💻 computer science

Privacy-Preserving Detection of Rare Disease-Associated Cell Subsets via Secure Multi-Party Computation

This paper proposes a secure multi-party computation framework that enables the privacy-preserving training and inference of the CellCnn model on secret-shared single-cell data, allowing institutions to collaboratively detect rare disease-associated cell subsets with high accuracy without exposing sensitive patient information.

Original authors: Ş. Selcan Magara, Esther Havemann, Debora Jutz, Ali Burak Ünal, Mete Akgün

Published 2026-08-21

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Ş. Selcan Magara, Esther Havemann, Debora Jutz, Ali Burak Ünal, Mete Akgün

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the microscopic world inside our bodies, health and disease often hinge on the presence of a few specific cells hiding among millions of others. Imagine looking for a single, unique grain of sand on a vast beach; this is the challenge scientists face when trying to find rare cell populations that signal the early stages of leukemia or a viral infection. Modern technology has given researchers the ability to measure dozens of proteins on thousands of individual cells at once, creating a high-resolution map of the immune system. However, the very data that makes these discoveries possible is also deeply personal. It can reveal a person's disease status, immune history, and even genetic predispositions. Because of this sensitivity, strict privacy laws prevent hospitals from simply sharing their patient data with one another. This creates a frustrating bottleneck: to find these rare cells reliably, scientists need to train computer models on large, diverse groups of patients, but they cannot legally pool the data required to do so.

A team of researchers has now developed a new way to solve this puzzle, allowing hospitals to collaborate on finding these rare cells without ever seeing each other's raw patient data. Their work focuses on a specific type of artificial intelligence called CellCnn, which is designed to spot these rare cell subsets. The researchers built a secure system that lets multiple computers work together on a shared mathematical problem while keeping the actual numbers hidden. They achieved this by splitting every piece of data into random, meaningless fragments and distributing them to different computing servers. These servers perform the complex calculations needed to train the AI on the fragments, communicating only with each other to combine their results. At no point does any single server, or even the researchers themselves, see the original patient information or the intermediate steps of the calculation. The system is designed so that the final result is just as accurate as if the data had been combined openly, but the privacy of every individual remains intact.

The team tested their method on real-world datasets involving cytomegalovirus infections and acute myeloid leukemia. In these tests, they compared their secure system against the standard, non-private version of the AI and a previous privacy-focused attempt. The results showed that their secure approach could identify disease-associated cells with nearly the same precision as the standard method. For instance, when looking for cells linked to a viral infection, their system achieved an accuracy of about 73 percent, which was virtually identical to the non-private version. In contrast, a previous privacy-preserving method, which had to simplify the AI's brain to make it work with encryption, performed noticeably worse, dropping to around 63 percent accuracy. The new system was able to keep complex parts of the AI, such as activation steps that help the computer learn patterns, which the older method had to discard.

Beyond just classification, the researchers demonstrated that their secure system could also handle a more difficult task: estimating exactly how many rare cancer cells were present in a sample. This is crucial for monitoring patients with minimal residual disease, where doctors need to know if a tiny number of cancer cells remain after treatment. The secure system predicted the fraction of these rare cells with a correlation of 0.98 against the true values, a level of performance that closely matched the standard, non-private model. This capability was something the previous privacy-preserving method could not do at all. The researchers also measured how long the process took, noting that training a model on a local network took about 20 minutes, though the speed was heavily dependent on the connection bandwidth between the computers.

The study confirms that it is possible to train powerful medical AI models on sensitive data without compromising patient privacy. By using a technique where data is shared in secret fragments rather than as a whole, the researchers showed that hospitals can collaborate effectively without violating privacy regulations. While the current system assumes that the computing servers will follow the rules and not deviate from the protocol, the work provides a strong foundation for future medical research. It suggests a path forward where the collective power of many hospitals can be used to detect rare diseases, all while ensuring that the private details of individual patients remain completely hidden throughout the entire process.

Technical Summary: Privacy-Preserving Detection of Rare Disease-Associated Cell Subsets via Secure Multi-Party Computation

Problem Statement
The detection of rare disease-associated cell subsets (e.g., leukemic blasts in minimal residual disease or specific NK-cell subsets in cytomegalovirus infection) is critical for understanding disease progression but is technically challenging due to low frequencies (as low as 0.01%). While the convolutional neural network (CNN) architecture known as CellCnn has demonstrated success in identifying these populations from high-dimensional single-cell mass cytometry data, its application is limited by data scarcity. Robust model training requires large, diverse patient cohorts that no single institution can typically assemble. However, single-cell data is highly sensitive, revealing disease status and genetic predispositions, which prevents cross-institutional sharing under strict privacy regulations like GDPR and HIPAA. Existing privacy-preserving solutions, such as PriCell (which uses homomorphic encryption), impose architectural constraints—specifically removing ReLU activations, bias terms, and regression capabilities—to fit within polynomial-circuit budgets, thereby reducing model expressivity and accuracy.

