Threshold Visual Cryptography Schemes With Tagged Shares

The appearance of shares encoded by traditional visual cryptography is not easy to distinguish and meaningless. It means the shares cannot be managed efficiently nor user-friendly. A tagged visual cryptography scheme (TVCS) provides additional tag images for the shares and decodes the tag images by folding up a single tagged share. A TVCS allows users to efficiently manage shares and greatly increases the user-friendliness of the shares. Previous researches have focused on codebook-based and random-grid-based TVCS approaches, but the visual qualities of recovered secret images and tag images can still be improved. Therefore, this study aims to provide better visual quality of recovered images by improving on previous methods. Moreover, the proposed approach supports adjustable visual qualities of recovered secret images and tag images. In this study, we theoretically analyze the performances of the proposed approach and then demonstrate implementation of the approach.


I. INTRODUCTION
The threshold visual cryptography scheme, denoted (k, n)-VCS (2 ≤ k ≤ n), for the sharing of binary images is also known as a threshold visual secret sharing scheme ((k, n)-VSSS). A secret image is encrypted into n noiselike shares that are printed on transparencies, and the shares are then distributed among n participants. No information about the secret image is revealed in any noise-like share. The encrypted secret image can be accessed by a qualified set that consists of at least k participants, whereas a set with less than k participants will not be able to retrieve the secret information. The qualified set retrieves and visually decrypts a secret image by stacking their transparencies without performing any cryptographic computation and without any knowledge of cryptography. In addition, the visual cryptography scheme (VCS) features one-time-pad encryption so that it can securely protect secret images [1]- [6].
The traditional VCSs protect secret images by noise-like shares; it leads to a management problem. Meaningless shares are difficult to identify, which is one of the main drawbacks The associate editor coordinating the review of this manuscript and approving it for publication was Ahmed Farouk .
to noise-like shares. It is difficult for participants to recognize each share, when a participant simultaneously holds several noise-like shares for different secret images. In 2001, Ateniese et al. pointed out this issue [7] and, to address it, proposed the construction of the extended visual cryptography scheme (EVCS), and added stego-images, or cover images into noise-like shares, to make identifiable meaningful shares. Subsequently, many researchers have focused on approaches to encoding meaningful shares in visual cryptography, which are known as friendly visual cryptography schemes (FVCSs) [8], [9]. Improving the friendliness of share management has become an important issue in VCS research [10]- [19].
One solution to mitigate the share-identification issue is the tagged visual cryptography scheme (TVCS) [20]. Each share of a TVCS is given a tag pattern, but the appearance of the shares still consists of noise-like black and white dots. The tag-pattern image is revealed by folding up a share. Wu and Sun adopted the random-grid technique to construct a threshold TVCS, denoted (k, n)-TVCS. This method avoids pixel expansion and the VCS codebook preparation problem [21].
Both TVCSs and FVCSs solve the problem of meaningful shares of VCSs, each method has different properties and advantages. TABLE 1 summarizes the features comparison of FVCSs and TVCSs in appearance of shares, applications, and residual traces problem. The descriptions are presented as below.
The FVCSs and TVCSs use meaningful shares to address the problem. The share has an identifiable appearance that can greatly reduce the management problem for participants. The appearance of shares of FVCSs has an identifiable image on it, anyone can see the image directly. The TVCSs generate noise-like shares that same as traditional VCSs, but tagged visual cryptography conceals the tag pattern in each share. When the tagged share is folded up, the concealed tag pattern can be revealed and be recognized by naked eyes. Hence, participants can easily manage their shares according to the tag patterns.
From perspective of applications, Chen et al. use TVCS to achieve access control in secret sharing [22]. Different qualify set can authorize to decrypt different secret regions, and verified by tagged shares. Furthermore, cheating prevention is another practical issue of VCS, for example, k dishonest participants collude to cheat honest participants with fake shares. To provide cheating prevention, tagged VCS can verify shares by tag patterns [21].
In addition, residual trace problem usually be regarded in FVCSs. When meaningful shares of FVCSs are stacked, the mix cover images will interfere with the stacked images.
For example, FIGURE 1 shows the phenomenon of residual traces in a (2, 2)-FVCS. FIGURE 1 (a) and (b) are meaningful shares with ''T'' and ''V'' patterns. While superimposing two shares, the secret image with heart pattern is decrypted in FIGURE 1 (c). But mixed ''T'' and ''V'' traces still reside and interfere with visual perception of recovered image, which is called the residual traces problem. Hence, FVCSs usually consider residual traces problem in encryption approaches to improve visual quality. On the contrary, at present, there is no clear residual traces problem and discussion in TVCSs researches. As TABLE 1 listed, FVCSs and TVCSs have different advantages and applications.
In addition, observed by research literature, because of the importance of meaningful shares in VCS, the problem of FVCS has attracted a lot of attentions. Now, the cover images used in FVCS researches are more than binary images. Many studies have tried to use more types of images, e.g., halftone images, random dot stereograms, QR code images and so on [14]- [16], which makes the researches more abundant. In sharing schemes investigation, beside threshold VCSs, recently FVCS studies have explored more diverse sharing schemes, for instance, general access structure with meaningful shares [5], friendly progressive visual cryptography [11], [19] and so on. However, all the above issues are open issues for tag visual cryptography.
Compared with the original VCS, the FVCSs and the TVCSs have lower visual quality of recovered secret images. In the effort to obtain friendly shares, the visual quality of images will be lost. Hence, improving the quality of recovered secret images and tag images are crucial issues in TVCS research.
This study adopts existing optimization probabilistic VCS codebooks [23], [24] as a basis for proposing a systematic encryption method for a (k, n)-TVCS. Our main objectives are to improve the visual qualities of recovered tag images and secret images. Moreover, the proposed approach provides a tuning feature for users. That is, users can adjust visual qualities between recovered secret and tag images according to their requirements.
The remainder of this paper is organized as follows. Section II reviews related works. The proposed (k, n)-TVCS is described in Section III. In Section IV, the performance of the proposed scheme is evaluated by experiments. We conclude this work in Section V.

