Research ArticleOPTICS

Metasurface-based key for computational imaging encryption

See allHide authors and affiliations

Science Advances  21 May 2021:
Vol. 7, no. 21, eabg0363
DOI: 10.1126/sciadv.abg0363


Optical metasurfaces can offer high-quality multichannel displays by modulating different degrees of freedom of light, demonstrating great potential in the next generation of optical encryption and anti-counterfeiting. Different from the direct imaging modality of metasurfaces, single-pixel imaging (SPI) as a typical computational imaging technique obtains the object image from a decryption-like computational process. Here, we propose an optical encryption scheme by introducing metasurface-images (meta-images) into the encoding and decoding processes as the keys of SPI encryption. Different high-quality meta-images generated by a dual-channel Malus metasurface play the role of keys to encode multiple target images and retrieve them following the principle of SPI. Our work eliminates the conventional digital transmission process of keys in SPI encryption, enables the reusability of a single metasurface in different encryption processes, and thereby paves the way toward a high-security optical encryption between direct and indirect imaging methods.


Nowadays, information security is of great importance in every aspect of life and thereby spawns various modern encryption modalities. Among them, optical encryption exploits abundant degrees of freedom (DOFs) of light (e.g., amplitude, phase, polarization, wavelength, and orbital angular momentum) to encode and decode target information, which opens a new door for information security communications and storage. Composed of two-dimensional (2D) arrays of nano-/micro-light scatterers (e.g., antennas and resonators), metasurfaces can effectively tailor different DOFs of light with their ultra-thin thicknesses (114), leading to a series of potential applications in optical encryption. By modulating the polarization states and nonlinear responses in multiple channels, metasurface imaging has been used to encode and decode different images (1534). By modulating both the spectral and polarization responses, metasurface holography has been successfully applied to hiding different information into different colors and polarization channels (1629). By controlling the linear polarization states for both the incident light and outgoing light, Malus metasurfaces that operate based on Malus’s law have been designed and applied to multi-image encryption and anti-counterfeiting (3034).

The imaging processes of the above metasurface-encryption schemes are all based on direct imaging of metasurfaces, where the decoding keys are carried by different DOFs of light. As a typical computational imaging technique, single-pixel imaging (SPI) can be used to obtain the target image by calculating the correlation between a series of illumination patterns and the corresponding bucket intensity values (35, 36). This indirect imaging modality offers an alternative optical encryption approach, where a calculation is required and the series of patterns and bucket intensities act as the key and ciphertext, respectively (37). On the basis of the computational principle of SPI, different encryption schemes have been developed to enhance the number of encrypted images and the security, such as multipositioned image encryption (38), multicolored image encryption (39), and visual cryptography encryption (40). Nevertheless, the large numbers of patterns (i.e., the keys of encryption and decryption) would necessarily increase the burden of the data transmission process and easily attract the attention of eavesdroppers, which is the intrinsic shortcoming of SPI in the application of optical encryption.

In this work, we fabricate a dual-channel Malus metasurface and use its high-quality meta-images to generate a matrix and its transform operation together as the keys to encode different target images, following the principle of SPI. During the decryption process, the meta-images projected by our dual-channel metasurface can not only fulfill an anti-counterfeiting process to obtain the cipher images but also further retrieve the keys to decode and recover different images from the corresponding cipher images, as shown in Fig. 1. By using camouflaged meta-images as the keys of computational imaging encryption and decryption, our work seamlessly integrates direct metasurface imaging and indirect computational imaging (i.e., SPI), which simultaneously enables the reusability of a single metasurface in different encryption processes and enhances the encryption security.

Fig. 1 Decryption of different images with a dual-channel Malus metasurface as the keys.

Three meta-images can be achieved by adjusting the polarization directions of the bulk-optic polarizer and the analyzer (Channel 1: α1 = 22.5° and α2 = 67.5°; Channel 2: α1 = −22.5° and α2 = 22.5°; Hybrid channel: α1 = −15° and α2 = 60°). Serving as meta-keys, three meta-images are used together to obtain different cipher images and further fulfill the decoding process based on the SPI principle. Photo credit: Peixia Zheng, University of Macau.


