## 2 Related Works
### Lhe-Based SNNI  
This approach utilizes leveled homomorphic encryption (LHE) schemes, e.g., BFV [23] and CKKS [24]. Such schemes allow a limited and predefined number of operations (e.g., additions and multiplications) that can be performed on encrypted data. The computational cost of LHE-based SNNI frameworks grows dramatically with the number of layers in NNs. CryptoNets [12] by Microsoft Research is the initial work for LHE-based SNNI. In this paper, the authors first presented an SNNI framework for a five-layer NN on the MNIST dataset. CryptoNets triggered significant interest in using LHE for SNNI. Based on the idea of CryptoNets, many subsequent works were proposed to improve the performance, scaled to deeper networks, and integrated with deep NN compiler technologies, e.g., CryptoDL [25], BNormCrypt [26], Faster-CryptoNets [27], HCNN [28], E2 DM [29], LoLa [30], CHET [31], SEALion [32], nGraph-HE [33], and nGraph-HE [11]. An essential feature of LHE schemes is that they offer the Single-Instruction-Multiple-Data (SIMD) technique [34], where we can pack multiple plain data into a single ciphertext and performing homomorphic operations on the ciphertext corresponds to simultaneously performing operations on multiple plain data. This feature helps amortize the cost of homomorphic operations, so it increases the throughput of the inference process. However, LHE-based SNNI frameworks have three inherent shortcomings.  
Firstly, LHE-based SNNI frameworks cannot evaluate the ReLU function, commonly used in deep learning. This is because existing LHE schemes do not support the comparison operation, which is required in computing the ReLU function. One solution widely adopted to address the issue is to replace the ReLU function with a polynomial approximation, e.g., CryptoNets replaces the ReLU function with the square function (\(f(x)=x^{2}\)). However, this solution compromises the accuracy of the NN [11]. Additionally, it requires re-training the entire NN, which is a costly procedure. Furthermore, training an NN with polynomial approximation, e.g., square function, unlike the ReLU function, may lead to strange behavior, as the derivative of the square function is unbounded.  
Secondly, LHE-based SNNI restricts the depth of the NNs, as LHE schemes allow only a limited number of operations that can be performed on the encrypted data. Thus, this method is not scalable and suitable for deep learning, where NNs can contain tens, hundreds, or sometimes thousands of layers [35; 36]. These issues can be addressed by using the bootstrapping technique [13]. However, the bootstrapping technique requires circular security and is a costly procedure. So one usually tries to avoid it as much as possible [14].  
Thirdly, and perhaps more importantly, even with many efforts to improve the performance, the computational cost of LHE-based SNNI frameworks is prohibitively large. This is because inference on deep NNs requires a large multiplicative level, leading to large LHE schemes' parameters.  
HeFUN addresses all three mentioned drawbacks of LHE-based SNNI thanks to two novel protocols. That is, the HeReLU protocol can exactly evaluate the ReLU function, which addresses the first drawback, and HeRefresh can refresh ciphertexts, which addresses the second and third drawbacks.