💻 computer science

PRISM-VFL: A Differentially Private Vertical Federated Framework for Heterogeneous Multi-Task Clinical Prediction

PRISM-VFL is a differentially private vertical federated learning framework that integrates LSTM encoders with a Multi-gate Mixture-of-Experts module to enable concurrent training of heterogeneous clinical prediction tasks, demonstrating that while in-hospital mortality prediction remains clinically viable under moderate privacy constraints, other tasks like decompensation and phenotyping face significant utility challenges despite effectively suppressing label inference attacks.

Original authors: Amelia A. Soare, Roland V. Bumbuc, H. Ibrahim Korkmaz, Vivek M. Sheraton

Published 2026-06-26

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Amelia A. Soare, Roland V. Bumbuc, H. Ibrahim Korkmaz, Vivek M. Sheraton

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a group of three hospitals that want to build a super-smart AI doctor to help predict patient outcomes. However, they face a big problem: they can't share their patient records. Privacy laws (like GDPR) and hospital rules forbid them from sending sensitive data to a central server.

Furthermore, each hospital only holds a different type of information about the same patients:

Hospital A has the vital signs (heart rate, blood pressure).
Hospital B has the lab results (blood sugar, pH levels).
Hospital C has the admission details (height, weight, initial diagnosis).

If they tried to build the AI separately, it would be weak because each hospital is missing half the puzzle. If they shared the data, they'd break the law.

Enter PRISM-VFL: The "Secure Puzzle" Solution

The researchers created a framework called PRISM-VFL. Think of it as a secure, private way for these hospitals to solve a puzzle together without ever showing each other their pieces.

Here is how it works, using simple analogies:

1. The "Translator" (Local Encoders)

Instead of sending raw patient data (which is like sending the actual puzzle pieces), each hospital runs its data through a local "translator" (a neural network called an LSTM).

Analogy: Imagine each hospital takes its specific puzzle pieces and turns them into a single, abstract "summary card" (an embedding). Hospital A's card summarizes the vital signs; Hospital B's card summarizes the labs. These cards contain the essence of the data but not the raw details.

2. The "Team Captain" (Server-Side MMoE)

These summary cards are sent to a central server. The server acts as a "Team Captain" who has a special tool called MMoE (Multi-gate Mixture-of-Experts).

Analogy: The Captain has a team of four different "experts" (sub-networks). When a summary card arrives, the Captain uses a smart "gate" to decide which expert should look at it.
- If the goal is to predict In-Hospital Mortality (will the patient survive?), the Captain routes the info to Expert #1.
- If the goal is to predict Decompensation (will the patient get worse quickly?), it goes to Expert #2.
- If the goal is Phenotyping (what specific diseases does the patient have?), it goes to Expert #3.
Why this matters: This prevents the different goals from getting in each other's way. It's like having a chef who knows when to use a knife for vegetables and a spoon for soup, rather than trying to do both with the same tool at the same time.

3. The "Noise Machine" (Differential Privacy)

Even though they are only sending summary cards, a curious server (or a hacker) might still try to guess the original patient details from those cards. To stop this, the researchers add a "noise machine."

Analogy: Before the server sends instructions back to the hospitals to update their translators, it adds a little bit of static or "static noise" to the signal. It's like whispering a secret through a crowded room; the message gets through, but if someone tries to eavesdrop, they only hear gibberish mixed with the real words.
The Trade-off: The more noise you add, the safer the privacy, but the "fuzzier" the AI becomes. The researchers tested different amounts of noise to find the sweet spot.

