Research Proposal Sample: Federated Learning for Privacy-Preserving Health Analytics

Model Answer

Introduction and Background

Machine learning models trained on large, pooled clinical datasets can support tasks such as readmission risk prediction, diagnostic classification and treatment outcome forecasting, but building such models conventionally requires centralising patient data from multiple hospitals or trusts into a single repository (Rieke et al., 2020). In the UK context, this centralisation is constrained by UK GDPR and by NHS information governance policy, which restrict the movement of patient-identifiable and, in many cases, even de-identified clinical data between organisations without a specific legal basis and data-sharing agreement (Information Commissioner’s Office, 2023). The result is that clinically valuable machine learning models are frequently trained on data from a single site, limiting both their statistical power and their generalisability to patient populations elsewhere.

Federated learning, introduced by McMahan et al. (2017), offers a technical route around this constraint. Rather than pooling raw data centrally, a shared global model is trained iteratively: each participating site (or “client”) trains the model locally on its own data and shares only the resulting model updates, typically gradients or weight deltas, with a central server, which aggregates these updates, most commonly via the Federated Averaging (FedAvg) algorithm, into an improved global model without ever accessing the underlying patient-level data. This architecture has generated substantial interest in the healthcare machine learning community as a way of enabling multi-institutional collaboration while respecting data governance boundaries (Sheller et al., 2020), and aligns closely with the direction set out in NHSX’s (2021) data strategy, which explicitly identifies privacy-preserving analytics techniques as a priority for realising the value of NHS data without compromising patient confidentiality.

Federated learning is not, however, a complete solution to the privacy and performance challenges it is intended to address. Model updates shared during training can still leak information about the underlying data through membership inference or gradient inversion attacks (Kairouz et al., 2021), meaning federated learning is usually combined with additional privacy-preserving techniques such as differential privacy or secure aggregation. Performance is also known to degrade when client datasets are non-identically distributed (non-IID), a realistic scenario across NHS trusts serving demographically and clinically distinct patient populations, motivating algorithmic variants such as FedProx (Li et al., 2020) designed specifically to improve convergence under this kind of statistical heterogeneity. This proposal is designed to evaluate these trade-offs empirically, using a realistic multi-client simulation, for a clinically motivated prediction task.

Research Aim, Objectives and Questions

Aim. To design and empirically evaluate a federated learning framework for privacy-preserving predictive analytics on simulated multi-site clinical data, comparing predictive performance and privacy-utility trade-offs against a centralised baseline for a 30-day hospital readmission prediction task.

Objectives:

• To implement a federated learning pipeline, comparing FedAvg and FedProx, on clinical data partitioned across simulated client sites with a realistic non-IID distribution.
• To benchmark federated model predictive performance against centralised and local-only (no collaboration) baselines using accuracy, AUC-ROC and F1-score.
• To integrate differential privacy into the federated training process and evaluate the resulting utility-privacy trade-off across a range of privacy budgets.
• To evaluate the communication efficiency of the compared federated algorithms, measured as the number of training rounds required to approach centralised-model performance.

Research Questions:

1. How does the predictive performance of a federated learning model compare with a centralised baseline for readmission prediction under a realistic non-IID client data distribution?
2. Does FedProx improve convergence and final performance relative to FedAvg under statistical heterogeneity across simulated clients?
3. What is the utility cost, in terms of predictive performance, of applying differential privacy at varying privacy budgets to the federated training process?

Brief Literature Context

McMahan et al. (2017) introduced Federated Averaging (FedAvg) as a communication-efficient algorithm for training a shared model across decentralised clients, demonstrating that a small number of local training epochs performed at each client before server-side aggregation could substantially reduce the number of communication rounds required relative to naive distributed gradient descent. Kairouz et al.’s (2021) comprehensive survey situates this contribution within a wider set of open problems, identifying statistical heterogeneity across clients, systems heterogeneity in client compute and connectivity, and residual privacy vulnerabilities as the three principal challenges facing practical federated learning deployment, all three of which are directly relevant to a realistic multi-trust NHS deployment scenario.

Statistical heterogeneity is a particular concern for healthcare applications, since patient populations, case mix and clinical coding practice vary meaningfully across hospital sites, producing genuinely non-IID client data rather than the artificially balanced partitions used in much early federated learning benchmarking work. Li et al. (2020) address this directly with FedProx, which adds a proximal regularisation term to the local client objective, constraining local updates from drifting too far from the current global model, and demonstrate improved convergence stability relative to FedAvg under simulated heterogeneous data partitions, making it a natural comparator algorithm for the present proposal’s non-IID experimental design.

Healthcare-specific applications of federated learning have grown rapidly. Sheller et al. (2020) demonstrated federated learning for brain tumour segmentation across multiple clinical institutions without sharing raw imaging data, finding federated models approached, though did not fully match, the performance of a centrally trained model, an encouraging but not unqualified result for the technique’s clinical viability. Rieke et al.’s (2020) review of federated learning in digital health similarly concludes that the technique holds substantial promise for multi-institutional collaboration but stresses that privacy guarantees from federation alone are incomplete, since model updates can still be exploited through inference attacks, a concern formally analysed within the broader federated learning security literature (Kairouz et al., 2021).

