Adversarial Robust Federated Learning for Secure Mortality Risk Prediction using Multi-Institutional Electronic Health Records (EHRs)

Summary

This study proposes an Adversarial-Robust Federated Learning (AR-FL) model for mortality risk prediction using multi-institutional Electronic Health Records. The model integrates min–max adversarial training, domain-aware attention, and privacy-preserving aggregation to enhance robustness, adaptability, and data confidentiality, enabling a secure, reliable, and generalizable clinical decision-support system suitable for heterogeneous healthcare environments.

Abstract

Electronic Health Records (EHRs) are the main source of data that enable data-driven clinical decision-making. However, the sensitive character of EHRs and the strict privacy policies in the healthcare sector make centralized model training difficult or impossible. An Adversarially Robust Federated Learning (AR-FL) model is proposed to predict patient mortality risk across different institutions without sharing the original EHR data. The primary aim of this study is to introduce a secure, reproducible, and scalable procedure for training privacy-preserving, adversarially resilient predictive models across diverse clinical settings. This study employs a min–max adversarial training approach at each institution to improve robustness against worst-case perturbations. A domain-aware attention mechanism is also employed to dynamically adapt to differences in clinical feature distributions within the institution. For confidentiality, the model updates are pooled using privacy-protecting methods that block the revealing of sensitive patient data during federated communication. This study specifies the entire process from data preprocessing and adversarial example generation to local training, secure aggregation, and global model evaluation, allowing for a consistent implementation across various healthcare environments. Experimental validations demonstrate that the AR-FL model achieves superior predictive performance, adversarial robustness, and cross-institutional generalization. By establishing a standardized training and evaluation pipeline, this study supports the development of reliable and ethically compliant clinical decision-support systems.

Introduction

Federated Learning (FL) has emerged as a transformative paradigm for privacy-preserving healthcare analytics by enabling collaborative model training across decentralized electronic health record (EHR) data without sharing raw patient information. This approach mitigates data silos and regulatory constraints while improving predictive performance in tasks such as mortality prediction. However, despite these advantages, FL systems remain vulnerable to adversarial and poisoning attacks. Figure 1 illustrates the collaborative architecture and workflow of federated learning across distributed clinical institutions.

Figure 1: Generic federated learning architecture and medical imaging applications. This figure illustrates the standard federated learning workflow, showing decentralized data storage, local model training, and secure server-side aggregation, along with its applications in medical imaging analysis. Please click here to view a larger version of this figure.

Recent advancements in healthcare analytics highlight the effectiveness of deep learning models in processing large-scale EHR data. Prior research¹ demonstrated that deep learning can achieve accurate and scalable predictions using raw clinical data. Furthermore, Miotto et al.² have reviewed the broader opportunities and challenges associated with deploying deep learning in healthcare systems. In addition, domain-specific innovations such as ClinicalBERT³ have improved clinical text understanding and predictive capabilities, while benchmark datasets including MIMIC-III⁴, MIMIC-IV⁵ and eICU⁶ have enabled reproducible and large-scale evaluations in critical care research.

Federated learning has gained significant attention as a solution for enabling collaborative healthcare analytics without compromising data privacy. Existing studies^7,8 have discussed its role in digital health development, along with associated challenges and open research issues. Moreover, federated learning has demonstrated practical applicability in real-world healthcare scenarios, including multi-institutional collaboration⁹ and clinical outcome prediction for COVID-19 patients¹⁰. However, challenges such as data heterogeneity remain significant. To address this, optimization strategies for heterogeneous environments¹¹ and approaches such as FedBN¹², which utilizes local batch normalization, have been proposed to improve model convergence and generalization.

Security and robustness in federated learning have become critical concerns due to the increasing exposure to adversarial threats. The concept of adversarial examples¹³ revealed that small perturbations can mislead deep learning models with high confidence. In federated settings, these vulnerabilities are exacerbated by threats such as backdoor attacks¹⁴ and model poisoning. To address these risks, adversary-resilient clustered federated learning approaches and robust optimization techniques based on adversarial training have been proposed^15,16. Additionally, secure communication frameworks integrating gradient boosting and LSTM models¹⁷ have been developed to mitigate man-in-the-middle attacks. At the same time, advanced architectures such as DBAFL^18,19 aim to defend against poisoning attacks in distributed environments.

