## 4 HeFUN: An iLHE-Based SNNI Framework
### HeRefresh: Refreshing Ciphertexts  
LHE schemes limit the depth of the circuit that can be evaluated. Furthermore, in the case of deep NNs, the multiplicative depth of the HE scheme must be a big value that causes computation overhead (as mentioned in Section 3.2). To address these issues, we design a simple but efficient protocol to regularly refresh intermediate layers in NNs, HeRefresh. In this section, we use \([{\mathbf{x}},\ell]\) to denote the ciphertext \([{\mathbf{x}}]\) is at the level \(\ell\), i.e., \(\ell\) multiplications can be performed on this ciphertext). **Ciphertexts refreshing problem. **\(\mathcal{C}\) holds secret key \(sk\), the server has public key \(pk\) but can not access to \(sk\). \(\mathcal{S}\) holds ciphertext \([{\mathbf{x}},\ell]\) (\({\mathbf{x}}\in\mathbb{R}^{n}\)) encrypted under \(sk\). \(\mathcal{S}\) obtains \([{\mathbf{x}},L]\), s.t. \(L>\ell\), without leaking \({\mathbf{x}}\) to \(\mathcal{C}\) and \(\mathcal{S}\). We now present our protocol that solves the ciphertext refreshing problem described above. The protocol is shown in Protocol 2. We now give the intuition behind the protocol and then present the proof for the correctness and security of the protocol (as illustrated in Lemma 2. ```
1:Input\(\mathcal{C}\): Secret key \(sk\)
2:Input\(\mathcal{S}\): Public key \(pk\), \([{\mathbf{x}},\ell]\)
3:Output\(\mathcal{S}\): \([{\mathbf{x}},L]\)
4:\(\mathcal{S}\) runs following steps:
5:\(\mathsf{Picks}\mathbf{r}\leftarrow\mathbb{R}^{n}\)
6:\([{\mathbf{x}}+{\mathbf{r}},\ell]\leftarrow[{\mathbf{x}},\ell]\oplus{\mathbf{r}}\)
7:Sends to \(\mathcal{C}\): \([{\mathbf{x}}+{\mathbf{r}},\ell]\)
8:\(\mathcal{C}\) runs following steps:
9:\(\overline{{\mathbf{x}}+{\mathbf{r}}\leftarrow\mathit{Decrypt}([{\mathbf{x}}+{\mathbf{r}}, \ell],sk)}\)
10:Sends to \(\mathcal{S}\): \([{\mathbf{x}}+{\mathbf{r}},L]\)
11:\(\mathcal{S}\) runs following steps:
12:\([{\mathbf{x}},L]=[{\mathbf{x}}+{\mathbf{r}},L]\odot{\mathbf{r}}\)
```  
**Protocol 2** HeRefresh: Ciphertexts refreshing protocol  
**Intuition. ** The idea of the protocol is as follows. First, \(\mathcal{S}\) additively blinds \([{\mathbf{x}}]\) with a random mask \({\mathbf{r}}\) (line 2) and sends the masked ciphertext \([{\mathbf{x}}+{\mathbf{r}}]\) to \(\mathcal{C}\) (line 3). Then, \(\mathcal{C}\) decrypts the ciphertext and obtains masked message \({\mathbf{x}}+{\mathbf{r}}\), which perfectly hides \({\mathbf{x}}\) from \(\mathcal{C}\) in an information-theoretic way (it is a one-time pad). Then, \(\mathcal{C}\) encrypts the masked message the \([{\mathbf{x}}+{\mathbf{r}}]\). This ciphertext is at the highest level \(L\), as it has not undergone any multiplication. Obviously, the encryption-decryption procedure can be considered as the ciphertext refresher. Finally, \(\mathcal{S}\) homomorphically subtracts \({\mathbf{r}}\) and obtains a new ciphertext,which is an \(L\)-level ciphertext. HeRefresh is essential to enable continued computation without increasing the encryption parameters. Rather than selecting encryption parameters large enough to support the entire NN, we must now only be large enough to support the linear layers and computation in the HeReLU protocol. Proof. : We first prove the correctness and then analyze the security of the protocol based on Definition 1. **Correctness. ** The correctness of the protocol is straightforward. We first consider the level of the ciphertext. At line 5, \(\mathcal{C}\) encrypts the plain message \(\mathbf{x}+\mathbf{r}\) into \([\mathbf{x}+\mathbf{r}]\). This _new_ ciphertext has not undergone any computation; hence, it is at the highest level of the HE scheme, i.e., \(L\). In line 6, the ciphertext involves one homomorphic subtraction; hence, the resulting ciphertext remains at the level \(L\). From now on, for the sake of simplicity, we remove the level notion in ciphertexts. At line 6 of the protocol, \([\mathbf{x}+\mathbf{r}]\odot\mathbf{r}=[\mathbf{x}+\mathbf{r}-\mathbf{r}]=[\mathbf{x}]\). **Security.