Inclusive Federated Learning Through Compliance-Weighted Noise Allocation in Healthcare AI

Benjamin Hamm; Dimitrios Bounias; Klaus Maier-Hein; Maximilian Zenk; Melih Co\c{s}\u{g}un; Ralf Floca; Saikat Roy; Santhosh Parampottupadam; Sarthak Pati; Sinem Sav

REVIEW 4 major objections 4 minor 34 references

Inclusive Federated Learning Through Compliance-Weighted Noise Allocation in Healthcare AI

T0 review · 4 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that compliance-weighted server-side differential privacy lets lower-compliance institutions join federated learning without degrading accuracy, by scaling the noise each client's update receives to that client's…

desk verdict Useful engineering skeleton for compliance-aware server-side DP in healthcare FL, but the headline 'no utility cost' claim is not supported by the reported experiments. read the letter →

arxiv 2505.22108 v4 pith:LWXAWYVH submitted 2025-05-28 cs.LG cs.AIcs.CRcs.DC

Santhosh Parampottupadam , Melih Coşğun , Sarthak Pati , Maximilian Zenk , Saikat Roy , Dimitrios Bounias , Benjamin Hamm , Sinem Sav

show 2 more authors

Ralf Floca Klaus Maier-Hein

This is my paper · ORCID

classification cs.LGcs.AIcs.CRcs.DC

keywords federatedlearningdifferentialprivacycompliancescoringadaptivenoiseallocationserver-sideDPmedicalimageclassificationhealthcareAIinclusivity

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper is trying to establish that healthcare federated learning does not have to choose between privacy and inclusion. Its mechanism assigns each institution a compliance score and maps that score to a per-client Gaussian noise scale, with noise applied on the server after clients upload their model updates. On two medical image benchmarks with 16 simulated clinics, the authors report that adding twelve lower-compliance clinics to four high-compliance ones improved BreastMNIST accuracy by 4.5 to 6.8 points for four of five aggregation strategies, and that compliance-weighted noise matched uniform server-side differential privacy at equal mean noise within 0.1 points. In other words, the paper argues that per-site noise control can be auditable and comes with no measured utility penalty. The formal $(\epsilon,\delta)$ bound, however, applies only to the aggregator's small dataset; the paper states that client-level privacy would require secure aggregation, which is left to future work.

What carries the argument

The load-bearing object is the compliance-to-noise mapping: $S_c=\frac{\sum_i w_i s_i}{\sum_i w_i}$ and $N_m=(1-S_c)+\text{min}$, where $S_c$ is a weighted average of 12 auditable compliance factors and min is a tiny baseline noise (set to $10^{-10}$ in the experiments). This mapping turns an institutional assessment into a deterministic noise scale, so per-site privacy burden is auditable and adjustable. The companion mechanism is server-side DP-SGD: the server trains one epoch on a small aggregator dataset using the noise-adjusted client updates, which lets the global model adapt to perturbed updates before aggregation. Together they let an aggregator add client-specific noise without requiring clinics to run DP-compliant training hardware themselves.

What would settle it

Capture a client's raw update on the server before the compliance-weighted noise is added and run a gradient-inversion attack on it: if recognizable patient images are recovered, the framework's client-data privacy claim fails for a curious aggregator, and the first round is especially exposed because the paper states it has no DP. Separately, repeating the 12-plus-4 versus 4-only comparison with many more seeds would show whether the reported accuracy gains are real or within random variation.

Watch

Extended reading notes

Core claim

On its own terms, the paper's central discovery is that a compliance score can be treated as a privacy budget: lower compliance means more noise, higher compliance means almost none, and this allocation is more inclusive than uniform noise. Concretely, a weighted compliance score $S_c$ computed from factors such as encryption, anonymization, and interoperability maps to a noise multiplier $N_m=(1-S_c)+\text{min}$, and the server runs DP-SGD on a small aggregator dataset with those per-client noise levels before global aggregation. Across six experimental configurations on PneumoniaMNIST and BreastMNIST, the configuration with 12 lower-compliance plus 4 compliant clients beat the compliant-only configuration by +4.5, +6.8, +5.2, and +1.6 points for FedAvg, FedMedian, FedProx, and FedYogi, and by -4.1 for FedAdam; the pooled gain was +2.8 points with five seeds, reported as not significant. When matched for mean noise, compliance-weighted allocation matched uniform server-side DP within 0.1 points, and the first-round noise cost 1.3 points on BreastMNIST and 2.5 points on PneumoniaMNIST under FedAvg.

