Researchers led by Mahbuba Ferdowsi, Ban-Hoe Kwan, Maw Pin Tan and Choon-Hian Goh, working across Universiti Tunku Abdul Rahman in Malaysia, the University of New South Wales in Australia, Universiti Malaya and Sunway University, have built a machine learning pipeline that trains on sensitive physiological data using differential privacy, produces explanations clinicians can inspect, and even runs its predictions on encrypted data. The work, published in BioMedical Engineering OnLine, analysed records from 137 participants who underwent head-up tilt testing, of whom 54 were classified as vasovagal syncope positive and 83 as negative. From electrocardiogram and blood pressure signals recorded during the tilt protocol, the team extracted 54 features capturing the haemodynamic and autonomic signatures of each patient’s response.

The privacy guarantee at the heart of the training process comes from differentially private stochastic gradient descent, or DP-SGD. In conventional training, a neural model’s gradients are computed from each patient example and used to update the model weights, which creates a risk that memorised details of individual patients could be extracted from the finished model. DP-SGD interrupts this leakage path in two ways. First, it clips the gradient computed from every individual example so that no single patient can exert an outsized influence on the weights. Second, it injects calibrated Gaussian noise into the clipped gradients before they are aggregated, obscuring the contribution of any one record. The strength of this protection is formally quantified by a privacy budget, expressed as epsilon and delta. In this study, the model was trained under a privacy budget of approximately epsilon equal to 16.5 with delta set to 10 to the power of minus 5, a setting that provides a mathematically provable bound on how much any single participant’s information can leak into the model or its outputs.

Crucially, this formal privacy came at a surprisingly modest cost in accuracy. The DP-SGD trained logistic regression model, combined with a feature importance selection step that retained the most informative variables, achieved a cross-validated accuracy of 0.833 plus or minus 0.035 and an area under the receiver operating characteristic curve of 0.888 plus or minus 0.019. The evaluation used a stratified five-fold cross-validation framework in which all pre-processing steps were performed strictly within each training fold, a design choice that prevents subtle data leakage from inflating performance estimates. For comparison, the researchers also trained baseline models including a standard logistic regression, random forest classifiers and artificial neural networks, providing a benchmark for how much predictive power was preserved once the privacy machinery was switched on.

The second, more ambitious layer of the pipeline attempted to hide patient data even at the moment of prediction, using fully homomorphic encryption. This cryptographic technique allows computation directly on encrypted values, meaning a hospital could send an encrypted feature vector to an untrusted server and receive an encrypted diagnosis without the server ever seeing the underlying physiological measurements. The team implemented the Cheon-Kim-Kim-Song scheme, often abbreviated CKKS, using the TenSEAL library, which is designed for arithmetic on approximate real numbers and is well suited to encrypting continuous biomedical features. Because homomorphic encryption supports only addition and multiplication, non-linear activation functions must be approximated by polynomials, and the researchers used a degree-3 polynomial approximation of the sigmoid function to perform encrypted classification.

Here the study delivered an honest and instructive negative result. While the differentially private model performed well, inference carried out entirely under encryption degraded sharply, with the area under the curve falling to roughly 0.53, barely better than a coin flip. The culprit was approximation error: the polynomial surrogate for the sigmoid, combined with the noise inherent in CKKS arithmetic, distorted the decision boundary enough to destroy much of the model’s discriminative power. The authors are careful to frame this as a feasibility assessment rather than a failure, noting that the encrypted pipeline was applied only at the prediction stage and that optimised homomorphic architectures are a clear direction for future work. The finding matters for the field because it quantifies, in a real clinical setting, the gap between privacy-preserving training and fully secure inference, showing that the former is nearly free in utility terms while the latter remains a genuine engineering challenge.

Interpretability, the third pillar of the framework, was assessed with two widely used explanation techniques, LIME and SHAP, which attribute a model’s predictions back to individual input features. Both methods converged on the same picture of what the model had learned. Tilt-phase haemodynamic measurements, specifically systolic and diastolic blood pressure recorded during the tilt (SBP_T and DBP_T), together with autonomic balance indices derived from heart rate variability and blood pressure variability in the low-frequency to high-frequency bands (LFHF_RRI_T and LFHF_SBP_T), emerged as the key predictors of a positive vasovagal syncope diagnosis. This alignment is clinically reassuring, because these features correspond to the physiological mechanisms physicians already associate with tilt-induced fainting: an exaggerated drop in vascular tone and a shift in autonomic control when the body is tilted upright.

The study’s authors are explicit about the limits of what their results demonstrate. All reported performance figures are internal, cross-validated estimates derived from a single-centre dataset of 137 participants, and the team cautions that they should not be read as evidence of generalizable clinical performance. The relatively modest sample size also meant that subgroup analyses were omitted, a decision consistent with the data minimisation principle that underpins the privacy framework itself. External validation on multi-centre cohorts, and independent confirmation that the identified haemodynamic and autonomic features hold across different populations and tilt-test protocols, remain essential next steps before any deployment in a clinical environment.

Even so, the work arrives at a moment when healthcare systems worldwide are wrestling with how to exploit the predictive power of machine learning without breaching patient trust or privacy law. Differential privacy, homomorphic encryption and explainable AI are usually studied in isolation; this study is notable for assembling all three around a concrete diagnostic problem and reporting exactly where each succeeds and where each breaks down. The demonstration that a formally private model can match conventional baselines with minimal utility loss offers a template for other biomedical prediction tasks, from arrhythmia detection to sepsis early warning, where training data are scarce, sensitive and ethically charged.

The research was funded by the UTAR Research Fund from Universiti Tunku Abdul Rahman and received ethics approval from both the UTAR Scientific and Ethical Review Committee and the UMMC Medical Research Ethics Committee, with written informed consent obtained from all participants. As hospitals move toward federated learning and cloud-based clinical AI, studies of this kind provide the empirical grounding needed to decide which privacy technologies are ready for the clinic today and which still require the next generation of cryptographic engineering. For patients whose fainting spells have defied easy diagnosis, the promise is an AI assistant that reads their tilt test accurately, explains its reasoning, and never exposes their data in the process.

Subject of Research: Privacy-preserving and explainable machine learning for vasovagal syncope detection from head-up tilt test signals

Article Title: Differentially private and explainable machine learning for vasovagal syncope detection: a feasibility study of homomorphic encryption for secure inference

Article References: Ferdowsi, M., Kwan, B.-H., Tan, M. P., & Goh, C.-H. (2026). Differentially private and explainable machine learning for vasovagal syncope detection: a feasibility study of homomorphic encryption for secure inference. BioMedical Engineering OnLine. https://doi.org/10.1186/s12938-026-01626-2

Image Credits: AI Generated

DOI: 10.1186/s12938-026-01626-2

Keywords: vasovagal syncope, head-up tilt test, differential privacy, DP-SGD, homomorphic encryption, CKKS scheme, explainable AI, LIME, SHAP, secure inference, biomedical engineering, electrocardiogram