## 3 PPDT Classification Model
### Proposed Protocol
As illustrated in Section 3.5, these computation times depend on \(S=\lceil(m+1)/m^{\prime}\rceil\), where \(m^{\prime}=\lfloor n/(m+1)\rfloor\). Thus, as \(m\) increases, the computation time increases rapidly. ## 5 Conclusions

In this paper, we proposed a privacy-preserving decision tree prediction protocol that enables secure outsourcing using homomorphic encryption. The proposed method uses the comparison protocol proposed by [PERSON] et al. [17] or [PERSON] et al. [15] to encrypt both feature vectors of a data holder and decision tree parameters of a model holder, and the structure of a decision tree model is hidden against both data holder and outsourced servers by calculating the path cost using the homomorphic matrix multiplication proposed by [PERSON] et al. [18]. Our experimental results demonstrate that the computation time for three-party protocol using XCMP [15] is drastically reduced by more than 85% compared to the naive two-party protocol without a reduction in the prediction accuracy. In addition, we compared the method using homomorphic matrix multiplication [18] with homomorphic inner product [19]. As a result, we confirmed that there were cases where the computation time was reduced by more than 90%. We also proposed a leaf node pruning (LNP) algorithm to accelerate the three-party prediction protocol. The computation time was reduced by up to 50% when the proposed LNP was applied. However, the proposed method has certain limitations. In particular, while the comparison results at each decision node are revealed to the outsourced server, the server cannot determine which specific feature each node corresponds to. This contrasts with the protocol by [PERSON] et al. [15], which prevents such leakage but incurs significantly higher computational costs. This highlights a fundamental trade-off between security and computational efficiency: our approach enhances scalability and performance at the cost of

Figure 6: Computation time for decision nodes. limited information leakage. In many practical scenarios, this trade-off may be acceptable; however, minimizing data exposure remains a critical objective. In future work, we will aim to design a more efficient protocol that preserves performance while eliminating any information leakage, thereby strengthening both privacy and practicality. Conceptualization, S.F., L.W. and S.O. ; methodology, S.F., L.W. and S.O. ; software, S.F. and S.O. ; validation, S.F. and S.O. ; formal analysis, S.F. and L.W. ; investigation, S.F. and L.W. ; resources, S.O. ; data curation, S.F. ; writing--original draft preparation, S.F., L.W. and S.O. ; writing--review and editing, L.W. ; supervision, S.O. ; project administration, S.O. and L.W. ; funding acquisition, S.O. and L.W. All authors have read and agreed to the published version of the manuscript. This work was partially supported by JST CREST (grant number JPMJCR21M1) and JST AIP accelerated program (grant number JPMJCR22U5), Japan. Not applicable. The original contributions presented in the study are included in the article; further inquiries can be directed to the corresponding author. We would like to thank [PERSON] for the useful discussion. The authors declare no conflicts of interest. ## Notations

The following notations are used in this manuscript:

\(\mathbf{1}\left\{\cdot\right\}\)Functions that return \(1\) if \(\cdot\) is true and \(0\) if false

\(\mu\)

\(A=[a_{0},\ldots a_{\ell-1}]\)Vector of length \(\ell\)

\(A_{d}=[a_{0},\ldots,a_{d-1},0,\ldots,0]\)\(d\)-bit subvector of \(A\)

\(a^{\mathrm{b}}=[a_{0},\ldots,a_{\mu-1}]\)\(\mu\)-bit binary vector of integer \(a\),

where \(a_{\mu-1}\) is the least significant bit of integer \(a\).