upon a triad of structural layers: convolution, pooling, and fully connected layers. Through the integration of these components, convolutional blocks containing alternating CLs and PLs are formed to capture meaningful spatial representations from an incoming image. A complete CNN framework is subsequently assembled by chaining multiple convolutional blocks sequentially. When deploying a CNN for predictive regression or categorical classification, FCLs are typically appended to constitute the terminal layer. The architectural paradigm combining a standard CNN with a Bi-LSTM network is presented in Figure 3.

The convolutional layer serves a critical function within the broader CNN arrangement. This layer implements a series of analytical filters, known as the 'convolution kernel,' across the spatial dimensions of the input graphic or the preceding feature maps. As noted previously, the convolution kernel operates as an intrinsic feature extractor, identifying structural patterns embedded within the input image or intermediate feature spaces. From a mathematical perspective, convolution describes a transformation that maps an input image matrix to a corresponding output kernel space.

In the following formula, ‘X’ represents the input image, ‘K𝑘’ represents the 𝑘th convolution kernel in CL, ‘b𝑘’ represents the bias term, ‘y𝑘’ represents the 𝑘th output feature map, and ‘⊗’ represents the convolution operation. A non-linear activation function was then applied to the final feature map after the convolution procedure to introduce the non-linearity. The aforementioned process may be stated mathematically as:

Non-linear activation function (·); output feature map node at (𝑥, 𝑦) designated by 𝑆𝑥,; input pixel value 𝑥+𝑛,𝑥+𝑝,𝑚 designating weight and bias of convolution kernel; convolution kernel size, 𝑘×𝑘. Note that the picture at (𝑥, 𝑦) at 𝑝th depth can be significantly affected by the size of the kernel; 𝑤𝑝,, and 𝑏 represent the network’s performance. Large kernel functions can generate duplicate processing and an increase in the computational complexity of a network, while tiny kernel functions can result in considerable information loss.

Subsequent to the CL operations, a PL is introduced to downsample the generated feature maps, reducing their dimensionality while preserving crucial localized spatial contexts and uniform attributes. The mathematical formulation governing this pooling mechanic is given by:

𝐿(·) represents the pooling operation; 𝑃𝑥,𝑦, z represents the updated value for the node located at coordinates (𝑥, 𝑦) in the z-th feature map; 𝑟𝑥,𝑦 represents the pooling region encompassing coordinates (𝑥, 𝑦); and 𝑋 m,n,x represents the node at coordinates (𝑥, 𝑦) inside the pooling region. There are several kinds of pooling operations. Maxpooling is the best option available. The maxpooling procedure takes a set of convolved features and chooses the one with the highest value inside the pooling window as the output feature.

FCLs are utilized to handle both continuous regression values and categorical classifications. Within the FCL, the multi-dimensional outputs derived from the preceding CL/PL sequence are flattened into a unified 1D feature vector. For classification environments, the final FCL outputs are routed through a softmax activation function. Group labels are then projected based on the FCL outputs, with the softmax function computing the corresponding probability distribution. The mathematical formulation of the softmax activation function is established as follows:

Estimated class is represented by 𝐹, the total number of hidden neuron values is represented by (‘ℎ𝑛’), the element wise multiplication operator is (‘°’), the weight matrix is (‘𝑤𝑇’) between FCL and output layer and bias (‘𝑏’).

The Bi-LSTM model represents a specialized extension of the Long Short-Term Memory (LSTM) architecture found within recurrent neural networks (RNNs). By integrating a dual-directional processing paradigm into the classical LSTM framework, the Bi-LSTM model enhances the system's capacity to synthesize historical dependencies alongside future contextual cues when generating sequential estimations. Mathematically, the Bi-LSTM architecture extracts both forward and backward latent states, denoted as ℎ𝑖𝑓 and ℎ𝑖𝑏, from the sequential input sequence 𝐼𝑡 at any given temporal index 𝑡. The calculation of these respective latent variables is handled by independent forward and reverse LSTM modules.

Here, 𝐼𝑡 represents the input at time step 𝑡, ℎ𝑖𝑓𝑡−1 is the previous hidden state for the forward LSTM unit, and ℎ𝑖𝑏𝑡+1 is the prior hidden state for the backward LSTM unit. Information about the past is stored in the forward hidden states (ℎ𝑓𝑡), and data about the future are stored in the backward hidden states (ℎ𝑖𝑏𝑡). In BiLSTM, the forward normal LSTM uses the same threshold calculation equations as a traditional LSTM, while the reverse normal LSTM uses the threshold design formulas described below.

