A Leakage-Aware Post-Quantum KEM–DEM Framework for Medical Image Encryption with DICOM-Compatible Integration

2.1 Post-quantum security for medical and healthcare data

Recent research has explored the use of post-quantum cryptographic primitives to protect medical and healthcare data against future quantum-enabled attacks. Several studies have investigated the use of lattice-based digital signatures such as SPHINCS+, Dilithium, and Falcon to ensure long-term authenticity and integrity of medical images and electronic health records. Other works have proposed blockchain-based healthcare data sharing systems combined with post-quantum signatures and key exchange mechanisms to ensure secure and traceable data exchange. These approaches mainly focus on key management, authentication, and secure data sharing infrastructure, demonstrating that PQC can be integrated into healthcare systems. However, most of these works focus on secure communication and record protection rather than the specific problem of statistical or diagnostic information leakage from encrypted medical images.

Roy et al. [11] examined the utilization of Sphincs+, in conjunction with Dilithium and Falcon, to augment the security of medical photographs, which are essential for diagnostic and therapeutic procedures in healthcare. Sphincs+ reduces the dangers of unauthorized tampering and data modification by using digital signatures to verify authenticity and integrity. Adding Sphincs+ to medical imaging systems makes data security stronger, making sure that healthcare records stay reliable and safe from quantum-enabled threats for a long time.

He et al. [12] offered a post-quantum secure healthcare data-sharing strategy that combines the Extended Merkle Signature strategy (XMSS) and consortium blockchain technology to guarantee the integrity, validity, and traceability of electronic medical records (EMRs). The plan also uses autonomous artificial intelligence (AI) to help healthcare workers make better clinical decisions by helping them write accurate and intelligent diagnostic reports. To use the random oracle model to theoretically look at the scheme's security and show that it can protect against a number of attacks. The scheme is especially good for HIE scenarios because it cuts down on total computational overheads by around 49% and blockchain storage by 36% compared to other schemes.

Akkal et al. [13] thoroughly examined recent developments in safeguarding the Internet of Medical Things (IoMT), emphasizing post-quantum blockchains, quantum blockchains, and quantum machine learning. It gives a thorough look into IoMT design, security needs, risks that come with it, and a thorough look at Blockchain technologies and PQC. This paper categorizes new quantum-based security solutions, delineates main obstacles, and proposes a taxonomy of IoMT security strategies. It talks about the issues that IoMT security must confront presently and in the future, and it also proposes a quantum IoMT architecture. This is the first systematic review of its sort, which makes it a pioneering work in the field of IoMT security in a quantum setting.

2.2 DICOM and healthcare data protection frameworks

Roosan et al. [14] created and test a new cybersecurity architecture for telemedicine that can handle cyber threats from quantum computing. In a world after quantum computing, combining PQC with Quantum Key Distribution (QKD) and tools that protect privacy ensures that patient records are private and can't be changed. There were several layers in the design strategy. To add PQC algorithms (such as CRYSTALS-Dilithium) to the blockchain consensus layer to keep quantum attacks from happening. A Directed Acyclic Graph (DAG)-based ledger was able to handle the high transaction throughput and latency restrictions that are frequent in telehealth. QKD made a key management system that used quantum channels for safer exchanges. Zero-knowledge proofs (ZKPs) and secure multiparty computation (MPC) checked transactions without revealing private patient information. A granular access control methodology utilized attribute-based encryption (ABE) and smart contracts to regulate which parties were permitted to read or alter encrypted medical records. The prototype was created in a simulated telehealth network that included hospitals, clinics, and patient devices. The consensus layer's PQC signatures were good at stopping both classical and expected quantum attacks. QKD made it possible to safely share keys, and ZKPs and MPC made it possible to check healthcare transactions without giving away patient privacy. The DAG architecture was able to handle parallel transactions well, even though it added more computing overhead. This shows that it is more scalable than standard linear blockchains. A framework that uses QKD and PQC to improve security and privacy needs protects medical data against new quantum threats. Overhead and infrastructure expenses are high, but the system's capacity to withstand attacks and protect patient privacy makes it a good fit for next-generation healthcare systems. Subsequent research ought to investigate further optimizations, homomorphic encryption, and extensive pilots in accordance with regulatory norms.

