## 5 Privacy-Preserving Outsourcing Medical Image Classification Based on Convolutional Neural Network
### Linear Operations  
In a convolutional neural network, matrix multiplication is the core operation. The forward and backward computation for both dense layers and convolutional layers are implemented as matrix multiplication, which in turn is based on dot products. Their output \(z_{j}\) can be computed through the formula  
\[z_{j}=\sum_{k=1}^{n}w_{k}\cdot x_{k}+bias,j=1,2,...,m \tag{2}\]  
where \(m\) is the node number of output, \(n\) represents the size of the convolution kernel in the convolution operation, and the node number of input in a fully connected layer, \(w_{k}\), \(x_{k}\) represents the \(k\)th values of weight and corresponding input while \(bias\) is the offset of the corresponding convolution kernel region or node, and the description of relevant formulas can be seen in [38]. Secure linear layers is a function that realizes secure computation of the linear computation described as Equation (1) [39]. It inputs secret shares of the vector \(\langle x\rangle_{i}\) and weight vector \(\langle w\rangle_{i}\) from the input layer or pooling layer and outputs the secret shares of result \(\langle z_{j}\rangle_{i}\) for the subsequent computation of activation functions. Our scheme simply used replicated secret-sharing technology. The multiplication computing process of secure linear layers between the three servers \(P_{0}\), \(P_{1}\), \(P_{2}\) is in Algorithm 2. ```
0:\(P_{0}\) holds (\(\langle x\rangle_{0}\),\(\langle w\rangle_{0}\)); \(P_{1}\) holds (\(\langle x\rangle_{1}\),\(\langle w\rangle_{1}\)), \(P_{2}\) holds (\(\langle x\rangle_{2}\),\(\langle w\rangle_{2}\)) resp. \(r_{i,i+1}\) is generated with a pseudo-random generator using a key pre-shared between \(P_{i}\) and \(P_{i+1}\). 0:\(P_{0}\), \(P_{1}\),\(P_{2}\) get \(\langle x\cdot w\rangle_{i}\) (\(i\in\{0,1,2\}\)) resp. 1:\(P_{i}\) sends its sharing (\(\langle x\rangle_{i}\), \(\langle w\rangle_{i}\)) to \(P_{i+1}\). (If \(i=2,i+1=0\)) Therefore, \(P_{0}\) has the pairs (\(\langle x\rangle_{



In practical experiments, we use a dedicated infrastructure that computes all dot products for matrix multiplication in a single batch of communication to reduce the number of communication rounds. ### Nonlinear Operation

Both rectified linear unit (ReLU) and max-pooling are regarded as non-linear operations that are based on comparison followed by oblivious selection. Rectified linear unit (ReLU) : The ReLU is a nonlinear function that can be expressed by \(\mathrm{ReLU}(x)=max(0,x)\). And the result \(z\) of \(\mathrm{ReLU}(x)\) can be obtained by simply computing

\[z=max(0,x)\rightarrow(x>0)\cdot x. \tag{3}\]

Secure ReLU function aims to compute nonlinear activation function \(\mathrm{ReLU}(x)\) securely. It inputs the secret shares of input value \(\langle x\rangle\) from the convolution layer or full connection layer and outputs the secret shares of results \(\langle z\rangle\); we can refer to [13] for a detailed description. \[z=\llbracket x>0\rrbracket\cdot\langle x\rangle\rightarrow\
eg MSB(x)\cdot \langle x\rangle. \tag{4}\]

According to Equation (4), the secure ReLU function includes two parts, secure MSB(\(\cdot\)) operation, and secure multiplication operation. Among them, secure MSB(\(\cdot\)) operation uses the arithmetic secret shares \(\langle x\rangle\) as input and outputs the Boolean secret shares of the highest bit \(\llbracket a_{l-1}\rrbracket\). Suppose there is a \(l\)-bit secret value \(x\), \(\langle x\rangle_{A}^{A}\), \(\langle x\rangle_{1}^{A}\) are secret shares of it. Let \(x=x_{l-1},...,x_{0}\), \(a=a_{l-1},...,a_{0}\), \(b=b_{l-1},...,b_{0}\) and \(c=c_{l-1},...,c_{0}\) denote \(x\), \(\langle x\rangle_{A}^{A}\), \(\langle x\rangle_{1}^{A}\) and \(\langle x\rangle_{2}^{A}\)with their corresponding bit strings respectively, and they meet \(x=a+b+c\)\((mod\ 2^{l})\).