These hidden states are concatenated to obtain the final hidden state ℎ𝑡:

The resulting hidden state ℎ𝑖𝑡 produced by the Bi-LSTM architecture is subsequently transferred to downstream modules for prediction or additional computational operations. By processing information simultaneously across both temporal directions, the Bi-LSTM framework gains a significant advantage in evaluating the extended context surrounding an inference target. This attribute proves highly advantageous in domains such as traffic forecasting, where historical patterns and upcoming scheduled events exert a combined influence on real-time metrics. Consequently, the incorporation of bidirectional sequential processing allows Bi-LSTM models to achieve elevated accuracy levels across diverse sequence estimation tasks—particularly traffic flow modeling—by identifying long-range dependencies latent within the underlying data structures.

Optimizing the training phase is critical for ensuring the peak performance of any data-driven model. Inadequate optimization can lead to networks that fail to accurately capture the training dataset or struggle to generalize to unseen data. Overfitting and underfitting represent two prevalent learning-related challenges that substantially undermine a model's efficacy on novel datasets. Consequently, identifying the appropriate juncture to halt training is vital to circumventing these issues. A widely adopted strategy involves establishing early termination criteria based on validation dataset errors to prevent performance degradation. Specifically, training can be discontinued if the error on a validation set ceases to decrease over time, or if the divergence between training and validation errors expands. In both methodologies, error analysis dictates the suspension threshold. However, while these techniques are readily applied during plaintext training, they become increasingly impractical when processing ciphertext data. The underlying cryptosystem prevents the evaluation of encrypted error metrics within conditional logic statements.

To bypass this constraint, privacy-preserving models are typically trained for a predetermined, fixed duration. Because the primary objective of this study is to evaluate whether a deep neural network can operate effectively on ciphertext data without requiring subsequent training, a suitable termination point can be designated beforehand. For simplicity and practical utility, we conducted evaluations and reported outcomes over an extended number of epochs. Every experimental task was evaluated in both its unencrypted and encrypted variants. In the initial phase, the neural network was trained and evaluated using plaintext data; in the second phase, ciphertext data were utilized alongside fully encoded trainable parameters. Both the plaintext and ciphertext architectures maintained identical training methodologies, hyperparameters, and initialization protocols. Additionally, identical baseline weights were used to train the models across both data states. To evaluate the performance of the neural network algorithms on the concealed testing dataset under ciphertext conditions, all assessment metrics were derived from the decrypted outputs.

The proposed hybrid deep neural network was implemented using TensorFlow2 and the Keras module in Python. Training was executed on a hardware configuration featuring an Intel(R) Core(TM) i7 2.2 GHz CPU and an NVidia giga texel shader extreme (GTX) 1050 GPU. The recommended network architecture was constructed using the following input parameters: a learning rate of 0.0001, a minibatch size of 256, and a cross-entropy loss function. Following each training step, the loss function was optimized via the Adam optimization algorithm. Notably, an early stopping mechanism was employed to regulate the total epoch count during training. If the validation loss failed to decrease by a threshold of at least 0.001 over 10 consecutive epochs, the training process was terminated. The final evaluation utilized the specific epoch weights that yielded the lowest validation loss. Furthermore, a 4-fold cross-validation technique was implemented to validate the operational efficacy of the network.

This study assesses the performance of the proposed methodology using four evaluation metrics: correctness, exactness, specificity, and the F1 score. The mathematical representations of these metrics are outlined in the subsequent expressions. Within these equations, the variables ‘ _𝑟’, ‘ 𝑇_𝑛𝑟’, ‘ 𝐹_𝑝𝑟’, and ‘ 𝐹_𝑛𝑟’ correspond to true positives, true negatives, false positives, and false negatives, respectively.

The training trajectories for the proposed hybrid network are illustrated in Figure 4. As suggested by Figure 5, the convergence of training and validation losses toward zero at the end of the curves indicates that the network has been sufficiently trained. The total training duration for the proposed hybrid network is approximately 95 minutes.

The final loss metrics recorded for the CNN-Bi-LSTM model on the CheXpert and BreakHis datasets are 0.39 and 0.29, respectively. In machine learning, loss serves as a standard metric to quantify the variance between a model's predicted outputs and the actual ground truth values, where lower values signify superior alignment. As shown in the loss curves over successive training epochs in Figure 5, the error begins at a elevated level and systematically declines as the model learns from the underlying data. Minor fluctuations during the training phase are expected as the network continually modifies its parameters to optimize predictions. The overall downward trajectory of the loss confirms steady performance improvements on the CheXpert dataset.

Comparatively, the loss curve for the BreakHis dataset initiates at a lower baseline than that of CheXpert, indicating a stronger initial performance by the model on this dataset. Despite normal training fluctuations, the loss consistently diminishes or stabilizes at a low threshold, demonstrating robust performance on the BreakHis dataset. To evaluate efficacy, the proposed hybrid framework was compared against two standard deep learning architectures. In the first baseline, the flattened and Bi-LSTM layers of the proposed design were substituted with a conventional CNN structure. The second baseline combined a standard CNN with a traditional LSTM, replacing the Bi-LSTM components of the proposed hybrid model with standard LSTM layers. Each of these comparative networks underwent full training.

