🧬 biology

Privacy-preserving federated tensor decomposition of single-cell immune data: recovering multicellular programs across institutions

This paper presents a privacy-preserving federated tensor decomposition method that enables institutions to collaboratively recover coordinated multicellular immune programs across diverse cell types and ancestries without sharing raw single-cell data, achieving performance equivalent to centralized analysis while significantly reducing membership inference risks.

Original authors: Axel Faes, Stephanie M. van den Berg, Maryam Amir Haeri

Published 2026-06-25

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Axel Faes, Stephanie M. van den Berg, Maryam Amir Haeri

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ⚕️ This is an AI-generated explanation of a preprint that has not been peer-reviewed. It is not medical advice. Do not make health decisions based on this content. Read full disclaimer

The Big Problem: The "Locked Library"

Imagine you have a massive library of medical stories (data) about how people's immune systems work. Each story is written by a different hospital. These stories are incredibly valuable because, when you read them all together, you can spot patterns that no single hospital could see alone.

However, there's a big problem: Privacy laws and patient consent mean these hospitals cannot physically move their books to a central library. They can't pool all the patient data into one giant pile. If they tried, they would risk revealing private information about specific patients.

The Solution: A "Secret Puzzle" Method

The authors of this paper created a new way to solve this puzzle without ever moving the books. They call it Federated Tensor Decomposition.

Here is how it works, using a few analogies:

1. The "Local Sketch" (Instead of the Whole Photo)

Imagine every hospital has a photo of a complex scene (the patient's immune system).

Old Way: Everyone sends their full, high-resolution photo to a central boss. The boss combines them to see the whole picture. Risk: If the boss is hacked, all the private photos are stolen.
New Way: Each hospital looks at their own photo and draws a simple, low-detail sketch of the main patterns they see (like "there's a big red shape here" or "the blue lines go this way"). They throw away the original photo and only send the sketch to the boss.
The Magic: The boss takes all these simple sketches and stacks them together. Because the math is done correctly, the stacked sketches recreate the exact same big picture as if everyone had sent their full photos.

2. The "Global Center" (Fixing the Bias)

Sometimes, one hospital might have mostly sick patients, while another has mostly healthy ones. If they just draw their own sketches, the "center" of the drawing might be skewed.

The authors invented a trick where the boss tells everyone, "Here is the average of everyone combined."
Each hospital then adjusts their local sketch to match this global average before sending it.
Result: Even if one hospital is very different from the others, the final combined picture remains accurate and fair. The paper shows this prevents the results from getting "confused" by which hospital the data came from.

3. The "Missing Pieces" Puzzle (Vertical Federation)

What if Hospital A only has pictures of the lungs, and Hospital B only has pictures of the liver? They don't share any common features, so they can't usually compare notes.

The authors' method uses the patients themselves as the glue. Even if the hospitals see different body parts, they often have the same patients in their records.
By linking the data through the shared patients (without revealing who they are), the system can reconstruct a full picture of the whole body, even though no single hospital ever saw the whole body.

What Did They Prove?

The team tested this method on real data from patients with diseases like Lupus (SLE), COVID-19, and lung fibrosis.

It Works Perfectly: When they compared their "federated" (split-up) method to the old "centralized" (pooled) method, the results were almost identical. The patterns they found were the same.
It Finds Hidden Patterns: In some diseases (like lung fibrosis), the problem isn't just in one cell type; it's a coordinated dance between many different cells. Their method found these "group dances" better than looking at just one cell type alone. In other diseases (like blood disorders), looking at just one cell type was enough, so the new method didn't add extra magic, but it didn't hurt either.
It's Private: They tested if a hacker could figure out if a specific person was in the data just by looking at the final sketches.
- Without their special security, a hacker could guess with 91% accuracy.
- With their special security (called "Secure Aggregation"), the hacker's guess dropped to 61% (which is basically a random guess).
- Crucial Point: The raw patient data (the "photos") never left the hospitals. Only the mathematical "sketches" were shared.

The Bottom Line

This paper presents a new mathematical tool that lets different hospitals work together to understand complex immune diseases without ever sharing their private patient data. It proves that you can get the same high-quality scientific insights from a "virtual" combined dataset as you would from a real, physical one, while keeping patient privacy secure.

What they explicitly did not claim:

They did not say this cures diseases.
They did not say this is ready for immediate use in every hospital tomorrow (they noted it requires specific technical setups).
They did not claim it works for every type of data perfectly; they found it is most useful for diseases where many different cell types work together (like fibrosis), and less critical for diseases dominated by a single cell type.

Technical Summary: Privacy-preserving federated tensor decomposition of single-cell immune data

Problem Statement
Single-cell RNA sequencing atlases are increasingly assembled across multiple institutions, ancestries, and biobanks. While centralized tensor decomposition (specifically the scITD framework) has proven effective at recovering "multicellular programs"—coordinated axes of transcriptional variation spanning multiple cell types that stratify disease—these methods require pooling raw data. In practice, patient-derived single-cell profiles are governed by strict consent and data-protection constraints that frequently preclude centralization. Existing federated single-cell methods address batch correction, cell-type classification, or QTL mapping, but none address the recovery of multicellular programs via tensor decomposition, particularly in settings where sites may not observe the same cell types (vertical federated learning).

