Federated AI Framework Unlocks Cross-Hospital Fracture Risk Data While Preserving Privacy

Osteoporotic fractures cost the healthcare system dearly—in hospital stays, surgeries, and lost productivity. Yet the tools doctors use to predict who will break a bone remain surprisingly crude. FRAX, the standard risk calculator, works from a limited set of patient characteristics and was built on data from specific populations, so it doesn't always translate well across different hospitals and different groups of people. The real problem is that hospitals sit on far richer data—detailed bone scans, blood work, years of visit records—but they can't pool it together. Privacy laws and regulatory caution keep those records locked away, siloed behind institutional walls.

A team of researchers has now demonstrated a way to break that impasse without actually breaking the privacy rules. They built ADP-FedRE, a four-layer federated learning system that lets hospitals collaborate on fracture risk prediction while keeping all raw patient data on-site. The framework works by having each hospital train a local model on its own records, then sharing only the mathematical updates—the learned patterns—with a central coordinator. Those updates are encrypted and noise-injected so thoroughly that no one can reverse-engineer individual patient information from them. The system aligns messy, heterogeneous data across sites: electronic health records, DXA bone density scans, biochemistry panels, and longitudinal visit sequences all get harmonized through a privacy-preserving matching process before the actual learning begins.

The technical architecture has four layers. First, a preprocessing pipeline uses privacy-preserving entity resolution to match records across institutions and fuses multi-modal data—images, lab values, clinical notes—using attention mechanisms that learn which signals matter most. Second, an adaptive differential privacy scheduler adds carefully calibrated noise to each hospital's gradient updates, tuning the amount of noise to each site's data heterogeneity while maintaining a floor that prevents early-round instability. Third, a Paillier-based secure aggregation protocol with threshold decryption ensures that the central orchestrator never sees unencrypted individual updates; the trust model itself is treated as a design priority, not an afterthought. Fourth, the whole system is audited for robustness against membership inference attacks, gradient inversion, and Byzantine poisoning—adversarial scenarios where someone tries to extract private information or corrupt the model.

The researchers tested the framework on a simulated eight-hospital federation built from three public bone health cohorts: OsteoLaus, NHANES, and the Study of Osteoporotic Fractures. They validated it on an external cohort, MrOS, that had no role in training or federation simulation. Under the federated setup, ADP-FedRE achieved an area under the curve of 0.894—a measure of how well it discriminates between people who will and won't fracture—with a 95% confidence interval of 0.885 to 0.903. That's within one point of what a centralized oracle model would achieve if all data were pooled in one place, and 2.8 points better than FedProx, an earlier federated learning approach. The privacy protection was real: the empirical advantage an attacker could gain from membership inference—the ability to guess whether a specific patient's data was in the training set—stayed below 0.04 at the chosen privacy ceiling.

When the researchers stress-tested the system, it held up. With 50% of hospitals dropping out mid-training, the model's accuracy fell by less than 1.8 points. When they simulated Byzantine attacks—where a malicious hospital sends corrupted updates—the system remained stable even when one in four sites was adversarial. An extended battery of attacks, including shadow-model inference, loss-based membership inference, gradient inversion, and property inference, all confirmed the same privacy envelope. Calibration—how well the model's confidence scores matched actual fracture rates—matched the centralized oracle in the clinically actionable range and beat FRAX on the Brier score, a measure of prediction accuracy: 0.118 versus 0.156.

Subgroup audits by sex, age band, and self-reported ethnicity revealed performance and privacy gaps, but within acceptable bounds. The framework offers what the researchers call a deployment-oriented template: a concrete blueprint for how hospitals could actually implement cross-institutional fracture screening while respecting privacy regulations and maintaining clinical utility. The layered design should transfer naturally to other chronic diseases that combine tabular data with imaging—heart disease, diabetes complications, kidney disease. But the researchers are clear about one thing: the real test is still ahead. Simulating a federation is one thing. Getting multiple hospitals to actually agree to participate, to standardize their data pipelines, to trust the system, and to deploy it in production is another task entirely.