Key-Embedded Privacy for Decentralized AI in Biomedical Omics
Authors: Rongyu Zhang, Hongyu Dong, Gaole Dai, Ziqi Qiao, Shenli Zheng, Yuan Zhang, Aosong Cheng, Xiaowei Chi, Jincai Luo, Pin Li, Li Du, Dan Wang, Yuan Du, Xudong Xing, Jianxu Chen, Shanghang Zhang
Organizations: School of Electronic Science and Engineering, Nanjing University, Nanjing, Jiangsu, 210023, China. · Department of Computing, The Hong Kong Polytechnic University, Hong Kong, 999077, China. · State Key Laboratory of Multimedia Information Processing, Peking University, Beijing, 100871, China. · College of Computer Science and Technology, Zhejiang University, Hangzhou, Zhejiang, 310058, China. · College of Engineering, Westlake University, Hangzhou, Zhejiang, 310058, China. · Zhongguancun Academy, Beijing, 100094, China. · College of Future Technology, Peking University, Beijing, 100871, China. · China Pharmaceutical University, Nanjing, Jiangsu, 211122, China. · Academy of Interdisciplinary Studies, Hong Kong University of Science and Technology, Hong Kong, 999077, China. · Beijing Institute of Genomics, Chinese Academy of Sciences and China National Center for Bioinformation, Beijing, 100101, China. · Leibniz-Institut für Analytische Wissenschaften – ISAS – e.V., Bunsen-Kirchhoff-Str. 11, Dortmund, 44139, Germany.
The rapid adoption of data-driven methods in biomedicine has intensified concerns over privacy, governance, and regulation, limiting raw data sharing and hindering the assembly of representative cohorts for clinically relevant AI. This landscape necessitates practical, efficient privacy solutions, as cryptographic defenses often impose heavy overhead and differential privacy can degrade performance, leading to sub-optimal outcomes in real-world settings. Here, we present a lightweight federated learning method, INFL, based on Implicit Neural Representations that addresses these challenges. Our approach integrates plug-and-play, coordinate-conditioned modules into client models, embeds a secret key directly into the architecture, and supports seamless aggregation across heterogeneous sites. Across diverse biomedical omics tasks, including cohort-scale classification in bulk proteomics, regression for perturbation prediction in single-cell transcriptomics, and clustering in spatial transcriptomics and multi-omics with both public and private data, we demonstrate that INFL achieves strong, controllable privacy while maintaining utility, preserving the performance necessary for downstream scientific and clinical applications.
Figures & tables
Figure 1: Overview of Implicit Neural Federal Learning (INFL). a The left column provides a concise comparison between traditional Federated Learning using explicit neural networks and the proposed approach based on implicit neural networks. In explicit settings, user data utilized for training local models may be vulnerable to attacks if not protected by privacy-preserving mechanisms such as differential privacy (DP) or homomorphic encryption (HE). In contrast, in the implicit framework, the model is inherently secure because it does not directly access raw user data. The right column illustrates the detailed workflow of INFL: each user train Meta Learners alongside the Local Learner and uploads only the Meta Learner parameters. These are then aggregated at the server via the Federated Averaging algorithm. b The top panel demonstrates the application of INFL to cancer subtyping based on protein expression levels. A multilayer perceptron (MLP) classifier (n=14) is initialized on each client and serves as the Local Learner. The middle panel adopts the GEARS model as the backbone architecture to perform gene expression level regression under various perturbations, evaluating both in-domain and out-of-domain gene predictions. The bottom panel employs SpaMosaic as the Local Learner for multi-modal spatial transcriptomics integration, supporting both horizontal integration (same modality across different sections) and mosaic integration (different modalities across sections).