Load-bearing premise

The privacy claim rests on the server being semi-honest and on each clinic's compliance score being accurate and honestly reported, because clients send un-noised updates to the server and the promised noise is added only after those updates arrive.

Editorial extensions

If this is right

A clinic with compliance score 0.3 automatically receives about 0.7 noise multiplier while a score-1.0 clinic receives near-zero noise, making the privacy burden visible and proportional to the trust score.
Because all DP noise is added on the server, resource-constrained clinics can participate without purchasing specialized DP-compliant hardware or running local DP-SGD.
Adding 12 lower-compliance clients to 4 compliant clients raised BreastMNIST accuracy by 4.5 to 6.8 points for FedAvg, FedMedian, FedProx, and FedYogi and lowered FedAdam by 4.1 points, with the pooled +2.8-point gain not significant at five seeds.
At equal mean noise, compliance-weighted allocation matched uniform server-side DP within 0.1 points of accuracy, so the paper claims no utility penalty from the adaptive allocation.
The formal $(\epsilon,\delta)$ privacy guarantee covers the aggregator dataset under a semi-honest aggregator; protecting client-level data requires secure aggregation, which the paper leaves to future work.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Beyond the paper: the compliance-to-noise map can be read as a data-quality filter; replacing subjective compliance scores with objective data-quality metrics would turn the mechanism into a general robustness strategy against low-quality or malicious clients.
Beyond the paper: matching uniform noise at equal mean noise does not imply equal effective privacy, because a curious server observes raw client updates before noise is applied; under that threat model the realized protection is weaker than the reported aggregator-dataset epsilon.
Beyond the paper: since each client receives a different noise scale, the framework invites per-client privacy accounting, tracking each institution's cumulative epsilon rather than a single global number.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Here's the short version: this paper is a reasonable engineering sketch, but the central empirical claim does not hold. The compliance-scoring checklist and the per-client noise-multiplier idea could be useful if someone builds on them. The experiments as run do not show that compliance-weighted noise has no utility cost.

What's actually new is modest. Per-client adaptive DP noise is already in the literature, and the authors cite Li et al. 2024 and Wang et al. 2020. The contribution is a domain-specific compliance scoring tool, a weighted checklist across HIPAA/GDPR/NIST/etc., mapped linearly to a noise multiplier. That is a legitimate design pattern for healthcare FL, but it is not a new privacy mechanism. I would credit the authors for being transparent: the abstract and Section 5 clearly state that the formal DP guarantee covers only the aggregator dataset, not client data, and that client-level DP would require secure aggregation. So the privacy concern is disclosed, though it does mean the 'privacy-preserving' framing should be read narrowly.

The soft spot is the utility claim, and it is load-bearing. Experiment 1 adds 12 lower-compliance clients with degraded data and compares against Experiment 4 with only 4 compliant clients. That changes number of clients, total data volume, and compliance-weighted noise at once. The +4.5 to +6.8 pp gains can be explained by a 4x larger training set. The claim that compliance-weighted noise matched uniform server-side DP at equal mean noise (+0.1 pp) is not traceable in Table 3: per-strategy differences between Experiments 1 and 6 range from -7.89 to +18.54 pp on BreastMNIST, and no mean-noise levels or standard deviations are reported. The noise formula Nm = (1 - Sc) + min is asserted without derivation or calibration, and compliance scores are manually assigned. Table 3 reports single numbers despite five seeds, and the abstract itself notes the pooled gain is not significant. None of this looks fraudulent, and the authors flag parts of it, but the central conclusion is not supported by the evidence as presented.

Who gets value? Someone building a compliance-aware FL demo might want to look at the scoring tool and the experiment design, but a reader should not take the utility results at face value. The paper needs a reanalysis where client count and data volume are matched or ablated, and where noise levels and error bars are reported.

Recommendation: I would not accept this for peer review in current form. The central comparison is confounded, and a serious referee would spend most of the time asking for obvious control experiments. I would keep the skeleton in mind, but the paper as written overclaims.

