## 4 HeFUN: An iLHE-Based SNNI Framework
### Hefun
The evaluation of activation function layers' running times, as shown in Table 1, reveals that HeFUN exhibits slower performance compared to CryptoNets. This difference stems from the intrinsic complexity of the activation functions utilized; CryptoNets employs a square function as the activation, which is a single homomorphic multiplication of two ciphertexts, whereas HeFUN utilizes the more complex HeReLU protocol for evaluating the ReLU function, as detailed in Table 7.

Despite this, HeFUN has an advantage in terms of its independence from the neural network's (NN) depth. Specifically, HeFUN maintains a _constant_ multiplicative depth of 3, regardless of the NN's depth, which avoids the escalation of LHE parameters--and consequently, inference times--that is seen with CryptoNets as the NN becomes deeper. To illustrate, the Activation 1 layer in HeFUN consistently requires 0.028 s for both small and large NNs (HeFUN\({}_{s}\) and HeFUN\({}_{l}\)), in contrast to CryptoNets, which records 0.008 s for a small NN (CryptoNet\({}_{s}\)) and increases to 0.012 s for a large NN (CryptoNet\({}_{l}\)). This observation reinforces the scalability of HeFUN in terms of computation time when compared to CryptoNets as NN complexity increases. ## 6 Discussion on Security of HeFUN

### Model Extraction Attack

While HeFUN ensures security against semi-honest adversaries by protecting client data and the model's parameters, it remains vulnerable to model extraction attacks. Adversaries can potentially exploit a series of inference queries to reverse-engineer the model's parameters [75; 76], reconstruct training samples [77; 78], or deduce the presence of specific samples in the training set [8]. Indeed, all the frameworks in Table 1 remain vulnerable to such attacks. We acknowledge that addressing model extraction is a distinct challenge from SNNI and is not the primary focus of our current work. ### Fully Private SNNI

HeFUN hides all the NN's parameters from the client and hides clients' data from the server. However, HeFUN does not completely hide the network architecture. Our protocol leaks the number of layers and the number of neurons in each layer to the client. To further enhance privacy, we can adopt the padding technique used in the Gazelle framework, which \begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline  & **Depth** & **Encryption** & **Decryption** & \multicolumn{3}{c}{**Multiplication**} & \multicolumn{3}{c}{**Addition**} \\ \cline{4-7}  & & & & **Cipher-Plain** & **Cipher-Cipher** & **Cipher-Plain** & **Cipher-Cipher** \\ \hline CryptoNets & \(L^{\,a}\) & 0 & 0 & 0 & 1 & 0 & 0 \\ HeReLU & 3 & 1 & 1 & 3 & 1 & 0 & 1 \\ \hline \hline \end{tabular}

* Depend on the NN’s depth.

\end{table} 
Table 7: Comparison between HeReLU protocol and square function evaluation in CryptoNets. involves adding dummy layers and neurons to conceal the network's true architecture at the cost of additional computational resources. Furthermore, our protocol obviously leaks the type of activation function used in the NN to the client. It should be noted that all frameworks in the MPC-based and HE-MPC hybrid-based approaches (in Table 1) leak such information. Among current SNNI approaches, LHE-based and FHE-based approaches do not expose any details about the NN, thereby providing a superior level of security. Despite this, such methods are constrained by their inability to efficiently compute certain functions like ReLU, their limitation in handling deep NNs, and the significant computational overhead involved. These limitations reduce their scalability and practical applicability in complex SNNI tasks. ## 7 Conclusions and Future Works

This paper introduces iLHE, a novel interactive LHE-based approach for SNNI. Building upon iLHE, we developed two innovative protocols that address the limitations of current HE-based SNNI methods. Our HeReLU protocol enables the evaluation of the ReLU activation function with reduced communication rounds compared to existing HE-MPC hybrid solutions.