II. RELATED WORKS
The TVCS encryption procedure usually consists of the steps of sharing a secret image and encrypting the image tags. According to the encryption methods, we divide the VOLUME 8, 2020 literatures into two categories: codebook-based TVCS and random-grid-based TVCS.

A. CODEBOOK-BASED TVCS
In 2011, Wang and Hsu [20] first proposed a threshold tagged visual cryptography scheme; (k, n)-TVCS. The encoding procedure has two steps: 1) secret image sharing and 2) tag image stamping. In Step 1, one secret image is encrypted with (k, n)-VCS, where the n generated noise-like shares are called base shares.
Step 2 involves marking tag patterns into n noise-like shares under security and contrast requirements.
The codebooks for (k, n)-VCS in the first step can adopt any existing basis matrices in traditional (k, n)-VCSs, or any reported collections of column vectors in probabilistic VCSs. Therefore, according to the VCS approach, we call Wang and Hsu's approach codebook-based (k, n)-TVCS.
Suppose each tag image is reconstructed by folding each base share in half in horizontal direction. The size of the tag image is half that of the secret image. Then, the width and height of the tag image are respectively denoted w and h, and the secret image has width w/2 and height h. Wang and Hsu's (k, n)-TVCS is briefly presented in ALGORITHM 1. [20] Step 1: Encrypt a secret image to n base shares according to a given (k, n)-VCS codebook. Let P be the average ratios of white pixels in base shares.

Algorithm 1 Codebook-Based TVCS Approach
Step 2: Stamping tag images into corresponding base shares to generate n tagged shares. For each tag image, Steps 2.1 to 2.3 are executed. Suppose the stamping tag pixel is denoted as t, as well as the corresponding two symmetrical pixels in base share are represented as b L and b R .
Step 2.1: If color of tag pixel t is black (t = 1) and color of b L and b R are both white, then one of two pixels (b L or b R ) is modified as black with equal probability. Step 2.2: If color of tag pixel t is white (t = 0) and color of b L and b R are both white, then randomly select one pixel from b L and b R and modified into black with probability, P 2. Step 2.3: Repeat Steps 2.1 and 2.2, until all tag pixels are stamped.
An advantage of the codebook-based TVCS is that it allows multiple folding-up operations and folding up by different directions and angles. However, it is inevitable that tags will degrade the visual quality of recovered images. Therefore, it is worth studying how to improve visual quality in TVCS approaches.