Referee Report

4 major / 4 minor

Summary. The manuscript proposes a compliance-aware federated learning framework that maps each institution's compliance score Sc to a per-step Gaussian noise multiplier Nm = (1.0 - Sc) + Min Noise Multiplier for server-side DP-SGD, and introduces a web-based compliance scoring tool aligned with several healthcare and security standards. The method is evaluated with five FL strategies on PneumoniaMNIST and BreastMNIST over six experimental configurations and five seeds; Table 3 reports accuracy, precision, recall, and F1 for each configuration. The authors claim that including 12 lower-compliance clients improves accuracy over a compliant-only baseline and that compliance-weighted noise allocation matches uniform server-side DP at equal mean noise, yielding 'no utility cost.' The formal DP guarantee is explicitly scoped to a small aggregator dataset under a semi-honest aggregator, with client-level DP deferred to future work.

Significance. If the central claim were established, the framework would be a useful practical contribution: it offers a concrete compliance scoring template, a formal DP accounting, and a mechanism for resource-constrained clinics to participate without dedicated DP hardware. The use of public benchmarks, five FL strategies, and five seeds provides a reasonable evaluation skeleton, and the limitations section is candid about the aggregator-only guarantee. However, the significance is currently undermined by the experimental design: the headline comparison is confounded with data volume, the equal-mean-noise comparison is not reproducible from Table 3, and the natural controlled comparison within Table 3 (Experiment 1 vs Experiment 3) actually suggests that compliance-weighted noise degrades accuracy for most strategies. The privacy guarantee, with cumulative epsilon on the order of 500 to 1400, is also much weaker than the 'privacy-preserving' framing suggests. The framework and scoring tool may still be of interest, but the empirical validation as submitted does not support the paper's main claims.

major comments (4)

[Abstract, §3 (Table 3)] The central 'no utility cost' claim rests on comparing Experiment 1 (4 compliant + 12 non-compliant clients) with Experiment 4 (4 compliant clients only). These conditions differ in client count and training-set size, so the reported gains of +4.5 to +6.8 pp on BreastMNIST could be due to the roughly four-fold larger dataset rather than to the compliance-weighted mechanism. If, as Table 1 and the description of a fixed 16-client split imply, Experiment 1 and Experiment 3 use the same 16 client subsets and differ only in the assigned compliance scores, then Table 3 shows that compliance-weighted noise degrades accuracy substantially for most strategies (e.g., FedMedian: 70.12 vs 83.67 on PneumoniaMNIST and 50.01 vs 73.24 on BreastMNIST; FedAvg: 82.43 vs 85.64 and 66.98 vs 73.68). The paper never reports this controlled comparison, and the headline claim is therefore not supported by the current experiments.
[§3 (Table 3), Abstract] The claim that compliance-weighted allocation 'matched uniform server-side DP at equal mean noise (+0.1 pp)' is not traceable from the reported data. No mean-noise levels, per-client noise multipliers, or per-configuration epsilon values are given, and the per-strategy accuracy differences between Experiment 1 and Experiment 6 in Table 3 are large and mixed (for example, on BreastMNIST they range from about -7.9 to +18.5 pp). To support this claim, the authors need to specify how equal mean noise was enforced and report seed-level means and standard deviations; Table 3 currently reports single numbers despite the stated five-seed protocol.
[§2 (Algorithm 1), §5] The formal DP guarantee covers only the small aggregator dataset under a semi-honest aggregator, because clients send un-noised updates to the server and noise is added after receipt. This is disclosed in the abstract and limitations, but the introduction and discussion repeatedly describe the framework as privacy-preserving without that qualification. The reported cumulative epsilon values of about 1434 (BreastMNIST) and 513 (PneumoniaMNIST) at delta=10^-5 are very large and should be discussed as providing only weak privacy for the aggregator dataset; the practically relevant client-level privacy scenario requires secure aggregation, which is not implemented, and the limitations section also notes that first-round client updates lack DP.
[§2 (Noise Multiplier Calculation, Compliance Scoring Mechanism)] The mapping Nm = (1.0 - Sc) + Min Noise Multiplier is asserted without calibration or sensitivity analysis, and the compliance scores come from the authors' own scoring tool with arbitrary weights (Equation 1, Table 2). Because Nm is a direct algebraic function of Sc, the observation that lower-compliance clients receive more noise is true by construction; what needs to be demonstrated is that this particular schedule preserves utility, and the paper provides no sensitivity analysis over the compliance weights or the noise schedule. This makes the 'no utility cost' conclusion dependent on unexamined modeling choices.

