## 5 Privacy-Preserving Outsourcing Medical Image Classification Based on Convolutional Neural Network
### Linear Operations
### Complexity Analysis

When computing a privacy-preserving outsourcing medical image classification based on a convolutional neural network, we should consider the full process of training and inference since back-propagation is used in training, which mainly includes division. In our work, the division operation is achieved with the Goldschmidt method, which computes multiplications. Assuming the number of parameter nodes of the convolution layer and full connection layer is \(n_{1}\) and \(n_{2}\), therefore, the communication complexity of the training is \(\mathcal{O}(n_{1}+n_{2})\) bit. In the process of inference, each round contains a series of time-consuming multiplication operations, which amount to \(\mathcal{O}(n_{1}+n_{2})\) bit, the communication complexity of \(\mathcal{O}(n_{1}+n_{2})\). As for the \(m\) comparison operations in max-pooling layer and Relu function, the round complexity of them are \(\mathcal{O}(mlogl)\) and \(\mathcal{O}(mlogl)\). For linear operation, suppose the stride is \(1\), the number of padding \(p\), and the sizes of input tensor, kernel, and output tensor of the secure convolutional layer are \(c_{1}\times n_{1}\times n_{1}\), \(c_{1}\times c_{2}\times n\times n\) and \(c_{2}\times n_{2}\times n_{2}\) respectively; and the sizes of the input vector and output vector of the fully-connected layer are \(c_{1}\), \(c_{2}\) respectively. As defined, the bit length of an additive secret share is \(1\), and the max pooling window size is \(s\) (e.g., \(s=4\) if the pooling window is \(2\times 2\)), and Table 3 shows the detailed communication complexity analysis. ## 6 Experimental Setup and Results

### Experimental Setup

We run our benchmarks on a commodity desktop equipped with Intel (R) Core i7-11700K CPU @ 3.60 GHz x 4 running Ubuntu 20.04 on a VMware Workstation allocated with 16 GB memory. The samples are trained and tested with a latency of 88.5 ms and a bandwidth of 220 Mbps. We build our implementation on the MP-SPDZ [41]. MP-SPDZ \begin{table}
\begin{tabular}{c c c} \hline \hline
**Secure Function** & **Communication** & **Round Complexity** \\ \hline SReLU & \(30l-24\) & \(logl+2\) \\ SMP & \((n-1)(36l-24)\) & \((n-1)(logl+2)\) \\ SD & \(k[6 lnc_{1}c_{2}(n-n+p+1)^{2}\) & \(k\) \\ \(+4 lnc_{1}c_{2}]\) & & \\ SCONV & \(6 lnc_{1}c_{2}(n_{1}-n+p+1)^{2}\) & \(2 nc_{2}(n_{1}-n+p+1)\) \\ SFC & \(4 lnc_{1}c_{2}\) & \(c_{2}n\) \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Communication Complexity Analysis of Secure. is a high-level library, which not only implements a series of MPC protocols, but also contains building blocks. We write code with Python and compile it into specific bytes. This code can be executed by the virtual machine to form the actual secure computing. This process allows optimization in the MPC context. The framework also has clear and precise computations that can be performed securely. This allows us to lower the cost in the next part. As for the public parameters, we set bit-length \(l=64\), fixed-point precision \(q=13\). Accurate identification and classification of breast cancer subtypes is an important clinical task. The evaluation of invasive breast cancer can be conducted from three aspects: the proportion of glandular tube formation, nuclear polymorphism, and mitotic count. The traditional method, judging by the naked eye, may make mistakes with lower efficiency. Therefore, according to our proposed scheme, we carried out the inference experiment on breast cancer. The three servers on the cloud platform trained the samples preprocessed on the local sides to obtain the model, which could be used to infer images from multiple users. As for the hyperparameter settings in the training processing, it is given in Table 4.

Samples : As for the dataset in our experiment, it consists of normal breast cells and breast cancer (BCa) specimens at \(40\times\), which is shown in Figure 3. Each image is preprocessed to the size of \(50\times 50\) on the local sides. And we get different results by changing the number of images in different experiments.