Three EU hospitals jointly train a sepsis prediction model — without any patient data ever leaving its hospital.
Three European hospitals, three private datasets
Each hospital has labeled sepsis cases. None can legally share patient records under GDPR — not even with each other. Training solo, each hospital has too few rare cases for a reliable model.
Each hospital encrypts its data locally
Data is encrypted under a shared FHE key (CKKS scheme, 128-bit security) before anything leaves the hospital. The coordinator only ever sees ciphertexts.
Coordinator trains on encrypted gradients
40 rounds. Per-round overhead ~40ms. The coordinator never sees a single patient record in plaintext.
FHE collaborative beats every solo model
Every hospital benefits — but small hospitals benefit most. AMC Amsterdam, with only 22 sepsis cases in training, gains +0.05 AUC from collaboration on its own patients.
| Approach | AUC | F1 | Records leaked |
|---|---|---|---|
| Solo: Charité Berlin | 0.960 | 0.840 | 0 |
| Solo: AMC Amsterdam | 0.928 | 0.868 | 0 |
| Solo: Policlinico Milano | 0.947 | 0.800 | 0 |
| FHE Collaborative (ours) | 0.956 | 0.816 | 0 |
| Plaintext oracle (illegal — central data lake) | 0.952 | 0.863 | all |
| Hospital | Solo AUC | FHE AUC | Lift |
|---|---|---|---|
| Charité Berlin (large cohort) | 0.988 | 0.987 | −0.001 |
| AMC Amsterdam (small cohort) | 0.840 | 0.889 | +0.050 |
| Policlinico Milano | 0.993 | 1.000 | +0.007 |