Privacy-Aware Federated nnU-Net for ECG Page Digitization

TL;DR

This paper introduces a privacy-preserving federated learning framework using nnU-Net for ECG page digitization, enabling cross-institutional collaboration without sharing raw data, while maintaining high accuracy and formal privacy guarantees.

Contribution

It presents a novel federated training protocol with secure aggregation and differential privacy for ECG digitization, handling non-IID data and ensuring privacy without sacrificing performance.

Findings

FedAdam converges faster than FedAvg and FedProx.

The framework approaches centralized performance levels.

The privacy mechanism effectively prevents raw data exposure.

Abstract

Deep neural networks can convert ECG page images into analyzable waveforms, yet centralized training often conflicts with cross-institutional privacy and deployment constraints. A cross-silo federated digitization framework is presented that trains a full-model nnU-Net segmentation backbone without sharing images and aggregates updates across sites under realistic non-IID heterogeneity (layout, grid style, scanner profile, noise). The protocol integrates three standard server-side aggregators--FedAvg, FedProx, and FedAdam--and couples secure aggregation with central, user-level differential privacy to align utility with formal guarantees. Key features include: (i) end-to-end full-model training and synchronization across clients; (ii) secure aggregation so the server only observes a clipped, weighted sum once a participation threshold is met; (iii) central Gaussian DP with Renyi accounting applied post-aggregation for auditable user-level privacy; and (iv) a calibration-aware digitization pipeline comprising page normalization, trace segmentation, grid-leakage suppression, and vectorization to twelve-lead signals. Experiments on ECG pages rendered from PTB-XL show consistently faster convergence and higher late-round plateaus with adaptive server updates (FedAdam) relative to FedAvg and FedProx, while approaching centralized performance. The privacy mechanism maintains competitive accuracy while preventing exposure of raw images or per-client updates, yielding deployable, auditable guarantees suitable for multi-institution settings.