# Secure Convolution Neural Network Inference Based on Homomorphic Encryption
## 3 System Model, Encryption Scheme and Design Goals
### Formal Definition  
In our scheme, the homomorphic encryption scheme supporting floating point numbers proposed by [PERSON] et al. (2016) is used. Some formal arithmetic definitions of the scheme are given below:  
**Definition 2**.: _Fix a base \(p>0\) and a modulus \(q_{0}\), and let \(q_{l}=p^{l}\cdot q_{0}\), for \(0<l<L\), choose \(\lambda\) as a security parameter, so we can choose a cyclotomic polynomial parameter \(M=M(\lambda,q_{L})\). For a level \(0<l<L\) and a fix \(k\), we definite the \(\ell\)-th level ciphertext is a vector in \(\mathcal{R}_{q_{l}}^{k}\). A level homomorphic encryption scheme is described over the polynomial ring \(\mathcal{R}=\mathbb{Z}(X)/\left(\mathcal{Q}_{M}(X)\right)\) which contains five basic algorithms \((\mathbf{KeyGen},\mathbf{Enc}_{pk},\mathbf{Dec}_{sk},\mathbf{Add},\mathbf{ Mult}_{exk})\) and a rescaling procedure:_  
* \(\mathbf{KeyGen}(1^{\lambda})\)_: choose a security parameter_ \(\lambda\)_, generate a secret key_ \(sk\)_, a public key_ \(pk\) _and a key_ \(evk\) _used for evaluation process;_
* \(\mathbf{Enc}_{pk}(m)\)_: for a given polynomial_ \(m\in\mathcal{R}\)_, output a ciphertext_ \(c\in\mathbf{R}_{q_{L}}^{k}\)_. For some small noisy e,the ciphertext_ \(c\) _for message_ \(m\) _satisfy_ \(\left\langle c,sk\right\rangle=m+e(modq_{L})\)_. A constant_ \(B_{clean}\) _denotes an encryption bound, i.e., error polynomial of a fresh ciphertext satisfies_ \(||e\;||_{\infty}^{cm}\leq B_{clean}\) _with an overwhelming probability;_
* \(\mathbf{Dec}_{sk}(\mathbf{c})\)_: for a ciphertext_ \(c\) _at a level_ \(\ell\)_, output a polynomial_ \(m\prime\leftarrow\left\langle c,sk\right\rangle(modq_{l})\)_;_
* \(\mathbf{Add}(\mathbf{c}_{1},\mathbf{c}_{2})\)_: for the given encrypts of_ \(m_{1},m_{2}\)_, output an encryption of_ \(m_{1}+m_{2}\)_. An error of output ciphertext is bounded by sum of two errors in input ciphertexts;_
* \(\mathbf{Mul}_{evk}(\mathbf{c}_{1},\mathbf{c}_{2})\)_: for a pair of ciphertexts \((c_{1},c_{2})\), output a ciphertext_ \(c_{mult}\in\mathcal{R}_{q_{\ell}}^{k}\) _satisfies_ \(\left\langle c_{mult},sk\right\rangle=\left\langle c_{1},sk\right\rangle \left\langle c_{2},sk\right\rangle+e_{mult}(mod\;q_{l})\) _for some polynomial_ \(e_{mult}\in\mathcal{R}\) _with_ \(||e_{mult}||\;||_{\infty}^{cm}\leq B_{mult}(\ell)\)_;_
* \(\mathbf{RS}_{\ell\to\ell}(c)\)_: for a ciphertext_ \(c\in\mathbf{R}_{q_{\ell}}^{k}\) _at level_ \(\ell\) _and a lower level_ \(\ell^{\prime}<\ell\)_, output the ciphertext_ \(c^{\prime}\leftarrow\left\lfloor\frac{q_{\ell^{\prime}}}{q_{\ell}}\right\rfloor\) _in_ \(c_{mult}\in\mathcal{R}_{q_{\ell^{\prime}}}^{k}\)_, i.e.,_ \(c^{\prime}\) _is obtained by scaling_ \(\frac{q_{\ell^{\prime}}}{q_{\ell}}\) _to the entries of_ \(\mathbf{c}\) _and rounding the coefficients to the closest integers. We will omit the subscript_ \(\ell^{\prime}\leftarrow\ell\)_, when_ \(\ell^{\prime}=\ell-1\)_._  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline \multirow{2}{*}{**Generation**} & \multirow{2}{*}{**Input Data Types**} & **Fast Packing or** & **Fast** & & \\  & & **Batching** & **Bootstrapping** & **Applications** & **Deficiency** \\ \hline First (Gentry09 [4]) & Binary data & Supported & Unsupported & SIMD & Large ciphertext \\ \hline Second (BGV [23], BFV [22]) & Integer & Supported & Unsupported & Fast Escalar Multiplication & Slow \\ \hline Third (FHEW [24], TFHE [25]) & Bitwise & Unsupported & Supported & Efficient Boolean Circuits & No support for \\ \hline Fourth (CKKS [26]) & Real Number & Supported & Unsupported & Fast polynomial approx; SIMD & Slow \\ \hline \hline \end{tabular}
\end{table}
Table 1: The classification of homomorphic encryption schemes.