Privacy preservation remains a fundamental requirement in federated healthcare systems. Collaboratively trained models can leak sensitive information through GAN-based attacks, highlighting inherent privacy risks²⁰. To mitigate such issues, secure aggregation protocols²¹ and differential privacy techniques²² have been introduced to ensure confidentiality in distributed learning. Furthermore, blockchain-based solutions^23,24 have been proposed for secure EHR management and data sharing, with additional studies^25,26,27,28 extending these approaches to improve interoperability, security, and efficiency in healthcare systems.

The rapid advancement of artificial intelligence in healthcare has also led to the development of hybrid intelligent models and integrated systems that enhance predictive performance and decision-making. Previous studies have also discussed the transformative role of AI in medicine²⁹ and adversarial attacks and defense mechanisms in machine learning systems^29,30.

Despite these advancements, existing research remains fragmented. Many federated learning models fail to incorporate adversarial robustness, making them susceptible to attacks. Additionally, domain heterogeneity is often insufficiently addressed, limiting generalization across institutions. Privacy-preserving mechanisms are often implemented in isolation, without integration with robustness and domain-adaptation strategies, resulting in incomplete and less reliable healthcare AI systems. To address these limitations, this paper proposes an integrated Adversarial Robust Federated Learning framework that combines adversarial training, domain-aware attention mechanisms, and secure aggregation. The proposed approach enhances robustness against attacks, improves adaptability across heterogeneous clinical environments, and ensures patient data privacy, thereby providing a comprehensive solution for real-world multi-institutional healthcare applications.

Protocol

Proposed methodology
The proposed Adversarially Robust Federated Learning (AR-FL) model aims to predict patient mortality risk securely and collaboratively across different healthcare institutions, while protecting data privacy and making the system resilient to adversarial perturbations. The deployment includes four primary elements: (1) the Federated Learning structure, (2) the min-max optimization-based adversarial training, (3) the domain-aware attention mechanism, and (4) the privacy-preserving parameter aggregation. The methodology is executed in a systematic flow designated for adversarial robust federated learning to estimate the mortality risk. The process, depicted in Figure 2, starts with data acquisition from numerous healthcare institutions, followed by data preprocessing to standardize features and handle missing values. A global model is initially created by a central server and then sent to every healthcare institution. Local adversarial training takes place within healthcare institutions, increasing the model's robustness to perturbations while allowing it to be adapted to domain-specific data. After training, the parameters of the local models are securely delivered to the server using secure parameter aggregation. The server incorporates these local model contributions to update the global model. This process is repeated several times in an iterative optimization to facilitate collaborative refinement of the model. As a result, the model is rigorously evaluated using clinical benchmarks that assess its predictive performance, adversarial robustness, and generalization across institutions.

Figure 2: Proposed AR-FL model. This figure presents the overall architecture of the proposed Adversarial-Robust Federated Learning model, including adversarial training, domain-aware attention, and privacy-preserving secure aggregation. Please click here to view a larger version of this figure.

Data collection
For this study, two publicly accessible Electronic Health Record (EHR) datasets are utilized: MIMIC-III⁴ and the eICU Collaborative Research Database⁶. MIMIC-III provides over 40,000 ICU admissions from a single major hospital, whereas eICU data comprise over 200,000 ICU stays from various hospitals in the US. The respective patient demographics, clinical measurements, lab test results, charted events, and outcomes recorded in these data streams make them very attractive for the mortality risk prediction task. The EHR datasets are each split into different parts to form a realistic multi-institutional federated learning environment; each part represents a different hospital or institution. The method captures differences across institutions in patients' characteristics, clinical protocols, documentation styles, and data availability. Each simulated institution can access only its own data subset and does not share any raw records with the central server or any other participating clients. This approach guarantees full compliance with privacy-preserving principles while simultaneously simulating the real-life limitations of inter-hospital cooperation. Mortality labels are extracted from the outcome fields indicated in the datasets, for example, in-hospital mortality indicators. These labels act as prediction targets for the federated learning model. Each institution thus maintains its own local set of patient feature records associated with mortality outcomes, enabling decentralized model training without revealing sensitive patient information.

