# Secure Convolution Neural Network Inference Based on Homomorphic Encryption
## 4 Our Scheme
### CNN Private Inference Scheme  
We adopted a network architecture similar to that of [PERSON] et al. [27], and adjusted the size of the convolution kernel, the number of channels, and the step size. The Swish function mentioned in the article by [PERSON] et al. [12] is used in both activation layers to improve the accuracy of inference. The comparison of our model architecture with that of [PERSON] et al. [27] is shown in Table 2.  
The dataset we used to validate the experiment is the MNIST dataset, which contains 70,000 images, of which 60,000 were used for training and 10,000 for testing, containing ten types of handwritten digits from 0 to 9. The MNIST dataset, although old, is still a benchmark for testing in the field of privacy-preserving neural network inference. Figure 3 is an example image from the MNIST dataset. CIFAR-10 is a 10-class image classification dataset consisting of RGB color images of ten different categories. This dataset contains 50,000 training images and 10,000 testing images, with an image size of 32 \(\times\) 32 pixels. The ten categories in CIFAR-10 are airplane, automobile, bird, cat, deer, dog, frog, horse, ship, and truck. Unlike the MNIST dataset, CIFAR-10 [28] is a relatively larger dataset and more challenging as the images have more details and complexity. CIFAR-10 is also widely used in  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Layer** & **Basic Model** & **Our Model** \\ \hline \multirow{2}{*}{CONV} & 64 input images of size 28 \(\times\) 28, 4 kernels of & 64 input images of size 28 \(\times\) 28, 5 kernels of \\  & size 7 \(\times\) 7 (4 channels), stride size of (3, 3) & size 4 \(\times\) 4 (5 channels), stride size of (2, 2) \\ \hline BN & None & \(13\times 13\times 5=845\) outputs \\ \hline ACT-1 & Squaring 256 input values \(x\gets x^{2}\) & \(x\gets 0.03347+0.5\cdot x+0.19566\cdot x^{2}-0.005075x^{4}\) \\ \hline FC-1 & Fully connecting with 8 \(\times\) 8 \(\times\) 4 = 256 inputs & Fully connecting with 13 \(\times\) 13 \(\times\) 5 = 845 inputs \\  & and 64 (neural nodes) outputs & and 100 outputs \\ \hline BN & None & 100 outputs \\ \hline ACT-2 & Squaring 64 input values \(x\gets x^{2}\) & \(x\gets 0.03347+0.5\cdot x+0.19566\cdot x^{2}-0.005075x^{4}\) \\ \hline FC-2 & Fully connecting with 64 inputs and 10 outputs & Fully connecting with 100 inputs and 10 outputs \\ \hline \hline \end{tabular}
\end{table}
Table 2: Model comparison with another scheme which [PERSON] et al. [27] used.  
machine learning and deep learning image classification tasks and is one of the benchmark datasets for many computer vision algorithms. Both of these datasets are relatively small in scale but suitable for model privacy protection in the inference field. When images are encrypted, the size of the information will rapidly expand, which is also a challenge for system performance. Therefore, we have chosen these two benchmark datasets.  
The training phase of the network and the add noise phase mentioned in Section 3.3 are implemented using Python and the Keras framework [29]. Keras is a Python-based deep learning framework that provides many convenient interfaces for researchers to use, and the inference stage is implemented using the SEAL library [30]. The following Table 3 provides an introduction to the characteristics of some open-source libraries for homomorphic encryption schemes.