B. RANDOM-GRID-BASED TVCS
Based on the random-grid (RG) technique, Wu and Sun proposed an encryption method for (k, n)-TVCS [21]. The RG-based (k, n)-TVCS is a two-phase algorithm, where the first phase is interim share generation and the second phase is tagged share modification. The algorithm for RG-based TVCS encoding is briefly described in ALGORITHM 2.
Step 1: Step 2: Modify the n interim shares R 1 , . . . , R n to form n tagged shares by Steps 3 and 4 when 1 Step 3: A number d 1 is randomly selected from 1, . . . , n and k −1 numbers g 1 ,. . . , g k−1 are randomly chosen from 1, . . . , n besides d 1 , the value of R d 1 (i, j) is modified by Step 4: Similarly, a number d 2 is randomly selected from 1, . . . , n besides d 1 and k − 1 numbers h 1 ,. . . , h k−1 are randomly chosen. The value of R d 2 (i, N − j + 1) is modified by Step5: Output n tagged shares R 1 , . . . , R n .
Assume the size of each tag image is half that of the secret image. The first phase (Step 1) encodes each tag image by (2, 2)-VCS constructing methods [25] and generates n interim shares (R 1 , . . . , R n ) of the same size as the secret image, i.e., double the size of the tag image. Each tag pixel is encrypted as two share pixels by (2, 2)-VCS. Then, the two corresponding share pixels are placed at two coordinates symmetrized to the folding line in the interim share.
The second phase (Steps 2, 3, and 4) modifies the pixels in the interim shares according to the secret image such that the generated tagged shares (R 1 , . . . , R n ) satisfy the constraints for the TVCS. The symbol ''⊕'' represents a XOR-ed operation. For one coordinate, Steps 3 and 4 randomly select one of n pixels in the same coordinate to be modified according to the secret pixel and k − 1 share pixels.
Wu and Sun's RG-based (k, n)-TVCS includes several features. The recovered secret images in RG-based (n, n)-TVCS have the optimal contrast values that the same as that of (n, n)-VCS [25]. However, when k < n, the contrast can be further improve. The contrast of recovered tag images depends on amount of participant, n. That is, the contrast value of tag images is fixed regardless k value variant in the (k, n)-TVCS. Moreover, the RG-based TVCS algorithm cannot be applied to (2, 2)-TVCS, which is a key drawback to be addressed.
In summary, the two approaches of TVCSs have different strength. In addition, codebook-based TVCS first encrypts the secret image, and then embeds tag pixels into the shares such that the tag patterns can appear by folding up. On the contrary, random-grid-based TVCS first encrypts each tag images, and then modifies the share pixels to share secret image. Although RG-based method does not require the preparation of codebooks in advance, this study will use traditional codebook-based methods to improve visual quality.

III. THE PROPOSED (k, n)-TVCS
To improve the visual quality of recovered images, we propose a (k, n)-TVCS based on the codebook-based TVCS. Thus, the encryption process includes two phases: Phase I encrypts one secret image, and Phase II hides tag images to n tagged shares, as FIGURE 2 shown. The optimizationbased probabilistic (k, n)-VCS codebooks [24] are adopted in Phase I. This section first reviews the probabilistic VCS, then describes the proposed (k, n)-TVCS encryption algorithm and analyzes the constraints and visual qualities of the TVCS.

A. BACKGROUND OF THE PROBABILISTIC VCS
The binary secret image consists of a collection of white and black pixels, in which each secret pixel is encrypted separately. The conventional visual secret sharing schemes (VSSSs) share a binary secret image by 0/1 basis matrices of n × m size. Each secret pixel is encoded as n blocks to n shares and each block consists of m white and black subpixels. The shares are m times the size of the original secret image. For example, a pair of well-known basis matrices, B w and B b , for (2, 2)-VCS are used to encode white and black secret pixels, as below.
In practice, the codebooks have two collections, C w and C b , which include all the matrices obtained by permuting the columns of B w and B b , as: One white (resp. black) secret pixel is encoded by randomly selecting one matrix in collection C w (resp. C b ). The typical conventional (2, 2)-VCS codebooks cause two times (m = 2) pixel expansion.
In 1999, Ito et al. [26] first proposed a probabilistic model for (k, n)-VCS that addresses the pixel expansion problem. The collections, C w and C b , consist of m n-tuple column vectors that are transformed from the existing conventional basis matrices. To share a white (resp. black) secret pixel, one of the column vectors in C w (resp. C b ) should be randomly selected and the i-th element in the column vector allocated to the i-th share. For example, according to the basis matrices in (1), Ito et al.'s collections C w and C b of (2, 2)-VCS should be: When the secret pixel is black, suppose the column vector 1 0 T in C b is randomly selected. Then, pixels 1 and 0 are distributed to shares 1 and 2, respectively. Each secret pixel is encoded to only one pixel for each corresponding share. Thus, both the image size of the shares and the recovered image remain invariant with the original secret image. Moreover, in 2004, Yang [23] proposed general rules to construct probabilistic (k, n)-VCS and proved that probabilistic VCS satisfies security constraints. Subsequently, Chiu and Lee [24] proposed an optimization model to obtain the codebooks for probabilistic (k, n)-VCS, which determined the chosen probabilities of the collections in codebooks C w and C b . Suppose the base code collection is denoted µ n i and consists of all n-tuple 0/1 column vectors with Hamming weight i. Furthermore, the chosen probabilities of µ n i are f w i (resp. f b i ) in C w (resp. C b ). Assume set µ n i includes n µ column vectors, each column vector is selected with probability n µ /f w i (resp. n µ /f b i ). Then, by the Chiu and Lee's model, the typical probabilistic (2, 2)-VCS is denoted as: and In addition, the optimization method obtains one of the (2, 3)-VCS codebooks, which we adopt in Section IV for VOLUME 8, 2020 performance evaluation and demonstrations as below. and The advantage of optimization-based probabilistic (k, n)-VCS is that the visual quality (contrast and blackness level) of the recovered image can be controlled efficiently. Hence, this study adopts codebooks in the optimization-based probabilistic (k, n)-VCS to develop a TVCS. The codebooks for (k, n)-VCS, 2 ≤ n ≤ 5, 2 ≤ k ≤ n, used in the proposed TVCSs [24] are shown in APPENDIX.

