🤖 AI

Privacy-Preserving Federated Autoencoder for ECG Anomaly Detection on Edge Devices

This paper presents a privacy-preserving federated autoencoder system for unsupervised ECG anomaly detection that successfully integrates differential privacy, federated learning, and INT8 quantization to achieve high detection accuracy on edge devices while maintaining legal-grade privacy and handling non-IID hospital data.

Original authors: Kaan Arda Akyol, Jakub Kacper Szeląg, Aydin Abadi, Maha Alghamdi, Ghadah Albalawi, Ghouse Ibrahim Kaleelullah, Hilal Tutus, Sarah Al Subaiei, Shardul Kapse, Syed Mohammed Raheeb, Mujeeb Ahmed, Rehmat

Published 2026-06-11

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Kaan Arda Akyol, Jakub Kacper Szeląg, Aydin Abadi, Maha Alghamdi, Ghadah Albalawi, Ghouse Ibrahim Kaleelullah, Hilal Tutus, Sarah Al Subaiei, Shardul Kapse, Syed Mohammed Raheeb, Mujeeb Ahmed, Rehmat Ullah

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a very sensitive, personal diary that records the rhythm of your heart every second. Doctors want to read these diaries to spot trouble before it becomes a heart attack. But there's a problem: you don't want to hand your diary over to a central library because it contains your deepest secrets (your medical data), and the library might get hacked or misused.

This paper presents a clever solution to that problem, acting like a "Secret Study Group" for heart monitors. Here is how it works, broken down into simple concepts:

1. The Secret Study Group (Federated Learning)

Instead of sending all the heart diaries to one big library, the researchers set up a system where the "students" (hospitals) keep their diaries on their own desks.

How it works: Each hospital trains a smart computer program (an AI) on its own local data. Instead of sharing the diary, they only share the lessons the AI learned (the "updates").
The Result: A central teacher (the server) collects these lessons, mixes them together, and sends back a smarter, combined teacher to everyone. No one ever sees anyone else's private diary.

2. The "Static" Noise (Differential Privacy)

Even sharing "lessons" can be risky. A clever hacker might look at the lessons and guess exactly what a specific person's diary said. To stop this, the researchers add a layer of protection called Differential Privacy.

The Analogy: Imagine you are whispering a secret to the teacher. To protect you, you add a little bit of "static" or background noise to your whisper. The teacher can still understand the general lesson, but they can't tell if you specifically said it or if it was just the noise.
The Trade-off: The paper found that if you add too much noise, the teacher gets confused and stops learning. They found a "Goldilocks" amount of noise (called $\epsilon=4$ ) that keeps you safe without ruining the teacher's ability to spot heart problems.

3. The Pocket-Sized Teacher (Edge Computing & Quantization)

Heart monitors are small devices (like the Raspberry Pi computer used in the study). They don't have the muscle of a giant supercomputer. The AI models are usually too heavy to run on these small devices.

The Solution: The researchers used a technique called Quantization. Think of this as taking a high-definition, 4K movie and compressing it into a standard DVD. You lose a tiny bit of picture quality, but the file size shrinks by half, and it plays much faster on a small player.
The Result: They made the AI model 50% smaller and twice as fast, allowing it to run smoothly on a small device without needing to connect to the internet constantly.

4. The "Spot the Odd One Out" Game (Anomaly Detection)

The AI isn't trying to diagnose a specific disease (like "This is a heart attack"). Instead, it's trained only on normal heartbeats.

The Analogy: Imagine a security guard who has memorized what a "normal" walk looks like. If someone walks in limping, dragging a foot, or moving strangely, the guard raises an alarm. The guard doesn't need to know why they are limping; they just know it's not normal.
The Goal: This system acts as a triage tool. It flags unusual heartbeats so a human doctor can look at them later. It is designed to catch anything strange, not just one specific disease.

What Did They Discover?

The researchers tested this system on data from 10 simulated hospitals with different types of patients (some with lots of data, some with very little). Here is what they found:

Teamwork Works: The "Secret Study Group" (Federated Learning) actually worked better or just as well as if all the data had been in one big library. In fact, having different types of data helped the AI learn better, preventing it from getting "stuck" in a bad habit.
Privacy vs. Smarts: They found a sweet spot. If they made the privacy too strict (too much noise), the AI got too confused to work. But at their recommended level ( $\epsilon=4$ ), it was safe enough for clinical use and smart enough to do the job.
Double Protection: They proved that adding the "static" noise (Privacy) and shrinking the model (Quantization) don't hurt each other. You can have a tiny, fast model that is also highly private.
The "Floor": They noticed that if you try to be too private (below $\epsilon=4$ ), the AI hits a "utility floor." It becomes so confused by the noise that it can't learn anything useful anymore, no matter how much you try.

The Bottom Line

This paper builds a system that lets doctors use AI to watch heart rhythms in real-time on small, wearable devices. It keeps your medical data on your device, adds a layer of mathematical noise to prevent hackers from reverse-engineering your identity, and shrinks the software so it runs fast on cheap hardware.

Crucially, the authors state this is a "screening and triage" tool. It is designed to say, "Hey, this heartbeat looks weird, please check it," rather than acting as a standalone doctor to diagnose specific conditions. It is the first system to successfully combine all these privacy and efficiency tricks for heart monitoring.

