## 2 Materials and Methods
### vePOD YOLO: Privacy Preserving Object Detection on the Edge  
YOLO is a single-stage object-detection network composed of multiple convolutional, max-pooling, and fully connected layers. The original image is not needed to generate region proposals. As a results, the image-level secret sharing can be used to build vePOD YOLO. Figure 3 depicts the structure of vePOD YOLO and its major secure functions. In vePOD YOLO, a vehicle partitions an image into several shares and encrypts them to generate secret shares using an encryption key obtained from the trusted server. Those secret shares are distributed to edge servers, each of which executes vePOD YOLO consisting of secure functions of the convolutional, max pooling, and fully connected layers (detailed in the following sections) on a secret share. The outputs from vePOD YOLO on the edge servers are combined on a vehicle to obtain the detected objects. Compared with the feature-level secret sharing, the image-level secret sharing approach simplifies the processing on a vehicle and makes an edge server execute the entire secure detection CNN. This may lead to a longer execution time from running the secure functions that contain addition operations on secure shares. A secret share \(M_{i}\) received by an edge server goes through a number of secure convolutional layers, secure max-pooling layers, and secure fully-connected layers. Convolutional layers and fully-connected layers perform linear transformations that do not affect the additive relationship among secret shares. Thus, the secure convolutional layer and secure fully-connected layer are the same as the original convolutional and fully-connected layers, respectively. We focus on the design of the secure max-pooling layer. Secure Function for Max-Pooling Layer  
Max pooling keeps important features by selecting the largest, i.e., \(max()\), in a stride. The \(max()\) function performs a non-linear operation on features, which may affect the additive relationship among secret shares. To assure the max-pooling layer generates correct results on secret shares, we design a secure max-pooling function. Algorithm 2 sketches the secure function for map pooling. In a vehicle-edge computing environment with two edge servers, secure map pooling works as follows. An edge server \(E_{1}\) processes a feature map \(F_{1}j\) in a channel \(j\) and processes a region \(R\) (e.g., \(2\times 2\)) at a time. To find the maximum-valued element in the region \(R\), it calculates the relative difference by subtracting the elements in \(R\) from the two edge servers, exchanges  
Figure 3: Structure and major components of vePOD YOLO. Image-level secret sharing is applied. Edge servers execute secure functions in vePOD YOLO to process secret shares. secret shares' relative difference, and adding them; i.e., if \(I\) is smaller than zero, the value of the raw data element in the region \(R\) with index \([\alpha,\beta]\) is smaller than the raw data element with the index \([w,h]\). The index of the greater element is recorded and this process is repeated until all the elements in \(R\) are processed. Thus, the index of the maximum-valued element in \(R\) can be determined. With this design, only the relative difference is exchanged between edge servers, which protects the feature maps and secret shares from being revealed to each other.