B. THE PROPOSED ENCRYPTION ALGORITHM FOR THE (k, n)-TVCS
To improve the visual quality of recovered tag images, we modify the encryption method based on Wang and Hsu's method. The proposed probabilistic (k, n)-TVCS encryption algorithm consists of two phases, as per previous related work [27].
The proposed two-phase (k, n)-TVCS encryption algorithm shares a binary secret image and yields n tagged shares. The black and white pixel colors are presented as logical 1 and 0, respectively. The related notations for the encryption algorithm are listed in TABLE 2. Note that the average density of black pixels in base shares, d, can be obtained from the codebooks of (k, n)-VCS or from the yielded shares. In addition, a given parameter, q, 0 <q ≤ 1, can provide adjustable contrasts of recovered tag images and secret images.
The encryption algorithm is shown in ALGORITHM 3. The input images include one secret image (M) and n tag images (TM i ). Phase I, consisting of Steps 1-4, performs the visual secret sharing procedures. For each coordinate in the secret image (M), the algorithm encrypts a black (white) pixel by the code collections, µ n i , in C b (C w ) with a chosen probability distribution f b i,n (f w i,n ). If set µ n i includes n µ column vectors, each column vector is selected with probability n µ /f w i,n (n µ /f b i,n ). Then each element of the selected column will be distributed to relative base share. Finally, Phase I generates base shares, S j , for 1 ≤j ≤ n. For example, assume a (2, 4)-TVCS is encrypted. First, Phase I encodes white and black secret pixels due to codebooks (2, 4)-VCS as following C w and C b , respectively.
Then, in Phase II (Steps 5-21), the tag-hiding procedure encodes tag images (TM j ) into the base shares (S j ) one by one. In Steps 5 and 6, the left and right symmetric coordinates along the central folding line are regarded as one pair of share pixels (S (x, y) and S(x, y)) and are processed together in Phase II.
Steps 6 to 20 // for each pair of coordination 6. x If TM j (x, y) =1 then 10.
Generate a random number r 12.
If r ≤ q then 13.
Generate a random number r 17.

In
Step 7, n pairs of share pixels are modified one by one.
Step 8 copies each pixel from the base shares S j to the tagged shares S j . If the value of the tag pixel TM j (x, y) is ''1'' (black) and the corresponding pair of pixels in the tagged share (i.e., S j (x, y) and S j (x, y)) are both white, then S j (x, y) and S j (x, y) cannot be stacked and decoded to black for TM j (x, y). Hence, Steps 11-13 are a modification process. One pixel of S j (x, y) and S j (x, y) is modified from 0 to 1 with probability q such that the tag pixel TM j (x, y) will be decoded as black. However, both the pixels in S j (x, y) and S j (x, y) may not have changed, which has probability 1 − q.
To avoid revealing the trace of the tags in shares, an equal percentage of white share pixels must be modified to black when the corresponding tag pixel is white. Hence, when the tag pixel is white, Steps 16-20 are executed. The algorithm selects S j (x, y) and S j (x, y) with pixel values ''1W1B'' to modify to ''2B'' by ratio p m , as shown in Steps 16-20. The ratio p m will be explained in the next section. Finally, in Step 21, when w×h coordinates are handled, the algorithm can output n tagged shares. For example, TABLE 3 shows the (2, 4)-TVCS encryption process of a pair of pixels located in (x, y) and (x, y) the secret pixels are and . Notations of y-axis coordinates are omitted in TABLE 3. First, assume phase I encrypts the white secret pixel to '' '' and the black pixel is encode to '' '' due to codebooks of probabilistic (2, 4)-VCS. Phase II considers relative tag pixels (TM) '' ''. In row of Share 1, tag is '' '' and share pixels are '' ''. Assume q= 0.8 and Step 11 generates random number r, r < q, thus Step 13 randomly selects one location from S 1 (x) and S 1 (x). Consequently, Steps 9-13 in algorithm modifies S 1 (x) to '' ''.