minor comments (4)

[§4 Discussion] The sentence 'gaining 1%–15% accuracy across strategies' overstates Table 3, where Experiment 1 versus Experiment 4 shows a decrease for FedMedian on both datasets (70.12 vs 79.44 on PneumoniaMNIST; 50.01 vs 62.84 on BreastMNIST).
[§3 Results] The sentence 'Notably ,The experiment' contains a punctuation and spacing error that should be corrected.
[§2 Experimental Setup] The text 'see Algo 18' should refer to Algorithm 1 in the pseudocode.
[§2 Pseudocode] The parameter 'eta' in the DPTrain call is used for a noise multiplier, but the notation is not defined in the pseudocode or the surrounding text.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the compliance-to-noise mapping is an explicit design choice, not a result derived from itself, and the performance claims rest on empirical cross-experiment comparisons rather than on a self-citation chain.

full rationale

The paper's derivation chain does not reduce a prediction to its input by construction. The noise multiplier formula Nm = (1.0 - Sc) + Min Noise Multiplier is a declared design decision: the paper never claims to derive 'lower compliance implies more noise' as an empirical finding, so this definitional link is the algorithm itself, not a circular result. The central utility claims are based on cross-experiment comparisons (Experiment 1 vs. Experiment 4 and Experiment 6) on public MedMNIST benchmarks. Those comparisons may be confounded because Experiment 1 simultaneously changes the number of clients, the total data volume, and the data degradation, and the abstract's '+0.1 pp at equal mean noise' is not traceable to Table 3; however, confounding and incomplete traceability are evidence/correctness concerns, not circularity. The formal differential-privacy guarantee is attributed to Dwork-Roth and implemented through the external Opacus library, and the self-citations involving co-author S. Pati ([25], [26]) support feasibility and background rather than serving as the load-bearing derivation. No specific quote-to-equation reduction satisfying the circularity test was found, so the appropriate finding is no significant circularity.

Assumptions & free parameters 5 free parameters · 4 assumptions · 1 invented entities

The central claim rests on a hand-designed noise formula, manually assigned compliance scores, user-selected weights, and the Opacus DP accountant. None of these are derived from first principles, and the formal guarantee is limited to the aggregator dataset. The paper does not provide independent evidence that compliance scores measure privacy risk.

free parameters (5)

Min Noise Multiplier = 1e-10
Hand-set baseline noise floor used in Nm=(1-Sc)+Min; not derived from any privacy budget or data-dependent criterion. Location: Section 2, Noise Multiplier Calculation.
Default compliance threshold for anonymization = 0.5
Tool default, adjustable by experiment owner; determines which clients are considered non-compliant. Location: Section 2, Compliance Scoring Mechanism.
Compliance scores for simulated clients = 1.0 for 4 trusted clients; 0.3 for 12 data-quality clients; range 0.1-0.6 for non-compliant groups
Assigned manually via web tool rather than measured, so the noise allocation depends on hand-chosen inputs. Location: Table 1 and Data Quality Experiment.
Weights w_i of 12 compliance factors = Not specified in paper
Compliance score in Equation 1 uses arbitrary user-chosen weights; no sensitivity analysis is given. Location: Section 2, Compliance Scoring Mechanism.
Data degradation parameters for 12 clients = crop/resize 80-100%, Gaussian noise sigma=0.05, contrast reduced to 80%
Used to simulate 'data quality' compliance factor; these values were chosen by the authors and affect the Exp 1 vs Exp 4 comparison. Location: Section 2, Data Quality Experiment.

assumptions (4)

standard math Gaussian mechanism provides (epsilon,delta)-DP with standard DP accounting (Dwork and Roth, Opacus implementation).
Used to compute the cumulative aggregator-dataset epsilon values in the abstract; the paper does not re-derive the mechanism.
domain assumption Compliance scores are accurate and honest and the aggregator is semi-honest.
Explicitly stated in Section 5 as a limitation; the framework's privacy and noise allocation rely on these assumptions.
ad hoc to paper Noise multiplier Nm=(1-Sc)+Min Noise Multiplier is an appropriate mapping from compliance to noise.
This linear mapping is asserted without theoretical or empirical justification; it is the core of the method.
domain assumption Server-side training on an aggregator dataset with Opacus DP-SGD yields a valid DP model release.
The paper assumes the Opacus accounting and release of the global model provide the stated DP guarantee, but the aggregator dataset is small and not all release steps are specified.

