Federated Learning for Privacy-Preserving Medical AI

Tin Hoang

cs.LGMar 16, 2026

Federated Learning for Privacy-Preserving Medical AI

Authors: Tin Hoang

Organizations: School of Computer Science and Electrical and Electronic Engineering, Faculty of Engineering and Physical Sciences, University of Surrey, Guildford, Surrey, GU2 7XH, UK

Abstract

This dissertation investigates privacy-preserving federated learning for Alzheimer's disease classification using three-dimensional MRI data from the Alzheimer's Disease Neuroimaging Initiative (ADNI). Existing methodologies often suffer from unrealistic data partitioning, inadequate privacy guarantees, and insufficient benchmarking, limiting their practical deployment in healthcare. To address these gaps, this research proposes a novel site-aware data partitioning strategy that preserves institutional boundaries, reflecting real-world multi-institutional collaborations and data heterogeneity. Furthermore, an Adaptive Local Differential Privacy (ALDP) mechanism is introduced, dynamically adjusting privacy parameters based on training progression and parameter characteristics, thereby significantly improving the privacy-utility trade-off over traditional fixed-noise approaches. Systematic empirical evaluation across multiple client federations and privacy budgets demonstrated that advanced federated optimisation algorithms, particularly FedProx, could equal or surpass centralised training performance while ensuring rigorous privacy protection. Notably, ALDP achieved up to 80.4% accuracy in a two-client configuration, surpassing fixed-noise Local DP by 5-7 percentage points and demonstrating substantially greater training stability. The comprehensive ablation studies and benchmarking establish quantitative standards for privacy-preserving collaborative medical AI, providing practical guidelines for real-world deployment. This work thereby advances the state-of-the-art in federated learning for medical imaging, establishing both methodological foundations and empirical evidence necessary for future privacy-compliant AI adoption in healthcare.

Figures & tables

Figure 2.1 : Traditional centralised training paradigm in medical AI. Multiple healthcare institutions aggregate sensitive patient data in centralised repositories, creating privacy risks, regulatory compliance challenges, and single points of failure that limit collaborative medical AI development.

Figure 2.2 : Federated learning paradigm for privacy-preserving collaborative medical AI. Healthcare institutions maintain local data sovereignty whilst participating in collaborative model development through secure parameter aggregation, eliminating the need for centralised data repositories whilst preserving privacy and regulatory compliance.

Figure 3.1 : Overview of federated learning with Adaptive Local Differential Privacy (ALDP) in multi-institutional medical imaging. Each medical institution trains a local 3D CNN model on its private MRI data and applies local differential privacy by adding calibrated Gaussian noise to model parameters before transmission. In ALDP, both the privacy budget $\varepsilon_{t}$ and noise scale $\sigma_{\text{base}}$ are adapted per round and per parameter tensor to improve privacy-utility trade-off. After each round, noisy local model updates are transmitted to a central server, where federated averaging is performed and the aggregated global model is broadcast back to all participating clients.

Framework	Easy to use	Documentation	Features	Community	Score
Flower	Highly user-friendly with intuitive APIs and extensive tutorials.	Comprehensive and well-maintained with numerous tutorials.	Cross-device FL, scalable client-server architecture, FedAvg/SecAgg/DP support, PyTorch integration	6200+ GitHub stars, 164+ contributors. Active community.	84.75%
PySyft	Steeper learning curve for beginners.	Some documentation may be outdated or less detailed.	Privacy-focused (DP, SMPC), encrypted computation, PyTorch-based	9600+ GitHub stars, 428+ contributors.	72.5%
OpenFL	Balanced between ease of use and robustness for research and production.	Decent documentation covering installation, tutorials, and API references.	Workflow-based FL, enterprise-ready, model aggregation, PyTorch and TensorFlow support.	2000+ GitHub stars, 164+ contributors.	69%
NVFlare	Production-focused with good documentation, suitable for users familiar with FL concepts.	Detailed documentation with guides for getting started and advanced topics.	Privacy-preserving FL, large file streaming, multi-cloud support, FedAvg/FedProx	700+ GitHub stars, 46+ contributors.	80.5%

Table 4.1 : Comparative analysis of some prominent federated learning frameworks based on ease of use, documentation quality, features, community support, and overall score from Riedel et al. [40] .

Figure 4.1 : Implementation architecture for federated learning-based ADNI classification system. The framework integrates the Flower federated learning platform with MONAI medical imaging capabilities and PyTorch deep learning infrastructure. The modular design supports multiple federated learning strategies and enables both local simulation and distributed deployment across cloud servers for large-scale experiments. Comprehensive experiment tracking and monitoring are provided through Weights & Biases integration.

Figure 5.1 : ADNI dataset filtering process using Analysis Ready Cohort (ARC) Builder on ida.loni.usc.edu platform, showing selection criteria for 3T MRI acquisitions and demographic filtering parameters.

