🧬 biology

FPLIER: Federated Pathway-Level Information Extractor

FPLIER is a federated learning framework that enables privacy-preserving, distributed training of pathway-level gene expression models across multiple institutions by securely aggregating updates to match centralized performance while mitigating membership inference risks through the incorporation of public data or dimensionality reduction.

Original authors: Daniele Malpetti, Christian Berchtold, Francesco Gualdi, Marco Scutari, Laura Azzimonti, Francesca Mangili

Published 2026-05-29

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Daniele Malpetti, Christian Berchtold, Francesco Gualdi, Marco Scutari, Laura Azzimonti, Francesca Mangili

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ⚕️ This is an AI-generated explanation of a preprint that has not been peer-reviewed. It is not medical advice. Do not make health decisions based on this content. Read full disclaimer

Imagine you are trying to solve a giant, complex puzzle. The picture on the box is a map of how genes work together in the human body. To solve this puzzle, you need to look at thousands of different pieces (genes) from many different people.

The problem is that many hospitals and research labs have their own unique piles of puzzle pieces, but they can't share them. Why? Because of privacy laws and patient confidentiality. They can't just dump all their pieces into one big box in the middle of the room.

This is where FPLIER comes in. It's a new, clever way to solve the puzzle together without ever actually sharing the pieces.

The Old Way: The "Centralized" Approach

Normally, to get a really good understanding of how genes work, scientists need a massive amount of data from many different sources. They usually gather all the data into one central super-computer.

The Analogy: Imagine everyone bringing their puzzle pieces to a single table. The more pieces you have, the clearer the picture becomes.
The Problem: You can't do this with medical data because it's like asking patients to hand over their private diaries. It's illegal and unethical.

The New Way: FPLIER (The "Federated" Approach)

FPLIER is like a game of "Telephone" but for math, where everyone stays in their own room.

The Setup: Each hospital keeps its own puzzle pieces (gene data) in a locked safe. They don't move the pieces.
The Teamwork: Instead of sending the pieces, each hospital does some math on their own pieces to figure out "clues" about the picture.
The Secret Handshake: They send these clues to a central coordinator. The coordinator mixes the clues together to update a "master guide" (the model).
The Result: The master guide gets smarter and smarter, learning from everyone's data, but no one ever sees anyone else's actual puzzle pieces.

The "Public Data" Secret Sauce

The paper found a special trick to make this even safer. Imagine that in addition to the private pieces, everyone also has access to a huge, public library of puzzle pieces that anyone can see (public gene data).

FPLIER mixes a little bit of these public pieces into every hospital's private pile before they start doing math.

Why? It acts like "noise" or "static" that hides the specific details of the private pieces. It's like adding a bunch of common, generic puzzle pieces to a unique, rare one. It becomes much harder to tell which piece belongs to which person.

The Big Discovery: The "Rank" Rule

The researchers discovered a very specific rule about privacy, which they call the "Rank" of the data.

Think of the data as a stack of transparent sheets.

Low Rank (Few samples, many genes): If you have very few people's data but thousands of genes, the sheets are thin and transparent. If you shine a light through them, you can easily see the specific patterns of the people who contributed. A hacker could look at the final guide and guess, "Ah, this pattern came from Hospital A!"
High Rank (Many samples, fewer genes): If you have a huge stack of sheets (lots of data) or you reduce the number of genes you're looking at, the stack becomes thick and opaque. The light can't get through. The patterns of any single person get lost in the crowd.

The Paper's Finding:
The researchers showed that if you add enough public data or reduce the number of genes, you reach a "Full Rank" state. In this state, the final guide looks so much like a random guess that a hacker cannot tell if a specific person's data was used to build it. It's like trying to find a specific grain of sand on a beach; once the beach is big enough, the grain is indistinguishable from the rest.

The Safety Check

The paper also describes a safety test. Before the final guide is released to the public, each hospital can run a test on its own data.

They ask: "Can this guide tell the difference between my training data and my test data?"
If the answer is "Yes, it's too specific," the hospital can say, "Stop! Don't release this yet." They can then add more public data or simplify the model until the guide becomes "blurry" enough to be safe.

Summary

FPLIER is a tool that lets hospitals collaborate on gene research without sharing private patient data. It works by:

Keeping data local.
Mixing in public data to create a "fog" that hides individual details.
Ensuring there is enough data (a "high rank") so that no single person's contribution can be singled out.

The paper proves that this method works just as well as the old, centralized way, but with a built-in safety mechanism that makes it very hard for hackers to figure out who participated in the study.

Technical Summary: FPLIER – Federated Pathway-Level Information Extractor

1. Problem Statement

In transcriptomics, gene-set-aware factorization methods like the Pathway Level Information Extractor (PLIER) achieve optimal performance when trained on large, heterogeneous expression compendia. However, many clinically relevant cohorts cannot be pooled into a single centralized dataset due to privacy concerns, regulatory requirements, and data governance policies. While Federated Learning (FL) offers a framework for collaborative training without data pooling, standard FL workflows (designed for deep learning with gradient-based updates) do not naturally align with PLIER. PLIER relies on closed-form linear-algebraic updates and structural constraints based on gene sets, requiring a dedicated reformulation to function in a distributed setting. Furthermore, there is a need to understand the privacy risks of such federated matrix factorization, specifically regarding membership inference attacks, which have been less studied in this context compared to deep learning.

2. Methodology

2.1. The FPLIER Framework

FPLIER is a federated reformulation of PLIER designed to enable collaborative training across multiple data holders while keeping raw gene expression data local. The protocol operates under an honest-but-curious threat model, where the server and clients follow the protocol but may attempt to infer additional information from observed quantities.

