Key-Embedded Privacy for Decentralized AI in Biomedical Omics

Abstract

The rapid adoption of data-driven methods in biomedicine has intensified concerns over privacy, governance, and regulation, limiting raw data sharing and hindering the assembly of representative cohorts for clinically relevant AI. This landscape necessitates practical, efficient privacy solutions, as cryptographic defenses often impose heavy overhead and differential privacy can degrade performance, leading to sub-optimal outcomes in real-world settings. Here, we present a lightweight federated learning method, INFL, based on Implicit Neural Representations that addresses these challenges. Our approach integrates plug-and-play, coordinate-conditioned modules into client models, embeds a secret key directly into the architecture, and supports seamless aggregation across heterogeneous sites. Across diverse biomedical omics tasks, including cohort-scale classification in bulk proteomics, regression for perturbation prediction in single-cell transcriptomics, and clustering in spatial transcriptomics and multi-omics with both public and private data, we demonstrate that INFL achieves strong, controllable privacy while maintaining utility, preserving the performance necessary for downstream scientific and clinical applications.

Figures (9)

• Figure 1: Overview of Implicit Neural Federal Learning (INFL).a The left column provides a concise comparison between traditional Federated Learning using explicit neural networks and the proposed approach based on implicit neural networks. In explicit settings, user data utilized for training local models may be vulnerable to attacks if not protected by privacy-preserving mechanisms such as differential privacy (DP) or homomorphic encryption (HE). In contrast, in the implicit framework, the model is inherently secure because it does not directly access raw user data. The right column illustrates the detailed workflow of INFL: each user train Meta Learners alongside the Local Learner and uploads only the Meta Learner parameters. These are then aggregated at the server via the Federated Averaging algorithm. b The top panel demonstrates the application of INFL to cancer subtyping based on protein expression levels. A multilayer perceptron (MLP) classifier (n=14) is initialized on each client and serves as the Local Learner. The middle panel adopts the GEARS model as the backbone architecture to perform gene expression level regression under various perturbations, evaluating both in-domain and out-of-domain gene predictions. The bottom panel employs SpaMosaic as the Local Learner for multi-modal spatial transcriptomics integration, supporting both horizontal integration (same modality across different sections) and mosaic integration (different modalities across sections).
• Figure 1: Supplementary quantitative metrics for perturbation prediction performance.a-b Model perturbation prediction performance characterized by quantitative metrics. The metrics are the same as in Figure \ref{['fig:figure3']}c-e, where lower values indicate better performance. a Performance on the Norman dataset under the in-domain (full) scenario. b Performance on the Norman dataset under the in-domain (partial) scenario. c-g Model perturbation prediction performance characterized by other quantitative metrics. For each scenario, we selected three metrics to demonstrate the performance of each method: the Pearson correlation coefficient (PCC) for all genes (Pearson(all)), the PCC for the top 20 differentially expressed genes (Pearson(de)), and the Pearson_delta (measuring the change). For all three metrics, higher values indicate better performance. c Performance on the Adamson dataset. d Performance on the Norman dataset under the in-domain (full) scenario. e Performance on the Norman dataset under the in-domain (partial) scenario. f Performance on the Norman dataset under the out-of-domain scenario. g Performance on the private dataset.
• Figure 2: Experimental results on bulk proteomics cancer subtyping task.a Experimental design of an algorithm for the cancer subtyping task, including training data partitioning, the training workflow, the final inference process, and downstream tasks. b Overall classification performance evaluated by quantitative metrics. Accuracy, F1-score, and AUROC are reported, with each metric representing the macro-average across all 14 class labels. c Radar chart displaying the individual AUROC metrics for each of the 14 class labels. d-f Interpretability analysis of the classification model using Shapley values. For each subtype, the top 5 most relevant proteins are shown. The horizontal axis represents the magnitude of the Shapley value, while the color intensity in each beeswarm plot indicates the expression level of the corresponding protein. A positive Shapley value for a highly expressed protein suggests a positive correlation with the cancer subtype, whereas a negative value indicates a negative correlation. d Interpretability analysis for Adenocarcinoma. e Interpretability analysis for Lymphoma. f Interpretability analysis for Transitional cell carcinoma. g Ablation study of INFL. Experiments were conducted after removing the INR module from the original model during the inference, and the overall classification performance was evaluated.
• Figure 2: Qualitative presentation of additional cases and hit rate analysis.a-d Qualitative case studies showing model perturbation performance. The green dotted line shows mean unperturbed control gene expression. Boxes indicate experimentally measured differential gene expression after perturbing some genes. Different symbols shows the mean change in gene expression predicted by different methods. Whiskers represent the last data point within 1.5× interquartile range. a Case of FARSB single-gene perturbation (from the Adamson dataset). b Case of ZNF318 and FOXL2 combined perturbation (from the Norman dataset, under the in-domain (full) scenario). c Case of MAP2K6 and IKZF3 combined perturbation (from the Norman dataset, under the in-domain (partial) scenario). d Case of YWHAE single-gene perturbation (from the private dataset). e Perturbation performance for different cases quantitatively displayed using hit rate.
• Figure 3: Experimental results on the single-cell transcriptomic perturbation prediction task.a Experimental design of algorithm for the single-cell transcriptomic perturbation prediction task, including training data partitioning, training workflow, final inference process, and downstream tasks. b Ablation study of INFL. Experiments were conducted after removing the INR module from the original algorithm, comparing the MSE metric for the top 20 differentially expressed genes across various scenarios. c-e Model perturbation prediction performance characterized by quantitative metrics. For each scenario, we selected three metrics to demonstrate the performance of each method: the MSE for all genes (MSE(all)), the MSE for the top 20 differentially expressed genes (MSE(de)), and the fraction of top 20 differentially expressed genes with opposite prediction direction (De_op_frac). For all three metrics, lower values indicate better performance. c Performance on the Adamson dataset. d Performance on the Norman dataset under the out-of-domain scenario (unseen_2). e Performance on the private dataset. f Qualitative case study showing model perturbation performance. The dual-gene perturbation (CEBPE + RUNX1T1) from the Norman dataset under the out-of-domain scenario is shown. The green dotted line shows mean unperturbed control gene expression. Boxes indicate experimentally measured differential gene expression after perturbing the gene combination CEBPE and RUNX1T1. Different symbols shows the mean change in gene expression predicted by different methods when they have not seen CEBPE nor RUNX1T1 experimentally perturbed at the time of training. Whiskers represent the last data point within 1.5× interquartile range. g Perturbation performance quantitatively displayed using hit rate. A prediction is considered accurate if the mean change in gene expression predicted by a method falls within the boxes range. The hit rate is calculated by summarizing the prediction accuracy across all 20 genes.

Theorems & Definitions (3)

• Definition 1: Model Output
• Proposition 1: Unauthorized Access
• Proposition 2: Inference without INR Parameters