C. THEORETICAL PERFORMANCE ANALYSIS
In this subsection, we prove that the proposed (k, n)-TVCS satisfies the constraints of a tagged VCS. We also theoretically analyze the visual effects of the proposed (k, n)-TVCS approach. Property 1: Let modification ratio p m = q(1 − d)/2d, traces of tag image can be eliminated from tagged shares.
Proof : TABLE 4 lists the related probabilities for analysis. Column 3 shows the appearance probabilities for all combinations (''WW'', ''WB'', ''BW'', and ''BB'') of S j (x, y) and S j (x, y). According to the proposed algorithm, columns 4 and 5 list the modification probabilities, Prob. (W → B), for individual base-share-pixel when tag pixel is black and white, respectively.
Next, we consider the whole ratios that white base-sharepixels are changed to black. When color of tag pixel is black and white, the whole ratio is denoted as P tag is B (W →B) and VOLUME 8, 2020 To maintain the density balance of black pixels in black and white regions of tag images, the values of P tag is B (W → B) and P tag is W (W → B) have to equal: Finally, modification probability p m is obtained by: When modification ratio p m is set to q(1 − d)/2d, the proposed encryption algorithm can balance black pixel density between black and white regions of the tag pattern. Therefore, no trace of tag image is revealed in any tagged share is true.
We now present several notations and definitions to analyze the visual quality. Usually, contrast is used as a metric to measure visual quality and evaluate performance in VCS studies [28]. We refer to the previous researches and define the contrast of recovered tag images and secret images as follows.
Definition 1: The contrast of a binary image is defined as α=(pw w − pw b )/(1 + pw b ), where parameters pw w and pw b respectively represent the white pixel density in the white and black regions of the secret images.
Based on Definition 1, we define and prove the contrast of a recovered tag image.
Property 2 (Contrast of Recovered Tag Image): Let notation α T represent the contrast of a recovered tag image. Then, Notations tw w and tw b respectively represent the probabilities that black and white tag pixels are decoded as white in a recovered tag image.
Proof: As per column 4 in TABLE 4 (tag pixel is black), when pixels S j (x, y) and S j (x, y) are ''WB'', ''BW'', or ''BB'', the recovered tag pixel will be black. However, when pixels S j (x, y) and S j (x, y) are ''WW'', the probability for no modification is 1 − q, so partial black tag pixels are recovered as white. Thus, the probability, tw b , that a black tag pixel is recovered as black is: Next, as in column 5 in TABLE 4 (tag pixel is white), only when both S j (x, y) and S j (x, y) are ''white'' is the recovered tag pixel white. Thus, the probability tw w is: Therefore, the contrast of a recovered tag image is obtained, as follows: Afterwards, for discussing the security and contrast constraints, we define following notations.
Definition 2 (For VCS): Notations pw w t and pw b t represent the densities of white pixels in base shares (S j ) or stacked images, where superscripts ''w'' and ''b'' denote colors of secret pixels, white and black, respectively. Subscript t is number of stacked shares.
Definition 3: (For TVCS): Notations pw w t and pw b t represent the densities of white pixels in tagged shares (S j ) or stacked images, where superscripts ''w'' and ''b'' denote colors of security pixels, white and black, respectively. Subscript t is number of stacked shares.
To derive the relationship between pw w t (resp. pw b t ) and pw w t (resp. pw b t ) in VCS and TVCS, respectively, we define a notation u. The notation u represents the remaining ratio that one white base share pixel keeps white in tagged shares after Phase II. pw w 1 = pw w 1 · u, for white secret pixels. pw b 1 = pw b 1 · u, for black secret pixels. Property 3: When stacking t shares, the values of pw w t (resp. pw b t ) in tagged shares can be obtained by the given pw w t (resp. pw b t ) in base shares.
Proof: According to column 4 in TABLE 4 (tag is black pixel), the probability of one share pixel being modified is q (1 − d) 2 2, which is same as obtain from column 5 in TABLE 4.
Next, the probability that one base-share-pixel is white is (1 − d). Therefore, the white share-pixels remaining ratio u is calculated by the following conditional probability: In Phase II of the proposed algorithm, the white pixel modification is independent of the secret pixel's color (white or black), and so the remaining ratios of white pixels in white and black regions of the secret image are equal (and equivalent to u).
If t share pixels in VCS stacked as white, and the t pixels simultaneously keep no change in Phase II of TVCS, then the stacking result is white, which probability is u t .
Hence, the probabilities pw w t and pw b t in TVCS can be obtained from the given pw w t and pw b t in VCS, as below. pw w t = pw w t u t and pw b t = pw b t u t . Thus, Equations (15), (16), and (17) hold. Moreover, in the special case, q is 1, we obtain