Differential privacy, formalised by Dwork and Roth (2014), addresses this residual privacy risk by injecting calibrated statistical noise into model updates, providing a mathematically bounded privacy guarantee parameterised by a privacy budget, epsilon, where smaller values of epsilon correspond to stronger privacy protection at the cost of reduced model utility. Truex et al. (2019) demonstrate a hybrid approach combining differential privacy with secure aggregation, the latter introduced by Bonawitz et al. (2017) as a cryptographic protocol that prevents the central server from inspecting individual client updates even in plaintext form, arguing that combining the two techniques offers stronger protection than either alone against a broader range of realistic adversaries. Yang et al.’s (2019) conceptual survey of federated learning situates these privacy-enhancing techniques within a wider typology of federated learning architectures, providing a useful framework for positioning the specific horizontal, cross-silo configuration this proposal adopts, in which clients share the same feature space but hold different patient populations, the configuration most representative of a genuine multi-NHS-trust deployment scenario.

What remains comparatively under-examined in this literature is a UK-relevant empirical evaluation of the utility-privacy trade-off, specifically for a readmission prediction task and specifically comparing FedAvg against FedProx under a non-IID partitioning designed to emulate cross-trust heterogeneity, rather than the more artificial IID partitions used in much of the foundational benchmarking literature. This proposal is designed to generate exactly this empirical evidence using a realistic, reproducible simulation pipeline.

Methodology

Design. The study will adopt an experimental, design-science research methodology, building and empirically evaluating a federated learning pipeline against defined performance and privacy metrics, an approach appropriate for applied computer science research that produces and evaluates a working technical artefact rather than testing a purely theoretical hypothesis.

Dataset and Client Simulation. As genuine multi-trust NHS data-sharing agreements are not feasible within a taught Master’s timeframe, the study will use the publicly available, credentialed-access MIMIC-III critical care database (Johnson et al., 2016), a large, de-identified dataset of intensive care admissions widely used as a realistic proxy dataset in the federated healthcare machine learning literature. The prediction task will be binary classification of 30-day hospital readmission using structured features including vital signs, laboratory results, prior admission count and demographic variables. The dataset will be partitioned into five simulated client “trusts” using stratified non-IID partitioning by care unit and patient demographic profile, deliberately introducing the kind of cross-site statistical heterogeneity a genuine multi-trust deployment would exhibit, rather than a naive random (IID) split.

Implementation. The federated pipeline will be implemented using the open-source Flower framework with a PyTorch backend, comparing a logistic regression baseline against a small feed-forward neural network. Three training configurations will be compared: FedAvg, FedProx with a tuned proximal term, and a centralised baseline trained on the pooled dataset, alongside a local-only baseline in which each client trains independently without collaboration, providing an upper and lower performance reference for the federated configurations. Differential privacy will be applied at the client level using per-example gradient clipping and noise addition via the Opacus library, evaluated across a range of privacy budgets (epsilon values of 1, 5, 10 and an unconstrained non-private baseline) to characterise the utility-privacy trade-off curve. Secure aggregation will additionally be implemented as a masking-based protocol to demonstrate a practically complete privacy-preserving pipeline, consistent with the hybrid approach described by Truex et al. (2019).

Evaluation Metrics and Analysis. Model performance will be assessed using AUC-ROC, accuracy and F1-score, given the expected class imbalance in readmission outcomes, alongside the number of communication rounds required for each federated configuration to reach within one percentage point of the centralised baseline’s AUC-ROC, as a measure of communication efficiency. Evaluation will use five-fold cross-validation repeated across ten random seeds to account for variability introduced by client partitioning and training stochasticity, with paired t-tests used to compare AUC-ROC distributions between FedAvg and FedProx, and between each federated configuration and the centralised baseline, reporting effect sizes alongside significance values.

Ethics. Because the study uses only the publicly available, de-identified MIMIC-III dataset accessed under a completed PhysioNet credentialing process and data use agreement, and does not involve primary data collection from human participants, full NHS Health Research Authority or Research Ethics Committee approval is not required. The project will nonetheless be submitted to the university’s departmental computer science ethics panel for review, given the sensitivity of health-related data, and all data handling, storage and processing will comply with the terms of the MIMIC-III data use agreement and with UK GDPR data-handling expectations as set out by the Information Commissioner’s Office (2023), including secure, access-controlled storage and deletion of derived data on project completion.

