## 5 Privacy-Preserving Outsourcing Medical Image Classification Based on Convolutional Neural Network
### Linear Operations
The difference between the sum \((+)\) of bit strings of \(a\), \(b\) and the bitwise-XOR \((\oplus)\) of the bit strings of \(a\), \(b\) is equal to the carry bits \(c_{l-1},...,c_{0}\), Then, MSB(\(x\)) can be obtained by computing \(x_{l-1}=c_{l-1}+a_{l-1}+b_{l-1}\), and s converted to compute the carry \(c_{l-1}\) via an \(l\)-bit full adder. The computation process of the secure ReLU function between the two servers \(P_{0}\), \(P_{1}\), \(P_{2}\) is as shown in Algorithm 3. ```
0:\(P_{0}\), \(P_{1}\) and \(P_{2}\) hold \(\langle x\rangle_{0}\), \(\langle x\rangle_{1}\) and \(\langle x\rangle_{2}\), respectively. 0:\(P_{0}\), \(P_{1}\) and \(P_{2}\) get \(\langle z\rangle_{0}=\langle\mathrm{ReLU}(x)\rangle_{0}\), \(\langle z\rangle_{1}=\langle\mathrm{ReLU}(x)\rangle_{1}\) and \(\langle z\rangle_{2}=\langle\mathrm{ReLU}(x)\rangle_{2}\). 1:\(P_{0}\), \(P_{1}\) and \(P_{2}\) get \(\llbracket a_{l-1}\rrbracket\) by run secure MSB(\(x\)). 2:\(P_{i}\) get \(\llbracket a_{l-1}\rrbracket=\llbracket a_{l-1}\rrbracket+i\) to get NOT MSB(\(x\)). 3:\(P_{i}\) changes boolean sharing\(\llbracket a_{l-1}\rrbracket\) to arithmetic shares \(\langle\tilde{a}_{l-1}\rangle\) using the term mixed-circuit computation for any technique that works over both computation domains [40]. 4:\(S_{0}\) and \(S_{1}\) compute \(\langle z\rangle=\langle\tilde{a}_{l-1}\rangle\cdot\langle x\rangle\) according to the SecureLinear algorithm mentioned above. ```
**Algorithm 3** SecureReLU \(\Pi_{SR}\{P_{0},P_{1},P_{2}\}\)

Secure Max Pooling Layer: The max pooling layer reduces the spatial size of the data by selecting the max value in the window. Therefore, we can obtain the max value by comparing the larger of the two numbers many times. The Secure Max Pooling Layer inputs a set of secret shares \(\langle x_{1}\rangle\), \(\langle x_{2}\rangle,...,\langle x_{N_{max}}\rangle\) and outputs the secret shares of results \(\langle z\rangle\). \[max(a_{1},a_{2})=a_{1}+b\cdot(a_{2}-a_{1}) \tag{5}\]

where \(b=\mathrm{MSB}(a_{1}-a_{2})\). According to Equation (5), secure max pooling layer involves _secure_ MSB(\(\cdot\)) _operation_ and secure multiplication operation. The computing process of the secure max pooling layer between the two servers \(P_{0}\), \(P_{1}\), \(P_{2}\) is shown in Algorithm 4. ```
0:\(P_{0}\), \(P_{1}\) and \(P_{2}\) hold the secret shares of input features within the pooling window \(\langle x_{1}\rangle_{0}\),..., \(\langle x_{N_{max}}\rangle_{0}\) and \(\langle x_{1}\rangle_{1},...,\langle x_{N_{max}}\rangle_{1}\) respectively. 0:\(P_{0}\), \(P_{1}\) and \(P_{2}\) obtain \(\langle z\rangle_{0}=\langle max(x_{1},...,x_{N_{max}})\rangle_{0}\), \(\langle z\rangle_{1}=\langle max(x_{1},...,x_{N_{max}})\rangle_{1}\) and \(\langle z\rangle_{2}=\langle max(x_{1},...,x_{N_{max}})\rangle_{2}\). 1:For each \(k\) from \(1\) to \(N_{max}\)do
2:\(P_{i}\) sets \(\langle a_{1}\rangle_{i}=\langle x_{k}\rangle_{i}\), \(\langle a_{2}\rangle_{i}=\langle x_{k+1}\rangle_{i}\). 3:\(P_{0}\), \(P_{1}\) and \(P_{1}\) compute secure MSB(\(\langle a_{1}\rangle-\langle a_{2}\rangle\)) to get the comparison bit \(\llbracket a_{l-1}\rrbracket\). 4:\(P_{i}\) changes boolean sharing\(\llbracket a_{l-1}\rrbracket\) to arithmetic shares \(\langle a_{l-1}\rangle\), it means \(P_{i}\) get \(\langle b\rangle\). 5:\(P_{0}\), \(P_{1}\) and \(P_{1}\) set \(\langle v\rangle=(i-\langle b\rangle)\cdot\langle a_{1}\rangle+\langle b \rangle\cdot\langle a_{2}\rangle\). \(P_{i}\) sets \(\langle x_{k+1}\rangle_{i}=\langle v\rangle_{i}\). 6:EndFor
7:\(P_{i}\) output \(\langle z\rangle_{i}=\langle max(x_{1},...,x_{N_{max}})\rangle_{i}=\langle x_ {N_{max}}\rangle_{i}\). ```

**Algorithm 4** SecureMaxPooling \(\Pi_{SMP}\{P_{0},P_{1},P_{2}\}\)

For two-dimensional max pooling over a window, it needs to perform three comparison operations in order to obtain the max value. To reduce the time cost, it can be obtained by computing the maximum of two pairs of values followed by the maximum of the two results.