Property 4 (Contrast of Recovered Secret Image):
Let α denote the contrast of the recovered image for the proposed probabilistic (k, n)-TVCS, then Proof: According to Definition 1, the contrast is Moreover, when q is 1, we obtain: In addition, according to Yang [23], Yang et al. [29] define security condition for probabilistic VCS, the study redefines the security condition for VCS, and TVCS as following Definition 4 and Definition 5.

Definition 4 (Security Condition for (k, n)-VCS):
For any t rows in codebooks of (k, n)-VCS with t < k, the values of pw w t and pw b t are the same, i.e., pw w t = pw b t , t < k. The security condition for the optimization based probabilistic (k, n)-VCS have been proved in reference [24], therefore, the base shares (output of Phase I) are satisfied the security condition.
Next, giving an example, (3, 4)-VCS, to explain the security constraints in VCSs. Codebooks C w and C b of (3, 4)-VCS are: Let λ(·) represent the stacking operation that stacks t-tuple of sets. For t = 1 to 3, the analysis is as below.
Definition 5 (Security Condition for (k, n)-TVCS): For any t rows in codebooks of (k, n)-TVCS with t < k, the values of pw w t and pw b t are the same, i.e., pw w t = pw b t , t < k.
Property 5: The security constraint for the proposed probabilistic (k, n)-TVCS is true.
Proof: According to Equations (15) and (16) in Property 3, pw w t and pw b t are: Moreover, due to the security condition in VCS (Definition 4), we obtain pw w t = pw b t , t < k are hold, which makes pw w t u t = pw b t u t . Thus, in TVCS, pw w t = pw b t , for t < k, are true. So the security condition is hold in tagged shares.

IV. PERFORMANCE EVALUATION
This section compares the proposed approach with related work in terms of the visual qualities of the recovered images. Then, we demonstrate experimental results. VOLUME 8, 2020

A. PERFORMANCE COMPARISON WITH WANG AND HSU'S APPROACH
This subsection compares the proposed probabilistic (k, n)-TVCS with Wang and Hsu's approach [20]. Wang and Hsu's approach allows the adoption of any reported (k, n)-VCS constructions in the first phase. Thus, for fairness, we adopt the optimization-based probabilistic (k, n)-VCS to encrypt the base shares for both Wang and Hsu's approach and our approach. Moreover, when parameter q is set to 1, the proposed (k, n)-TVCS and Wang and Hsu's approach have equal modification ratios for white pixels in a base share. Thus, the contrasts of the recovered secret images for both approaches are equal. Hence, this subsection only compares the proposed approach with Wang and Hsu's approach in terms of the contrast of recovered tag images (α T ).
In Wang and Hsu's approach [20], white pixel density is denoted as P 0 , P 0 = 1 − d. When the tag pixel is white and the corresponding base-share-pixel is white, the modification probability is P 0 2. The probability that one pair of the baseshare-pixel is ''WW'' is (P 0 ) 2 . The probability that the two share pixels stay ''WW'' after modification is (1 − P 0 /2) 2 . Thus, in the recovered tag image, the probability that one white tag pixel is decoded as white is Moreover, in the approach of Wang and Hsu, black tag pixels are fully decoded as black. Therefore the contrast of the recovered tag image, α T Wang , is: Next, based on the theoretical analysis results, we list the contrast of recovered tag images, α T This , from n = 2 to 5, i.e., (2,2) to (5,5) in TABLE 5. The proposed (k, n)-TVCS adopts parameter q = 1. To compare with α T Wang , improvement factor α T is defined as the following equation: Obviously, the proposed (k, n)-TVCS algorithm outperforms Wang and Hsu's approach in terms of the contrast of recovered tag (α T ). For example, with (2, 2)-TVCS, due to the codebook in Equations (4) and (5), the proposed approach obtains d = 0.5. Then according to Property 2, let q be 1. Thus, contrast α T This = 25%, as below: By comparing, according to Equations (19) and (20), Wang and Hsu's approach obtains: Thus, the proposed approach improves on Wang and Hsu's method by 77.8%.
TABLE 5 lists all α T for (k, n)-TVCS, 2 ≤ n ≤ 5, 2 ≤ k ≤ n. The improvements range from 44.1% to 77.8%. The analysis results show that our approach significantly improves the contrasts of recovered tag images.