Figure 5.2 : Overview of the ADNI MRI image preprocessing pipeline. The workflow comprises: (1) downloading raw DICOM files; (2) converting DICOM series to volumetric NIfTI format; (3) resampling to $1\;\mathrm{mm}^{3}$ isotropic voxel spacing for spatial consistency; (4) non-linear spatial normalization to the ICBM152 MNI template for anatomical alignment across subjects; and (5) skull stripping to remove non-brain tissue. This multi-step pipeline ensures each image is harmonised and analysis-ready for robust multi-site neuroimaging studies.

Diagnosis	#Subjects	Gender (Male/Female)	Age (years)
Cognitively Normal (CN)	490	199/291	$70.58\pm 6.62$
Dementia (AD)	307	174/133	$73.45\pm 7.86$

Table 5.1 : Development dataset statistics showing distribution of subjects across diagnostic categories for training and validation

Diagnosis	#Subjects	Gender (Male/Female)	Age (years)
Cognitively Normal (CN)	50	15/35	$68.90\pm 6.57$
Dementia (AD)	50	33/17	$73.97\pm 7.62$

Table 5.2 : Independent test dataset statistics showing balanced distribution across diagnostic categories for final evaluation

Layer	Type	Kernel Size	Pooling	Output Channels
Layer 1	Conv3d + BN + ReLU + MaxPool	(3,3,3)	(4,4,4)	8
Layer 2	Conv3d + BN + ReLU	(3,3,3)	-	8
Layer 3	Conv3d + BN + ReLU + MaxPool	(3,3,3)	(3,3,3)	16
Layer 4	Conv3d + BN + ReLU	(3,3,3)	-	16
Layer 5	Conv3d + BN + ReLU + MaxPool	(3,3,3)	(2,2,2)	32
Layer 6	Conv3d + BN + ReLU	(3,3,3)	-	32

Table 5.3 : 3D CNN (CNN_8CL) architecture for 3D ADNI MRI classification

Strategy	#Clients	Global Test Accuracy (%)	Global Test F1 (%)
CL (Centralised)	–	80.2 $\pm$ 2.23	79.66 $\pm$ 2.51
FedAvg	2	79.2 $\pm$ 1.94	78.84 $\pm$ 2.17
FedProx (best $\mu=10^{-5}$ )	2	80.4 $\pm$ 2.33	80.05 $\pm$ 2.44
FedAvg	3	79.2 $\pm$ 2.23	78.93 $\pm$ 2.36
FedProx (best $\mu=10^{-5}$ )	3	81.4 $\pm$ 3.20	81.26 $\pm$ 3.24
SecAgg+	3	78.2 $\pm$ 2.14	77.79 $\pm$ 2.30

Table 6.1 : Cross-validation results on the test set of the 3D CNN model under centralised and 2/3/4-client settings

Panel of Figure 6 — Figure 6.1 : Normalized confusion matrices comparing centralised training with the best-performing federated approach.

Strategy	#Clients	Privacy Budget ( $\epsilon$ )	Global Test Accuracy (%)	Global Test F1 (%)
CL (Centralised)	–	–	78.6 $\pm$ 3.38	78.06 $\pm$ 3.49
( $\epsilon$ , $\delta$ )-DP	2	100	55.2 $\pm$ 4.26	50.05 $\pm$ 8.29
( $\epsilon$ , $\delta$ )-DP	2	500	70.2 $\pm$ 4.45	68.71 $\pm$ 5.66
( $\epsilon$ , $\delta$ )-DP	2	1000	72.0 $\pm$ 4.94	71.04 $\pm$ 5.55
( $\epsilon$ , $\delta$ )-DP	2	2000	75.6 $\pm$ 4.63	74.81 $\pm$ 5.71
Adaptive ( $\epsilon$ , $\delta$ )-DP	2	initial $\varepsilon_{0}$ =100	60.8 $\pm$ 4.53	56.70 $\pm$ 8.21

Table 6.2 : Comparative performance of Local (

\epsilon

\delta

)-DP and Adaptive Local (

\epsilon

\delta

)-DP (ALDP) strategies across varying numbers of clients and epsilon values, with

\delta

fixed at

1\times 10^{-5}

and the clipping norm set to 1.0 for all experiments.

Strategy	Client 1 Test Acc (%)	Client 2 Test Acc (%)	Client 3 Test Acc (%)	Client 4 Test Acc (%)	All Test Acc (%)
CL	68.2 $\pm$ 2.93	72.8 $\pm$ 9.66	70.6 $\pm$ 5.16	75.4 $\pm$ 1.02	80.2 $\pm$ 2.23

Table 6.3 : Results of an ablation study assessing the impact of individual client contributions in a federated learning setting. Each client was trained independently using only its own dataset, without data sharing, and evaluated on the same balanced test set (50 CN and 50 AD samples) as the global test set in the federated learning experiment presented in Table 6.1 . The final column reports centralized training results, combining data from all four clients, which demonstrates improved performance through data aggregation.

Strategy	Average Training Time (h:mm:ss)	Relative to Centralised (%)
CL (Centralised)	2:52:07	100.0
FedAvg	3:30:22	121.9
FedProx	3:58:00	138.0
SecAgg+	2:39:56	92.9
Local DP	3:31:50	122.6
ALDP	3:56:43	137.2

Table 6.4 : Average total training time comparison across centralised and federated learning strategies (on 4-client scenario) for 100 training rounds/epochs. Results represent mean values computed from five independent experimental runs for each strategy.

Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

Category	Parameter	Value	Description
Training	Batch Size	2–8	Varies on different number of concurrent clients
Training	Learning Rate	$1\times 10^{-4}$	Initial learning rate
Training	LR Scheduler	Cosine	Learning rate scheduler
Training	Optimizer	AdamW	Optimization algorithm
Training	Weight Decay	$1\times 10^{-2}$	Weight Decay regularization
Training	Mixed Precision	False	Enable automatic mixed precision

Appendix

Table A.1 : Key Hyperparameters for Federated Learning Training

Strategy	#Clients	$\mu$	Global Test Accuracy (%)	Global Test F1 (%)
CL (centralised)	-	-	80.2 $\pm$ 2.23	79.66 $\pm$ 2.51
FedProx	2	$1.0$	79.6 $\pm$ 4.32	79.11 $\pm$ 4.75
FedProx	2	$10^{-1}$	80.2 $\pm$ 2.23	79.91 $\pm$ 2.33
FedProx	2	$10^{-3}$	79.2 $\pm$ 3.37	78.77 $\pm$ 3.86
FedProx	2	$10^{-5}$	80.4 $\pm$ 2.33	80.05 $\pm$ 2.44
FedProx	3	$1.0$	78.2 $\pm$ 4.96	77.41 $\pm$ 6.15

Appendix

Table A.2 : Hyper-parameter tuning results for FedProx across different numbers of clients, illustrating the effect of varying

\mu

values on global test accuracy and F1 score.

Explore similar work

ADP-FL-MedSeg: Adaptive Differential Privacy for Federated Medical Segmentation Across Diverse Modalities
Apr 7, 2026Puja Saha, Eranga UkwattaDifferentially Private Federated Learning Medical Image Segmentation
College of Engineering, University of Guelph, 50 Stone Road E, Guelph, ON, Canada
Similarity Weighted Aggregation with Global Differential Privacy for Federated Brain Lesion Segmentation
Aug 1, 2026Muhammad Irfan Khan, Eero Lehtonen, Joni Obradovic +4Federated Learning Aggregation Non-IID Federated Learning
Turku University of Applied Sciences, Turku 20520, Finland
TrustFed: Enabling Trustworthy Medical AI under Data Privacy Constraints
Mar 23, 2026Vagish Kumar, Syed Bahauddin Alam, Souvik ChakrabortyFederated Learning Uncertainty Quantification
Department of Applied Mechanics Indian Institute of Technology Delhi · Grainger College of Engineering Nuclear, Plasma & Radiological Engineering Department National Center for Supercomputing Applications, Urbana, IL, USA · Department of Applied Mechanics Yardi School of Artificial Intelligence (ScAI) Grainger College of Engineering Indian Institute of Technology Delhi University of Illinois Urbana-Champaign, Urbana, IL, USA

Apr 7, 2026J/K move · Enter open · S save

ADP-FL-MedSeg: Adaptive Differential Privacy for Federated Medical Segmentation Across Diverse Modalities

Puja Saha, Eranga Ukwatta

College of Engineering, University of Guelph, 50 Stone Road E, Guelph, ON, Canada

Differentially Private Federated Learning Medical Image Segmentation

Open paper AskPDF arXiv

Large volumes of medical data remain underutilized because centralizing distributed data is often infeasible due to strict privacy regulations and institutional constraints. In addition, models trained in centralized settings frequently fail to generalize across clinical sites because of heterogeneity in imaging protocols and continuously evolving data distributions arising from differences in scanners, acquisition parameters, and patient populations. Federated learning offers a promising solution by enabling collaborative model training without sharing raw data. However, incorporating differential privacy into federated learning, while essential for privacy guarantees, often leads to degraded accuracy, unstable convergence, and reduced generalization. In this work, we propose an adaptive differentially private federated learning (ADP-FL) framework for medical image segmentation that dynamically adjusts privacy mechanisms to better balance the privacy-utility trade-off. The proposed approach stabilizes training, significantly improves Dice scores and segmentation boundary quality, and maintains rigorous privacy guarantees. We evaluated ADP-FL across diverse imaging modalities and segmentation tasks, including skin lesion segmentation in dermoscopic images, kidney tumor segmentation in 3D CT scans, and brain tumor segmentation in multi-parametric MRI. Compared with conventional federated learning and standard differentially private federated learning, ADP-FL consistently achieves higher accuracy, improved boundary delineation, faster convergence, and greater training stability, with performance approaching that of non-private federated learning under the same privacy budgets. These results demonstrate the practical viability of ADP-FL for high-performance, privacy-preserving medical image segmentation in real-world federated settings.

Abstract

Explore similar work

ADP-FL-MedSeg: Adaptive Differential Privacy for Federated Medical Segmentation Across Diverse Modalities

Similarity Weighted Aggregation with Global Differential Privacy for Federated Brain Lesion Segmentation

TrustFed: Enabling Trustworthy Medical AI under Data Privacy Constraints