invented entities (1)

Compliance score Sc from the compliance scoring tool
purpose: Controls the per-client noise multiplier and is the central input to the adaptive DP allocation.
The score is a novel composite metric defined by the authors; it has no external validation or demonstrated correlation with actual data privacy risk. Compliance scores are hand-assigned in every experiment.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Inclusive Federated Learning Through Compliance-Weighted Noise Allocation in Healthcare AI." pith.science (2026). https://pith.science/paper/LWXAWYVH

@misc{pith2026250522108,
  author       = {Pith},
  title        = {Pith review of: Inclusive Federated Learning Through Compliance-Weighted Noise Allocation in Healthcare AI},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/LWXAWYVH}},
  note         = {Machine review of arXiv:2505.22108}
}

abstract

Background: Federated learning (FL) enables collaborative training of clinical AI models without centralizing patient data, but adoption is limited by privacy concerns, heterogeneous institutional compliance, and resource disparities; standard differential privacy (DP) applies uniform noise to all clients, penalizing well-compliant or under-resourced institutions. Objective: We introduce a compliance-aware FL framework that adapts DP to institutional compliance, letting lower-compliance sites participate without uniformly penalizing others. Methods: A compliance scoring tool aligned with HIPAA, GDPR, NIST, ISO, and HL7/FHIR maps each client score to a per-step Gaussian noise scale for server-side DP-SGD on a small aggregator dataset. The formal $(\epsilon,\delta)$ bound applies to the aggregator dataset under a semi-honest aggregator; client-level DP needs secure aggregation (future work). We evaluate five FL strategies on PneumoniaMNIST and BreastMNIST (16 clients, 50 rounds, five seeds); the cumulative aggregator-dataset $\epsilon$ is about 1434 (Breast) and 513 (Pneumonia) at $\delta=10^{-5}$. Results: Including 12 lower-compliance clients (Experiment 1) versus a compliant-only baseline (Experiment 4) changed BreastMNIST accuracy by +4.5 (FedAvg), +6.8 (FedMedian), +5.2 (FedProx), +1.6 (FedYogi), and -4.1 (FedAdam) percentage points (pooled +2.8 pp; not significant at n=5; up to +17 pp per configuration); compliance-weighted allocation matched uniform server-side DP at equal mean noise (+0.1 pp), carrying no utility penalty, and first-round noise cost 1.3 pp (Breast) and 2.5 pp (Pneumonia, FedAvg). Conclusions: Compliance-weighted server-side DP lets lower-compliance institutions join FL without degrading performance, giving auditable per-site noise control at no utility cost; formal guarantees apply to the aggregator dataset, with client-level DP requiring secure aggregation.

Figures

Figures reproduced from arXiv: 2505.22108 by the authors.

**Figure 1.** (a) Existing FL with client-side DP uses uniform noise, requiring DP-compliant hardware, limiting less compliant, resource-constrained clinics. (b) Server-side DP adds uniform noise post-aggregation, reducing privacy-utility efficiency and further excluding less compliant clinics. (c) Our compliance-aware adaptive DP applies per-client noise before aggregation, enabling participation from low-resource, less complia… view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

34 extracted references · 28 canonical work pages

[1]

https://artificialintelligenceact.eu/, [Accessed 11-01-2025]

Act, E.A.I.: EU Artiﬁcial Intelligence Act | Up-to-date d evelop- ments and analyses of the EU AI Act — artiﬁcialintelligencea ct.eu. https://artificialintelligenceact.eu/, [Accessed 11-01-2025]

work page 2025
[2]

Scientiﬁc reports 12(1), 1953 (2022)

Adnan, M., Kalra, S., Cresswell, J.C., Taylor, G.W., Tizh oosh, H.R.: Federated learning and diﬀerential privacy for medical image analysi s. Scientiﬁc reports 12(1), 1953 (2022)

work page 2022
[3]

