cs.LGMar 30, 2026
SaveKey-Embedded Privacy for Decentralized AI in Biomedical Omics
Organizations: School of Electronic Science and Engineering, Nanjing University, Nanjing, Jiangsu, 210023, China. · Department of Computing, The Hong Kong Polytechnic University, Hong Kong, 999077, China. · State Key Laboratory of Multimedia Information Processing, Peking University, Beijing, 100871, China. · College of Computer Science and Technology, Zhejiang University, Hangzhou, Zhejiang, 310058, China. ·
Abstract
The rapid adoption of data-driven methods in biomedicine has intensified concerns over privacy, governance, and regulation, limiting raw data sharing and hindering the assembly of representative cohorts for clinically relevant AI. This landscape necessitates practical, efficient privacy solutions, as cryptographic defenses often impose heavy overhead and differential privacy can degrade performance, leading to sub-optimal outcomes in real-world settings. Here, we present a lightweight federated learning method, INFL, based on Implicit Neural Representations that addresses these challenges. Our approach integrates plug-and-play, coordinate-conditioned modules into client models, embeds a secret key directly into the architecture, and supports seamless aggregation across heterogeneous sites. Across diverse biomedical omics tasks, including cohort-scale classification in bulk proteomics, regression for perturbation prediction in single-cell transcriptomics, and clustering in spatial transcriptomics and multi-omics with both public and private data, we demonstrate that INFL achieves strong, controllable privacy while maintaining utility, preserving the performance necessary for downstream scientific and clinical applications.
Figures & tables
Figure 1: Overview of Implicit Neural Federal Learning (INFL). a The left column provides a concise comparison between traditional Federated Learning using explicit neural networks and the proposed approach based on implicit neural networks. In explicit settings, user data utilized for training local models may be vulnerable to attacks if not protected by privacy-preserving mechanisms such as differential privacy (DP) or homomorphic encryption (HE). In contrast, in the implicit framework, the model is inherently secure because it does not directly access raw user data. The right column illustrates the detailed workflow of INFL: each user train Meta Learners alongside the Local Learner and uploads only the Meta Learner parameters. These are then aggregated at the server via the Federated Averaging algorithm. b The top panel demonstrates the application of INFL to cancer subtyping based on protein expression levels. A multilayer perceptron (MLP) classifier (n=14) is initialized on each client and serves as the Local Learner. The middle panel adopts the GEARS model as the backbone architecture to perform gene expression level regression under various perturbations, evaluating both in-domain and out-of-domain gene predictions. The bottom panel employs SpaMosaic as the Local Learner for multi-modal spatial transcriptomics integration, supporting both horizontal integration (same modality across different sections) and mosaic integration (different modalities across sections).
Figure 2: Experimental results on bulk proteomics cancer subtyping task. a Experimental design of an algorithm for the cancer subtyping task, including training data partitioning, the training workflow, the final inference process, and downstream tasks. b Overall classification performance evaluated by quantitative metrics. Accuracy, F1-score, and AUROC are reported, with each metric representing the macro-average across all 14 class labels. c Radar chart displaying the individual AUROC metrics for each of the 14 class labels. d-f Interpretability analysis of the classification model using Shapley values. For each subtype, the top 5 most relevant proteins are shown. The horizontal axis represents the magnitude of the Shapley value, while the color intensity in each beeswarm plot indicates the expression level of the corresponding protein. A positive Shapley value for a highly expressed protein suggests a positive correlation with the cancer subtype, whereas a negative value indicates a negative correlation. d Interpretability analysis for Adenocarcinoma. e Interpretability analysis for Lymphoma. f Interpretability analysis for Transitional cell carcinoma. g Ablation study of INFL. Experiments were conducted after removing the INR module from the original model during the inference, and the overall classification performance was evaluated.
Figure 3: Experimental results on the single-cell transcriptomic perturbation prediction task. a Experimental design of algorithm for the single-cell transcriptomic perturbation prediction task, including training data partitioning, training workflow, final inference process, and downstream tasks. b Ablation study of INFL. Experiments were conducted after removing the INR module from the original algorithm, comparing the MSE metric for the top 20 differentially expressed genes across various scenarios. c-e Model perturbation prediction performance characterized by quantitative metrics. For each scenario, we selected three metrics to demonstrate the performance of each method: the MSE for all genes (MSE(all)), the MSE for the top 20 differentially expressed genes (MSE(de)), and the fraction of top 20 differentially expressed genes with opposite prediction direction (De_op_frac). For all three metrics, lower values indicate better performance. c Performance on the Adamson dataset. d Performance on the Norman dataset under the out-of-domain scenario (unseen_2). e Performance on the private dataset. f Qualitative case study showing model perturbation performance. The dual-gene perturbation ( CEBPE + RUNX1T1 ) from the Norman dataset under the out-of-domain scenario is shown. The green dotted line shows mean unperturbed control gene expression. Boxes indicate experimentally measured differential gene expression after perturbing the gene combination CEBPE and RUNX1T1 . Different symbols shows the mean change in gene expression predicted by different methods when they have not seen CEBPE nor RUNX1T1 experimentally perturbed at the time of training. Whiskers represent the last data point within 1.5× interquartile range. g Perturbation performance quantitatively displayed using hit rate. A prediction is considered accurate if the mean change in gene expression predicted by a method falls within the boxes range. The hit rate is calculated by summarizing the prediction accuracy across all 20 genes.
