## 4 HeFUN: An iLHE-Based SNNI Framework
### Problem Statement  
We consider a standard scenario for cloud-based prediction services. In this context, \(\mathcal{S}\) possesses an NN, and \(\mathcal{C}\) sends the data to \(\mathcal{S}\) and subsequently obtains the corresponding prediction. The problem is formally defined as:  
\[\mathbf{z}:=a_{L}\Big{(}f_{L}\Big{(}\mathbf{W}^{(L)},a_{L-1}\Big{(}f_{L-1}\Big{(}\dots a _{1}\Big{(}f_{1}\Big{(}\mathbf{W}^{(1)},\mathbf{x},\mathbf{b}^{(1)}\Big{)}\Big{)}\Big{)} \Big{)},\mathbf{b}^{(L)}\Big{)}\Big{)}\]  
where \(\mathbf{x}\) is the input data, \(f_{i}\) is the linear transformation applied in the \(i\)th layer, \(a_{i}\) is (usually non-linear) activation functions, and \(\mathbf{W}^{(i)}\) and \(\mathbf{b}^{(i)}\) are the weight and bias in the \(i\)-th layer of the NN. The problem we address is SNNI. That is, after each prediction, \(\mathcal{C}\) obtains the prediction \(\mathbf{z}\), while \(\mathcal{S}\) learns nothing about \(\mathbf{x}\) and \(\mathbf{z}\), and \(\mathcal{C}\) learns nothing about \(\mathbf{W}^{(i)}\) and \(\mathbf{b}^{(i)}\) with \(i=\overline{1,n}\) except \(\mathbf{z}\). In this paper, we focus on the ReLU function, i.e., \(a_{i}=\mathsf{ReLU}()\). The final activation function, i.e., \(a_{L}\), can be omitted in the inference stage without compromising the accuracy of predictions. This is because NN predictions rely on the index with the maximum value in its output vector, and since the \(a_{L}\) is monotone increasing, whether or not we apply it will not affect the prediction. The following sections elaborate on how to homomorphically evaluate layers in NNs in the HeFUN framework.  
**Linear layers (\(\mathbf{f_{i}}\)).** These layers apply a linear transformation on input. In NNs, there are two common linear transformations, i.e., fully connected layers and convolution layers.  
_Fully connected layer._ The fully connected layer can be considered as the multiplication between an encrypted vector (\([\mathbf{x}]\)) and a plain weight matrix (\([\mathbf{W}]\)) and addition with a bias vector (\(\mathbf{b}\)). Based on operators supported by the CKKS scheme (as described in Section 3.2), the fully connected layer can be efficiently evaluated in the ciphertext domain. In particular, \([\mathbf{x}]\odot\mathbf{W}\oplus\mathbf{b}=[\mathbf{x}\cdot\mathbf{W}]\oplus\mathbf{b}=[\mathbf{x}\cdot \mathbf{W}+\mathbf{b}]\).  
_Convolution layer._ A convolutional layer consists of filters that act on input values. Convolutional layers aim to extract features from the given image. Every filter is an \(n\times n\) square that moves with a certain stride. By convolving the image pixels, we compute the dot product between filter values and the values adjacent to a particular pixel. Similar to the fully connected layer, the convolution layer can be efficiently evaluated in the ciphertext domain, i.e., \([\mathbf{x}]\odot\mathbf{W}\oplus\mathbf{b}=[\mathbf{x}\ast\mathbf{W}+\mathbf{b}]\).  
After linear layers, a non-linear activation function (\(a_{i}\)) is usually applied. Unfortunately, the activation function cannot be evaluated in the ciphertext domain. The next section presents our method to address this problem.