## 6 Experiment Evaluation
### Secure Inference  
We use PriRepVGG for secure inference and simulate a 3-party scenario with three servers. We record the computation cost of secure inference with input resolution \(225\times 225\) of PriRepVGG and \(65\times 65\) of AlexNet, as Table 4. Each party owns the private secret shares provided by the model holder and the data holder extracted in Section 6.4. Every single party is unable to reconstruct the origin secret in the security setting discussed in Section 4; thus, the non-data-owning party is unable to learn the data of others in the task of secure inference. The data holder will finally obtain the result of inference. We record the results of the secure inference to compute the recall, precision, f1 score and accuracy obtained by the model under ciphertext inference, and compare the result with the plaintext inference in Section 3.  
As shown in Figure 4, the secure inference is stable, and the difference rate does not exceed 0.08. In addition, the accuracy of secure inference is flat compared to the accuracy in plaintext. We obtained the following detailed results: the setting of batch size of 128, and the average misjudged numbers of the plaintext model is 9. As shown in Table 5 the average error score rate for five random batch experiments is 0.0703.  
\begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline \multirow{2}{*}{**Indicators**} & \multicolumn{2}{c}{**Batch Size = 32 \(\ell\) = 32**} & \multicolumn{2}{c}{**Batch Size = 64 \(\ell\) = 32**} & \multicolumn{2}{c}{**Batch Size = 128 \(\ell\) = 32**} & \multicolumn{2}{c}{**Batch Size = 32 \(\ell\) = 64**} \\ \cline{2-9}  & **Ours** & **AlexNet** & **Ours** & **AlexNet** & **Ours** & **AlexNet** & **Ours** & **AlexNet** \\ \hline Time (s) & 5.89 \(\times 10^{2}\) & 5.95 \(\times 10^{2}\) & 1.289 \(\times 10^{3}\) & 1.269 \(\times 10^{3}\) & 2.58 \(\times 10^{3}\) & 4.83 \(\times 10^{2}\) & 7.82 \(\times 10^{2}\) & 7.61 \(\times 10^{2}\) \\ Comm. (MB) & 2.282 \(\times 10^{3}\) & 2.611 \(\times 10^{3}\) & 5.64 \(\times 10^{3}\) & 5.22 \(\times 10^{3}\) & 1.129 \(\times 10^{4}\) & 4.94 \(\times 10^{3}\) & 9.77 \(\times 10^{3}\) & 4.835 \(\times 10^{3}\) \\ RAM(G/per & & & & & & & \\ node) & 10 & 6.3 & 28 & 11.52 & 35 & 25 & 20 & 12 \\ \hline \hline \end{tabular}
\end{table}
Table 4: Evaluation of secure inference in settings of batch size and \(\mathbb{Z}_{L}\) for PriRepVGG and AlexNet.  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Batch Size** & **I** & **II** & **III** & **IV** & **V** \\ \hline
32 & 2 & 3 & 3 & 1 & 2 \\
64 & 5 & 10 & 5 & 3 & 7 \\
128 & 9 & 12 & 7 & 6 & 11 \\ \hline accuracy & 0.0703125 & 0.09375 & 0.0546875 & 0.046875 & 0.0859375 \\ \hline \hline \end{tabular}
\end{table}
Table 5: Record of the misjudgement for five random batch experiments.  
We test AlexNet, VGG-16, and PriRepVGG to compare the performances of the three networks with input resolution \(227\times 227\), \(224\times 224\), and \(225\times 225\). Figure 5 shows that the communication and time cost of PriRepVGG is 1-1.5 orders of magnitude lower than the VGG-16. The communication rounds of PriRepVGG is 3\(\times\) lower than the AlexNet shown in Figure 6. The evaluation shows that the specific plain inference architecture of PriRepVGG benefits the lightweight of parameters and computational cost reduction. In terms of the time cost for secure inference, the PriRepVGG network is under 10 to 20 s per image with the batch size growing.