Figure 2: Experimental results on bulk proteomics cancer subtyping task. a Experimental design of an algorithm for the cancer subtyping task, including training data partitioning, the training workflow, the final inference process, and downstream tasks. b Overall classification performance evaluated by quantitative metrics. Accuracy, F1-score, and AUROC are reported, with each metric representing the macro-average across all 14 class labels. c Radar chart displaying the individual AUROC metrics for each of the 14 class labels. d-f Interpretability analysis of the classification model using Shapley values. For each subtype, the top 5 most relevant proteins are shown. The horizontal axis represents the magnitude of the Shapley value, while the color intensity in each beeswarm plot indicates the expression level of the corresponding protein. A positive Shapley value for a highly expressed protein suggests a positive correlation with the cancer subtype, whereas a negative value indicates a negative correlation. d Interpretability analysis for Adenocarcinoma. e Interpretability analysis for Lymphoma. f Interpretability analysis for Transitional cell carcinoma. g Ablation study of INFL. Experiments were conducted after removing the INR module from the original model during the inference, and the overall classification performance was evaluated.
Figure 3: Experimental results on the single-cell transcriptomic perturbation prediction task. a Experimental design of algorithm for the single-cell transcriptomic perturbation prediction task, including training data partitioning, training workflow, final inference process, and downstream tasks. b Ablation study of INFL. Experiments were conducted after removing the INR module from the original algorithm, comparing the MSE metric for the top 20 differentially expressed genes across various scenarios. c-e Model perturbation prediction performance characterized by quantitative metrics. For each scenario, we selected three metrics to demonstrate the performance of each method: the MSE for all genes (MSE(all)), the MSE for the top 20 differentially expressed genes (MSE(de)), and the fraction of top 20 differentially expressed genes with opposite prediction direction (De_op_frac). For all three metrics, lower values indicate better performance. c Performance on the Adamson dataset. d Performance on the Norman dataset under the out-of-domain scenario (unseen_2). e Performance on the private dataset. f Qualitative case study showing model perturbation performance. The dual-gene perturbation ( CEBPE + RUNX1T1 ) from the Norman dataset under the out-of-domain scenario is shown. The green dotted line shows mean unperturbed control gene expression. Boxes indicate experimentally measured differential gene expression after perturbing the gene combination CEBPE and RUNX1T1 . Different symbols shows the mean change in gene expression predicted by different methods when they have not seen CEBPE nor RUNX1T1 experimentally perturbed at the time of training. Whiskers represent the last data point within 1.5× interquartile range. g Perturbation performance quantitatively displayed using hit rate. A prediction is considered accurate if the mean change in gene expression predicted by a method falls within the boxes range. The hit rate is calculated by summarizing the prediction accuracy across all 20 genes.
Figure 4: Experimental results on the horizontal spatial transcriptomics integration task. a Experimental design of the algorithm framework for the spatial transcriptomics horizontal integration task, including training data partitioning, the training workflow, the final inference process and downstream clustering tasks. b Spatial visualization of the clustering results. c Quantitative metrics for the clustering performance, using four indices: ARI, AMI, NMI, and HOM. d Differential expression analysis performed using the INFL clustering results, showing highly differentially expressed genes for each domain. We selected the genes CXCL13 and FABP4 , referenced relevant literature to confirm their biological significance and plotted their spatial distributions. e Spatial distribution maps of the genes CXCL13 and FABP4 . Comparison with the INFL clustering map in panel b shows a strong spatial concordance between the expression of these genes and the locations of the follicle and pericapsular adipose tissue domains respectively, confirming the specificity of gene expression.
Figure 5: Experimental results on the mosaic spatial multi-omics integration task. a Experimental design of the algorithm framework for the spatial multi-omics mosaic integration task, including training data partitioning, the training workflow, the final inference process, and downstream clustering tasks. b Spatial visualization of the clustering results. c Quantitative metrics for the clustering performance, using four indices: ARI, AMI, NMI, and HOM. d Differential expression analysis performed using the INFL clustering results, showing highly differentially expressed genes for each domain. We selected the genes RGS13 and SDC1 , referenced relevant literature to confirm their biological significance, and plotted their spatial distributions. e Spatial distribution maps of the genes RGS13 and SDC1 . Comparison with the INFL clustering map in panel b shows a strong spatial concordance between the expression of these genes and the locations of the germinal center and connective and epithelial tissue domains respectively, confirming the specificity of gene expression.