Data preprocessing
Every institution processes its local EHR data independently before the model training starts. Since federated learning disallows the sharing of any patient-level data or even summary statistics among participating institutions, all preprocessing steps are performed locally at each institution and are based only on the information in that institution's dataset. The preprocessing flow consists of some crucial steps. At first, numerical clinical variables such as vital signs, laboratory test results, and physiological measurements are normalized to eliminate differences in value ranges and stabilize model convergence. Each institution's local data is the only source for computing the statistics used for the normalization. Next, categorical attributes such as gender, admission type, or diagnostic categories are converted to numerical representations using methods such as one-hot encoding or institution-specific mappings. Hence, the federated model can handle categorical data without the need for shared encoding dictionaries or cross-institutional reference tables. Third, missing data, which are common in clinical datasets, are handled using local imputation techniques. Depending on the feature type and the clinical context, institutions might resort to mean imputation, forward-filling based on previous observations, or even rule-based clinical replacements. Since each institution performs imputation independently, no external metadata or shared imputation parameters are required. Following these procedures, each institution is able to create a complete processed feature dataset together with the associated mortality outcomes. The local datasets are then used as input for the federated model training. Throughout the entire preprocessing pipeline, no raw data, derived statistics, or intermediate outputs are transmitted outside the institution, ensuring strict adherence to privacy-preserving data management practices.

Model initialization
Let K {1, 2,…, K} be the collection of institutions (clients) involved, where each institution possesses a local dataset. {  where  represents input EHR features and  Is the associated mortality label (binary or categorical). A global model  is trained collaboratively across all clients, where θ are the shared model parameters.

The process follows the standard Federated Averaging (FedAvg) protocol:
The central server initializes global parameters and broadcasts them. Each client k∈K performs local training using its data and updates the model to  . The server combines the updates by taking the weighted average:

^, where n = 

The procedure of central server initialization and the local training steps go on for T global communication rounds.

Local adversarial training (Min–Max optimization)
In order to improve robustness, each client conducts adversarial training at their local site. Rather than minimizing empirical risk on clean data, the clients engage in a min-max problem:

(x+δ),y)

L: Loss function
δ: Adversarial perturbation constrained by
S: Adversarial threat space
(x+δ): Prediction under perturbed input

At the time of each local epoch, adversarial samples are created utilizing Projected Gradient Descent (PGD) or Fast Gradient Sign Method (FGSM). Afterwards, the model's training proceeds with these samples in order to increase its robustness.

Domain-aware attention mechanism
Electronic Health Records (EHR) data from different institutions can vary greatly in terms of data distribution, feature semantics, and clinical practices. To tackle this issue, the AR-FL model incorporates a domain-specific attention module into its model.

Let   be the input vector from institution k. The attention weights  for each feature j∈ {1..., d} are computed as:

 = 

where are trainable attention weights. The input is re-weighted as:

Through this mechanism, the model is able to emphasize characteristics that are important for clinical practice according to the nature of the data used by the institution, thus increasing its adaptability and interpretability.

Privacy-preserving parameter aggregation
AR-FL uses very secure aggregation along with differential privacy techniques if required to maintain the highest level of privacy during communication. Secure Aggregation: Users encrypt their model updates in such a way that the server can only calculate the total but not the separate contributions.

Differential Privacy: Adds noise to model updates:

Where σ controls the privacy-accuracy tradeoff.

During distributed updates, these approaches ensure that private patient data or institutional information is not at risk of being leaked.

Global model update
Once the local training phase is completed at each institution, the central server gathers the client-submitted model updates. These updates consist solely of changes to model parameters and do not include any raw patient data or intermediate feature representations. To merge the knowledge gained from the various institutions, the server applies the Federated Averaging (FedAvg) method. In this process, the server computes a weighted average of the local models based on the amount of data available at each institution. Institutions contributing larger datasets have a proportionally greater influence on the updated global model. Because the updates were transmitted using secure aggregation techniques, the server cannot view or isolate any individual institution's parameters. Rather, the server gets an encrypted or a privacy-protected combined representation only. This guarantees the confidentiality of the training process and the destruction of any institution-specific patterns or patient characteristics that might have been detected. After computing the aggregated update, the server prepares a fresh global model that stands for the total knowledge acquired from all collaborating institutions in that communication round. The new global model is then sent back to every institution for the next round of local adversarial training to commence.

