# Secure Convolution Neural Network Inference Based on Homomorphic Encryption
## 4 Our Scheme
### Batch Processing in Inference Stage
: _For and that is a power of \(2\), ring \(\mathcal{R}=\mathbb{Z}[x]\big{/}\left(x^{d}+1\right)\), prime integer \(q=q(d)=1 mod2d\), and \(B=\omega\big{(}d\sqrt{logd}\big{)}\), there is an efficiently sample distribution \(\chi\) that outputs elements of \(\mathcal{R}\) of length at most \(B\) with overwhelming probability, such that if there exists an efficient algorithm that solves \(RLWE_{d,q,\chi}\) then there is an efficient quantum algorithm for solving \(f(d)\cdot(q/B)\) -approximate worst-case SVP for ideal lattices over \(\mathcal{R}\), for every super-polynomial factor \(f(d)=d^{\omega(1)}\)._

**Theorem 2** ([34]). : _Let \(K\) denote an arbitrary number field of degree \(n\). Let \(\alpha=\alpha(n)\in(0,1)\) be arbitrary, and let the (rational) integer modulus \(q=q(n)\geq 2\) be such that \(\alpha-q\geq\omega\big{(}\sqrt{logn}\big{)}\). There is a probabilistic polynomial-time quantum reduction from \(K-DGS\gamma\) to \(O_{K}-LWE_{q,\gamma\leq\alpha}\), where \(\gamma=\eta_{e}I-\omega logn/\alpha\)._

Our local client fills the convolution window of multiple images in the same position into a vector \(s\), and enters the vector \(s_{i}\) each into the encoding function \(\mathit{E}cd(z;\Delta)\to p_{i}\), returning the plaintext polynomial \(p_{i}\). Then specify the security level and call the homomorphic encryption scheme \(\mathit{KeyGen}(1^{\lambda})\to\mathit{sk},\mathit{pk},\mathit{ek}\), described in Section 3.2 to obtain the secret key \(\mathit{sk}\) which users keep themselves, the evaluation key \(\mathit{evk}\) is sent to the cloud sever directly. Then call \(\mathit{Enc}_{\mathit{pk}}(p_{i})\) with the returned public key \(\mathit{pk}\), sampling \(v_{i}\leftarrow\mathcal{Z}\mathcal{O}(0.5)\) and \(e_{i_{1}},e_{i_{2}}\leftarrow\mathcal{D}G\big{(}\sigma^{2}\big{)}\), outputs \(v_{i}\cdot\mathit{pk}+\left(p_{i}+e_{i_{1}},e_{i_{2}}\right)(mod\ q_{L})\), encrypts the plaintext polynomial \(p_{i}\) to ciphertext \(c_{i}\), ciphertext \(c_{i}\) satisfy \(\langle c_{i},\mathit{sk}\rangle=p_{i}+e_{i}(modq_{L})\), \(\langle\cdot\rangle\) is the inner product operation. According to Definition 3, the ciphertext form satisfies the uniform random sampling \(A_{N,\mathit{sk},\mathit{ck}}(c_{i})\) on the RLWE distribution, thereby specifying the \(RLWE_{N,\mathit{q,\chi}}(\mathcal{D})\) problem in Definition 4. From Theory 1, the approximate SVP problem on the ideal lattice can be reduced to \(RLWE_{d,\chi}\). Then, the difficulty of restoring the \(p_{i}\) from \(v_{i}\cdot\mathit{pk}+\left(p_{i}+e_{i_{1}},e_{i_{2}}\right)(mod\ q_{L})\) can be based on the difficulty of the approximate SVP problem on the ideal grid. [PERSON] et al. [34] also provide approximate SVP (worst-case) to the search version of R-LWE on an ideal lattice (quantum reduction). When specifying the encryption scheme parameters, we need to consider that the security level of \(\lambda\)-bits [35;36] is met when \(N\geq\frac{\lambda+110}{\lambda 2}log(P\cdot q_{L})\) (\(P\) is the plaintext module), and the security level of 192 bits can be achieved when N is \(2^{15}\), and the maximum bit length of the coefficient modulo \(q_{L}\) is 611 bits. The total length of the coefficient modulus used in our scheme is 540 bits, so this scheme can meet the security level of \(\lambda=192\) bits. Therefore, the security of the information uploaded by users on the cloud service side can be guaranteed. ## 6 Performance Evaluation

In this Section, we evaluate the performance of our proposed privacy-preserving neural network security inference scheme. First, we test the time of atomic operations required in various inference processes of homomorphic encryption schemes under specific parameters, and calculate the total number of various operations in the entire inference process, and the test results are shown in the table of Section 6.1. In Section 6.2, we monitored the time spent by different network layers and memory usage during inference, and the test results are presented in tabular form.