Extended Data Fig. 1: Supplementary quantitative metrics for perturbation prediction performance. a-b Model perturbation prediction performance characterized by quantitative metrics. The metrics are the same as in Figure 3 c-e, where lower values indicate better performance. a Performance on the Norman dataset under the in-domain (full) scenario. b Performance on the Norman dataset under the in-domain (partial) scenario. c-g Model perturbation prediction performance characterized by other quantitative metrics. For each scenario, we selected three metrics to demonstrate the performance of each method: the Pearson correlation coefficient (PCC) for all genes (Pearson(all)), the PCC for the top 20 differentially expressed genes (Pearson(de)), and the Pearson_delta (measuring the change). For all three metrics, higher values indicate better performance. c Performance on the Adamson dataset. d Performance on the Norman dataset under the in-domain (full) scenario. e Performance on the Norman dataset under the in-domain (partial) scenario. f Performance on the Norman dataset under the out-of-domain scenario. g Performance on the private dataset.
Extended Data Fig. 2: Qualitative presentation of additional cases and hit rate analysis. a-d Qualitative case studies showing model perturbation performance. The green dotted line shows mean unperturbed control gene expression. Boxes indicate experimentally measured differential gene expression after perturbing some genes. Different symbols shows the mean change in gene expression predicted by different methods. Whiskers represent the last data point within 1.5× interquartile range. a Case of FARSB single-gene perturbation (from the Adamson dataset). b Case of ZNF318 and FOXL2 combined perturbation (from the Norman dataset, under the in-domain (full) scenario). c Case of MAP2K6 and IKZF3 combined perturbation (from the Norman dataset, under the in-domain (partial) scenario). d Case of YWHAE single-gene perturbation (from the private dataset). e Perturbation performance for different cases quantitatively displayed using hit rate.
Extended Data Fig. 3: Additional experimental results on protein validation for the mosaic integration task. a Differential expression analysis based on the INFL clustering results, showing the most highly differentially expressed proteins for each domain. We selected the protein CXCR5, consulted relevant literature to confirm its biological significance, and plotted its spatial distribution. b Spatial distribution of the protein CXCR5. Compared with the INFL clustering map in Figure 5 b, its expression shows strong spatial concordance with the germinal center and lymphoid follicle domains, confirming the specificity of this protein.
Appendix figures & tables1 asset
Supplementary material from the paper’s appendix.
Appendix
Supplementary Fig. 9: Sanity check on general classification tasks. a Performance comparison of INFL against four baselines (FL-LP, FL-LP-HE, FL-LP-DP, FL-LoRA-DP, PPML) across five benchmarks (Stanford Cars, Stanford Dogs, CIFAR-100, CLEVR Count, and KITTI Distance), showing accuracy (bar charts). b Computational cost versus accuracy trade-off analysis, highlighting INFL’s efficiency compared to the high-overhead FL-LP-HE baseline. c Robustness evaluation against data heterogeneity under different non-IID levels (Dirichlet concentration α∈{0.3,…,0.7} ) and convergence curves (right column). d Ablation studies examining the impact of varying client numbers (top) and INR sizes (bottom) on model performance. e Privacy stress test comparing the standard INFL against a variant without the meta-learner (simulating an unauthorized attack), demonstrating the necessity of the key-conditioned design for maintaining utility.
This dissertation investigates privacy-preserving federated learning for Alzheimer's disease classification using three-dimensional MRI data from the Alzheimer's Disease Neuroimaging Initiative (ADNI). Existing methodologies often suffer from unrealistic data partitioning, inadequate privacy guarantees, and insufficient benchmarking, limiting their practical deployment in healthcare. To address these gaps, this research proposes a novel site-aware data partitioning strategy that preserves institutional boundaries, reflecting real-world multi-institutional collaborations and data heterogeneity. Furthermore, an Adaptive Local Differential Privacy (ALDP) mechanism is introduced, dynamically adjusting privacy parameters based on training progression and parameter characteristics, thereby significantly improving the privacy-utility trade-off over traditional fixed-noise approaches. Systematic empirical evaluation across multiple client federations and privacy budgets demonstrated that advanced federated optimisation algorithms, particularly FedProx, could equal or surpass centralised training performance while ensuring rigorous privacy protection. Notably, ALDP achieved up to 80.4% accuracy in a two-client configuration, surpassing fixed-noise Local DP by 5-7 percentage points and demonstrating substantially greater training stability. The comprehensive ablation studies and benchmarking establish quantitative standards for privacy-preserving collaborative medical AI, providing practical guidelines for real-world deployment. This work thereby advances the state-of-the-art in federated learning for medical imaging, establishing both methodological foundations and empirical evidence necessary for future privacy-compliant AI adoption in healthcare.
