# Privacy-Preserving Outsourced Artificial Neural Network Training for Secure Image Classification
## 4 The Framework and Construction for Privacy-Preserving Image Classifier
### Description of Proposed Scheme
#### 4.4.2 Data Encryption  
To preserve the data privacy, the user needs to encrypt each sample of his local dataset \(D\). In the following, according to the main idea mentioned in Section 4.3 we present a customized method for protecting users data, adapting to create privacy-preserving ANN model by the \(\mathcal{S}_{\mathcal{NNN}}\) with the cooperation of the \(\mathcal{S}_{\mathcal{AU}}\).  
Assume that dataset \(D\) includes \(m\) samples. We first choose a mask matrix \(A\) to generate a two-part ciphertext \(A^{-1}\) and \(Ax\) where the two parts are utilized by the \(\mathcal{S}_{\mathcal{NNN}}\) and \(\mathcal{S}_{\mathcal{AU}}\), respectively. Specifically, the user selects a random non-singular matrix \(A\in Z^{a\times a}\), then computes its inverse matrix \(A^{-1}\in Z^{a\times a}\) and the blinded data \(\bar{\mathbf{x}}=Ax\) using \(A\), and then finally sends the encrypted version \(\bar{\mathbf{x}}\) to the \(\mathcal{S}_{\mathcal{AU}}\), the matrix \(A^{-1}\) and labels \(\{\mathbf{y}^{(1)},\dots,\mathbf{y}^{(m)}\}\) to the \(\mathcal{S}_{\mathcal{NNN}}\). Then, we divide the dataset \(D\) into \(\lceil m/l\rceil\) groups. For each group, we use the public key \(pk^{FEIP}\) to encrypt the vector formed by the \(i\)th \((i=1,2,\dots,a)\) feature of all of the \(l\) samples. The obtained ciphertexts are sent to the server \(\mathcal{S}_{\mathcal{NNN}}\).  
The user data encryption approach is specified in Algorithm 1. The user sends \(A\mathbf{x}^{(i)}\) to the server \(\mathcal{S}_{\mathcal{AU}}\). Meanwhile, the user transfers \(A^{-1}\) with labels \(\mathbf{y}\) to the the \(\mathcal{S}_{\mathcal{NNN}}\). For _IPPNN_ model, we require the user to share labels to the \(\mathcal{S}_{\mathcal{NN}}\) in plaintext. Note that the single label vector \(\mathbf{y}^{(i)}\) is without violating privacy laws since \(\mathbf{y}^{(i)}\) does not contain any substantial information.  
```
0: user dataset \(D=\{(\mathbf{x}^{(1)},\mathbf{y}^{(1)}),\ldots,(\mathbf{x}^{(m)},\mathbf{y}^{(m)})\}\), batch size \(l\), public key \(pk^{FEIP}=(h_{i}=g^{k^{i}})_{i\in[l]}\).
0: the blinded sample \(\tilde{\mathbf{x}}^{(i)}\), \(i=1,2,\ldots,m\), the encrypted vector for sample features.
1: Choose a random non-singular matrix \(A\in\mathbb{Z}^{n\times a}\) and compute its inverse matrix \(A^{-1}\in\mathbb{Z}^{a\times a}\);
2:for\(i=1,2,\ldots,m\)do
3: Compute \(\tilde{\mathbf{x}}^{(i)}=A\mathbf{x}^{(i)}\) using the mask matrix \(A\).
4:endfor
5: Divide \(D\) into \(\lceil m/l\rceil\) groups. Each group contains \(l\) samples.
6: Add \(l-(m\text{ mod }d)\) random samples uniformly picked from \(D\) to the last group if \(m\) is not divisible by \(l\).
7:for\(i=1,2,\ldots,\lceil m/l\rceil\)do
8:for\(j=1,2,\ldots,a\)do
9:\(r\leftarrow\mathbb{Z}_{p}\)
10: Encrypt data sample features as \[C_{lj}^{(i)} =Enc_{pk^{FEIP}}(x_{j}^{(i-1)l+1},\ldots,x_{j}^{(il)})\] \[=(g^{r},h_{1}^{r}s^{x^{(i-1)l+1}},\ldots,h_{l}^{r}s^{x^{(i)}})\]
11:endfor
12:endfor
13: Send the encrypted data \(\tilde{\mathbf{x}}^{(i)}\) to the \(\mathcal{S}_{\mathcal{AI}}\).
14: Send the matrix \(A^{-1}\), ciphertexts \(C_{lj}^{(i)}\) and labels \(\{\mathbf{y}^{(1)},\ldots,\mathbf{y}^{(m)}\}\) to the \(\mathcal{S}_{\mathcal{NN}}\).
```  
**Algorithm 1** User data encryption and uploading.