## 3 PPDT Classification Model
### Proposed Protocol  
The protocol's detailed procedure is illustrated in Figure 3 and Algorithm 1. It comprises eight steps involving data transmission and computation. Let \(K\) represent the number of classes in the classification task \(\mathcal{C}=\{C_{0},C_{1},\ldots,C_{K-1}\}\). Figure 3: Flowchart of the proposed protocol, where \([\cdot]\) denotes the ciphertext of \({}^{\prime}\).”. The following provides a step-by-step description of the protocol:  
**Step 1 (client):**: The client generates a secret-public key pair \((sk,pk)\) and sends \(pk\) to the model holder and server. **Step 2 (client):**: The client encrypts each element of a feature vector by packing it using Equation (6). \[ \begin{split}\llbracket X_{i}\rrbracket_{1}&= \mathsf{Enc}(pk,\mathsf{poly}_{1}(x_{i}^{\mathsf{b}})),\\ \llbracket X_{i}\rrbracket_{2}&=\mathsf{Enc}(pk, \mathsf{poly}_{2}(x_{i}^{\mathsf{b}})).\end{split}  \tag{22}\]  
For \(i=1,\ldots,N\), the client sends ciphertexts to the model holder. **Step 3 (model holder):**: For \(j=1,\ldots,m\), the model holder encrypts threshold \(t_{j}\) by packing it using the Equation (6). \[ \begin{split}\llbracket t_{j}\rrbracket_{1}&= \mathsf{Enc}(pk,\mathsf{poly}_{1}(t_{j}^{\mathsf{b}})),\\ \llbracket t_{j}\rrbracket_{2}&=\mathsf{Enc}(pk, \mathsf{poly}_{2}(t_{j}^{\mathsf{b}})).\end{split}  \tag{23}\]  
For \(k=1,\ldots,m+1\), the model holder generates path vector \(P_{k}\) multiplied by a random number  
\[P_{k}^{\prime}=r_{k}\cdot P_{k}, \tag{24}\]  
and the following classification result vector is generated:  
\[V_{k}:=r_{k}^{\prime}\cdot P_{k}+[\mathsf{score}(L_{k}),0,\ldots,0], \tag{25}\]  
where \(\mathsf{score}(L_{k})\in\mathcal{C},r_{k},r_{k}^{\prime}\in\mathbb{Z}_{p}^{*}\). As described in Section 3.2, the model holder generates \(S\) path matrices \(P_{1},\ldots,P_{S}\) and \(S\) classification result matrices \(V_{1},\ldots,V_{S}\). Note that the path vector and classification result vector corresponding to the same path should be in the same matrix row. For \(s=1,\ldots,S\), path matrix \(P_{s}\) and classification result matrix \(V_{s}\) are encrypted as follows:  
\[ \begin{split}\llbracket P_{s}\rrbracket_{mat}&= \mathsf{Enc}(pk,\mathsf{poly}_{mat}(P_{s})),\\ \llbracket V_{s}\rrbracket_{mat}&=\mathsf{Enc}(pk, \mathsf{poly}_{mat}(V_{s})),\end{split}  \tag{26}\]  
where Equation (16) is used to compute \(\mathsf{poly}_{mat}\). A pair of ciphertexts of the elements of a threshold and its comparative feature vector  
\[(\llbracket X_{\lambda_{j}}\rrbracket_{1},\llbracket X_{\lambda_{j}} \rrbracket_{2}),(\llbracket t_{j}\rrbracket_{1},\llbracket t_{j}\rrbracket_{2}), \tag{27}\]  
and ciphertext pairs of the path matrices and classification result matrices  
\[\llbracket P_{s}\rrbracket_{mat},\llbracket V_{s}\rrbracket_{mat} \tag{28}\]  
are sent to the server for \(j=1,\ldots,m\) and \(s=1,\ldots,S\), respectively. **Step 4 (server):**: The server calculates \(\llbracket d_{j}\rrbracket\) in Equation (10) as \(a=t_{j},b=X_{\lambda_{j}}\). The server masks \(\llbracket d_{j}\rrbracket\) in encrypted form using random polynomial \(\gamma_{j}\leftarrow\mathcal{Z}_{p}\) and then sends \(\llbracket d_{j}^{\prime}\rrbracket\) to the client. **Step 5 (client):**: The client decrypts \(\llbracket d_{j}^{\prime}\rrbracket\) and obtains \(d_{j}^{\prime}=\mathsf{Dec}(sk,\llbracket d_{j}^{\prime}\rrbracket)\), which is then returned to the server. **Step 6 (server):**: The server obtains \(d_{j}\) from Equation (13) and the comparison result vector \(B=[1,b_{1},\ldots,b_{m}]\). If any of the \(i\mu\)-th \((i=0,\ldots,\mu-1)\) coefficients in \(d_{j}\) is zero, then \(b_{j}=1\); otherwise, \(b_{j}=0\). **Step 7 (server):**: The server packs the comparison result vector \(B\) using Equation (14) to obtain \(\mathsf{poly}_{t}(B)\). The server calculates  
\[