# Secure Convolution Neural Network Inference Based on Homomorphic Encryption
## 4 Our Scheme
### Batch Processing in Inference Stage
Our experiment is outlined as follows: we propose a methodology for training neural networks on encrypted data using homomorphic encryption. Our approach involves evaluating the computation depth required for the model inference and choosing suitable encryption parameters, followed by evaluating the noise error generated by the ciphertext produced by this parameter after undergoing homomorphic ciphertext evaluation at this depth. We modify the model to adapt to the arithmetic range (linear, polynomial operations) of homomorphic encryption and embed the noise into the original data to generate adversarial samples for training the model. Our batched ciphertext inference algorithm is embedded into the inference process, and we use both the model trained with and without adversarial training to perform ciphertext inference simultaneously. We observe the similarity between their output probabilities and the output probabilities of plaintext inference to determine the impact of the noise and also observe the efficiency improvement of our batched ciphertext inference algorithm. Our experimental environment is a CPU with Intel-i7 3.6 Ghz, as well as 128 GB of physical memory. The entire client-side encryption process and the inference process on the cloud service side are completed by the experimental environment. ### Numerical Analysis

In this Section, we evaluate the performance of our proposed privacy-preserving neural network security inference scheme, and first we analyze the computational complexity of the entire cryptographic network at the arithmetic level. We write the length and width of the image to be uploaded as \(h\times w\), the length and width of the convolution kernel as \(k\times k\), the step size as \(st\), the number of channels as \(c\), the length and width of dense layer \(1\) as \(wh\times ww\), \(wh\) as the width of the input end, the length and width of dense layer \(1\) as \(di\times do\), the number of plaintext slots allocated for each picture as \(s\), and the time consumption of various homomorphic atomic operations is shown in Table 4.

### Evaluation of Results

Previously, in Section 4.2 we provided improvements to the batch algorithm, in Section 4.3 we stated the effect of noise on the inference results in homomorphic schemes, and in this chapter, our experimental results are shared. In order to verify whether random noise will have an effect at the end of the inference stage, and whether the above method has a certain effect, we verify it by the following method: first randomly select 64 pictures from the test set, and in the case of adding noise in the training phase, the test pictures with the same noise will be (so the test images all contain noise, only show the extraction results) and the output (without classifier) vector in the last layer of the network and the corresponding label vector (the correct result index position is \(1\), the rest of the index position is \(0\)) to enable cosine similarity with the image without adding noise under the same model, and then compare the effect of the two training modes (the image position is the same), and the comparison results are shown in the Table 5. Under the parameters of ten epochs, we can see that there is a relatively large \begin{table}
\begin{tabular}{c c c} \hline \hline
**Operation** & **Time Consumption(s)** & **Evaluation Times** \\ \hline Encryption & 0.43155 & \(((h-k)/s+1)^{2}\) \\ \hline Multiplication(Ciphertext) & 0.00714 & \(\mathbf{4}\times((h-k)/s+1)^{2}\) \\ \hline Multiplication(Plaintext) & 0.00198 & \((c+4)\times((h-k)/s+1)^{2}+(wh+di+3)\) \\ \hline Relinearization & 0.07435 & \(2\times((h-k)/s+1)^{2}+2\) \\ \hline Rescale & 0.01009 & \((c+8)\times((h-k)/s+1)^{2}+(wh+di+3)\) \\ \hline Rotation & 0.01009 & \(c\times(\lceil\texttt{log2}(k^{2})\rceil+\lceil\texttt{log2}(s)\rceil)\times((h-k )/s+1)^{2}\) \\ \hline Add & 0.00080 & \((c+5)(\lceil\texttt{log2}(k^{2})\rceil+\lceil\texttt{log2}(s)\rceil)\times((h-k )/s+1)^{2}+(3+do)\) \\ \hline \hline \end{tabular}
\end{table}