## 5 Privacy-Preserving Outsourcing Medical Image Classification Based on Convolutional Neural Network
### Linear Operations
Figure 9 shows the comparison of test loss between the method of computing in plaintext on the local side and our privacy-preserving outsourcing scheme. We select 15 epochs as a sample with obvious fluctuations. We will find that with the increase in epochs, the gap of test loss between the method of computing in plaintext on the local side and our privacy-preserving outsourcing scheme is gradually narrowing. The losses computing at the user end are 0.6332, 0.6568, 0.6545, 0.6765, 0.6625, 0.6514, 0.6601, 0.6618, 0.6624, 0.6498, 0.6331, 0.6367, 0.6223, 0.6354, and 0.6182. The losses with privacy-preserving outsourcing scheme are 1.05377, 1.07591, 1.02434, 1.02974, 1.03277, 0.879127, 0.853824, 0.77706, 0.778715, 0.702974, 0.76854, 0.753241, 0.777706, 0.767706, and 0.762706. With the increase of epochs, the loss gradually decreases, which shows the correctness and rationality of our experiment. Figure 10 shows the local time cost of the direct method and our scheme. In our experiment, samples were divided into training and test data sets in a ratio of 7:3. It could be inferred that the local cost of both direct computation and our scheme increased with the increase of samples. However, when the sample was fixed, the burden of the local end-performing privacy-preserving outsourcing scheme was far less than that of the direct computation, which also confirmed the superiority that it could greatly reduce the computing burden of users when completing the medical image classification. Figure 8: Comparison of test accuracy between the method of computing in plaintext on the local side and our scheme. ## 7 Conclusions and Future Work

In this paper, we propose a scheme for privacy-preserving outsourcing medical image classification, which is the first attempt to outsource a specific medical application based on a convolutional neural network. In practice, it reduces the computing and storage burden on the user side. Combining the knowledge of cloud computing with cryptography, the sensitive information to protect the privacy of the input and the model information can be hidden in the whole scheme. We also carried out a pathological section staining experiment, which proved the efficiency of scheme. The system proposed in the paper is for privacy-preserving outsourcing medical image classification in a semi-honest and non-colluding threat model, which means that we can widely implement medical image classification outsourcing based on a convolutional neural network. Further, we will explore how to achieve new general privacy-preserving outsourcing medical image classification in a semi-honest and non-colluding threat model, which means that we can safely implement medical image classification outsourcing based on a convolutional neural network. Figure 10: The local time cost of the direct method and our scheme. Figure 9: Comparison of test loss between the method of computing in plaintext on the local side and our scheme. schemes for a malicious model in the future. Additionally, we will conduct research on other complex machine-learning algorithms in the future. For example, the training process of a decision tree often contains thousands of parameters, which is very time-consuming, and the data involved usually contains some private information. Therefore, it is necessary to design a privacy-preserving scheme for the process. Methodology, writing--review and editing, conceptualization, Q.Y. and H.Z. ; validation, formal analysis, H.X. ; investigation, software, F.K. All authors have read and agreed to the published version of the manuscript. This research is supported by the National Natural Science Foundation of China (6210221), the Youth Program of Natural Science Foundation of Shandong Province (ZR202102190210), the Key Research and Development Project of Qingdao (21-1-2-21-XX) and the Shandong Provincial Youth Innovation Team (2022 KJ296). Not applicable. The data used to support the findings of this study are available from the corresponding author upon request. The authors declare no conflict of interest.