💻 computer science

Privacy-Utility Tradeoffs in Hierarchical Federated Learning Under Combined Differential Privacy and CKKS Homomorphic Encryption for Distributed Healthcare Networks

This paper proposes a hierarchical federated learning framework for healthcare that integrates client-level differential privacy with institution-level CKKS homomorphic encryption, demonstrating that while differential privacy incurs measurable accuracy losses dependent on the privacy budget, homomorphic encryption introduces no utility degradation, thereby isolating and quantifying the distinct privacy-utility tradeoffs of each mechanism.

Original authors: Sayed Mohammed Alwedaei, Jenan Moosa

Published 2026-07-09

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Sayed Mohammed Alwedaei, Jenan Moosa

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a group of hospitals trying to build a super-smart medical AI together. They want to learn from their combined data to diagnose diseases better, but they have a strict rule: no hospital can ever see another hospital's raw patient data. It's like trying to bake a giant cake together, but no one is allowed to show their secret family recipe or even their bowl of ingredients to the others.

This paper is about a new "recipe" for how these hospitals can collaborate safely. The authors, Sayed Mohammed Alwedaei and Jenan Moosa, created a system called Hierarchical Federated Learning (HFL). Think of it as a three-story office building:

The Clients (Ground Floor): Individual doctors or clinics with their own patient data.
The Institutions (Middle Floor): The hospitals or large medical centers that manage the clinics.
The Global Aggregator (Top Floor): The central AI brain that combines everything.

The Two Big Problems They Solved

The paper identifies two main ways privacy can be broken in this process:

The "Leaky Bucket" Problem (Privacy): Even if you don't share the raw data, the "updates" (the lessons the AI learns) can sometimes reveal too much about the specific patients.
The "Open Envelope" Problem (Confidentiality): Even if the updates are safe from leaking secrets, sending them over the internet is like sending a postcard. Anyone intercepting the mail can read it.

The Solution: A Double-Lock System

The authors combined two powerful tools to fix both problems at once:

1. Differential Privacy (The "Static Noise" Machine)
Imagine the doctors are trying to whisper a secret to the AI. To make sure no one can figure out exactly what they said, they add a little bit of "static noise" to their whisper.

How it works: Before sending their lesson, the system adds random mathematical noise. It's like turning up the volume on a radio just enough to drown out a specific voice, but keeping the overall song (the AI model) clear.
The Trade-off: The more noise you add (to be safer), the harder it is for the AI to learn the song perfectly. The paper tested different amounts of noise (called "privacy budgets" of 2, 4, 6, and 8).
- Result: On a simple image task (MNIST), adding noise only made the AI slightly less accurate (about 1-2% drop). On a complex heart rhythm task (MIT-BIH), the drop was bigger (up to 12%), but still usable. The key finding: The noise is the only thing that makes the AI less accurate.

2. CKKS Homomorphic Encryption (The "Magic Envelope")
This is the second lock. Imagine sending your lesson inside a sealed, magical envelope that can be opened, read, and even added to other envelopes without ever being opened.

How it works: The hospitals encrypt their noisy updates. The middle-level hospitals (Institutions) can add these encrypted updates together mathematically without ever seeing the actual numbers inside. It's like a group of people adding up their bank balances on a locked calculator; the calculator gives the total, but no one sees the individual amounts.
The Surprise: The authors wanted to know: "Does this magic envelope slow down the AI or make it less smart?"
- Result: Zero. The paper claims that using this encryption introduces no accuracy loss at all. The AI performs exactly as well with the encrypted data as it does with the noisy-but-unencrypted data.

The Big Takeaway

The most important discovery in this paper is the separation of costs.

Privacy Cost: Comes from the "noise" (Differential Privacy). It hurts accuracy a little bit, but keeps secrets safe.
Confidentiality Cost: Comes from the "encryption" (Homomorphic Encryption). It costs a little bit of time to lock and unlock the envelopes, but it does not hurt the accuracy of the AI at all.

The Verdict

The authors tested this on two datasets: handwritten digits (MNIST) and heart rhythm data (MIT-BIH). They found that:

You can have a very private system where the AI is still quite smart.
You can send these private updates over the internet securely (using the "magic envelope") without making the AI any dumber.
The system is stable; if you run the experiment three times, you get almost the exact same result every time.

In short, this paper proves that you can build a secure, collaborative medical AI where the "privacy" part makes it slightly less perfect, but the "security" part (keeping the data secret during transmission) doesn't cost you anything in terms of performance. It's a win-win for safety and speed.

Technical Summary: Privacy-Utility Tradeoffs in Hierarchical Federated Learning Under Combined Differential Privacy and CKKS Homomorphic Encryption

Problem Statement

The integration of Artificial Intelligence into healthcare faces significant operational obstacles regarding data privacy and security. Centralized systems present single points of failure, risking violations of regulations such as GDPR and HIPAA. While Federated Learning (FL) allows collaborative training without sharing raw data, existing privacy-preserving approaches often address Differential Privacy (DP) and Homomorphic Encryption (HE) in isolation.

