Cryptanalysis and Improved Image Cryptosystem via Chaos and Convolutional Neural Network

Chaos-based image encryption schemes are often motivated by the apparent randomness of chaotic sequences and by the nonlinear processing capability of convolutional neural networks (CNNs). However, these properties alone do not guarantee cryptographic security. In this work, we present a systematic cryptanalysis of an image-encryption framework combining Logistic-map dynamics, pixel permutation, XOR masking, CNN-based processing, image hiding, and wavelet-domain operations. Under the fixed-state condition considered in our analysis, the reversible encryption core can be reduced to c=Π(p)⊕s, where Π is a plaintext-independent permutation and s is a fixed byte-wise mask. The effective secret is therefore characterized by the equivalent pair (Π,s), rather than by the nominal parameters of the underlying chaotic map. Based on this structural reduction, we derive mask-cancellation and differential relations and develop five complementary cryptanalytic methods: chosen-plaintext, known-plaintext, chosen-ciphertext, differential, and model-class black-box attacks. The chosen-plaintext attack recovers the XOR mask from an all-zero query and determines the permutation using position-labelled inputs. The known-plaintext attack constructs cross-sample XOR fingerprints to progressively identify permutation positions when the available plaintexts provide sufficient diversity. The chosen-ciphertext and differential attacks recover the inverse mapping or eliminate the fixed mask through carefully designed query pairs. The black-box attack further uses multi-byte coordinate encoding to identify the complete fixed input–output transformation without prior knowledge of the block structure. These attacks do not require recovery of the Logistic-map parameters; instead, they directly reconstruct the equivalent transformation required to decrypt ciphertexts generated under the same induced state. In addition, for the explicitly linear fixed-convolution component of the target framework, we perform a separate conditional impulse-response experiment to recover its effective convolution kernel. Experiments on 128×128 grayscale images with 16×16 blocks demonstrate exact byte-level plaintext recovery for the analyzed fixed-state reversible core, while also showing that known-plaintext recovery depends on sample diversity. The results indicate that reusable and separable permutation–mask structures remain vulnerable even when embedded in chaos- and CNN-assisted image-processing pipelines, motivating per-image state diversification and stronger key-dependent coupling between permutation and diffusion.