🤖 AI

Similarity Weighted Aggregation with Global Differential Privacy for Federated Brain Lesion Segmentation

This paper proposes DP-SimAgg, a privacy-preserving federated learning framework that combines similarity-weighted aggregation with server-side differential privacy to effectively train brain tumor segmentation models on heterogeneous, multi-institutional MRI data while maintaining competitive performance under strict privacy budgets.

Original authors: Muhammad Irfan Khan, Eero Lehtonen, Joni Obradovic, Elina Kontio, Esa Alhoniemi, Suleiman A. Khan, Mojtaba Jafaritadi

Published 2026-08-04

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Muhammad Irfan Khan, Eero Lehtonen, Joni Obradovic, Elina Kontio, Esa Alhoniemi, Suleiman A. Khan, Mojtaba Jafaritadi

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a world where doctors could build a super-smart AI to spot brain tumors, but they can't share their patients' private MRI scans because of strict privacy laws. It's like trying to bake the world's best cake, but every baker is forbidden from sending their secret recipe or ingredients to a central kitchen. This is the heart of Federated Learning: a clever way for computers to learn together without ever sharing the raw data. Instead of moving the data, the computers send only the "lessons learned" (mathematical updates) back to a central teacher.

However, there are two big hurdles. First, every hospital's data is different—some have older scanners, different patient groups, or unique ways of labeling tumors. This is like a classroom where some students speak different dialects; if the teacher just averages their answers, the final lesson might be confusing. Second, even the "lessons" sent back can sometimes leak secrets. If a sneaky hacker intercepts these updates, they might be able to reverse-engineer them to guess what a specific patient's scan looked like. This is the challenge of Differential Privacy: a mathematical shield that adds just enough "static" or noise to the lessons so that no one can tell if a specific person's data was used, while still keeping the overall lesson accurate.

This paper, titled "Similarity Weighted Aggregation with Global Differential Privacy for Federated Brain Lesion Segmentation," tackles both problems at once. The researchers, working at Turku University of Applied Sciences, created a new method called DP-SimAgg. Think of it as a super-organized group project for 33 different hospitals. They used a dataset of 1,251 MRI scans from patients with glioblastoma (a type of brain tumor) to train an AI to slice out the tumor from the healthy brain tissue.

Here is how their new method works, using a playful analogy:

Imagine the central server is a conductor leading an orchestra of 33 musicians (the hospitals). In a standard setup, the conductor just takes the average sound of everyone and plays it back. But if one musician is playing a slightly different tune (because their data is weird or "non-IID"), the music sounds messy. The researchers' Similarity-Weighted Aggregation acts like a smart conductor who listens to each musician. If a musician's sound is close to the group's harmony, the conductor gives them a loud, clear microphone. If a musician is playing a wild, off-key solo (an outlier), the conductor turns their volume down. This ensures the final song (the AI model) stays on track, even if the musicians are playing from different sheet music.

But wait, what about the privacy? The conductor is still hearing the notes, which could be risky. So, they add a Global Differential Privacy layer. Imagine the conductor adds a gentle, calibrated "hiss" of static noise to the final recording. This noise is carefully calculated: it's loud enough to hide exactly which notes any single musician played (protecting the patient's privacy), but quiet enough that the melody of the song remains beautiful and recognizable.

The researchers tested this on a powerful computer cluster using Intel's OpenFL platform. They ran the training for 20 rounds (like 20 practice sessions). They compared their new method against a standard, non-private version.

The results were promising. When they used a "strict" privacy setting (where the noise was high, with a privacy budget of $\epsilon = 1$ per round), the AI still managed to do a decent job. It achieved a "Dice score" (a measure of how well the AI's outline matches the real tumor) of 0.6357 for the enhancing tumor, 0.5305 for the tumor core, and 0.5274 for the whole tumor. While this was lower than the non-private version, it showed the system still worked even with heavy privacy protection.

When they relaxed the privacy rules a bit (increasing the budget to $\epsilon = 10$ per round, meaning less noise), the AI's performance jumped up, getting very close to the non-private version. For the whole tumor, the score hit 0.7962, nearly matching the 0.7896 of the non-private baseline.

Crucially, the paper notes that adding this privacy shield didn't slow things down much. The training took about 16 to 18 hours in all cases, and the computer memory usage was almost identical (around 305 GB). This suggests that you don't have to sacrifice speed to get privacy.

The authors are careful to point out that this is a simulation and a specific experiment. They found that while the method works well, it relies on a "trusted" central server to add the noise. If that server were untrustworthy, the privacy guarantee might change. They also noted that the sensitivity of the tumor types varied; the AI was better at finding the whole tumor than the tiny, tricky core when the privacy noise was high.

In short, this paper suggests that it is possible to build a collaborative, privacy-safe AI for brain tumor segmentation that handles messy, different data from many hospitals without breaking a sweat. It's a step toward a future where hospitals can learn from each other to save lives, without ever having to share a single patient's private photo.

Technical Summary: DP-SimAgg for Privacy-Preserving Federated Brain Lesion Segmentation

Problem Statement
Federated Learning (FL) offers a pathway for collaborative machine learning in medical imaging without sharing raw patient data, addressing the tension between data scarcity and strict privacy regulations (e.g., HIPAA, GDPR). However, standard FL protocols face two critical challenges in the medical domain:

Statistical Heterogeneity (Non-IID): Data distributions vary significantly across institutions due to differences in imaging protocols, scanner hardware, and patient populations. Standard aggregation methods like FedAvg suffer from "client drift," where divergent local updates degrade global model convergence and quality.
Privacy Leakage: Transmitting model updates (gradients or parameters) can expose sensitive information. Attacks such as gradient inversion and membership inference can reconstruct private patient attributes or training samples from these updates, meaning vanilla FL lacks formal privacy guarantees.