We design and fabricate a dual-channel Malus metasurface, as shown in Fig. 2. Here, silver nanobricks acting as nanopolarizers, which can control the polarization state of output light pixel-by-pixel, are used to form the metasurface for dual-channel binary meta-image display (for more design details, see section S1). Figure 2 (A and B) shows the unit-cell structure and the reflection and transmission spectra, simulated with CST Microwave Studio software (for more simulation details, see section S2). Thus, based on Malus’s law, the output light intensity can be manipulated by configuring silver nanobricks with identical geometric sizes but different orientation angles (32). As shown in Fig. 2C, four orientation candidates of each nanobrick (22.5°, 67.5°, 112.5°, and 157.5°) are selected to record four binary states of “00,” “01,” “11,” and “10” of two different channels. On the basis of this dual-channel polarization multiplexing scheme, we can record two different binary meta-images into the orientation distribution of silver nanobrick arrays—a quick response (QR) code linking to the website of H.-C.L.’s research group and a designed icon of a “deer.”

Fig. 2 Design principle and experimental results of the dual-channel meta-image display.

(A) Unit-cell structure. The designed silver nanobrick has dimensions of length L = 160 nm, width W = 80 nm, height H = 70 nm, and cell size C = 300 nm. (B) Simulated reflectivities (Rl, Rs) and transmissivities (Tl, Ts) under linearly polarized incident light polarized along the long (l) and short axes (s) of the nanobrick, respectively. (C) Calculated transmitted intensity under channels 1 and 2. The black dots indicate the four orientation candidates and their binary intensity code states. (D) Partial SEM photos of the fabricated sample. Scale bar, 500 nm. (E) Illustration of recording two different binary patterns into the same nanobrick arrays shown in (D). (F) Experimentally captured meta-images under four different cases. Channel 1: α1 = 22.5° and α2 = 67.5°; Channel 2: α1 = −22.5° and α2 = 22.5°; Hybrid channel: α1 = −15° and α2 = 60°; Unpolarized: without polarizer and analyzer. Scale bars of 20 μm are shown in all meta-images.

In our design, two images with the same dimensions of 57 pixels × 57 pixels are simultaneously recorded into a single metasurface of 85.5 × 85.5 μm2, i.e., each pixel corresponds to a 5 × 5 nanobrick array. Next, the metasurface sample is fabricated by the standard electron beam photolithography. Figure 2D shows the partial scanning electron micrograph (SEM) image of the fabricated sample. Figure 2E illustrates the correspondence between the pixel array and the transmitted intensity profiles for both channels, indicating that each nanobrick participates in the recording of the information for both binary images. Because the meta-images appear right at the metasurface plane, we use an optical microscope (Motic BA310Met) with ×50 magnification for the meta-image observation (more details about the experimental setup and meta-image capture process are provided in section S3). To experimentally observe the meta-images in different channels, a bulk-optic polarizer and an analyzer are inserted before and after the metasurface to control the polarization directions of the incident and transmitted light, respectively, as shown in Fig. 1 and fig. S2. Thus, dual-channel binary meta-images with high fidelity can be readily identified at desired nonorthogonal polarization optical paths (i.e., α1 = 22.5° and α2 = 67.5° for channel 1; α1 = −22.5° and α2 = 22.5° for channel 2), as shown in Fig. 2F. By adjusting the bulk-optic polarizer and the analyzer to an intermedium state (e.g., α1 = −15° and α2 = 60° here), a hybrid channel can be obtained as meta-image 3, which cannot be simply obtained by superimposing meta-images 1 and 2. On the other hand, no image will be observed without the help of the bulk-optic polarizer and the analyzer. As shown in Fig. 2F, all three meta-images are observed with high fidelity in the pixel level, which enables further information encryption together with computational imaging method.