Bagdasaryan, E., Shmatikov, V.: Diﬀerential privacy has disparate impact on model accuracy (2019), https://arxiv.org/abs/1905.12101

work page Pith review arXiv 2019
[4]

arXiv preprint arX iv:2007.14390 (2020)

Beutel, D.J., Topal, T., Mathur, A., Qiu, X., Fernandez-M arques, J., Gao, Y., Sani, L., Kwing, H.L., Parcollet, T., Gusmão, P.P.d., Lane, N.D.: Flower: A friendly federated learning research framework. arXiv preprint arX iv:2007.14390 (2020)

arXiv 2020
[5]

Genes 15(12), 1650 (2024)

Calvino, G., Peconi, C., Strafella, C., Trastulli, G., Me galizzi, D., Andreucci, S., Cascella, R., Caltagirone, C., Zampatti, S., Giardina, E.: Federated learning: Breaking down barriers in global genomic research. Genes 15(12), 1650 (2024)

work page 2024
[6]

Cummings, R., Desfontaines, D., Evans, D., Geambasu, R., Huang, Y., Jagielski, M., Kairouz, P., Kamath, G., Oh, S., Ohrimenko, O., Papernot , N., Rogers, R., Shen, M., Song, S., Su, W., Terzis, A., Thakurta, A., Vassilv itskii, S., Wang, Y.X., Xiong, L., Yekhanin, S., Yu, D., Zhang, H., Zhang, W.: Advanc ing diﬀerential privacy: Where we are now and futur...

arXiv 2024
[7]

Dankar, F.K., El Emam, K.: Practicing diﬀerential privac y in health care: A review. Trans. Data Privacy 6(1), 35–67 (Apr 2013)

work page 2013
[8]

Dimitrov, D.I., Balunović, M., Konstantinov, N., Vechev , M.: Data leakage in fed- erated averaging (2022)

work page 2022

Show all 34 references

[9]

Foundations and Trends® in Theoretical Computer Science 9(3–4), 211–407 (2014)

Dwork, C., Roth, A., et al.: The algorithmic foundations o f diﬀerential privacy. Foundations and Trends® in Theoretical Computer Science 9(3–4), 211–407 (2014)

2014
[10]

IEEE access 10, 22359–22380 (2022)

El Ouadrhiri, A., Abdelhadi, A.: Diﬀerential privacy fo r deep and federated learn- ing: A survey. IEEE access 10, 22359–22380 (2022)

2022
[11]

https://doi.org/10.5281/zenodo.3828935, https://github.com/Lightning-AI/lightning

Falcon, W., The PyTorch Lightning team: PyTorch Light- ning (Mar 2019). https://doi.org/10.5281/zenodo.3828935, https://github.com/Lightning-AI/lightning

2019 doi
[12]

5 , Security and Pri- vacy Controls for Information Systems and Organizations — c src.nist.gov

Force, J.T.: NIST Special Publication (SP) 800-53 Rev. 5 , Security and Pri- vacy Controls for Information Systems and Organizations — c src.nist.gov. https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final, [Accessed 11-01-2025]

2025
[13]

https://gdpr.eu/tag/gdpr/, [Accessed 11-01-2025]

gdpr.eu: General Data Protection Regulation (GDPR). https://gdpr.eu/tag/gdpr/, [Accessed 11-01-2025]

2025
[14]

In: Proceedings of the IEEE conference on computer vision and pa ttern recognition

He, K., Zhang, X., Ren, S., Sun, J.: Deep residual learnin g for image recognition. In: Proceedings of the IEEE conference on computer vision and pa ttern recognition. pp. 770–778 (2016)

2016
[15]

https://www.hhs.gov/hipaa/for-professionals/privacy/index.html, [Accessed 11-01-2025]

hhs.gov: The hipaa privacy rule. https://www.hhs.gov/hipaa/for-professionals/privacy/index.html, [Accessed 11-01-2025]

2025
[16]

https://hl7.org/fhir/overview.html, [Accessed 11-01-2025]

http://hl7.org/fhir: Overview - FHIR v5.0.0 — hl7.org. https://hl7.org/fhir/overview.html, [Accessed 11-01-2025]