DP-only implementations protect against inference attacks on model updates but leave plaintext parameters exposed during transmission, failing to guarantee transmission confidentiality.
HE-only schemes secure transmission but often fail to quantify the accuracy cost of noise injection or the interaction between encryption and model utility.
Hybrid approaches exist but lack systematic evaluation of the combined privacy-utility tradeoff within a Hierarchical Federated Learning (HFL) setting across varying privacy budgets ( $\epsilon$ ).

Consequently, there is an unquantified gap regarding whether combining client-level DP with institution-level HE introduces measurable accuracy degradation beyond the noise injection of DP alone, specifically within the context of distributed healthcare networks.

Methodology

The authors propose a three-tier HFL framework designed to reflect the organizational structure of distributed healthcare networks (Clients $\to$ Institutions $\to$ Global Aggregator). The system integrates two distinct privacy mechanisms:

Client-Level $(\epsilon, \delta)$ -DP: Applied locally at each client before transmission. This involves gradient clipping (to norm $C$ ) and the injection of calibrated Gaussian noise ( $\sigma$ ) to bound information leakage.
Institution-Level CKKS HE: The Cheon-Kim-Kim-Song (CKKS) scheme is applied to encrypt the privatized updates. Institutions aggregate these ciphertexts directly using the additive homomorphic property of CKKS, decrypting only the final weighted mean before forwarding it to the global aggregator.

Experimental Setup:

Datasets: MNIST (handwritten digits) and MIT-BIH Arrhythmia (ECG signals), representing image and physiological waveform modalities.
Topology: Three institutions, each with three clients.
Privacy Budgets: Evaluated across $\epsilon \in \{2, 4, 6, 8\}$ with $\delta = 10^{-5}$ .
Configuration: CKKS parameters were fixed (polynomial modulus degree 8192, $n_{slots}=4096$ ) across all experiments.
Reproducibility: Results are reported as mean $\pm$ standard deviation over three independent random seeds (42, 123, 7).

Key Contributions

Integrated Framework: A hierarchical FL architecture that enforces client-level DP and institution-level CKKS HE, ensuring no raw data or plaintext model updates are exposed.
Systematic Empirical Evaluation: A rigorous assessment of the privacy-utility tradeoff across two healthcare-relevant datasets and four privacy budgets.
Isolation of Utility Degradation: An empirical demonstration that CKKS HE introduces zero measurable accuracy loss when applied to gradient aggregation. This isolates DP noise as the sole source of utility degradation, establishing a clear separation between privacy costs (DP) and confidentiality costs (HE).

Results

Accuracy and Utility:

Baseline Performance: The HFL pipeline achieved high accuracy without privacy mechanisms: $99.65\%$ (MNIST) and $97.73\%$ (MIT-BIH).
DP Impact: DP introduced bounded accuracy loss.
- MNIST: Loss ranged from $1.88\%$ ( $\epsilon=2$ ) to $1.25\%$ ( $\epsilon=8$ ).
- MIT-BIH: Loss ranged from $12.23\%$ ( $\epsilon=2$ ) to $6.15\%$ ( $\epsilon=8$ ). The higher loss in MIT-BIH is attributed to the sensitivity of physiological waveform classification to gradient perturbation compared to image patterns.
HE Impact: Comparing DP-only vs. DP+HE configurations revealed no directional accuracy gap. For instance, at $\epsilon=2$ , MNIST accuracy was identical ( $97.77\%$ ) for both configurations. The difference ( $\Delta_{HE}$ ) was effectively zero ( $0.00\%$ to $\pm 0.01\%$ ), confirming that encryption does not degrade model utility.

Overhead:

Computational Cost: HE overhead is concentrated at the client tier.
- Client-side encryption accounted for the dominant share of time (e.g., $4.42$s for MNIST, $9.74$s for MIT-BIH per round).
- Institution-level aggregation and decryption were lightweight ($1.00$s and $0.27$s for MNIST, respectively).
Communication Cost: DP increased model update size by approximately $60\%$ due to noise injection. HE introduced no additional communication cost, as the ciphertext size was managed within the existing overhead structure.

Significance and Claims

The paper claims to provide an empirical foundation for deploying privacy-preserving FL in healthcare by demonstrating that:

Confidentiality can be achieved without utility loss: The use of CKKS HE secures transmission and aggregation without compromising predictive performance, separating the cost of confidentiality from the cost of privacy.
DP is the primary utility bottleneck: All observed accuracy degradation is attributable to DP noise, which decreases monotonically as the privacy budget relaxes.
Reproducibility: The results are stable across independent seeds, with standard deviations below $0.13\%$ for MNIST and $1.31\%$ for MIT-BIH.

The authors note limitations, specifically that the use of balanced IID data distributions isolates the privacy signal from data heterogeneity, meaning reported accuracy losses represent a lower bound for heterogeneous deployments. Additionally, the current scope limits HE to the client-to-institution tier, leaving the institution-to-global tier for future exploration via Secure Multi-Party Computation (SMPC). Byzantine resilience and blockchain auditability are explicitly excluded from this work.