By using meta-images as the key, we perform the image encryption process based on the SPI principle. As a transition of different channels, a hybrid channel (i.e., meta-image 3) has almost never played any role in previous metasurface imaging and encryption applications. Here, we use meta-image 3 as the encryption key in our scheme, which can be recognized as a matrix Mm × n (here, m = n = 57) with three different values as 0, 1, and 2 according to its three-level brightness, as shown in the blue area of Fig. 3. Subsequently, the matrix Mm × n undergoes a Left-shift operation, in which each element shifts to the kth position on its left to form a new matrix in the kth operation, as shown in the pink area of Fig. 3. After N (N = m × n) operations, N different matrices {Mm × n}N can be obtained and the matrix Mm × n will return to the original one. Following the principle of SPI, we use these N different matrices to interact with the target image 1 (i.e., Baboon) represented by T1m×n one by one and obtain N bucket signals {Io}N, where the kth bucket signal is calculated by Iok = ∑m, nT1m × n · Mkm × n. Then, the N bucket signals {Io}N are normalized and resized into an 8-bit cipher image 1 (m × n pixels), in which each pixel value represents a bucket signal. The cipher image 1 (57 pixels × 57 pixels) is converted into a binary form (456 pixels × 57 pixels), and further resized into 228 pixels × 114 pixels and concealed into the least significant bit (LSB) of the cover image, as shown in the yellow area of Fig. 3 (for more details of the conversion, see section S4). Target image 2 can be encoded into the second LSB of the cover image in the same way but with different transformation operation (e.g., Up-shift) of the matrix. To briefly summarize the encryption process, an encryptor encodes different target images into different cipher images by using a single meta-image together with different specific matrix operations as the keys, followed by the encryption of the cipher images into a cover image with an LSB steganography. Here, we only introduce two simple matrix operations to encode two different cipher images. For our encryption scheme, various matrix operations can be applied to encode different cipher images, and more LSBs of cover images or a larger size cover image can be used to store different cipher images (see section S5). It is worth mentioning that meta-images 1 and 2 can also be used to replace meta-image 3 as the keys to encode additional information. Different from meta-image 3, which is a three-level brightness image, meta-images 1 and 2 only have two levels of brightness, which will be converted into binary matrices.

Fig. 3 Encryption process with meta-images as the key.

The blue area shows the transformation from meta-image 3 into a ternary matrix. The pink area indicates the matrix encoding flow with different matrix operations (i.e., Left-shift and Up-shift). The yellow area is the schematic of the SPI encryption and the least significant bit (LSB) steganography. Target image 1 (Baboon) is from the University of Southern California–Signal and Image Processing (USC-SIPI) Image Database. Cover image is from Peixia Zheng, University of Macau.

Using the single metasurface, the decryption process can be fulfilled with two steps. The decryptor can first scan the QR code in meta-image 1 and obtain the cover image from the directed website, as shown in the red box of Fig. 4. Ensuring that both meta-image 2 and the cover-image contain the same key element (e.g., deer), the anti-counterfeiting process is well completed and the decryption can proceed. As an inverse process of the encryption, the LSB and second LSB will be first read out from the cover image and resized into two 57 pixel × 57 pixel cipher images by performing a binary to decimal conversion. Two cipher images are two sets of bucket signals {Io}N as mentioned above. The blue box in Fig. 4 indicates the process to obtain the meta-keys that consists of two parts, one as the transformation matrix (i.e., meta-image 3 here) and the other as the matrix operations. The matrix operations can be pre-agreed between the encryptor and the decryptor, or they can be hidden into a meta-image by steganography. Here, the matrix operations “Left-shift” and “Up-shift” are steganographically written as the letters “LU” in meta-image 2, where LU is the alphabetic writing of deer in Chinese. Then, together with meta-image 3 acting as the transformation matrix, two sets of patterns, namely, N different matrices {Mm × n}N, can be obtained with Left-shift and Up-shift operations, respectively. By using the reconstruction algorithm of SPI (see Materials and Methods), one can finally recover two images from the two sets of bucket signals {Io}N and N different matrices {Mm × n}N, respectively. It is noteworthy that both the matrix and its operation are critical for image reconstruction. Once the matrix or the operation is not matched with each other, only noise will be obtained as demonstrated in section S6.

Fig. 4 Scheme of the decryption processes with meta-images as the key.

The red box shows the retrieval of cipher images from meta-image 1. The blue box shows the retrieval of keys with meta-image 2 containing the matrix operations and together with meta-image 3 providing the transformation matrix. Photo credit: Peixia Zheng, University of Macau.