2025
[17]

https://www.iso.org/standard/63553.html, [Accessed 11-01-2025]

iso.org: ISO 25237:2017 — iso.org. https://www.iso.org/standard/63553.html, [Accessed 11-01-2025]

2017
[18]

In: Trustworthy AI in Medical Imaging, pp

Kaiser, J., Mueller, T., Kaissis, G.: Diﬀerential priva cy in medical imaging appli- cations. In: Trustworthy AI in Medical Imaging, pp. 411–424 . Elsevier (2025) Inclusive, Diﬀerentially Private Federated Learning for C linical Data 11

2025
[19]

arXiv preprint arXiv:2409.09727 (2024)

Li, M., Xu, P., Hu, J., Tang, Z., Yang, G.: From challenges and pitfalls to rec- ommendations and opportunities: Implementing federated l earning in healthcare. arXiv preprint arXiv:2409.09727 (2024)

2024 arXiv
[20]

Proceedings of Ma chine learning and sys- tems 2, 429–450 (2020)

Li, T., Sahu, A.K., Zaheer, M., Sanjabi, M., Talwalkar, A ., Smith, V.: Federated optimization in heterogeneous networks. Proceedings of Ma chine learning and sys- tems 2, 429–450 (2020)

2020
[21]

Li, X., Zmigrod, R., Ma, Z., Liu, X., Zhu, X.: Fine-tuning language models with diﬀerential privacy through adaptive noise all ocation (2024), https://arxiv.org/abs/2410.02912

2024 arXiv
[22]

In: Artiﬁcial intelligence and statistics

McMahan, B., Moore, E., Ramage, D., Hampson, S., y Arcas, B.A.: Communication-eﬃcient learning of deep networks from dece ntralized data. In: Artiﬁcial intelligence and statistics. pp. 1273–1282. PML R (2017)

2017
[23]

arXiv preprint arXiv:2010.10664 (2020)

Nguyen, P., Silence, A., Darais, D., Near, J.P.: Duetsgx : Diﬀerential privacy with secure hardware. arXiv preprint arXiv:2010.10664 (2020)

2020 arXiv
[24]

https://www.nist.gov/cyberframework, [Accessed 11-01-2025]

NIST: Cybersecurity Framework — nist.gov. https://www.nist.gov/cyberframework, [Accessed 11-01-2025]

2025
[25]

Nature communicat ions 13(1), 7346 (2022)

Pati, S., Baid, U., Edwards, B., Sheller, M., Wang, S.H., Reina, G.A., Foley, P., Gruzdev, A., Karkada, D., Davatzikos, C., et al.: Federated learning enables big data for rare cancer boundary detection. Nature communicat ions 13(1), 7346 (2022)

2022
[26]

, Wang, J.J., Lakshmi- narayanan, A., Wang, S.h., Sheller, M.J., et al.: Privacy pr eservation for federated learning in health care

Pati, S., Kumar, S., Varma, A., Edwards, B., Lu, C., Qu, L. , Wang, J.J., Lakshmi- narayanan, A., Wang, S.h., Sheller, M.J., et al.: Privacy pr eservation for federated learning in health care. Patterns 5(7) (2024)

2024
[27]

In: International Conference on Learning Representations (2021), https://openreview.net/forum?id=LkFG3lB13U5

Reddi, S.J., Charles, Z., Zaheer, M., Garrett, Z., Rush, K., Konečný, J., Kumar, S., McMahan, H.B.: Adaptive federated optimizat ion. In: International Conference on Learning Representations (2021), https://openreview.net/forum?id=LkFG3lB13U5

2021
[28]

Ren, X., Yang, S., Zhao, C., McCann, J., Xu, Z.: Belt and br aces: When federated learning meets diﬀerential privacy (2024), https://arxiv.org/abs/2404.18814

2024 arXiv
[29]

Med ical Image Analysis 95, 103206 (2024)

Schmidt, K., Bearce, B., Chang, K., Coombs, L., Farahani , K., Elbatel, M., Mouheb, K., Marti, R., Zhang, R., Zhang, Y., et al.: Fair eval uation of feder- ated learning algorithms for automated breast density clas siﬁcation: The results of the 2022 acr-nci-nvidia federated le...