Limitations. MIMIC-III is a US intensive-care dataset, used here as a realistic, ethically accessible proxy for a genuine multi-NHS-trust scenario that could not be arranged within a Master’s dissertation timeframe; findings should therefore be read as a proof-of-concept evaluation of the federated pipeline’s technical viability and privacy-utility characteristics, rather than as a validated, deployment-ready clinical prediction tool. The synthetic non-IID partitioning strategy, while designed to be realistic, cannot fully replicate the specific patterns of heterogeneity that would arise across genuine NHS trust populations, and results should be interpreted with this caveat when considering their transferability to a real multi-trust deployment.

Simulated Client Partitions

Table 1 summarises the five simulated client partitions that will be constructed from the MIMIC-III cohort, illustrating the intended non-IID structure across care unit and readmission prevalence used to emulate cross-trust heterogeneity.

Timeline

The project is planned to run across nine months from ethics review to submission, summarised in Table 2. Time is deliberately front-loaded toward dataset access and pipeline development, since PhysioNet credentialing and initial framework configuration are known sources of early-stage delay in projects using MIMIC-III.

Expected Contribution

This study will make three main contributions. Technically, it will provide an empirically grounded, UK-relevant benchmark comparing FedAvg and FedProx under realistic non-IID conditions for a clinically motivated readmission prediction task, together with a characterised utility-privacy trade-off curve across a range of differential privacy budgets, evidence that remains comparatively sparse for this specific combination of task and algorithm comparison in the current literature.

Practically, the resulting pipeline and findings are directly relevant to the priorities set out in NHSX’s (2021) data strategy, which identifies privacy-preserving analytics as a route to unlocking cross-institutional value from NHS data without centralising patient records, offering a concrete, reproducible demonstration of how such an approach might be evaluated before any genuine multi-trust deployment is attempted.

Methodologically, the study will produce an open, documented experimental pipeline, covering non-IID client partitioning, federated training, differential privacy integration and evaluation, that could be extended by future researchers to genuine multi-trust NHS data once appropriate governance agreements are in place, or adapted to other clinically motivated prediction tasks beyond readmission risk, providing a reusable foundation for further UK health-data federated learning research.

References

Bonawitz, K., Ivanov, V., Kreuter, B., Marcedone, A., McMahan, H.B., Patel, S., Ramage, D., Segal, A. and Seth, K. (2017) ‘Practical secure aggregation for privacy-preserving machine learning’, in Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. New York: ACM, pp. 1175–1191.

Dwork, C. and Roth, A. (2014) ‘The algorithmic foundations of differential privacy’, Foundations and Trends in Theoretical Computer Science, 9(3–4), pp. 211–407.

Information Commissioner’s Office (2023) Guide to the UK GDPR. Wilmslow: ICO.

Johnson, A.E.W., Pollard, T.J., Shen, L., Lehman, L.H., Feng, M., Ghassemi, M., Moody, B., Szolovits, P., Celi, L.A. and Mark, R.G. (2016) ‘MIMIC-III, a freely accessible critical care database’, Scientific Data, 3, article 160035.

Kairouz, P. et al. (2021) ‘Advances and open problems in federated learning’, Foundations and Trends in Machine Learning, 14(1–2), pp. 1–210.

Li, T., Sahu, A.K., Zaheer, M., Sanjabi, M., Talwalkar, A. and Smith, V. (2020) ‘Federated optimization in heterogeneous networks’, Proceedings of Machine Learning and Systems, 2, pp. 429–450.

McMahan, H.B., Moore, E., Ramage, D., Hampson, S. and y Arcas, B.A. (2017) ‘Communication-efficient learning of deep networks from decentralized data’, in Proceedings of the 20th International Conference on Artificial Intelligence and Statistics (AISTATS), pp. 1273–1282.

NHSX (2021) Data Saves Lives: Reshaping Health and Social Care with Data. London: NHSX.

Rieke, N., Hancox, J., Li, W., Milletarì, F., Roth, H.R., Albarqouni, S., Bakas, S., Galtier, M.N., Landman, B.A., Maier-Hein, K., Ourselin, S., Sheller, M., Summers, R.M., Trask, A., Xu, D., Baust, M. and Cardoso, M.J. (2020) ‘The future of digital health with federated learning’, npj Digital Medicine, 3, article 119.

Sheller, M.J., Edwards, B., Reina, G.A., Martin, J., Pati, S., Kotrotsou, A., Milchenko, M., Xu, W., Marcus, D., Colen, R.R. and Bakas, S. (2020) ‘Federated learning in medicine: facilitating multi-institutional collaborations without sharing patient data’, Scientific Reports, 10, article 12598.

Truex, S., Baracaldo, N., Anwar, A., Steinke, T., Ludwig, H., Zhang, R. and Zhou, Y. (2019) ‘A hybrid approach to privacy-preserving federated learning’, in Proceedings of the 12th ACM Workshop on Artificial Intelligence and Security. New York: ACM, pp. 1–11.

Yang, Q., Liu, Y., Chen, T. and Tong, Y. (2019) ‘Federated machine learning: concept and applications’, ACM Transactions on Intelligent Systems and Technology, 10(2), pp. 1–19.