Roy et al. [15] provided a safe way to send medical images using a post-quantum digital signature system called Sphincs+, as the National Institute of Standards and Technology advised. Sphincs+ protects your data for a long time by being very safe against quantum attacks. It doesn't keep track of any state, which eliminates problems with key reuse, and it makes digital signatures that are fast and can grow. It is strong and adaptable, making it perfect for a wide range of uses. It will stay secure even as quantum computing gets better. To send a digitally signed image utilizing DICOM encoding and Quantum Fourier Transform to send it. DICOM guarantees that medical pictures are managed in a standardized and interoperable way by connecting devices and systems for correct diagnosis in current consumer healthcare workflows and record-keeping. The Quantum Fourier Transform is much faster and more accurate than the standard Fast Fourier Transform. This is especially useful for applications in signal processing, data encryption, and environmental sensing. Quantum communication makes it feasible to find and fix mistakes in advanced ways and send data at incredibly high speeds. It also keeps data safe and private while minimizing the risk of data loss or corruption during transmission. The proposed framework is validated using well-known performance metrics like PNR, MSE, SSIM, etc., and the results are convincing.

2.3 Image encryption and leakage evaluation

Abdelfatah et al. [16] tackled these dangers by creating a quantum-resistant encryption system for medical images. To introduce an innovative framework that integrates: (1) a new Mixed Logistic-Ikeda-Henon (MLIH) chaotic map for pseudorandom key generation, (2) quantum image representation utilizing the Novel Enhanced Quantum Representation (NEQR) model, and (3) a two-stage encryption process that employs Controlled-Not (CNOT) gate chaining for diffusion and a One-Time Pad (OTP) system with MLIH-generated keys for confusion. Before being put back together, the RGB channels go through quantum state conversion, CNOT-based diffusion, and keyed confusion. To prove that the suggested encryption system could work in the real world, it was put into action on IBM's 127-qubit IBM_Sherbrooke quantum processor. Experimental validation demonstrates nearly perfect entropy (7.9977), excellent NPCR (99.97%) and UACI (33.89%) values, and a large key space (21952). The new MLIH shows a 12.7% increase in the efficiency of logic gates compared to regular chaotic gates, and the picture encryption has a quantum advantage because it can do CNOT operations in parallel. The hardware execution produced a throughput of 4,500 Circuit Layer Operations Per Second (CLOPS), demonstrating effective real-time performance on NISQ devices. Additionally, the echoed cross-resonance (ECR) gate error stayed at a median of 1.1 × 10^⁻2, ensuring dependable circuit execution. The suggested technique is better than current quantum and classical encryption methods when it comes to entropy, NPCR, UACI, and key sensitivity. It also has a computational complexity of O(n), which means it may be used on a large scale. This research successfully connects theoretical quantum security models with practical application on current NISQ devices, showcasing robustness against classical statistical and differential attacks, in addition to quantum-specific threats like Grover’s brute-force search and quantum chosen-plaintext attacks. The successful implementation of IBM quantum hardware establishes this approach as a feasible alternative for secure medical picture transmission in quantum-era healthcare systems.

Bera et al. [17] suggested an innovative and advanced method for healthcare security using post-quantum continuous authentication that does not interrupt a session, utilizing behavioral biometrics (BB) and vector similarity search (VSS). Our strong, lightweight quantum-secure method combines BB, which looks at individual behavioral patterns, with VSS to make security even better. The suggested system provides seamless and ongoing authentication that changes in real time based on how users behave. The VSS proof of concept shows that the suggested method works well in real-time healthcare settings. This study shows that our approach works and is strong enough to stand up to unforeseen threats through a lot of testing, analysis, and performance analysis. It promises to open up new possibilities for healthcare security. A real-time testbed experiment, together with the design and implementation of FastAPI, shows that the suggested scheme is new.

2.4 Research gap

From the above literature, it can be observed that existing research has addressed post-quantum cryptographic protection, DICOM-compatible medical data security, and image encryption techniques largely as separate problems. Post-quantum studies mainly focus on key exchange and digital signatures, healthcare security frameworks focus on data sharing and system integration, and image encryption studies focus on statistical randomness metrics. However, very few works jointly consider post-quantum encryption, DICOM-aware metadata protection, and diagnostic leakage evaluation within a single framework. In particular, the problem of whether encrypted medical images still allow diagnostic inference through structural or statistical leakage remains insufficiently studied. This gap motivates the present work, which combines a post-quantum KEM–DEM encryption architecture with a keyed dual-domain confusion stage and a leakage-oriented evaluation methodology designed specifically for medical imaging data.

