Selective image encryption is common in remote sensing systems because it protects sensitive regions of interest (ROI) while limiting computational cost. However, many selective designs enable cross-tile structural leakage under chosen-plaintext attacks when secret-dependent transformations are reused across spatial positions. This paper proposes Tilewise Domain-Separated Selective Encryption (TDS-SE), where per-tile (and optionally per-frame) keys are derived from a master secret via HKDF with explicit domain separation, and ROI masks are treated strictly as external side information. Structural leakage is evaluated using two reconstruction-based distinguishers -- a linear model and a lightweight convolutional neural network -- under multiple attack settings. Experiments on RESISC45 and SEN12MS cover ablation tests, cross-position transferability, cross-sample generalization, and ROI-knowledge asymmetry. Results show that per-tile domain separation reduces position-conditioned transfer for the linear probe, and that adding frame freshness improves robustness to imperfect ROI assumptions for the CNN probe. Cross-sample generalization exhibits mixed behavior across settings, consistent with an empirical evaluation perspective, while selective-encryption functionality is preserved under the same tiling and ROI policy. Beyond the method itself, the paper provides a structured protocol for evaluating selective encryption under realistic attacker capabilities.

翻译：选择性图像加密在遥感系统中应用广泛，因其能在保护敏感兴趣区域（ROI）的同时控制计算开销。然而，当依赖密钥的变换在空间位置上重复使用时，许多选择性加密方案在选择明文攻击下会引发跨分块的结构性信息泄露。本文提出分块域分离选择性加密（TDS-SE）方法，其中每个分块（可扩展至每帧）的密钥通过带显式域分离的HKDF从主密钥派生，且ROI掩码被严格视为外部辅助信息。我们在线性模型和轻量级卷积神经网络两种基于重建的区分器下，通过多种攻击场景评估结构性信息泄露。在RESISC45和SEN12MS数据集上的实验涵盖消融测试、跨位置可迁移性、跨样本泛化能力及ROI知识不对称性分析。结果表明：分块级域分离降低了线性探测器的位置条件迁移性；增加帧新鲜度可提升CNN探测器对不完善ROI假设的鲁棒性。跨样本泛化在不同场景下呈现混合特性，这与经验评估视角一致，而选择性加密功能在相同分块与ROI策略下得以保持。除方法本身外，本文还提出了一套结构化协议，用于在实际攻击者能力下评估选择性加密方案。