Iterative optimization
Federated learning is a multi-stage process that involves several communication rounds. Each round consists of the local model's training, secure sending of updates, global aggregation, and subsequent distribution of the improved model to the participants. The repeated rounds help the model gradually move toward a robust, stable solution. During these rounds, each organization brings its knowledge of its patient population, thereby creating a model that can identify clinical patterns across different settings. It should be noted that adversarial training and the domain-aware attention mechanism are sometimes implemented through local training in each round. Thus, the model is constantly being refined, and its power to combat adversarial attacks grows, while its ability to adapt to different feature distributions across institutions improves. Through iterative optimization, the model not only improves its generalization performance but also becomes increasingly tolerant of data imbalance, institutional variation, and adversarial settings. The procedure is carried out until either a preset number of communication rounds is reached or the global model indicates stable convergence.

Evaluation
At the end of all communication rounds, the final global model is thoroughly evaluated using held-out test sets derived from the participants' datasets. Since these test sets are not used for model training, they provide a fair and impartial measure of the model's performance. Model effectiveness is evaluated through the computation of different metrics from several angles. Clean accuracy assesses the situation where normal conditions are in place. It measures the model's correctness in predicting mortality outcomes. In contrast, adversarial accuracy estimates the extent to which the model is able to maintain its performance even when input data are altered in an adversarial manner. The area under the receiver operating characteristic (ROC) curve (AUC-ROC) provides insight into the model's proficiency in distinguishing between live and deceased patients. The F1 score serves as an indicator of the precision-recall relationship, which is particularly significant for unbalanced clinical datasets. The generalization gap reveals the disparity in performance across different institutions, thereby demonstrating the model's versatility in adapting to varied data sources. The privacy risk is finally quantified through the use of simulated adversarial attacks, which ascertain whether secure aggregation and optional differential privacy are, in fact, effective in protecting patient confidentiality. All these evaluation metrics together yield a comprehensive picture of the model's predictive power, resistance to adversarial attacks, stability across different institutions, and adherence to privacy-preserving requirements. Algorithm 1 (Supplementary File 1) below shows the Adversarial Robust Federated Learning (AR-FL) for Mortality Risk Prediction.

Results

The AR-FL model was tested on two publicly available, de-identified, multi-institutional electronic health record (EHR) datasets: the MIMIC-III and the eICU Collaborative Research Database, which include a variety of ICU patient records with in-hospital mortality outcomes. The dataset was spread across simulated hospital scenarios representing the actual differences among institutions regarding their data characteristics. A separate model was trained for each client (institution) using its own private EHR data, and the a...

Discussion

This paper presents an Adversarial-Robust Federated Learning (AR-FL) model aimed at enhancing mortality risk prediction using multi-institutional Electronic Health Records (EHRs) by improving accuracy, robustness, and generalizability. The study reveals that incorporating adversarial training into the federated environment will significantly benefit the model by making it more resistant to input perturbations and domain variability across different institutions. These new results are in line with previous ones, which sho...

Materials

List of materials used in this article

Name	Company	Catalog Number	Comments
Adam Optimizer	PyTorch	https://pytorch.org/docs/stable/generated/torch.optim.Adam.html	Optimization
CUDA Toolkit	NVIDIA	https://developer.nvidia.com/cuda-toolkit	Version 11.8; GPU acceleration
Differential Privacy Library	Opacus	https://opacus.ai	Version 1.3.0; DP-based privacy-preserving training
eICU Collaborative Research Database	PhysioNet	https://physionet.org/content/eicu-crd/2.0/	ICU patient EHR data
MIMIC-III	PhysioNet	https://physionet.org/content/mimiciii/1.4/	ICU patient EHR data
PGD Attack Script	GitHub	https://github.com/Saswati-C/AR-FL-HER	Version: commit-hash; Adversarial example generation
PyTorch	PyTorch.org	https://pytorch.org	Version 2.0; Model implementation and training
Tesla V100 GPU	NVIDIA	https://www.nvidia.com/en-us/data-center/v100/	Model training