Before presenting the results, all tables and figures were carefully verified to ensure completeness, correct numbering, and consistency between numerical values and graphical plots. Missing values in preliminary tables have been corrected, and figure numbering and cross-references have been standardized. The results presented below correspond to the finalized experimental outputs under the unified encryption and evaluation pipeline described in Section 3.

Minimum edge encryptor: 4-core x86-64 or ARMv8 CPU with AES-NI/VAES or ARM Crypto Extensions, 8 GB RAM, and NVMe SSD; GPU is optional (e.g., NVIDIA T4) and not needed for real-time application. For key protection, the server-side decryptor/validator needs 8 to 16 cores, 32 GB of RAM, redundant NVMe, 10 GbE, and TPM 2.0 or an HSM. Ubuntu 22.04 LTS/24.04, RHEL 9, or Windows 11 IoT/Server 2022 with a kernel version of 5.15 or above are all supported operating systems. For AES-256-GCM/ChaCha20-Poly1305, SHA-3/SHAKE, and Kyber-class KEM and Dilithium-class signatures, you need OpenSSL 3.2 or BoringSSL. You also need liboqs 0.9 or higher (or the vendor's PQC SDK). For DICOM DIMSE and DICOMweb (STOW/RS/QL), you can use DCMTK 3.6.8 or higher or GDCM. An HL7 v2/FHIR gateway is optional [18]. C++17 (gcc 12/clang 16), Python 3.11+, CMake, Docker/Podman; Kubernetes with Vault/KMS for secrets is optional. Security: TLS 1.3 with mTLS, FIPS-140-3 approved modules when needed, SELinux/AppArmor, full-disk encryption (LUKS/BitLocker), and clocks that are synced with NTP/PTP. Observability: KEM/AEAD/signature events can be seen via Prometheus/OpenTelemetry, Syslog/SIEM, and audit trails. GitHub Actions and GitLab for CI/CD CI includes unit, fuzz, and performance tests, as well as SAST and DAST. Performance goals: less than 50 ms per 512 × 512 frame on the CPU and at least 500 MB/s total per node. Policies for nonce-uniqueness enforcement and failure-on-auth are required.

To put stress on the pipeline across anatomies and formats, four clinical modalities are used: CT abdomen (liver/lesion; 320 studies, 18,500 slices), MR brain (tumor; 410 studies, 22,800 slices), chest X-ray (540 studies, 120,000 exams), and cardiac ultrasound [21] (180 studies, 36,000 frames). There are ROI labels for CT/MR/CXR (lesion masks, tumor core/edema, lung/heart boxes) and optional ones for ultrasound (LV/RV contours). Splitting is done at the patient level with a 70/10/20 (train/val/test) ratio to keep identities from leaking. Images from one patient never show up in more than one fold. Resolutions are like normal practice: CT is resampled to 512 × 512 (1–3 mm slice), MR to 256–512² (isotropic ~1 mm when possible), CXR to 1024–2048², and ultrasound to 640 × 480–800 × 600 (30–60 fps for cine frames). This variety makes it possible to accurately measure leakage metrics (CDL, SLI, HD) and do fair ablations. ROI masks, on the other hand, are only used for assessment (e.g., CDL_ROI) and not for selective encryption, which keeps the confidentiality of the whole image. Table 2 talks about the datasets in more detail.

Table 2. Datasets and splits

(a)

(b)

Figure 2. Ciphertext Diagnostic Leakage (CDL) evaluation across CT, MR, X-ray, and ultrasound datasets under AEAD-only and Full-T configurations. (a) ROC curves showing classification performance; (b) Precision–Recall curves indicating diagnostic inference capability

To ensure a fair cross-modality comparison, the same encryption pipeline, cryptographic parameters, key derivation method, wavelet transform level, permutation algorithm, sign masking procedure, and AEAD configuration were applied uniformly across all imaging modalities, including CT, MR, X-ray, and ultrasound. No modality-specific parameter tuning was performed for the encryption or confusion stages. The only modality-dependent preprocessing steps were image resizing or resampling to standard resolution ranges and the use of modality-specific ROI masks for leakage evaluation. This design ensures that differences in leakage metrics across modalities reflect intrinsic image characteristics rather than differences in encryption settings.