Tin Hoang
School of Computer Science and Electrical and Electronic Engineering, Faculty of Engineering and Physical Sciences, University of Surrey, Guildford, Surrey, GU2 7XH, UK
Background: Federated learning (FL) enables collaborative training of clinical AI models without centralizing patient data, but adoption is limited by privacy concerns, heterogeneous institutional compliance, and resource disparities; standard differential privacy (DP) applies uniform noise to all clients, penalizing well-compliant or under-resourced institutions. Objective: We introduce a compliance-aware FL framework that adapts DP to institutional compliance, letting lower-compliance sites participate without uniformly penalizing others. Methods: A compliance scoring tool aligned with HIPAA, GDPR, NIST, ISO, and HL7/FHIR maps each client score to a per-step Gaussian noise scale for server-side DP-SGD on a small aggregator dataset. The formal (ε,δ) bound applies to the aggregator dataset under a semi-honest aggregator; client-level DP needs secure aggregation (future work). We evaluate five FL strategies on PneumoniaMNIST and BreastMNIST (16 clients, 50 rounds, five seeds); the cumulative aggregator-dataset ε is about 1434 (Breast) and 513 (Pneumonia) at δ=10−5. Results: Including 12 lower-compliance clients (Experiment 1) versus a compliant-only baseline (Experiment 4) changed BreastMNIST accuracy by +4.5 (FedAvg), +6.8 (FedMedian), +5.2 (FedProx), +1.6 (FedYogi), and -4.1 (FedAdam) percentage points (pooled +2.8 pp; not significant at n=5; up to +17 pp per configuration); compliance-weighted allocation matched uniform server-side DP at equal mean noise (+0.1 pp), carrying no utility penalty, and first-round noise cost 1.3 pp (Breast) and 2.5 pp (Pneumonia, FedAvg). Conclusions: Compliance-weighted server-side DP lets lower-compliance institutions join FL without degrading performance, giving auditable per-site noise control at no utility cost; formal guarantees apply to the aggregator dataset, with client-level DP requiring secure aggregation.
Santhosh Parampottupadam, Melih Coşğun, Sarthak Pati +7
German Cancer Research Center (DKFZ), Division of Medical Image Computing, Heidelberg, Germany · Department of Computer Engineering, Bilkent University, Universiteler 06800 Çankaya/Ankara, Türkiye · Medical Research Group, MLCommons, San Francisco, CA, USA +2
Federated Learning (FL) with Differential Privacy (DP) can ensure the protection of healthcare data privacy against malicious user attacks. However, FL with the DP method faces an inherent trade-off: stronger privacy protection degrades predictive accuracy due to injected noise. On the other hand, Homomorphic Encryption (HE) enables computations on encrypted data and the aggregation of encrypted gradients without introducing DP-induced noise, thereby potentially increasing the predictive accuracy. However, it may increase the computation cost. To improve the predictive accuracy while considering the computational ability of heterogeneous clients, we propose a Privacy-Preserving Machine Learning (PPML)-Hybrid method. In the proposed PPML-Hybrid method, clients distributedly select either HE or DP based on their computational resources, so that HE clients contribute noise-free updates while DP clients reduce computational overhead. Meanwhile, clients with high computational resources can flexibly adopt HE or DP according to their privacy needs. Performance evaluation on omics datasets shows that our proposed method achieves comparable predictive accuracy while significantly reducing computation time relative to HE-only. Additionally, it outperforms DP-only methods under equivalent or stricter privacy budgets.
Yusaku Negoya, Feifei Cui, Zilong Zhang +3
Department of Computer and Network Engineering, The University of Electro-Communications, Tokyo, Japan · School of Computer Science and Technology, Hainan University, Haikou 570228, China. · Department of Electrical and Computer Engineering, University of Houston, Houston, TX, 77204, USA +1