# Secure Convolution Neural Network Inference Based on Homomorphic Encryption
## 4 Our Scheme
### Batch Processing in Inference Stage
Since our experimental process is trained with ciphertext, ciphertext reasoning, and the training process is adjusted in plaintext, this means that for the image of the ciphertext state, the weights originally trained may be somewhat unmatched. The decryption result of the CKKS scheme decryption algorithm is actually an approximation of the plaintext, so the noise growth caused by homomorphism may bring some significant accuracy loss. Experimental tests are also carried out in the original text of the encryption scheme, and the output of the \(x^{1024}\) polynomial is calculated under certain parameters, and the accuracy of 10 bits is lost [26]. In our specific image classification privacy protection scheme, we can understand that after the picture is encrypted, even if it is immediately decrypted, the value of each pixel is not the original value, but this error is very small, and the error of the entire picture will make the image \"blurry\", which will have a certain impact on the inference result at the macroscopic level. For example, if we first scale a pixel with a grayscale value of 18 to the [0, 1] interval, the value is about 0.0705882353, and when the plaintext scale scale is \(2^{40}\), the noise carried by the encryption scheme will cause an error to the value of the eighth decimal place after decryption. After ciphertext inference, the error will rise to 5-6 decimal places, and the error of this size will have a certain impact on the accuracy of network reasoning. To solve this problem, we believe that if similar noise is added during the training stage, the model can extract the information of the \"blurred\" state picture, so that the model's learning ability can resist the influence of noise after trying to add standard \(\sigma=5.0\) Gaussian distribution random sampling to the image of the training process as an approximate error, so as to achieve the accuracy effect generated by the above error analysis. In the following Section 6.2, we show the validation experiment and the experimental results, and it turns out that our method has a certain effect. ## 5 Security Analysis

In this Section, we provide the security analysis of the homomorphic encrypted neural network inference scheme; for our solution, it needs to be proved that the ciphertext vector packaged by the local client (each ciphertext contains an extended convolution window) cannot obtain any valid information when the cloud service provider performs operations. Definition 3: Let \(\mathcal{R}^{\vee}\) be the dual fractional ideal of \(\mathcal{R}\) and write \(\mathcal{R}^{\vee}_{q}=\mathcal{R}^{\vee}/q\mathcal{R}^{\vee}\). For a positive integer modulus \(q\geq 2,s\in\mathcal{R}^{\vee}_{q},r\in(\mathbb{R}^{+})^{N}\), and an error distribution \(\mathcal{X}:=\lfloor\ \mathbf{v}



\(\mathbb{H},\mathbb{H}=\left\{z=\left(z_{i}\right)_{j\in Z^{*}_{M}}\in\mathbb{C}^{N}: z_{j}=\overline{z_{-j}},\forall j\in\mathbb{Z}^{*}_{M}\right\}\) and computes its discretization to \(\sigma(\mathcal{R})\) after multiplying a scaling factor \(\Delta\). Return the corresponding integral polynomial \(m(X)=\sigma^{-1}(\lfloor\Delta\cdot\pi^{-}1(z)\sigma R\rceil)\in\mathcal{R}\)

**Definition 6**. : _For a real \(0\leq\rho\leq 1\), we define \(\mathcal{Z}\mathcal{O}(\rho)\) as a distribution that draws each entry in the vector from \(v\in\{0,\pm 1\}^{N}\), with probability \(\rho/2\) for each of \(-1\) and \(+1\), and probability being zero \(1-\rho\)._

**Definition 7**. : _We define \(\mathcal{D}G\big{(}\sigma^{2}\big{)}\) as a sample procedure that samples a vector in \(\digamma^{N}\) by drawing its coefficient independently from the discrete Gaussian distribution of variance \(\sigma^{2}\)_

**Theorem 1** ([34]).