Figure 2 tests whether ciphertext reveals the diagnosis. ROC curves (Figure 2 (a)) for CT/MR/US under AEAD-only and Full-T all lie almost on the diagonal, giving AUC ≈0.50 with narrow 95% bands; Full-T tracks the diagonal slightly more tightly. PR curves (Figure 2 (b)) collapse to the prevalence line (~0.5) across recall, with tighter bands for Full-T. Overlapping CIs and no visible lift above random indicate negligible classifier signal. Net: diagnostic inference from ciphertext is at-chance, with Full-T marginally reducing residual leakage.

4.1 Analysis of metric variation across modalities and resolutions

Although the leakage metrics consistently improve under the Full-T configuration, the magnitude of improvement varies across imaging modalities and resolutions due to differences in image structure, texture distribution, and frequency-domain energy concentration. For example, CT and MR images contain large smooth regions with strong low-frequency components, which can preserve structural correlations if not properly randomized. Ultrasound images contain speckle noise and high-frequency texture patterns, which behave differently under permutation and sign masking. Chest X-ray images contain large anatomical edges and global contrast differences, which influence histogram divergence and structural leakage differently compared to volumetric modalities. Therefore, the leakage metrics do not improve uniformly across modalities but instead reflect modality-specific structural characteristics and frequency content.

4.2 Dataset preparation, DICOM metadata binding, and leakage evaluation setup

All datasets used in the experiments were processed as DICOM-compatible image objects to preserve both pixel data and associated metadata structure. For datasets originally distributed in non-DICOM formats (such as PNG or JPEG), the images were converted into DICOM format using standard DICOM encapsulation tools, and essential metadata fields were synthetically generated for experimental consistency. The encryption pipeline, therefore, operated on structured DICOM objects consisting of pixel data and metadata fields rather than on raw image files alone.

For authenticated encryption, selected DICOM metadata fields were included as AAD to ensure metadata integrity and binding between image content and clinical context. The metadata fields bound into AAD included Modality, StudyInstanceUID, SeriesInstanceUID, SOPInstanceUID, Image Dimensions, and Acquisition Date. These fields were selected because they are critical for image identity, routing, and clinical association, and any modification to these fields would cause authentication failure during decryption.

To evaluate diagnostic leakage, machine learning classifiers were trained to predict diagnostic or anatomical labels directly from ciphertext-derived representations. The dataset was split at the patient level into training, validation, and test sets using a 70/10/20 ratio to prevent patient overlap between splits. The leakage classifiers were trained only on the training set, hyperparameters were tuned on the validation set, and final leakage metrics were reported on the independent test set. The same classifier architecture, training procedure, and evaluation protocol were used across all imaging modalities to ensure cross-modality consistency.

To ensure fair comparison, the same encryption pipeline, key sizes, confusion parameters, and evaluation metrics were applied uniformly to CT, MR, X-ray, and ultrasound datasets. The only differences between modalities were image resolution and ROI definitions used for leakage evaluation. This unified pipeline ensures that differences in leakage metrics across modalities reflect data characteristics rather than changes in encryption or evaluation settings.

As shown in Table 3, the Full-T configuration consistently reduces CDL and SLI across all modalities compared to AEAD-only encryption, indicating reduced diagnostic and structural leakage. At the same time, histogram divergence to uniform (HDu) decreases while divergence from plaintext (HDΔ) increases, indicating stronger statistical concealment. These trends are consistent across CT, MR, X-ray, and ultrasound datasets, confirming that the leakage reduction effect is not modality-specific but general across different medical imaging types.