Existing solutions often address these issues in isolation. Aggregation strategies that handle non-IID data (e.g., FedProx, SCAFFOLD) typically require modifications to local training procedures, which is impractical in heterogeneous clinical environments. Conversely, differential privacy (DP) mechanisms often rely on local DP (adding noise at the client), which incurs high noise levels and utility loss, or standard server-side DP applied to simple averaging, which fails to account for data heterogeneity.

Methodology: DP-SimAgg
The authors propose DP-SimAgg, a server-side framework that unifies similarity-weighted aggregation with global differential privacy. The method operates within the Intel OpenFL platform and requires no modification to collaborator-side training procedures. The core mechanism involves four integrated stages:

L2 Norm Clipping: Before aggregation, each collaborator's model update vector ( $v_i$ ) is projected onto an L2 ball of radius $C$ . This bounds the influence of any single collaborator and establishes a finite upper bound on the sensitivity of the aggregation function, a prerequisite for differential privacy.
Similarity-Weighted Aggregation (SimAgg): Instead of simple averaging, the server computes aggregation weights based on the similarity of each clipped update to the global consensus. Updates closer to the average receive higher weights, while divergent updates (likely caused by non-IID data or outliers) are down-weighted. This mitigates client drift without altering local training.
Empirical Sensitivity Estimation: To calibrate the noise injection, the server estimates the L2 sensitivity ( $\Delta f$ ) of the aggregation function. This is done by simulating a "neighboring dataset"—replacing one collaborator's update with a bounded adversarial tensor—and measuring the L2 difference between the original and simulated aggregation outputs.
Gaussian Noise Injection: Using the estimated sensitivity and a per-round privacy budget $(\epsilon_0, \delta_0)$ , calibrated isotropic Gaussian noise is added to the aggregated tensor at the server. This provides formal $(\epsilon_0, \delta_0)$ -differential privacy guarantees for that round.

The framework employs a sliding window selection strategy for collaborators to ensure fair participation and diversity across training cycles, avoiding the biases of static or purely random selection.

Key Contributions

Unified Framework: DP-SimAgg is presented as the first framework to explicitly combine server-side similarity-weighted aggregation with central Gaussian differential privacy for multi-institutional medical image segmentation, specifically without requiring changes to local training loops.
Server-Side Design: The approach is purely server-side, making it deployable in environments where institutions use diverse software stacks or lack infrastructure for custom training modifications.
Algorithmic Specification: The paper provides complete algorithmic specifications (Algorithms 1–3) detailing the clipping, weighting, sensitivity estimation, and noise injection processes, along with formal $(\epsilon_0, \delta_0)$ -DP guarantees per round and sequential composition accounting.
Empirical Evaluation: A comprehensive evaluation is conducted on the FeTS 2022 benchmark (1,251 multi-modal MRI scans across 33 institutions), quantifying the privacy-utility trade-off across different privacy budgets.

Experimental Results
The framework was evaluated over 20 communication rounds using a 3D Residual U-Net. The results highlight the trade-off between privacy strictness and segmentation accuracy (measured by Dice scores):

Strict Privacy ( $\epsilon_0 = 1$ , cumulative $\epsilon_{total} = 20$ ): The model maintains competitive performance with Dice scores of 0.6357 (Enhancing Tumor), 0.5305 (Tumor Core), and 0.5274 (Whole Tumor). While lower than the non-private baseline, these scores remain within the range of inter-rater variability observed in clinical studies.
Relaxed Privacy ( $\epsilon_0 = 10$ , cumulative $\epsilon_{total} = 200$ ): Performance approaches the non-private SimAgg baseline, achieving Dice scores of 0.7962 (Enhancing Tumor), 0.6757 (Necrotic Core), and 0.6872 (Peritumoral Edema). Specifically, the scores are 0.7962 for the Enhancing Tumor (ET, Label 4), 0.6757 for the Necrotic Core (NCR, Label 1), and 0.6872 for the Peritumoral Edema (ED, Label 2). The composite regions are defined as Tumor Core (TC = NCR ∪ ET, Labels 1+4) and Whole Tumor (WT = NCR ∪ ED ∪ ET, Labels 1+2+4).
Computational Overhead: The integration of DP adds negligible computational cost. Wall-clock time, memory usage, and energy consumption differ by less than 5% compared to the non-private baseline, confirming the practicality of the noise injection step relative to local training costs.

Significance and Claims
The authors claim that DP-SimAgg successfully demonstrates that privacy-preserving collaborative learning is feasible for complex medical imaging tasks without sacrificing the robustness required for non-IID data. By integrating similarity weighting with DP, the framework mitigates the dual challenges of client drift and information leakage.

The paper modestly positions its contribution as filling a gap in the literature: while SimAgg was known to outperform FedAvg in non-IID settings, its behavior under differential privacy constraints was previously unstudied. The work establishes that similarity-weighted aggregation remains effective even when calibrated noise is injected, offering a viable path for privacy-compliant medical AI. The authors acknowledge limitations, including the reliance on a trusted aggregator (standard for central DP), the use of empirical rather than analytical sensitivity bounds, and the restriction to a single segmentation task, suggesting future work in tighter accounting and broader validation.

Technical Summary: DP-SimAgg for Privacy-Preserving Federated Brain Lesion Segmentation

More like this