# Secure Convolution Neural Network Inference Based on Homomorphic Encryption
## 4 Our Scheme
### Batch Processing in Inference Stage  
We propose a method to fully utilize the ciphertext slot for batch image encryption in the inference process, addressing the issue of incomplete utilization of the ciphertext slot. To implement this method, we first divide each image into corresponding convolution windows, and then stitch together the images that need to be batched in a manner that does not interfere with subsequent rotation operations. Specifically, we employ an image segmentation algorithm to extract the convolutional windows used by the convolutional layer, where p represents the resulting window matrix, with each row representing a convolutional window. The implementation process of the image segmentation algorithm is described in Algorithm 1. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Library** & **BGV [23]** & **THE [25]** & **FHEW [24]** & **BFV [22]** & **CKKS [26]** & **Language** \\ \hline SEAL [30] & ✓ & ✗ & ✗ & ✓ & ✓ & C++/C \\ \hline HElib [31] & ✓ & ✗ & ✗ & ✗ & ✓ & C++ \\ \hline FHEW [24] & ✗ & ✗ & ✓ & ✗ & ✗ & C++ \\ \hline TFHE [25] & ✗ & ✓ & ✗ & ✗ & ✗ & C++/C \\ \hline HEAAN [32] & ✗ & ✗ & ✗ & ✓ & C++ \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Available open-source libraries for homomorphic encryption. Figure 3: Examples in MNIST dataset. ```
1:A image \(I\) of the size \(h\times w\)(matrix), the size \(k\times k\) of a kernel, and a stride \(s\) of 2 (vertical and horizontal), index of the position of image
2:conv partial of the size \(f^{2}\times k^{2}\)
3:f \(\leftarrow\) (h - k)/strides \(+1\);
4:for\(i\) := 0 to fdo
5:for\(k\) := 0 to fdo
6:for\(i\) := 0 to kdo
7:for\(j\) := 0 to kdo
8:\(p[i\times f+k]\leftarrow\) [I\([s\times i+t][s\times k+j]\)
9:endfor
10:endfor
11:endfor
12:return conv partial
```  
**Algorithm 1** Image Divider  
Subsequently, we need to stitch the batched images together, and the necessary operations required for the subsequent inference steps need to be considered during the stitching process, so we assign the number of plaintext slots of the convolution kernel area plus the sum of the output dimensions of the first dense layer at the same window position for each image. In the preprocessing picture stage, each position is filled with the value of the window, then filled with the number of slots minus 0 of the window size, and then the window in the same position as the next picture, and so on. In subsequent convolution operations, the accumulation step of the vector after the dot product requires a rotation operation. Assuming that there are values at positions 1-8 of the plaintext slot, then we want to add them up, we need to shift them left 1 time and then add them to the original vector, in this case the values in the slot are \(1+2,2+3,3+4,\ldots,8+0\). Next we need to add the first slot to the third slot, so that we can obtain a value of 1-4 in the first slot, and so on, adding up the eight slots needs to be rotated \(log_{2}^{s}\) times, and s is the number of slots that need to be accumulated. In the encryption scheme, the plaintext slot is similar to the structure of the loop queue, the left shifted slot will move to the end of the entire plaintext, in order not to let the value moved to the back end affect the rotation accumulation process, we need to reserve enough slots for each position as Algorithm 2.