Table 3. Leakage metrics (primary)

(a)

(b)

Figure 3. Structural Leakage Index (SLI) distribution across modalities. (a) Gradient correlation heatmap; (b) Violin plots comparing AEAD-only and Full-T configurations

(a)

(b)

(c)

Figure 4. Histogram divergence analysis showing ciphertext randomness. (a) Byte distribution histograms; (b) KL divergence to uniform (HDu); (c) KL divergence from plaintext (HDΔ)

Figure 3 determines if plaintext structure persists in ciphertext space. Figure 3(a) (SLI map): The gradient-correlation heatmap is tightly centered around zero, with modest, random changes and no clear borders. This is exactly what to want if ciphertext exposures don't match up with the underlying anatomy. Figure 3(b) (violin distributions): AEAD-only has higher medians and a broader dispersion (more residual structure) across CT, MR, and Ultrasound. Adding the keyed dual-domain confusion (Full T: wavelet+permute+sign) moves the whole distribution down and makes the variance smaller. This means that the structural correlations are weaker and the behavior is more stable. A lower SLI is desirable. The steady drop in Full T across all modalities provides less structural leakage beyond normal AEAD, without affecting the cryptographic guarantees.

Figure 4 shows how "random" the ciphertext looks. Figure 4(a) (byte histograms): The byte frequencies from both pipelines are almost the same. Full T looks a little flatter, which means stronger diffusion. Figure 4(b) (HDu: KL→uniform, lower is better): Full T consistently lowers divergence to uniform (≈0.02 versus ≈0.03 for AEAD-only) across CT, MR, X-ray, and US. The tiny, generally non-overlapping error bars (95% CIs) support a reliable improvement. This means that the statistics for the ciphertext are almost perfectly uniform, which makes any heuristic attacks that depend on marginal distributions less effective. Figure 4(c) (HDΔ: KL→plaintext, higher is better): Full T makes the difference between the original plaintext and the new one bigger (around 1.6 to 1.7 bits, depending on the modality). A higher HDΔ means that the ciphertext is less comparable to the source, which makes content-linked statistical indications even less useful. When you look at all three together, you can see that Full T (wavelet+permute+sign) is the most important on both axes—closer to uniform and farther from plaintext—across all modalities with tight CIs. This evidences stronger confusion/diffusion in practice without altering cryptographic guarantees.

Table 4. ROI-conditioned leakage

Table 4 measures leakage within diagnostic ROIs. Across brain tumor core/edema, abdominal lesions, chest lung fields, and cardiac LV lumen, Full T halves-to-thirds CDL_ROI (≈0.009–0.011) versus AEAD-only (≈0.022–0.028), indicating negligible ROI-specific inference from ciphertext and uniform protection across anatomies tested.

Figure 5 puts crucial dependence and dissemination to the test. Figure 5(a): BER compared to key-bit flips. The ciphertext bit-error rate stays close to 0.48–0.50 even when only one key bit is flipped, and it stays mostly flat when more flips happen (log₂ scale). That flat spot at about ½ is where the avalanche is likely to happen: Small key changes mix up about half of the bits, which shows that the data is well-diffused and there are no exploitable partial correlations. Figure 5(b): A visual grid with the wrong key. When you use the wrong keys to "decrypt" something, you get noise that doesn't have any structure—no anatomical traces. In a true system, AEAD would fail with an auth-tag error and show nothing. The panel shows what any pre-auth or coerced decoding would look like. Figure 5(c): Distribution of key sensitivity. The histogram mass between 0.995 and 1.000 (which is 1 − pixel-match vs. wrong key) shows that almost all pixels are different when a key is wrong. These results show that any key problem, like a bit flip, an incorrect key, or tampering, makes the output worthless and/or fails authentication. This shows that the system is strong against differential, fault, and misconfiguration attacks.

Table 5 shows that both pipelines are cryptographically robust. Key sensitivity ~0.998–0.999 and avalanche BER ≈0.5 indicate catastrophic failure under wrong keys. Tamper detection is ~100% (auth tag fails), nonce-reuse incidents are zero per 10⁶ frames, and provenance verification succeeds ~100%. Full-T matches/edges AEAD-only across all safeguards, with negligible performance cost.

Figure 6 shows how much it costs to run edge and server CPUs at different resolutions with AEAD-only and Full T (wavelet+permute+sign). Latency in Figure 6(a) increases with resolution; servers are quicker. At 512², edge 14 ms (AEAD) against 16 ms (Full T), server 9 ms vs 10 ms; at 2048², edge 58 ms vs 66 ms, server 40 ms vs 46 ms. The confusion layer adds a consistent latency of about 10% to 15%. Throughput in Figure 6(b) goes down as images get bigger, but servers can handle higher rates. At 512², the edge speed went from 800 to 720 MB/s (AEAD→Full T), and the server speed went from 960 to 864 MB/s. At 2048²: edge 500→450 MB/s, server 600→540 MB/s (~10–12% less with Full T). Energy in Figure 6(c) gets bigger with higher resolution and goes up a little with Full T. Edge: 0.8 to 2.1 J (AEAD) vs. 0.88 to 2.31 J (Full T). Server: 0.68 to 1.78 J (AEAD) vs. 0.75 to 1.96 J (Full T). Overall, Full T is still usable, but it loses about 10–15% of its performance to better stop leaks.