Technical Summary: Privacy-Preserving Federated Autoencoder for ECG Anomaly Detection on Edge Devices

Problem Statement
Continuous electrocardiography (ECG) monitoring offers the potential to detect rhythm abnormalities before they escalate into cardiovascular events. However, deploying such systems in real-world clinical settings faces three simultaneous, often conflicting, challenges:

Privacy Compliance: Patient ECG data is highly sensitive under regulations like GDPR and HIPAA. Centralizing data for training is often legally prohibited. While Federated Learning (FL) keeps data local, it remains vulnerable to gradient inversion and membership inference attacks.
Edge Efficiency: Continuous monitoring devices are typically resource-constrained (e.g., ARM Cortex-A based, such as Raspberry Pi 4). Models must be small and fast enough for real-time inference, yet standard quantization techniques have not been validated for the fine-grained reconstruction fidelity required by unsupervised anomaly detection.
Detection Effectiveness: Models must maintain high detection quality when trained on non-IID (non-independent and identically distributed) data across different hospitals, a common scenario in distributed healthcare.

Existing literature often addresses these issues in isolation or focuses on supervised classification, leaving a gap in unsupervised, reconstruction-based anomaly detection that simultaneously satisfies formal privacy guarantees, edge deployment constraints, and non-IID robustness.

Methodology
The authors propose and evaluate an end-to-end federated system designed for unsupervised 12-lead ECG anomaly detection on the PTB-XL dataset. The pipeline integrates four core components:

Federated Learning (FL): The system simulates ten hospitals (clients) using a Dirichlet distribution ( $\alpha=0.5$ ) to create a non-IID partitioning of 6,294 normal ECG samples. A central server aggregates model updates using Federated Averaging (FedAvg) over 50 rounds.
Model Architectures: Three autoencoder families are evaluated:
- VanillaAE: Fully connected layers.
- ConvAE: 1D convolutional encoder/decoder with GroupNorm.
- VAE: Variational Autoencoder with a reparameterization trick.
  All models are trained to reconstruct normal cardiac morphology; anomalies are flagged based on high reconstruction error (MSE).
Differential Privacy (DP): To prevent privacy leakage from shared updates, the system employs client-side Differentially Private Stochastic Gradient Descent (DP-SGD). Per-sample gradients are clipped ( $L_2$ norm $C=1.0$ ) and Gaussian noise is injected. The system uses a Rényi-DP accountant to track the privacy budget ( $\epsilon, \delta$ ), with $\delta$ fixed at $10^{-5}$ .
Edge Deployment & Quantization: The best-performing 32-bit floating-point (FP32) models undergo 8-bit integer (INT8) post-training quantization (PTQ) without retraining. The final models are benchmarked on a Raspberry Pi 4 (AArch64 architecture) to measure latency and energy efficiency.

Key Contributions
The paper claims to be the first work to evaluate the intersection of Federated Learning, formal $(\epsilon, \delta)$ -DP, unsupervised reconstruction-based detection, and quantized AArch64 deployment for ECG data. Specific contributions include:

Empirical Characterization of Composition: The study demonstrates how FL, DP, and quantization interact. Crucially, it finds that the performance penalties of DP and quantization are empirically independent, allowing practitioners to enable both simultaneously without multiplicative degradation.
Privacy-Utility Trade-off Analysis: Through a five-point $\epsilon$ sweep, the authors identify $\epsilon=4$ as a recommended operating point for clinical data. They observe a "utility floor" at AUROC $\approx 0.610$ ; below $\epsilon=4$ , gradient noise overwhelms the reconstruction signal, causing the model to converge to a trivial mapping.
Edge Efficiency Validation: INT8 quantization reduces model size by approximately 53% and decreases Raspberry Pi 4 inference latency by 16.6% to 44.3% (a 1.20–1.80 $\times$ speedup) with negligible accuracy loss (<0.12% AUROC degradation).
Federation as Regularization: In a counter-intuitive finding, federated training improved the performance of the VAE architecture significantly (+0.165 AUROC) compared to its centralized baseline. The authors attribute this to non-IID client updates acting as implicit regularization, preventing the "posterior collapse" observed in the centralized VAE.

Results

Detection Quality: The federated ConvAE achieved the highest performance with an AUROC of 0.782, matching or exceeding centralized baselines across all architectures.
Privacy Impact: Stronger privacy (lower $\epsilon$ ) monotonically degraded performance. At $\epsilon=1$ , performance hit the utility floor. At $\epsilon=4$ , the system maintained an AUROC of roughly 0.610–0.640 (depending on architecture) while doubling the formal privacy guarantee compared to $\epsilon=8$ .
Deployment Metrics: The recommended configuration (ConvAE INT8) achieved an AUROC of 0.787 with a model size of 2.76 MB and an inference latency of 14.1 ms on a Raspberry Pi 4, consuming approximately 56 mJ per inference.
Per-Class Performance: As an unsupervised one-class detector, the system showed AUROC values near 0.50 for specific abnormal classes (MI, STTC, HYP, CD), confirming its role as a screening tool rather than a specific diagnostic classifier. Hypertrophy (HYP) was the most difficult class to distinguish.

Significance and Claims
The paper positions this work as a critical step toward deployable, ethical, and practical cardiac monitoring systems.

Ethical Necessity: The authors argue that for quasi-biometric data like ECG, formal privacy guarantees (DP) are a prerequisite, not an enhancement, to prevent re-identification via gradient attacks.
Practical Viability: By proving that high-privacy ( $\epsilon=4$ ) and high-efficiency (INT8) configurations can coexist without compounding penalties, the system offers a viable path for real-time, population-level screening on edge devices.
Scope Limitation: The authors modestly clarify that the system is designed for screening and triage to flag potential abnormalities for cardiologist review, not as a standalone diagnostic tool for specific conditions. They acknowledge limitations regarding the use of a single dataset (PTB-XL), simulated non-IID partitioning, and the assumption of an "honest-but-curious" server, noting that secure aggregation and cross-dataset validation are necessary future steps.