# Secure Convolution Neural Network Inference Based on Homomorphic Encryption
## 4 Our Scheme
### Batch Processing in Inference Stage
```
1:An activation output ciphertext vector \(A\) of the size \(f\), dense weights matrix \(W\) of the size \(d\times f\), \(d\) is the dense layer output size, dense bias vector \(b\) of the size \(d\times 1\), each image slots \(s\), batch size \(bs\)
2:Ciphertexts ct.\(D\) of dense output vector
3:dense weights plain \(dp\gets 0\)\(\triangleright\)\(dp\in\mathbb{R}^{f\times(bs\times s)}\)
4:for i := 0 to \(f\)do
5:for j := 0 to \(bs\)do
6:for q := 0 to \(d\)do
7:\(dp_{i}\).append(\(W_{[i][p]}\))
8:endfor
9:for k := 0 to \(s\)-\(d\)do
10:\(dp_{i}\).append(0)
11:endfor
12:\(dp_{i}\leftarrow\)Encode(\(dp_{i}\))
13:endfor
14:for i := 0 to \(bs\)do
15:\(V\).append([1, 0, 0,..., 0, 0]) \(\triangleright\) append a vector that size is \(bs\) to \(V\) overt round
16:endfor
17:\(V\leftarrow\)Encode(\(V\))
18:ct.\(A\gets MultP(\)ct.\(A\),\(V\))\(\triangleright\) Only reserve the first slot of each window
19:for i := 0 to \(f\)do
20:for j := 0 to \(\lceil\log 2(s)\rceil\)do
21:\(\text{temp}\leftarrow\)Rot(\(ct.A_{i}\), \(-\text{exp}(j)\)) \(\triangleright\) Move the first slot value to other slots
22:\(ct.A_{i}\leftarrow\)AddInplace(temp)
23:endfor
24:for i := 0 to \(f\)do
25:\(ct.A_{i}\leftarrow\)MultPInplace(\(dp_{i}\))
26:\(ct.A_{i}.\)RescaletoNext()
27:endfor
28:ct.\(D\leftarrow\)AddMany(\(A\))\(\triangleright\) Add f ciphertexts from \(A\) together and store into ct.\(D\)
```

**Algorithm 4** Homomorphic Dense

SIMD [33] technology has long been used by [5; 15]. Cryptonets and MiniONN use CRT technology to split a single large number into multiple small numbers for parallel operations. We have expanded the use of SIMD technology to better integrate the input and output structures of neural networks. It should be noted that the method proposed by us can be applied to all matrix operations necessary for the output of the convolutional layer in all CNNs to enter the dense layer. In the process of connecting neurons, unlike the previous matrix multiplication, we expand each value of the output of the convolutional layer to the same size as the output dimension of the dense layer, and then perform a dot product operation with each row of the dense layer weight matrix, and finally add all the rows at once to compress the output into a ciphertext, and the change of the matrix to the output dimension is also indirectly transferred to the expansion process of the ciphertext slot. ### Dealing with Noise Effects

In Section 3.4, the ciphertext encrypted using the CKKS scheme contains hierarchies, messages, and noise boundaries in addition to the ciphertext itself to dynamically manage the size of the ciphertext. A complete ciphertext can be seen as a quadruple form: \((c,l,v,B),c\in\mathcal{R}^{k}_{qi}\). Compared with the general homomorphic encryption scheme, the CKKS scheme does not prepare an independent plaintext space for the embedded noise, and the message \(m^{\prime}=m+e\) output by the decryption algorithm is slightly different from the original message \(m\), but when the maximum value \(||e||\leq_{\infty}^{can}\) can of the noise vector is much smaller than the maximum value \(||m\ |\ |_{\infty}^{\alpha m}\) can of the message vector, it can be regarded as an approximation of the approximate calculation. For two ciphertext \((c_{1},l,v_{1},B_{1})\) and \((c_{2},l,v_{2},B_{2})\), all parts of noisy if defined by \(\beta_{i}=B_{i}/v_{i}\), \(B_{scale}=\sqrt{N/3}\cdot(3+8\sqrt{h})\), \(B_{ks}=8\sigma N/\sqrt{3}\), \(B_{mult}(l)=P^{-1}\cdot q_{l}\cdot B_{ks}+B_{scale}\). We multiply it once and scale the result to the next level, resulting in a relative error of:

\[\beta^{\prime}=\beta_{1}+\beta_{2}+\beta_{1}\beta_{2}+\frac{B_{mult}(l)+p^{l^ {\prime}-l}B_{scale}}{v_{1}v_{2}} \tag{2}\]

We can approximate it as consuming one level for homomorphic operations, if it is directly decrypted, it will bring \(\beta^{\prime}/q_{l}\) error to the message.