Methodology
The authors propose a federated estimator for multicellular tensor decomposition that operates on a donor $\times$ cell-type $\times$ gene tensor. The data is represented as pseudobulk expression (summed UMI counts per donor per cell type), normalized, and centered.

Complete-Panel Federation (Horizontal FL):
- Protocol: Each site $s$ holds a subset of donors. Sites compute a local low-dimensional program subspace by performing a truncated Singular Value Decomposition (SVD) on their local, globally-centered data matrix ( $X_s - \bar{x}$ ).
- Aggregation: Instead of sharing raw cells or donor scores, sites transmit only scaled loadings ( $M_s = \Sigma^{(K)}_s V^{(K)\top}_s$ ). A coordinator merges these by stacking the matrices and performing a global SVD.
- Centering: A critical component is federated global-mean centering. Sites first exchange per-site means to compute a global mean $\bar{x}$ , which is then used to center local data before SVD. This operation is provably equivalent (up to truncation error) to centralized decomposition and ensures robustness against site-label confounding (e.g., when one site has a skewed case fraction).
- Privacy: The aggregation is a summation, making it compatible with Secure Aggregation (SecAgg), ensuring the coordinator sees only the aggregate, not individual site contributions.
Incomplete-Panel Federation (Vertical FL):
- Scenario: Sites share donors but observe disjoint sets of cell types (partitioned features). Fixed-feature federated PCA cannot apply here.
- Protocol: Sites compute local "donor-gram" blocks $G_s = (X_s - \bar{x})(X_s - \bar{x})^\top$ over their specific cell-type columns.
- Aggregation: The coordinator sums these blocks ( $G = \sum G_s$ ) to reconstruct the full centralised Gram matrix. Eigendecomposition of $G$ yields shared donor scores. Sites then compute loadings for their specific cell types, which are concatenated to form the full program.
- Privacy: Revealing the donor Gram matrix exposes donor-level structure (maximal leakage). To maintain privacy, the coupling (summing and eigendecomposition) must be performed under Homomorphic Encryption (HE) or Multiparty Computation (MPC), releasing only the final program loadings.

Key Contributions

Vertical-FL Recovery: The first method to recover full multicellular programs when no single site observes all cell types, utilizing donor-mode coupling to span cell types unseen by any individual site.
Confounding-Robust Estimator: A federated merge strategy using global-mean centering that prevents degradation of program quality under severe site-label skew (e.g., one site containing 90% cases), a failure mode for naive per-site centering.
Privacy Evaluation: A rigorous membership-inference attack (MIA) evaluation quantifying leakage. The study demonstrates that while revealing per-site subspaces or donor Grams is highly leaky (MIA AUC $\approx$ 0.9–1.0), using Secure Aggregation for the complete-panel scheme or HE/MPC for the incomplete-panel scheme reduces leakage to near-random levels (MIA AUC $\approx$ 0.61).
Cross-Tissue Utility Map: An empirical delineation of when multicellular recovery provides predictive advantage over single-cell-type analysis, identifying that the method outperforms single-cell baselines primarily in tissues with strong cross-cell-type coordination (fibrotic diseases).

Results

Faithful Recovery: On a 261-donor Systemic Lupus Erythematosus (SLE) atlas, the federated estimator recovered the canonical interferon multicellular program with a subspace correlation of 0.967 and a phenotype separation AUC of 0.958, statistically indistinguishable from the centralized result ( $\Delta$ AUC = -0.000).
Robustness: The method maintained performance across multi-ancestry splits and adversarial processing-cohort splits (0% vs. 90% cases). On a real-world COVID-19 atlas split across three UK institutions, the federated subspace correlation was 0.989.
Incomplete Panels: When SLE cell types were partitioned into disjoint panels, the donor-gram coupling recovered the full program with exact subspace correlation (1.000 by construction), a feat impossible for fixed-feature federated PCA.
Predictive Utility:
- Interstitial Lung Disease (ILD): The multicellular program significantly outperformed the best single cell type (AUC 0.959 vs. 0.910), capturing a fibrotic axis spanning $\approx$ 24 cell types.
- Fibrosing Cholangiopathy (Liver): Corroborated the ILD finding (AUC 0.975), though the small cohort size ( $n=16$ ) limits definitive claims.
- Other Tissues: In blood (SLE, COVID), gut, kidney, and heart cohorts where a single compartment often dominates the signal, the multicellular program achieved parity with the best single cell type but did not exceed it.
Privacy: Secure aggregation reduced the membership-inference AUC from 0.906 (curious coordinator seeing per-site subspaces) to 0.609 (merged subspace only).

Significance and Claims
The paper claims to close the gap between the biological utility of multicellular tensor decomposition and the governance constraints of multi-institutional data. The primary contribution is a faithful, private federated recovery of established coordinated programs. The authors explicitly state that the method "earns its cost" (i.e., provides predictive gain over single-cell analysis) specifically in settings with strong cross-cell-type coordination (fibrotic tissues), while remaining a faithful private recovery mechanism in other contexts.

The work does not claim to solve formal Differential Privacy (DP) for current cohort sizes, noting that statistically meaningful private subspace recovery requires sample sizes ( $n$ ) beyond current single-cell atlases. Instead, it relies on Secure Aggregation and membership-inference evaluations to provide practical privacy guarantees. The study establishes a taxonomy of release objects (subspaces vs. Grams vs. scores) and their associated privacy risks, offering a practical pathway for cross-institutional and cross-ancestry immune program analysis without sharing raw cells.