Table 6 shows how edge (AES-NI) and server CPUs compare for different image sizes and two configurations: AEAD-only and Full T (Wavelet+Permute+Sign). As the resolution goes up (512²→2048²), both platforms have higher latency and lower throughput, which is what to expected. The Full T pipeline adds a small, steady cost: about 10–15% more latency, 10–12% less throughput, and 10% more energy per image compared to AEAD-only. This is because of the extra wavelet, permutation, and sign phases. Because they have more processors and memory bandwidth, servers have about 30% lower latency and 20% higher throughput than edge devices. The overhead for ciphertext size is still low (3.5% AEAD-only; 4.8% Full T) because KEM/signature framing is the major focus and the payload is stream-encrypted. The CPU usage goes up with the resolution and the confusion layer (+6–7 percentage points). Both platforms fulfill practical budgets (for example, ≤16 ms at 512² on edge; ≤10 ms on server), and Full T can still be used with known costs.

(a)

(b)

(c)

Figure 5. Testing key sensitivity and diffusion properties: (a) BER vs. key bit flips; (b) Decrypt with wrong-key (visual grid); (c) Key sensitivity

Table 5. Robustness and security behavior

(a) Runtime

(b) Throughput

(c) Energy

Figure 6. Performance overheads across resolutions: (a) Runtime; (b) Throughput; (c) Energy

The stacked bars in Figure 7 show classical bits (base), quantum bits (semi-transparent), and the margin over 128-bit security (top). Schemes at NIST L5-ish (ML-KEM-1024, ML-DSA-87) exhibit the largest margins (~+62 bits). Mid-tier sets (ML-KEM-768, ML-DSA-65) retain modest headroom (~+22 bits). Entry sets (ML-KEM-512, ML-DSA-44) fall short (negative/zero margin), indicating sub-128-bit quantum security. Use to select parameter sets matching retention lifetimes and risk. The leakage classifier configuration used in the experiments is summarized in Table 7.

The purpose of the leakage classifier is not to build a diagnostic model but to test whether the ciphertext contains learnable diagnostic information. Therefore, classifier performance close to random guessing indicates low diagnostic leakage. Table 8 and Figure 8 show how each part of the confusion helps to reduce leakage compared to the AEAD-only baseline (Δ = 0). With 95% CIs, three bars per setting show ΔCDL, ΔSLI, and ΔHDu (lower is preferable). This shows the same deltas as well as p-values (for ΔCDL) and Cliff's δ (effect size). The relationship between proposed leakage metrics and standard cryptographic security concepts is summarized in Table 9.

Table 6. Performance and overheads

Figure 7. Summary of Quantum Resistance Margin (QRM) results

Table 7. Leakage classifier configuration is detailed

Key takeaways:

• Full T (W+P+S) shows the biggest changes in all metrics (≈−0.012 ΔCDL, −0.023 ΔSLI, −0.013 ΔHDu), with tight CIs, a very tiny p-value (~3.4 × 10⁻⁵), and a big effect (δ≈0.62).
• Permutation (P) has the most effect on SLI (−0.012), which suggests that adjacency scrambling mainly targets structural correlations. Sign (S) and Wavelet (W) both cause consistent but lesser decreases across metrics (|Δ|≈0.004–0.010).
• Error bars hardly ever cross zero, which shows that the results are statistically significant and stable.
• The pattern supports synergy: putting W, P, and S together stops diagnostic leakage (CDL), structural correlation (SLI), and non-uniformity (HDu) better than any one of them alone.

To ensure cross-modality comparability, the encryption parameters, key sizes, confusion transform configuration, and AEAD settings were kept identical across all modalities. The same leakage evaluation pipeline and classifier architecture were used for CT, MR, X-ray, and ultrasound datasets. Only image resolution and ROI definitions differed due to modality-specific characteristics. This design ensures that the reported differences in leakage metrics are attributable to modality characteristics rather than differences in encryption configuration or evaluation methodology.