What Did They Find? (The Results)

The researchers tested this system using a massive, public dataset of ICU patients (MIMIC-III), simulating the three hospitals described above. They tried to predict three things:

Will the patient die in the hospital? (In-Hospital Mortality)
Will the patient get critically worse? (Decompensation)
What diseases does the patient have? (Phenotyping)

Here is the "bottom line" in everyday terms:

The "Survival" Prediction (IHM): This was the big winner. The system worked very well, almost as good as if all the data had been in one place. Even with the privacy "noise" added, the AI could still predict patient survival with high accuracy. It proved that this method is ready for this specific task.
The "Getting Worse" Prediction (Decompensation): This one was shaky. Sometimes the AI worked well, but other times it failed completely. The researchers found that the system was very sensitive to how it was set up. It didn't reach a level of reliability that doctors could trust yet.
The "Disease Type" Prediction (Phenotyping): This also struggled. Even without any privacy noise, the system couldn't predict the specific diseases well enough to be useful.

The "Privacy vs. Usefulness" Balance

The study introduced a new way to measure this balance called PCMU.

Analogy: Imagine you are buying a car. You want it to be fast (useful) but also safe (private).
- If you drive with no seatbelt (no privacy), you are fast but risky.
- If you drive with a giant, heavy steel cage (too much privacy), you are safe but the car is too slow to move.
- The researchers found that for predicting survival, you can wear a very strong seatbelt (strong privacy) and still drive fast enough to be useful. But for the other tasks, the car just wouldn't move fast enough, even without the cage.

The Conclusion

The paper concludes that PRISM-VFL is a successful blueprint for hospitals to collaborate on AI without sharing private data.

It works great for predicting patient survival.
It is not yet ready for predicting acute deterioration or specific disease types, as those tasks need more development before they are reliable enough for real-world use.
The system successfully kept the "eavesdropping" attempts (label inference attacks) down to random guessing levels when strong privacy was applied.

In short: They built a secure, multi-hospital AI team. It's a champion at predicting who might pass away, but it's still a rookie at predicting who might get sicker or what specific illnesses they have.

Technical Summary: PRISM-VFL

Problem Statement
Vertical Federated Learning (VFL) enables collaborative model training across institutions holding complementary patient features without sharing raw data. However, existing VFL frameworks face two critical limitations in clinical settings: (1) they lack support for the concurrent optimization of heterogeneous prediction tasks (Multi-Task Learning, or MTL) under formal privacy guarantees, and (2) they often assume a single active party or uniform task structures. In real-world healthcare, institutions may hold disjoint feature sets (e.g., vital signs vs. lab results) for the same patients while pursuing distinct clinical goals (e.g., mortality prediction vs. phenotyping). Furthermore, integrating Differential Privacy (DP) into Federated MTL introduces complex trade-offs; uniform noise application can degrade utility for high-priority tasks, while the interaction between task-specific sensitivity and shared representations remains under-explored.

Methodology
The study introduces PRISM-VFL (Privacy-Resilient Institutional Split Multi-task VFL), a framework designed for heterogeneous multi-task clinical prediction.

Architecture: The system follows a split learning paradigm. Each participating site (simulated as three hospitals) processes its local time-series features using a two-layer Long Short-Term Memory (LSTM) encoder, producing a 64-dimensional embedding. These embeddings are transmitted to a central server.
Server-Side Processing: The server concatenates embeddings from all sites into a 192-dimensional vector. This vector is processed by a Multi-gate Mixture-of-Experts (MMoE) module, comprising four shared expert sub-networks and a learned softmax gate for each task. This architecture allows tasks to route through different expert specializations, mitigating negative transfer.
Privacy Mechanism: The framework applies Differentially Private Stochastic Gradient Descent (DP-SGD) specifically at the cut layer. Per-sample embedding gradients ( $\partial L/\partial \langle k$ ) returned from the server to the clients are clipped and perturbed with Gaussian noise before updating local encoders. The study evaluates both uniform noise allocation and task-stratified noise allocation, where noise multipliers are adjusted based on clinical urgency (e.g., lower noise for In-Hospital Mortality to preserve utility).
Dataset and Simulation: The framework was evaluated on a vertically partitioned version of the MIMIC-III dataset. The 14 clinical variables were distributed across three simulated sites:
- Site A: Vital signs (7 variables) tasked with In-Hospital Mortality (IHM).
- Site B: Laboratory results (4 variables) tasked with Decompensation risk stratification.
- Site C: Admission-time static measurements (3 variables) tasked with Phenotyping (25 disease groups).
- Patient alignment was achieved via Private Set Intersection (PSI) simulation, retaining only patients with ICU stays $\ge$ 48 hours.
Evaluation: The study utilized a comprehensive suite of metrics, including AUC-ROC, Brier score, and a novel Privacy-Communication-adjusted Multi-task Utility (PCMU) score. It also introduced a theoretically derived multi-task label inference bound, $g(\sigma, \rho) = \Phi(C\sqrt{1+\rho}/\sigma)$ , and validated it against empirical embedding-space attacks (label inference and membership inference).