B. PERFORMANCE COMPARISON WITH WU AND SUN'S APPROACH
This subsection compares Wu and Sun's RG-based method [21] and the proposed encryption approach (parameter q = 1) in terms of visual quality, according to the theoretical analysis results.
First, we refer to Wu and Sun's analysis for the RGbased (k, n)-TVCS [21]. The contrast of the recovered image (denoted as α Wu ) and the contrast of the recovered tag image (denoted as α T Wu ) are: Next, the contrasts of the recovered secret images and recovered tag images, 2 ≤ n ≤ 5 and 2 ≤ k ≤ n, are evaluated. The contrasts of Wu and Sun's approach are obtained by Equations (21) and (22). Moreover, the contrasts of the proposed (k, n)-TVCS are obtained from Property 2, Property 3, and Property 4, and q = 1. The probabilities pw w and pw b refer to the codebooks in the optimization-based probabilistic (k, n)-VCS [24].
Wu and Sun's RG-based method has better contrasts of recovered images in the (3, 3)-, (4, 4)-, and (5, 5)-TVCSs, suggesting that Wu and Sun's method can obtain better contrasts than our approach for k = n, n ≥ 3. However, when k < n, our approach obtains higher contrasts of recovered images than Wu and Sun's method.
Moreover, the contrasts of recovered tag images from the theoretical analysis results are illustrated in TABLE 7. The results show that when n = 2, 3, or 4, the proposed approach obtains better contrasts of recovered tag images than Wu and Sun's method. However, when amount of participant n is greater than or equal to 5, Wu and Sun's method has higher contrasts of recovered tag images than our approach.
In summary, when amount of participant n is less than 5 and k < n, the proposed (k, n)-TVCS outperforms the related methods in terms of visual quality of recovered images and recovered tag images. In addition, Wu and Sun's approach  cannot provide (2, 2)-TVCS encryption, which is addressed in the proposed approach.

C. EVALUATION FOR ADJUSTABLE VISUAL QUALITY
In this subsection, we observe the visual quality by adjusting parameter q in the proposed (2, 2)-and (2, 3)-TVCSs.

1) (2, 2)-TVCS
According to the results of the theoretical analysis, the visual quality values of the proposed (2, 2)-TVCS for recovered images are α= 28.1% and α T = 25% when q = 1. In the experiment, parameter q varies from 0 to 1 and the corresponding contrasts of the recovered tag images and secret image are as shown in FIGURE 3. FIGURE 3 shows that when parameter q decreases, the contrast of the recovered secret image (α) increases, but the contrast of the tag image (α T ) decreases. For example, when q decreases from 1.0 to 0.5, the contrast of the recovered secret image increases from 28.1% to 38.3%, but the contrast of the tag image decreases from 25.0% to 11.1%. A special case, when q = 0, the result is a (2, 2)-VCS, and contrast of the tag image (α T ) is zero.
We varied parameter q from 0 to 1.0, the values of α and α T are shown in FIGURE 4. When q decreases from 1.0 to 0.5, the contrast of the recovered secret image increases (from 17.1% to 22.6%) but the contrast of the tag image decreases (from 25.0% to 11.1%). When q decreases to zero, the values of α T is zero, which is (2, 3)-VCS with α= 28.6%.
This experiment demonstrates the proposed approach provides adjustable contrasts between α and α T by setting parameter q. The adjustable flexibility makes users can adjust the encryption outcomes according to their requirements.