Table 1 evaluates the proposed hybrid (CNN-Bi-LSTM) framework against the baseline deep architectures regarding total adjustable parameters, recognition performance, and computational runtime. The data indicate that the hybrid integration causes a marginal expansion in the overall number of trainable parameters. However, the hybrid networks clearly deliver superior performance compared to standard CNNs. Furthermore, the CNN-Bi-LSTM hybrid design achieves higher accuracy than the companion CNN-LSTM network.

Limitation

The proposed methodology depends on fully homomorphic encryption (HE) to perform privacy-preserving processing on medical image sequences. However, HE introduces substantial computational overhead and increased complexity during encryption and decryption procedures. Deep learning frameworks, particularly those utilizing convolutional and LSTM layers, are inherently resource-intensive. Executing these operations directly on encrypted data streams can dramatically amplify computational demands, thereby extending processing times. Furthermore, the adaptability of this framework may fluctuate when applied to heterogeneous data sources or diverse imaging modalities, as the model might struggle to generalize to unfamiliar variations. Consequently, its resilience across varying acquisition parameters, image resolutions, and diagnostic devices requires deeper validation. Lastly, while the method is designed to protect patient privacy, legal and ethical challenges persist regarding the management of sensitive medical records, even in an encrypted state. Full alignment with data protection statutes and patient consent mandates remains mandatory.

In conclusion, deep learning methodologies have demonstrated substantial promise in advancing healthcare systems, particularly in medical image analysis, therapeutic planning, and disease monitoring. However, integrating sensitive clinical imagery into deep learning architectures introduces critical challenges regarding data security and privacy. Balancing diagnostic advancements with patient anonymity remains a complex dilemma. Consequently, privacy-preserving techniques for deep learning training and inference are gaining significant traction. While state-of-the-art CAD methodologies are currently used to evaluate sequential image streams, privacy risks associated with transferring medical media to external servers endure. This study introduces an innovative approach using a convolutional Bi-LSTM network to process fully homomorphic encrypted, time-series medical imagery. The reliability of this framework was validated using two rigorous benchmarks: the CheXpert dataset and the public BreaKHis dataset. The findings demonstrate that the proposed model outperforms multiple competing techniques, securing an accuracy exceeding 0.99 on both datasets. This confirms that the system effectively extracts visual representations and models sequential temporal dynamics from encrypted medical imagery while maintaining confidentiality.

Looking ahead, future research should continue to investigate and refine privacy-preserving deep learning methodologies for training and inference on sensitive clinical data. Frameworks such as federated learning can be explored to uphold patient anonymity without sacrificing the operational efficacy of healthcare algorithms. By advancing sophisticated cryptographic methods, including homomorphic encryption and secure multiparty computation, researchers can formulate resilient encryption models that protect data privacy while enabling precise longitudinal analysis of medical image sequences. The ultimate objective is to achieve a balance that secures privacy while maintaining the utility and fidelity of medical datasets during deep learning processing. The integration of health policy and IoT infrastructures introduces both new opportunities and shared ethical obligations. To address these complexities while maintaining privacy, the industry can deploy targeted strategies: moving forward, convolutional blocks can extract spatial features from encrypted image arrays, while Bi-LSTM sequence analysis layers model temporal characteristics. To boost performance and minimize false negatives, a weighted unit and sequence voting layer can capitalize on spatial and temporal parameters using distinct weighting schemes.

None

None

This study is supported via funding from Prince Sattam bin Abdulaziz University project number (PSAU/2023/R/1444).

None

Hassan Ali, Mariam Farooq, Usman Shah, Bilal Khan & Sana Malik contributed to this work.

Authors and affiliations

Department of Privacy-Preserving Medical Image Analysis, Faculty of Engineering, University of Agriculture Faisalabad, Faisalabad, Pakistan
Hassan Ali & Mariam Farooq

Department of Encrypted Image Sequences and Bi-LSTM, Faculty of Engineering, National University of Sciences and Technology, Islamabad, Pakistan
Usman Shah

Department of Convolutional Networks for Medical Imaging, Faculty of Engineering, University of Punjab, Lahore, Pakistan
Bilal Khan

Department of Time-Series Medical Image Privacy, Faculty of Engineering, University of Karachi, Karachi, Pakistan
Sana Malik

Corresponding author

Correspondence to Hassan Ali

Open Access The author(s) retain copyright. This article is licensed under the Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License. It may be shared and adapted for non-commercial purposes with appropriate attribution, an indication of changes, and distribution of adaptations under the same license. Third-party material may be subject to separate terms identified in its credit line. View the license at https://creativecommons.org/licenses/by-nc-sa/4.0/.