Encrypted Image Classification

Definition

Image classification is the task of assigning an image to one of a fixed set of classes. In the encrypted setting the image is secret and the model runs homomorphically: nothing is decrypted between the encrypted input and the encrypted output.

Given an encrypted image represented as a real vector $x \in \mathbb{R}^N$, a fixed model $f$ is evaluated on the ciphertext to produce a score vector

over $C$ classes. The predicted class is the slot of greatest score,

Context

The operation is defined over real-valued data encrypted under an approximate homomorphic scheme (CKKS). The model $f$ is a fixed function from an $N$-dimensional image vector to a $C$-dimensional score vector; it is applied to the ciphertext without access to the plaintext input. What varies between specifications is the scheme and its parameters, the image size and layout, the number of classes, the dataset, and the model itself.

The kernel states only the input/output contract and the classification semantics. It does not fix a model architecture, a preprocessing pipeline, an approximation strategy, or accuracy figures — those are properties of a specification and of the submitted solution.

Composition

This is an end-to-end application kernel (abstraction level "applications"), not a primitive. A solution is built by composing lower-level component kernels of the catalogue, for example:

• matrix multiplication and linear maps for the dense and convolutional layers;
• activation approximations — such as relu, sign, logistic, gelu — evaluated as polynomials on ciphertext;
• reductions and score-producing steps such as softmax.

The application defines the outer contract (encrypted image in, encrypted class scores out); the component kernels supply the arithmetic underneath.

Parameters Defined by Specifications

A specification pins the general classification task down to a concrete problem by fixing:

• the encryption scheme and its parameters (here CKKS);
• the image representation and its length $N$;
• the number of classes $C$;
• the dataset and its labelling;
• the correctness metric (classification accuracy against plaintext labels);
• what is secret and what is fixed/public (the input versus the model).

Applications

Encrypted image classification supports private machine-learning inference: image-based diagnosis on confidential medical scans, classification of private photographs, and any setting where an image owner wants a prediction from a model without revealing the image and without the model holder learning the input or the result.