D. CONTRAST VARIATIONS
The subsection conducts a set of experiments to observe the contrast variations with number of stacking shares increase. The experiments implement the proposed (k, n)-TVCS in several scenarios, including n = 2 to 5, k = 2 to n, by secret image ''MCU'' and tag images ''A'' to ''E'' in FIGURE 5. We set the parameter q as 1 and 0, each scenario runs 10 times and the statistical results are illustrated in TABLE 8. First, in TABLE 8, for q = 1, the contrasts variation of recovered images (α) are listed for k ≤ t ≤ n, from (2, 2)-TVCS to (5, 5)-TVCS.
For (k, n)-TVCS, k < n, when number of staked shares (t) is greater than k, the contrast value (α) progressively increases, then even decreases if n − k ≥ 2. For example, (3, 4)-TVCS obtains α = 7.37% and 12.92%, that progressively increase for t = 3 and 4, respectively. For example, in (2, 5)-TVCS, when t are 2 to 3, contrast values increase from 18.62% to 22.13%. But when t are 4 and 5, contrast values decrease to 19.14% and 16.96%. We observe the experimental results and explain the reason for the variation. When t is 2, few black secret pixels still are decoded as white. When number of stacked shares t is 3, the black secret pixels have been fully recovered as black, which causes the contrast value increase. When the number of stacked shares continues to increase (t = 4, 5), the few secret pixels in the white area are decoded to the black pixels, which will make the contrast α decrease instead. Next, the recovered contrast (α), maximum and minimum α are sequentially listed in TABLE 8. Moreover, the contrasts of recovered tag images (α T ) in the experiments are also listed in TABLE 8. Last, while the parameter q is set as 0, the (k, n)-TVCS become a (k, n)-VCS, the experimental results of contrasts (α) are listed in   When folding up tagged shares, FIGURE 6(c) and (d) show recovered tag images. The contrasts α T are 25.2%, and 25.0%, which are very close to its theoretical value 25%. Moreover, FIGURE 6(e) shows the recovered secret image. The experimental contrast value (α) is 28.6%, which is close to the theoretical contrast of 28.1%.
When stacking any two tagged shares, the stacked images appear noise-like, which is a security constraint of VCS, as illustrated in FIGURE 7(d), (e) and (f). When the three tagged shares are stacked, the secret image ''Lena'' is decoded as FIGURE 7(g). The recovered contrast of the secret image (α) is 10.5%, which is very close to the theoretical contrast of 10.6%. Moreover, while folding up tagged shares, FIGURE 7(h), (i) and (j) show three recovered tag images. The recovered contrasts α T are 24.9%, 25.1%, and 25.3%, which align with the theoretical contrast 25%.   Next, we implement (2, 3)-TVCSs for four scenarios, i.e., values of q are 1.0, 0.8, 0.5, and 0.3, to verify that the recovered contrasts can be slightly adjusted by parameter q. Due to space limitations, we select only one of the recovered images (stacking shares 1 and 2) and one of the recovered tag images, ''A'', for each scenario to be illustrated in FIGURE 9 (a) to (d). As shown in FIGURE 9(a) to (d), when the value of q decreases from 1.0 to 0.3, the contrasts (α) of the recovered images ''MCU'' gradually increase, from 19.0%, 20.0%, 23.1%, to 25.0%, providing clearer visual percepts. On the other hand, the contrasts of tag images ''A'' (α T ) gradually reduces, from 24.8%, 18.8%, 11.2%, to 6.5%, significantly decreasing the visual quality. According to requirements, the user can choose an appropriate q value. The experiment shows that the proposed (k, n)-TVCS can provide the feature of adjustable contrasts for users.
In summary, the experimental results show the proposed approach: 1) provides correct (k, n)-TVCSs, 2) provides contrasts trade-off between recovered secret and tag images. Moreover, the theoretical analysis performance is aligned with the implemental results.

V. CONCLUSION
In this paper, we proposed a two-phase tagged visual cryptography construction method, the (k, n)-TVCS, that adopts an optimized probabilistic visual cryptography scheme (VCS) to encode base shares and hide tag images. The proposed approach has the following key features. First, the proposed (k, n)-TVCS encryption algorithm is a systematic approach that can encrypt threshold TVCS for any k and n. Second, it addresses the pixel-expansion problem in traditional VCS. Third, the proposed approach provides a feature for tuning the contrasts of recovered secret images and tag images by a parameter so that users can adjust visual qualities according to their requirements.
This study presents a theoretical analysis of visual quality. Then, experiments showed that the results of the theoretical analysis and implementation are very close, thus confirming the accuracy and effectiveness of the proposed encryption algorithm. Moreover, we compared the performance of the proposed algorithm with related works. The results showed that when amount of participant n is less than 5 and threshold, k < n, the proposed (k, n)-TVCS outperforms the other methods in terms of the visual quality of recovered secret and tag images. In addition, this study solves the problem that RG-based TVCS does not work for (2, 2)-TVCS. Finally, this study makes helpful contributions to the field of threshold tagged visual cryptography.