Key Contributions

Framework Development: PRISM-VFL is the first VFL architecture to simultaneously support heterogeneous task sets across vertically partitioned sites with explicit DP guarantees, utilizing MMoE for task-specific routing.
Per-Task Privacy Analysis: The study provides a granular analysis of privacy-utility trade-offs, demonstrating that a single uniform noise multiplier fails to capture task-specific instability. It introduces a method for evaluating clinical utility thresholds ( $\epsilon^*$ ) for individual tasks within a multi-task setting.
Theoretical and Empirical Bounds: A theoretical reference bound for multi-task label inference is derived and validated against an empirical attack suite, showing that MMoE routing keeps multi-task inference risks within single-task limits when gradient coupling is low.
Reproducible Benchmark: The authors establish a reproducible MIMIC-III vertical split benchmark that partitions both features and prediction targets, facilitating future research in multi-site multi-task VFL.

Results

Performance: PRISM achieved a mean AUC-ROC of 0.781 for IHM, 0.632 (with high cross-seed variance) for Decompensation, and 0.613 (macro-AUC) for Phenotyping.
Multi-Task Gain: Significant gains were observed for Decompensation (+0.093 AUC) compared to single-task baselines, attributed to the auxiliary physiological context provided by other sites. IHM and Phenotyping showed marginal gains (+0.003 and +0.002, respectively). No systematic negative transfer was detected across configurations.
Privacy-Utility Trade-off:
- IHM: Remained clinically viable under moderate privacy constraints ( $\epsilon \in (1, 2)$ ), maintaining an AUC above the 0.75 utility floor.
- Decompensation and Phenotyping: Failed to reach their respective clinical utility floors (0.70 and 0.65) even in the absence of DP constraints ( $\epsilon = \infty$ ), indicating that the current architecture and data distribution are insufficient for these specific tasks in this configuration.
- Stability: DP stochasticity caused asymmetric instability. IHM showed peak instability at $\epsilon=1$ before recovering, while Decompensation and Phenotyping degraded progressively.
Privacy Efficacy: Under strong privacy ( $\epsilon = 0.5$ ), label inference attacks were suppressed to near-random performance (AUC 0.498). Membership inference attacks remained ineffective across all budgets, a result attributed to the architectural properties of the VFL configuration rather than DP alone.
Ablations: The study found that learned gating in MMoE was the primary driver of multi-task benefits, not increased capacity. Interestingly, lower embedding dimensions (32 vs. 128) preserved IHM utility better under strong privacy constraints.

Significance and Claims
The paper claims that PRISM-VFL demonstrates the feasibility of privacy-preserving, heterogeneous vertical federated multi-task learning. However, the authors emphasize that clinical readiness is task-conditional. Under the tested conditions, IHM is the only task that meets clinical utility thresholds under moderate privacy, while Decompensation and Phenotyping require further architectural development or data enrichment before deployment.

The study positions PRISM not merely as a performance benchmark but as a methodological template for evaluating which clinical prediction problems are suitable for federated multi-task deployment. It highlights that uniform privacy strategies are insufficient for heterogeneous tasks and that future systems require task-adaptive calibration mechanisms. The work establishes a baseline for multi-site VFL research, acknowledging that results on a single-institution dataset (MIMIC-III) likely represent an optimistic estimate of real-world performance due to the lack of distributional shifts found in genuine multi-site deployments.