Core Mechanism:

Data Partitioning: The gene expression matrix $Y$ is partitioned column-wise (samples) across $N$ clients. Each client $i$ holds a private dataset $Y^{priv}_i$ and is assigned a shard of a shared public dataset $Y^{pub}_i$ .
Global vs. Local Variables:
- Local: Each client retains its expression matrix $Y_i$ and the corresponding latent representation $B_i$ locally. These are never shared.
- Global: The gene loading matrix $Z$ , the gene-set association matrix $U$ , and the gene-set membership matrix $C$ are global parameters shared among the consortium.
Secure Aggregation: The training updates in PLIER depend on matrix products such as $YY^\top$ , $YB^\top$ , and $BB^\top$ . In FPLIER, these quantities are computed additively across clients ( $\sum Y_i Y_i^\top$ , etc.) using the SecAgg+ protocol. This ensures the server only sees the aggregated sum, not individual client contributions.
Algebraic Equivalence: Because the updates depend on data only through these aggregated sums, FPLIER produces training updates that are algebraically equivalent to a centralized PLIER approach (up to minor numerical differences), preserving the mathematical structure of the original method.

Protocol Phases:

Preliminary Steps: The server distributes shards of public data to clients. Clients concatenate their private data with their public shard, perform local train/holdout splits, and participate in a federated z-score standardization.
Federated Training: Clients iteratively update local matrices and securely aggregate the necessary matrix products to update global $Z$ and $U$ .
Post-release Assessment (Optional): Clients can locally evaluate the model's sensitivity to membership inference attacks using their holdout sets before the model is released.

2.2. Privacy Evaluation Strategy

The authors evaluate privacy risk through membership inference attacks in two settings:

Training-time Attack: An honest-but-curious server attempts to determine if a specific sample was in the training set using the aggregated covariance-like matrix $YY^\top$ observed during initialization. The attack uses principal component analysis (PCA) on $YY^\top$ to project candidate samples; training samples typically yield smaller reconstruction residuals.
Post-release Attack: An external adversary uses the released model parameters ( $Z$ and $\lambda_2$ ) to reconstruct samples and measure the Spearman rank correlation between the original and reconstructed profiles.

3. Key Contributions

FPLIER Formulation: The first federated formulation of a gene-set-aware factorization method for transcriptomic analysis, specifically adapting PLIER's optimization procedure for distributed training.
Empirical Validation: Demonstration that FPLIER converges stably and produces decompositions statistically indistinguishable from centralized PLIER across simulated consortia (K–CLIER and MultiPLIER settings).
Privacy-Rank Analysis: A systematic analysis revealing that membership inference risk is governed by the rank of the training expression matrix. The study identifies that increasing the sample-to-feature ratio ( $n/p$ ) or incorporating public data moves the system toward a "full-rank regime," where training and non-training samples become indistinguishable to attackers.
Novel Post-release Analysis: The first presentation of membership inference risks for standard centrally trained PLIER models, showing that the same rank-based principles apply to released models.

4. Experimental Results

The authors evaluated FPLIER using datasets from the K–CLIER (kidney biology) and MultiPLIER (general transcriptomics) studies, simulating federated consortia with varying proportions of public data (0% to 100%).

Model Utility: FPLIER converged reliably. Kolmogorov–Smirnov tests on gene-wise reconstruction correlations showed no statistically significant difference between FPLIER and centralized PLIER.
Training-time Attacks:
- In rank-deficient regimes (low $n/p$ , little public data), the server could achieve near-perfect AUROC (close to 1.0) in distinguishing training samples from holdout samples.
- As public data was added or dimensionality was reduced, $n/p$ increased. Once the system approached the full-rank regime ( $n/p \approx 1$ ), attack performance dropped sharply toward random guessing (AUROC $\approx 0.5$ ).
Post-release Attacks:
- Similar trends were observed: attack effectiveness decreased as the rank of the training data increased.
- However, post-release attacks were generally less effective than training-time attacks and exhibited more variability across clients, likely due to the influence of regularization and gene-set constraints on the latent space.
Dimensionality Reduction: Reducing the feature space (e.g., to 2,000 genes in K–CLIER) shifted the system into a full-rank regime at smaller sample sizes, significantly mitigating attack effectiveness.

5. Significance and Claims

The paper claims that FPLIER provides a pragmatic and proportionate solution for collaborative transcriptomic analysis in the face of data governance constraints. Its primary significance lies in:

Enabling Collaboration: It allows institutions to leverage large, heterogeneous public datasets and private cohorts simultaneously without centralizing sensitive raw data, adhering to regulatory frameworks like GDPR.
Defining Privacy Boundaries: The work establishes that for matrix factorization methods like PLIER, privacy is not an absolute binary but a function of data rank. It provides a practical guideline: consortia should aim to operate in a full-rank regime (achieved via public data integration or dimensionality reduction) to naturally mitigate membership inference risks without necessarily resorting to differential privacy, which can degrade model utility.
Operational Safeguards: The protocol includes a built-in mechanism for clients to locally assess privacy risk before model release, allowing them to block release if the model is found to be overly sensitive to their specific data distribution.

The authors maintain a modest stance, noting that their privacy guarantees are empirical rather than formal (unlike differential privacy) and that the study is limited to an honest-but-curious threat model. They suggest future work could incorporate formal privacy mechanisms and explore federated singular value decomposition to further reduce exposure during initialization.