papers/hanzo-fhe-inference/sections/05-encrypted-neural-network-inference.tex

\section{Encrypted Neural Network Inference}

\label{sec:nn}
% ============================================================================

\subsection{Layer-by-Layer Evaluation}

A neural network with $L$ layers is evaluated homomorphically as:
\begin{equation}
\mathbf{h}^{(l)} = \hat{\phi}_d\!\left(W^{(l)} \cdot \mathbf{h}^{(l-1)} +
\mathbf{b}^{(l)}\right), \quad l = 1, \ldots, L,
\end{equation}
where $\mathbf{h}^{(0)} = \texttt{Enc}(\mathbf{x})$ is the encrypted input
and $\hat{\phi}_d$ is the polynomial activation approximation.

\begin{lemma}[Multiplicative Depth]
An $L$-layer neural network with degree-$d$ polynomial activations requires
multiplicative depth $L \cdot (\lceil\log_2 d\rceil + 1)$. For $L = 4$ and
$d = 7$: depth $= 4 \times (3 + 1) = 16$ levels.
\end{lemma}

\subsection{CKKS Parameter Selection}

The ring degree $N$ and ciphertext modulus $Q$ are selected to provide 128-bit
security while supporting the required multiplicative depth:

\begin{table}[H]
\centering
\small
\begin{tabular}{lrrr}
\toprule
\textbf{Depth} & \textbf{Ring $N$} & \textbf{$\log_2 Q$} & \textbf{Security (bits)} \\
\midrule
8 & $2^{14}$ & 438 & 128 \\
16 & $2^{15}$ & 881 & 128 \\
24 & $2^{16}$ & 1761 & 128 \\
\bottomrule
\end{tabular}
\caption{CKKS parameter selection for 128-bit security at various depths.}
\label{tab:params}
\end{table}

% ============================================================================