## 2 Related Work
### Privacy Preservation
As a consequence, without substantial development, practical adoption is bounded. Alternatively, with a focus on enabling privacy-preserving deep learning-based analysis in real-world applications, [PERSON] et al. [15] proposed an approach in which a simplified encryption scheme based on linear transformations is adapted for both training and inference on encrypted data. The approach is based on linear transformation and relies on the non-commutativity property of matrix algebra. Because of this, the encryption scheme has practical advantages as it requires significantly less computational cost, is noise-free (allowing for an unlimited number of operations without noise accumulation) and implicitly allows for computations on real numbers. It is, however, associated with weaker security compared to standard homomorphic encryption schemes. Numerous open-source homomorphic encryption libraries have arisen in recent years to facilitate the development and use of homomorphic encryption for AI models, including SEAL, HElib, TFHE, PALISADE, cuHE, HEAAN, and HE-transformer [16]. Microsoft's Simple Encrypted Arithmetic Library (SEAL) [17], with support for the Brakerski/Fan-Vercauteren (BFV) [18] and Cheon-Kim-Kim-Song (CKKS) [19] schemes, and IBM's HE-Lib [20] based on the Brakerski-Gentry-Vaikuntanathan (BGV) [21] scheme, are two of the most widely used libraries for building privacy-preserving neural network inference applications. The first and most obvious shortcoming of HELib and SEAL is their noise accumulation behaviour during homomorphic operations, which severely limits the operations that may be done on ciphertexts. Noise-management mechanisms are used to maintain the noise level below a predetermined threshold, hence preventing the ciphertext from becoming corrupted. To accommodate for this, the calculation depth must be specified in advance to provide an adequate noise budget and assure proper decryption. The \"bootstrapping\" technique, which allows for the reduction of noise in ciphertexts when it exceeds a predefined threshold, is regarded inefficient and is frequently the bottleneck of privacy-preserving AI models. For example, inference using a ResNet-20 model on the CIFAR-10 dataset takes approximately four hours when employing the SEAL and CKKS techniques [22]. While there are some works that significantly improve bootstrapping time [23; 24], they consider ciphertexts as single-bit encryptions and use logic gate operations to design arbitrary algorithms as circuits. Additionally, neither HElib nor SEAL directly support floating-point numbers. They treat ciphertexts as integers (or approximations thereof) and perform only multiplication and addition on them. As a result, implicit division is not supported, and non-linear functions must be approximated by low-degree polynomials. Three objectives are critical in the development of privacy-preserving AI models: accuracy, data security, and computational complexity [16]. Extremely safe models are ineffective if their accuracy and computing complexity are inadequate. As a result, depending on the nature of the problem, a trade-off must be made when selecting the encryption mechanisms.