To sum up, meta-images play the role of keys in the decryption processes. Meta-image 1 provides the web link to get the cipher images from the cover image, and meta-image 3 generates N different matrices {Mm × n}N together with meta-image 2 as the decryption key. Meta-image 2 also fulfills an anti-counterfeiting process with the cover image. Therefore, with only a dual-channel metasurface, an image anti-counterfeiting and a multiple-image decryption process can be successfully achieved, which greatly enhances the security and information amount delivered by a single metasurface. Moreover, by designing different matrix operations, the metasurface-based encryption key (i.e., N matrices developed from the meta-image) will be different, indicating that a single metasurface can be used in multiple round encryptions.


Error tolerance is of great importance to any decryption process. For our scheme, the error may mainly originate from the inaccurate recognition of meta-images, i.e., the recognition error of pixel value, between the encryptor and the decryptor. Theoretically, any grayscale images can be chosen as the key based on our proposed scheme. However, the more gray levels of the image, the more recognition errors may appear. Within standard experimental error, it is difficult to correctly recognize each pixel intensity value for a grayscale (0–255) image by using a standard charge-coupled device camera. To ensure the accuracy of the intensity detection of the meta-images, two meta-images of dual-channel metasurface here are designed as binary images, and meta-image 3 from the hybrid channel is used as the key for the error study below.

To study the error tolerance, we apply different pixel errors (i.e., white, green, and blue dots represent the pixel values that are wrongly recognized as 2, 1, and 0 in the ternary matrix, respectively) with different ratios to the recognized image (57 pixels × 57 pixels) from meta-image 3, as shown in Fig. 5. To test the universality of the error tolerance, we choose the error pixel randomly. As shown in Fig. 5, the compressed sensing total variation (TV) regularization algorithm (see Eqs. 2 to 4 in Materials and Methods) can offer a nearly perfect recovered image without error. The recovered images can still be recognized with an error ratio above 10%. When the error ratio increases, strip-like background starts to appear in the recovered image. Nevertheless, the recovered image from the TV method with around a 10% error ratio still presents a better quality than the recovered one from the conventional second-order correlation function (CF) method (see Eq. 1 in Materials and Methods). It is because the TV method is one of the most robust methods to attenuate measurement noise (41). Because each pixel is equivalent in the computational process, the error location and composition (e.g., all 2, all 1, or all 0, or random ternary error) will give little impact on the computational imaging reconstruction, implying that our decryption process is highly robust against the recognition error.

Fig. 5 Error tolerance study of the decryption processes with correct keys.

The left box shows two recovered images with different error ratios using the compressed sensing TV regularization recovery algorithm. The right box shows recovered images from conventional second-order CF method. The first row shows the recognized images (57 pixels × 57 pixels) from meta-image 3 with different error ratios. Three-valued errors are applied to random pixel in the recognized images, where the white, green, and blue dots represent the error value 2, 1, and 0, respectively. Photo credit: Peixia Zheng, University of Macau.

It is worth noting that, in (42), helicity-dependent metasurface holographic images were used as the target images to perform the SPI with a series of random patterns. Similar to conventional SPI encryptions, large numbers of random patterns acted as the key and were required to be sent from the encryptor to the decryptor in that scheme, which put a burden on the data transmission and had a high risk of key leakage. In contrast, the encryption and decryption keys are both camouflaged as meta-images here. Therefore, without conventional digital transmission of large numbers of keys, an ultra-small dual-channel metasurface can greatly enhance the security during the encryption and decryption processes based on computational imaging. Moreover, together with different matrix operations, a single meta-image can act as different keys and encode different information, indicating that a single metasurface becomes a digitally dynamic one and has good reusability in different encryption processes. Our scheme can not only work for the Malus metasurface but also help to enhance the security of other metasurfaces in the encryption applications. For example, our keys and cipher images can be concealed into different images generated by a reprogrammable metasurface hologram scheme (27) or can be integrated with the thermal-spectral drift method (26) to camouflage our meta-keys in a covert way, which thereby further increases the security. In addition, one key merit of our scheme is to apply the computational algorithms and steganography to metasurfaces, which can be extended to other possible methods of hiding two or more sets of information in a single print (1214).