From a practical perspective, these metrics can be interpreted as follows. If CDL approaches zero (AUC ≈ 0.5), the ciphertext does not allow diagnostic inference and behaves as semantically secure data with respect to diagnostic tasks. If SLI approaches zero, structural information from the original image is not preserved in ciphertext space. Low HDu indicates that ciphertext byte distribution is close to uniform, which is a common statistical property expected from secure encryption schemes. High HDΔ indicates that ciphertext distribution is significantly different from plaintext distribution, reducing the risk of statistical inference. High key sensitivity and avalanche behavior indicate strong diffusion and resistance to differential attacks. Finally, QRM indicates whether the selected post-quantum parameters meet long-term security targets (e.g., ≥128-bit post-quantum security).

Table 8. Ablation study (effect and significance)

Table 9. Relationship between proposed metrics and standard security concepts

Figure 8. Ablation impact

4.3 Interpretation of leakage metrics and relation to standard security measures

The leakage metrics used in this study are designed to complement, rather than replace, traditional cryptographic security definitions such as IND-CPA and IND-CCA security. Standard cryptographic definitions ensure that ciphertext does not reveal plaintext information in a formal adversarial model. However, in practical systems involving structured data such as medical images, it is also important to evaluate whether ciphertext exhibits statistical or structural patterns that may enable inference attacks without breaking the encryption algorithm.

The proposed metrics can therefore be interpreted as practical indicators of statistical indistinguishability, structural information leakage, and key sensitivity, which are related to established concepts in cryptography and information theory. Their interpretations are summarized as follows.

Overall, the ablation demonstrates that the keyed dual-domain confusion materially strengthens privacy beyond AEAD alone, with Full-T providing the clearest, statistically robust gains.

The leakage metrics approach ideal values (e.g., AUC ≈ 0.5 for diagnostic inference) because the evaluation is performed on ciphertext representations after authenticated encryption, where the ciphertext is expected to be statistically close to random under standard cryptographic assumptions. The purpose of the leakage evaluation is therefore not to produce large performance differences, but to measure small deviations from random behavior that may still exist due to structural or format-related leakage. The dual-domain confusion stage reduces these small deviations further, which appears as modest but consistent improvements across multiple metrics rather than large visible performance gaps.

4.4 Limitations and practical considerations

Despite the promising results, this study has several practical limitations that should be considered when interpreting the results. First, the experimental evaluation was conducted on offline datasets rather than real multi-site clinical network traffic, so the results primarily reflect data-level confidentiality and leakage behavior rather than full system-level deployment performance. Second, the study does not include hardware-level side-channel analysis such as timing leakage, power analysis, or cache-based attacks, which may be relevant in high-security deployment environments. Third, large-scale traffic analysis, including packet size correlation, traffic timing patterns, and long-term traffic monitoring, was not evaluated in this work. Fourth, although DICOM metadata binding and workflow compatibility were designed, the system was evaluated in a controlled environment rather than in a production PACS or hospital network. Therefore, the proposed framework should be interpreted as a security-engineering and leakage-evaluation framework rather than a fully validated clinical deployment solution. Future work should include real-world system integration, hardware security evaluation, and large-scale traffic analysis to further validate the approach in operational healthcare environments.

From a practical perspective, the results indicate that standard authenticated encryption already provides strong cryptographic confidentiality, but measurable diagnostic leakage may still be observed through statistical and structural patterns when evaluated using task-based metrics. The addition of the keyed dual-domain confusion stage reduces these leakage indicators across multiple imaging modalities with a moderate computational overhead of approximately 10–15%. This suggests that leakage-aware preprocessing may be useful in scenarios where encrypted medical images are stored or transmitted in environments where traffic analysis or inference-based attacks are a concern. However, the results should be interpreted as experimental evidence under controlled conditions rather than as a complete validation of clinical deployment readiness. Although system components such as PACS integration, DICOMweb compatibility, and gateway-based encryption are discussed to define a realistic deployment scenario, the experimental validation in this work was conducted using offline datasets and controlled processing environments. Therefore, the results should be interpreted as demonstrating the feasibility and performance of the security framework rather than a full clinical system deployment.