2024
[30]

Scientiﬁc reports 10(1), 12598 (2020)

Sheller, M.J., Edwards, B., Reina, G.A., Martin, J., Pat i, S., Kotrotsou, A., Milchenko, M., Xu, W., Marcus, D., Colen, R.R., et al.: Feder ated learning in medicine: facilitating multi-institutional collaborati ons without sharing patient data. Scientiﬁc reports 10(1), 12598 (2020)

2020
[31]

In: Procee dings of the 14th ACM Conference on Recommender Systems

Wang, H., Zhao, Q., Wu, Q., Chopra, S., Khaitan, A., Wang, H.: Global and local diﬀerential privacy for collaborative bandits. In: Procee dings of the 14th ACM Conference on Recommender Systems. pp. 150–159 (2020)

2020
[32]

Wen, Y., Geiping, J., Fowl, L., Goldblum, M., Goldstein, T.: Fishing for user data in large-batch federated learning via gradient magniﬁcati on (2022)

2022
[33]

Scientiﬁc Data 10(1), 41 (2023)

Yang, J., Shi, R., Wei, D., Liu, Z., Zhao, L., Ke, B., Pﬁste r, H., Ni, B.: Medmnist v2- a large-scale lightweight benchmark for 2d and 3d biomedica l image classiﬁcation. Scientiﬁc Data 10(1), 41 (2023)

2023
[34]

arXiv preprint arXiv:2109.12298 (2021)

Yousefpour, A., Shilov, I., Sablayrolles, A., Testuggi ne, D., Prasad, K., Malek, M., Nguyen, J., Ghosh, S., Bharadwaj, A., Zhao, J., Cormode, G., Mironov, I.: Opacus: User-friendly diﬀerential privacy library in P yTorch. arXiv preprint arXiv:2109.12298 (2021)

2021 arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.

[1] [1]

https://artificialintelligenceact.eu/, [Accessed 11-01-2025]

Act, E.A.I.: EU Artiﬁcial Intelligence Act | Up-to-date d evelop- ments and analyses of the EU AI Act — artiﬁcialintelligencea ct.eu. https://artificialintelligenceact.eu/, [Accessed 11-01-2025]

work page 2025

[2] [2]

Scientiﬁc reports 12(1), 1953 (2022)

Adnan, M., Kalra, S., Cresswell, J.C., Taylor, G.W., Tizh oosh, H.R.: Federated learning and diﬀerential privacy for medical image analysi s. Scientiﬁc reports 12(1), 1953 (2022)

work page 2022

[3] [3]

Bagdasaryan, E., Shmatikov, V.: Diﬀerential privacy has disparate impact on model accuracy (2019), https://arxiv.org/abs/1905.12101

work page Pith review arXiv 2019

[4] [4]

arXiv preprint arX iv:2007.14390 (2020)

Beutel, D.J., Topal, T., Mathur, A., Qiu, X., Fernandez-M arques, J., Gao, Y., Sani, L., Kwing, H.L., Parcollet, T., Gusmão, P.P.d., Lane, N.D.: Flower: A friendly federated learning research framework. arXiv preprint arX iv:2007.14390 (2020)

arXiv 2020

[5] [5]

Genes 15(12), 1650 (2024)

Calvino, G., Peconi, C., Strafella, C., Trastulli, G., Me galizzi, D., Andreucci, S., Cascella, R., Caltagirone, C., Zampatti, S., Giardina, E.: Federated learning: Breaking down barriers in global genomic research. Genes 15(12), 1650 (2024)

work page 2024

[6] [6]

Cummings, R., Desfontaines, D., Evans, D., Geambasu, R., Huang, Y., Jagielski, M., Kairouz, P., Kamath, G., Oh, S., Ohrimenko, O., Papernot , N., Rogers, R., Shen, M., Song, S., Su, W., Terzis, A., Thakurta, A., Vassilv itskii, S., Wang, Y.X., Xiong, L., Yekhanin, S., Yu, D., Zhang, H., Zhang, W.: Advanc ing diﬀerential privacy: Where we are now and futur...

arXiv 2024

[7] [7]

Dankar, F.K., El Emam, K.: Practicing diﬀerential privac y in health care: A review. Trans. Data Privacy 6(1), 35–67 (Apr 2013)

work page 2013

[8] [8]

Dimitrov, D.I., Balunović, M., Konstantinov, N., Vechev , M.: Data leakage in fed- erated averaging (2022)

work page 2022