Figure 4: Experimental results on the horizontal spatial transcriptomics integration task. a Experimental design of the algorithm framework for the spatial transcriptomics horizontal integration task, including training data partitioning, the training workflow, the final inference process and downstream clustering tasks. b Spatial visualization of the clustering results. c Quantitative metrics for the clustering performance, using four indices: ARI, AMI, NMI, and HOM. d Differential expression analysis performed using the INFL clustering results, showing highly differentially expressed genes for each domain. We selected the genes CXCL13 and FABP4 , referenced relevant literature to confirm their biological significance and plotted their spatial distributions. e Spatial distribution maps of the genes CXCL13 and FABP4 . Comparison with the INFL clustering map in panel b shows a strong spatial concordance between the expression of these genes and the locations of the follicle and pericapsular adipose tissue domains respectively, confirming the specificity of gene expression.
Figure 5: Experimental results on the mosaic spatial multi-omics integration task. a Experimental design of the algorithm framework for the spatial multi-omics mosaic integration task, including training data partitioning, the training workflow, the final inference process, and downstream clustering tasks. b Spatial visualization of the clustering results. c Quantitative metrics for the clustering performance, using four indices: ARI, AMI, NMI, and HOM. d Differential expression analysis performed using the INFL clustering results, showing highly differentially expressed genes for each domain. We selected the genes RGS13 and SDC1 , referenced relevant literature to confirm their biological significance, and plotted their spatial distributions. e Spatial distribution maps of the genes RGS13 and SDC1 . Comparison with the INFL clustering map in panel b shows a strong spatial concordance between the expression of these genes and the locations of the germinal center and connective and epithelial tissue domains respectively, confirming the specificity of gene expression.
Extended Data Fig. 1: Supplementary quantitative metrics for perturbation prediction performance. a-b Model perturbation prediction performance characterized by quantitative metrics. The metrics are the same as in Figure 3 c-e, where lower values indicate better performance. a Performance on the Norman dataset under the in-domain (full) scenario. b Performance on the Norman dataset under the in-domain (partial) scenario. c-g Model perturbation prediction performance characterized by other quantitative metrics. For each scenario, we selected three metrics to demonstrate the performance of each method: the Pearson correlation coefficient (PCC) for all genes (Pearson(all)), the PCC for the top 20 differentially expressed genes (Pearson(de)), and the Pearson_delta (measuring the change). For all three metrics, higher values indicate better performance. c Performance on the Adamson dataset. d Performance on the Norman dataset under the in-domain (full) scenario. e Performance on the Norman dataset under the in-domain (partial) scenario. f Performance on the Norman dataset under the out-of-domain scenario. g Performance on the private dataset.
Extended Data Fig. 2: Qualitative presentation of additional cases and hit rate analysis. a-d Qualitative case studies showing model perturbation performance. The green dotted line shows mean unperturbed control gene expression. Boxes indicate experimentally measured differential gene expression after perturbing some genes. Different symbols shows the mean change in gene expression predicted by different methods. Whiskers represent the last data point within 1.5× interquartile range. a Case of FARSB single-gene perturbation (from the Adamson dataset). b Case of ZNF318 and FOXL2 combined perturbation (from the Norman dataset, under the in-domain (full) scenario). c Case of MAP2K6 and IKZF3 combined perturbation (from the Norman dataset, under the in-domain (partial) scenario). d Case of YWHAE single-gene perturbation (from the private dataset). e Perturbation performance for different cases quantitatively displayed using hit rate.
Extended Data Fig. 3: Additional experimental results on protein validation for the mosaic integration task. a Differential expression analysis based on the INFL clustering results, showing the most highly differentially expressed proteins for each domain. We selected the protein CXCR5, consulted relevant literature to confirm its biological significance, and plotted its spatial distribution. b Spatial distribution of the protein CXCR5. Compared with the INFL clustering map in Figure 5 b, its expression shows strong spatial concordance with the germinal center and lymphoid follicle domains, confirming the specificity of this protein.
Appendix figures & tables1 asset
Supplementary material from the paper’s appendix.
Appendix
Supplementary Fig. 9: Sanity check on general classification tasks. a Performance comparison of INFL against four baselines (FL-LP, FL-LP-HE, FL-LP-DP, FL-LoRA-DP, PPML) across five benchmarks (Stanford Cars, Stanford Dogs, CIFAR-100, CLEVR Count, and KITTI Distance), showing accuracy (bar charts). b Computational cost versus accuracy trade-off analysis, highlighting INFL’s efficiency compared to the high-overhead FL-LP-HE baseline. c Robustness evaluation against data heterogeneity under different non-IID levels (Dirichlet concentration ) and convergence curves (right column). d Ablation studies examining the impact of varying client numbers (top) and INR sizes (bottom) on model performance. e Privacy stress test comparing the standard INFL against a variant without the meta-learner (simulating an unauthorized attack), demonstrating the necessity of the key-conditioned design for maintaining utility.
More in this topic
Privacy-Preserving ML
Privacy-preserving machine learning develops methods to learn, share, and run models while limiting exposure of sensitive data.
See all 432 papers