## 4 HeFUN: An iLHE-Based SNNI Framework
### Hefun
The comparison shown in Figure 1 illustrates that HeFUN surpasses Gazelle by reducing both communication rounds and costs. Specifically, HeFUN performs ReLU evaluation in just two rounds, whereas Gazelle requires more communication rounds, namely two rounds (to convert between HE and MPC and vice versa)and communication rounds required by GC. In HeFUN, two ciphertexts are transmitted between the client and the server, while the number of messages exchanged in Gazelle is larger, namely two ciphertexts (\([\mathbf{x}+\mathbf{r_{1}}]\) and \([\text{ReLU}(\mathbf{x})+\mathbf{r_{2}}]\)) and a huge number of messages exchanged in the GC protocol. In Gazelle, the client needs to involve the GC procedure, which is undesirable in SNNI. In contrast, for HeFUN, the client only needs to perform decryption and encryption, which are simple algorithms in the HE scheme, while other heavy computation takes place in the server. One should acknowledge that in Gazelle, the server's operations include homomorphic addition and subtraction; conversely, in HeFUN, the server performs homomorphic multiplication (as delineated in line 7, Protocol 1), which necessitates an LHE scheme with larger parameters due to the additional multiplications required. Where Gazelle operates with a multiplicative depth of 1, HeFUN requires a depth of 3. Another HE-MPC hybrid-based SNNI framework is MP2 ML [16], which incorporates the ABY protocol [20] for the evaluation of the ReLU function, as opposed to the utilization of GC. In the comparative analysis (see Figure 1), the GC component is substituted with an ABY component. It is obvious that HeFUN demonstrates superior performance over MP2 ML in terms of both the number of communication rounds and communication costs. Overall, HeFUN outperforms the current HE-MPC hybrid-based approach in evaluating ReLU in terms of communication complexity. This is primarily attributed to HeFUN's elimination of the necessitated communication-intensive GC or ABY protocols. However, HeFUN presents an elevated multiplicative depth requirement of 3, in contrast to the multiplicative depth of 1 required by Gazelle and MP2 ML. ### HeRefresh Experimental Results

In the HE scheme, HeRefresh is equivalent to the bootstrapping procedure, which both aim to reduce the noise in ciphertexts. We compare HeRefresh with the bootstrapping technique for CKKS [70], implemented in OpenFHE. We report the result for refreshing noise for one ciphertext. To ensure the reliability of the results, we repeat the experiment 1000 times and take the average result. The comparison results are shown in \[=(\mathbf{x}\cdot\mathbf{W}_{1},\ldots,\mathbf{x}\cdot\mathbf{W}_{n})\qquad\text{ (Property (\ref{eq:1}))}\]1 The depth is the number of expected homomorphic multiplications performed before noise refreshing, \(N\) is the degree of the polynomial used in the CKKS scheme, and the level is the multiplicative level required for noise refreshing. Bootstrapping homomorphically

\[=(\mathbf{x}\cdot\mathbf{W}_{1},\ldots,\mathbf{x}\cdot\mathbf{W}_{n})\qquad\text{ (Property (\ref{eq:1}))}\]2 Comparison between Gazelle [15] and HeFUN. The main bottleneck of Gazelle is GC. HeFUN is _solely_ based on HE, hence avoiding expensive GC procedure. HeFUN outperforms Gazelle in terms of communication rounds and communication cost. computes the decryption equation in the encrypted domain. The procedure consumes an amount of homomorphic multiplication, so the level of the CKKS scheme needs to be big enough for this procedure. The details of the bootstrapping procedure are out of the scope of this work. Please refer to [70] for details. While DoubleR (Protocol 2) only requires simple computation, i.e., encryption, decryption, addition, and subtraction, we do not need to increase the level of CKKS. The larger level of CKKS leads to a bigger value of \(N\) to meet the security requirement. With simpler operators and smaller parameters, DoubleR is much faster than bootstrapping. For example, with a depth of 1, DoubleR is nearly 300 times faster than bootstrapping.