Methodology
The authors propose a Secure Multi-Party Computation (MPC) framework that enables the end-to-end training and inference of CellCnn entirely on secret-shared data. The system operates under a semi-honest security model with an honest majority, utilizing a three-party setup: two computing proxies ( $P_0, P_1$ ) and a helper party ( $P_2$ ).

Data Representation: Data owners (healthcare institutions) split their single-cell measurements into two random additive shares over the ring $\mathbb{Z}_{2^{64}}$ , sending one share to each proxy. No party ever observes the raw plaintext data.
Computation: The proxies perform local additions and interact for multiplications using Beaver triples supplied by the helper. Real-valued computations are handled via fixed-point arithmetic.
Architectural Adaptations: To accommodate the MPC environment while retaining the full expressivity of CellCnn, the authors replaced specific non-polynomial operations:
- Optimizer: Replaced the Adam optimizer (requiring division/square roots) with mini-batch SGD with momentum.
- Activations: Retained ReLU activations in the convolutional layer (supported natively) and used mean pooling to avoid secure comparisons.
- Output Heads: Replaced the standard softmax/cross-entropy head with a per-class sigmoid approximated by a degree-three least-squares polynomial. For regression tasks, a tanh-based head trained against mean-squared error was implemented using masked secure exponential and division.
- Bias Terms: Unlike prior HE-based approaches, bias terms were retained in both convolutional and fully connected layers.

Key Contributions

Full-Architecture MPC Implementation: The paper presents the first implementation of CellCnn under MPC that retains critical architectural components (ReLU, bias terms) previously omitted in privacy-preserving variants like PriCell.
Regression Capability: The framework supports continuous outcome prediction (regression) via a tanh-based head, extending the utility of privacy-preserving CellCnn beyond the classification-only limitations of homomorphic encryption-based predecessors.
Decoupled Training: The protocol allows data owners to provide shares and disconnect, as the computation is performed by a fixed set of dedicated computing parties, unlike synchronous federated learning models that require all data holders to remain online.

Results
The method was evaluated on three benchmarks: CMV (NK-cell) classification, AML (three-class) classification, and AML Minimal Residual Disease (MRD) regression.

CMV Classification: The MPC implementation achieved multi-cell input accuracy of $0.727 \pm 0.141$ and phenotype accuracy of $0.681 \pm 0.146$ . These results closely tracked the plaintext CellCnn baseline ( $0.721 \pm 0.173$ and $0.716 \pm 0.158$ , respectively) and significantly outperformed the PriCell baseline ( $0.633 \pm 0.127$ ).
AML Classification: On the three-class AML task, the MPC implementation achieved $0.935 \pm 0.047$ multi-cell accuracy, remaining closer to the plaintext ceiling (1.0) than PriCell ( $0.898 \pm 0.055$ ).
AML MRD Regression: In the regression task, the MPC model recovered the underlying blast fraction with a Pearson correlation of $r=0.98$ and a Mean Absolute Error (MAE) of 1.0 percentage points, compared to $r=0.99$ and MAE of 0.8 pp for the plaintext baseline.
Runtime: Training the CMV model for 20 epochs took approximately 1,200 seconds on a 5 Gbps LAN. The authors note that bandwidth is a primary bottleneck, as reducing speed to 1 Gbps increased training time to 2,700 seconds.

Significance and Claims
The authors claim that their approach successfully bridges the gap between the statistical necessity of multi-institutional data collaboration and the legal/ethical constraints of data privacy. By retaining the full CellCnn architecture (including ReLU and bias terms) and supporting regression, the proposed MPC framework offers higher accuracy and broader applicability than previous privacy-preserving baselines. The paper emphasizes that the method allows for accurate analysis of rare cell subsets without exposing raw patient data or intermediate values to any computing party. The authors acknowledge limitations, including the reliance on a semi-honest threat model and the use of synthetic ground truths for regression benchmarks, suggesting that future work should focus on strengthening security to malicious models and validating on larger, real-world clinical cohorts.

More like this