Hospitals Can Now Train AI Together Without Sharing Patient Data

Every heartbeat recorded by a bedside monitor, every ventilator reading, every lab result streamed from an intensive care unit is a data point that could help artificial intelligence predict a patient’s decline hours before it happens. Yet the same data streams that power modern predictive medicine are also among the most sensitive records on earth, and hospitals have long been reluctant, and often legally unable, to pool them. A research team led by Ibrahim Aqeel and Emad S. Hassan at Jazan University in Saudi Arabia, working with colleagues at Umm Al-Qura University, believes it has found a way to break this deadlock. In a study published in the journal Cluster Computing, they present FedDeepRiskNet++, a federated learning framework designed to let many medical institutions train a shared diagnostic model without any raw patient data ever leaving its home hospital.

Federated learning is not a new idea. Instead of shipping data to a central server, the technique sends the model to the data: each hospital trains the algorithm locally on its own patients and shares only the resulting parameter updates, which are then averaged into a global model. The problem, as the researchers emphasize, is that sharing gradients is not the same as sharing nothing. Sophisticated adversaries can reconstruct individual patient records from model updates, a class of threats known as gradient leakage and membership inference attacks. On top of that, real hospital networks are messy places, with devices of wildly different computing power, unreliable wireless links, and data distributions that differ from one ward to the next, a condition researchers call non-IID data. Conventional federated frameworks tend to stumble under exactly these conditions.

FedDeepRiskNet++ attacks the problem with four interlocking modules, each addressing a different failure mode. The first is differential privacy, a mathematically rigorous method of protecting individuals in a dataset by injecting carefully calibrated noise into the local model updates before they leave the hospital. The noise is large enough to make it impossible to infer whether any single patient’s record contributed to a result, but small enough that the aggregate statistical signal survives. The second module is secure aggregation based on CKKS homomorphic encryption, a scheme introduced by cryptographers Cheon, Kim, Kim and Song that allows arithmetic to be performed directly on encrypted numbers. In practice, this means the central server can combine the encrypted updates from all participating hospitals and never see any of them in decrypted form.

The third and arguably most novel component is what the authors call adaptive privacy-budget scheduling, or APBS. Differential privacy is governed by a parameter called epsilon, the privacy budget: a smaller epsilon means stronger privacy but noisier, less useful updates, while a larger epsilon improves accuracy at the cost of confidentiality. Most systems fix this value once and live with the trade-off. APBS instead treats it as a dynamic dial, adjusting the privacy budget in real time according to each client’s reliability, energy status, and communication conditions. A well-connected, trustworthy hospital node running on stable power can operate with tighter privacy; a struggling device on a congested network can be allocated a different budget so that the global model’s utility does not collapse. The researchers report that this adaptive scheduling significantly improves the privacy-utility trade-off compared with static allocation, a conclusion they back up with ablation experiments that remove individual modules and measure the damage.

The fourth module tackles a less glamorous but equally critical bottleneck: communication. In large-scale federated systems, the sheer volume of model updates shuttling between hospitals and the aggregation server can overwhelm networks and drain the batteries of edge devices. FedDeepRiskNet++ employs adaptive gradient sparsification, transmitting only the most significant portions of each update rather than the full parameter set, combined with what the authors describe as encryption-aware communication packaging, which bundles the sparse updates so that the overhead of homomorphic encryption does not erase the savings. The result, according to the paper, is a reduction in communication cost of approximately 23 percent compared with standard approaches, with cumulative communication overhead held to 165 megabytes.

The performance numbers are the study’s headline claim. Tested on two widely used clinical datasets, PhysioNet 2023 and MIMIC-III, the framework achieved 91.2 percent classification accuracy and a 90.1 percent F1-score, a balanced measure of precision and recall that matters greatly in medical settings where both missed diagnoses and false alarms carry costs. Crucially, these results were obtained while maintaining a low privacy budget of epsilon equal to 2.9, a level that represents meaningful formal privacy protection rather than a token gesture. The authors compared their system against a series of established baselines, including the canonical FedAvg algorithm, the differentially private DP-FedAvg, the privacy-aware hierarchical framework PAHFL, Health-FedNet, and their own earlier FedDeepRiskNet, and found that the new framework also converged faster under heterogeneous non-IID hospital conditions, meaning it needed fewer communication rounds to reach a usable model.

Why does this matter beyond the benchmark tables? The Internet of Medical Things has expanded explosively, with connected monitors, infusion pumps, wearable sensors and imaging devices generating continuous streams of clinical data. Predictive models trained on a single hospital’s population inevitably inherit its blind spots, and the COVID-19 pandemic demonstrated both the promise and the difficulty of cross-institutional collaboration, as researchers who built federated models for predicting clinical outcomes in COVID-19 patients learned firsthand. A framework that combines formal privacy guarantees, cryptographic protection, and communication efficiency could make it practical for networks of hospitals, including smaller facilities with limited infrastructure, to contribute to large-scale diagnostic models without exposing their patients or exhausting their networks.

The study also reflects a broader shift in how the machine learning community thinks about privacy. For years, differential privacy and homomorphic encryption were seen as alternatives, each too costly to combine with the other. FedDeepRiskNet++ is part of a growing body of work arguing that layered defenses, noise plus encryption plus sparsification, can coexist if each layer is engineered with the others in mind. The adaptive scheduling of the privacy budget is particularly significant because it acknowledges a truth that static designs ignore: privacy is not a fixed setting but a resource that must be spent wisely across a fleet of heterogeneous devices. The work builds on the team’s earlier energy-aware FedDeepRiskNet system for multi-hospital environments, extending it with the encryption and scheduling machinery needed for security-critical deployments.

There are, of course, limits to what any single study can establish. The experiments were conducted on retrospective datasets rather than in live hospital deployments, and the authors note that no datasets were newly generated or analyzed beyond the benchmark evaluations. Real-world rollouts will need to confront regulatory audits, adversarial participants, and the operational realities of hospital IT departments. The research was funded by the Deanship of Graduate Studies and Scientific Research at Jazan University, and the team includes Noha Mostafa of Jazan’s computer sciences department and Ayman A. Alharbi of Umm Al-Qura University. Still, the central demonstration stands: strong privacy protection, communication efficiency, and high diagnostic reliability can coexist within large-scale federated healthcare systems. If frameworks like FedDeepRiskNet++ mature from benchmarks into clinical infrastructure, the era in which hospitals must choose between protecting their patients and advancing medicine may finally be drawing to a close.

Subject of Research: Privacy-preserving federated learning for secure medical Internet of Things systems

Article Title: FedDeepRiskNet++: a privacy-enhanced federated learning framework for secure and scalable medical IoT systems

Article References: FedDeepRiskNet++: a privacy-enhanced federated learning framework for secure and scalable medical IoT systems. (n.d.). https://doi.org/10.1007/s10586-026-06616-6

Image Credits: AI Generated

DOI: 10.1007/s10586-026-06616-6

Keywords: federated learning, differential privacy, homomorphic encryption, medical IoT, healthcare AI, data privacy, secure aggregation, communication efficiency, non-IID data, clinical prediction, edge computing, privacy budget