Recovering Clinical Utility Under Differential Privacy: Empirical Validation of Adaptive Federated Aggregation on Heterogeneous Cardiovascular Datasets

Technical Summary: Recovering Clinical Utility Under Differential Privacy

Problem Statement
The central challenge addressed is the tension between the need for large, diverse datasets to train high-quality cardiovascular risk models and the legal prohibitions (e.g., GDPR, LGPD) against centralizing patient records. While Federated Learning (FL) allows institutions to collaborate without sharing raw data, it faces two compounding technical barriers in clinical settings:

1. Statistical Heterogeneity (Non-IID): Real-world clinical data varies significantly across institutions in demographics, disease prevalence, and collection protocols, causing "client drift" where local gradients diverge from the global optimum.
2. Privacy-Utility Trade-off: Differential Privacy (DP) is required to prevent inference attacks but introduces calibrated noise that destabilizes model convergence, particularly under Non-IID conditions. This often leads to significant degradation in clinical utility, especially for minority classes (high-risk patients).

Previous work by the authors established a theoretical and synthetic basis for a solution but lacked validation on authentic, heterogeneous clinical data. This study bridges that gap by moving from controlled synthetic benchmarks to real-world multi-institutional validation.

Methodology
The study validates the FedCVR framework, an architecture integrating server-side adaptive optimization with client-side Differential Privacy.

• Architecture:
  • Client-Side: Five heterogeneous institutions (Framingham, Cleveland, Hungarian, Switzerland, Long Beach VA) perform local training on private Electronic Health Records (EHR). Clients apply Differential Privacy via gradient clipping (L2 norm $C=1.0$) and the addition of calibrated Gaussian noise ($\sigma$) before transmitting update vectors to the server.
  • Server-Side: Instead of standard weighted averaging (FedAvg), the server employs an Adam-based adaptive optimizer. It maintains first-moment (mean) and second-moment (variance) estimates of the gradients. This mechanism acts as a "temporal denoiser," using momentum to smooth out the zero-mean Gaussian noise injected by DP and dampen oscillations caused by client drift.
• Data Configuration:
  • Five real-world cardiovascular datasets were harmonized to a 13-attribute UCI schema.
  • The datasets exhibit genuine heterogeneity: varying sample sizes (123 to 4,238 records), disease prevalence (15% to 94%), and missing feature patterns (e.g., near-total absence of cholesterol in the Switzerland dataset).
  • Evaluation Protocol: A client-level leave-one-institution-out cross-validation was used. In each fold, one institution is held out entirely for testing while the model is trained on the remaining four. This tests generalization to unseen healthcare institutions.
• Experimental Setup:
  • Models were trained for 100 communication rounds with 5 local epochs.
  • Privacy budgets ranged from $\epsilon \approx 4.2$ (operational) to $\epsilon \approx 1.2$ (strict).
  • Comparisons were made against standard FedAvg, FedCVR without DP, and local-only models.

Key Contributions

1. First Real-Data Empirical Validation: This work provides the first evaluation of the FedCVR architecture on genuine, multi-institutional cardiovascular data, extending previous synthetic findings to a realistic federated network.
2. Robust Evaluation Protocol: The introduction of a client-level cross-validation protocol with a composite global test set offers a stronger measure of generalization than independent resampling, directly simulating the deployment scenario of adding a new institution to a federation.
3. Characterization of Real-World Heterogeneity: The study quantifies how authentic data challenges (missing features, uncontrolled class imbalance, distributional edge cases) impact the privacy-utility trade-off, moving beyond engineered synthetic benchmarks.

Results

• Performance: Under an operational privacy budget ($\sigma=0.8, \epsilon \approx 4.2$), FedCVR achieved an F1-Score of 79.2% and an AUC of 0.96.
• Statistical Superiority: FedCVR statistically outperformed standard FedAvg across all metrics (paired t-tests, all $p \le 0.003$, significant under Bonferroni correction). The adaptive mechanism improved F1-Score by 2.8 percentage points over FedAvg.
• Convergence: FedCVR converged significantly faster, reaching 95% of its final performance in 45 rounds compared to 85 rounds for FedAvg. The adaptive mechanism effectively mitigated the oscillatory behavior ("client drift") observed in FedAvg.
• Privacy Cost: The introduction of Differential Privacy incurred a minimal utility cost. Compared to the non-private adaptive baseline (F1 79.5%), the strictest privacy regime ($\epsilon \approx 1.2$) resulted in only a 1.4 percentage point drop (F1 78.1%).
• Generalization: The global federated model performed competitively with or better than locally trained models across all institutions. Notably, smaller institutions (Cleveland, Hungarian) saw significant gains (+3.2% and +2.8% F1, respectively), while the largest institution (Framingham) saw no degradation, confirming the framework's value for data-scarce sites without penalizing data-rich ones.

Significance and Claims
The paper claims that server-side adaptive optimization is a structural prerequisite for recovering clinical utility in federated learning under Differential Privacy. The results demonstrate that the "temporal denoising" property of momentum-based aggregation generalizes from synthetic environments to authentic, heterogeneous clinical data.

Key takeaways emphasized by the authors include:

• Regulatory Viability: Strict privacy compliance (GDPR/LGPD) and high clinical utility are not mutually exclusive; the framework achieves rigorous privacy guarantees with negligible performance sacrifice (<2% degradation).
• Democratization of AI: The approach allows smaller, resource-constrained healthcare facilities to access model quality previously attainable only through large-scale data centralization, without compromising data sovereignty.
• Architectural Robustness: The adaptive aggregation mechanism inherently filters both stochastic noise from statistical heterogeneity and deliberate noise from Differential Privacy, stabilizing convergence in complex, real-world federated networks.

The authors maintain a modest stance, acknowledging that while the results are statistically significant and robust across folds, the study relies on curated public datasets rather than raw, uncurated EHRs, and future work requires prospective clinical validation to confirm impact on patient outcomes.