In conclusion, we have proposed and experimentally tested an encryption scheme by using meta-images as the keys, based on the SPI principle. With a certain matrix operation, a meta-image is developed into a digitally dynamic one and generates a series of patterns to encode and decode a target image through a computational imaging process. A single meta-image is reusable in our encryption scheme and can act as different keys with different matrix operations. Moreover, different channels of a metasurface (even a hybrid channel) can play as different keys, which thereby enhance the number and disguise of keys during the anti-counterfeiting and encryption processes. The robustness of our metasurface-based key has also been verified by the error tolerance study. By introducing meta-images as the key for computational imaging encryption, our scheme eliminates the conventional digital transmission process of keys in SPI encryption, enhances the encryption security, and, more importantly, enables the reusability of a single metasurface in optical encryption applications.


SPI reconstruction

Following the principle of SPI, the target image can be recovered from the correlation calculations between the N matrices {Mm × n}N and N bucket signals {Io}N. Here, the N matrices {Mm × n}N are obtained after N operations (Left-shift or Up-shift) on meta-image 3, and N bucket signals {Io}N read from the cipher image in which each pixel value represents a bucket signal Iok. The simplest SPI algorithm for the image recovery is to calculate the second-order CF as followsG(2)=1Nk=1NIok·Mkm×n(1)where G(2) represents the recovered image.

Other reconstructed algorithms can also be chosen, such as compressed sensing algorithms. In compressed sensing algorithm, the matrix Mkm × n will be resized into a row vector A (A = m × n), and N matrices {Mm × n}N will be rewritten as a 2D matrix B (B = N × A). For the bucket signals {Io}N, it will be expressed as a column vector IoCGI(N × 1). If the target image is sparse in matrix B, it can be efficiently reconstructed by solving the convex optimization program as followsTCGI=T,min T1subject to IoCGI=BT(2)where TCGI is the recovered target image, T is the original target, and ‖T1is the L1-norm of T. Here, we choose the compressed sensing TV regularization method as a demonstration of compressed sensing algorithms. The recovered images in Figs. 1 and 4 are calculated from TV method. The TV minimization model has a huge capability in preserving the edges of image, because the gradient’s integral of a natural image is statistically low. The augmented Lagrangian method is applied to restore image efficiently.

The target image’s TV is calculated using L2-norm with the gradient calculation matrix H. The model becomesmin g2,subject to HT=g,BT=IoCGI(3)

By introducing a Lagrange multiplier y to incorporate the equality constraints into the objective function, the Lagrange function is minimized asmin L=g2+y1,HTg+μ12HTg22+y2,BTIoCGI+μ22BTIoCGI22(4)min L=g2+μ12HTg+y1μ122+μ22BTIoCGI+y2μ222where μ1,2 are the parameters balancing different optimization items. The detailed derivations can be obtained from (41).


Supplementary material for this article is available at

This is an open-access article distributed under the terms of the Creative Commons Attribution-NonCommercial license, which permits use, distribution, and reproduction in any medium, so long as the resultant use is not for commercial advantage and provided the original work is properly cited.


Acknowledgments: Funding: This work is financially supported by Start-up Research Grant of University of Macau (SRG2019-00174-IAPME), National Natural Science Foundation of China (nos. 91950110, 11774273, 11904267, 11474027, and 11735005), and H2020 European Research Council Project nos. 734578 (D-SPA) and 648783 (TOPOLOGICAL). Author contributions: H.-C.L., G.Z., and S.Z. conceived the idea and supervised the project. P.Z., H.-C.L., Z.Y., and J.X. designed the encryption flow and conducted the simulations. Q.D., Z.L., and G.Z. designed and fabricated the metasurface and performed the imaging experiment. All authors contributed to the discussions and manuscript writing. Competing interests: The authors declare that they have no competing interests. Data and materials availability: All data needed to evaluate the conclusions in the paper are present in the paper and/or the Supplementary Materials. Additional data related to this paper may be requested from the authors.

Stay Connected to Science Advances

Navigate This Article