FedDeepRiskNet-Audit: Privacy and attack-aware federated learning for clinical time series analysis

Background Federated learning (FL) enables collaborative clinical modeling without centralizing sensitive patient records. However, shared model information may expose private data, while malicious client contributions can compromise model integrity. Combining privacy protection, attack-aware screening, and encrypted aggregation also introduces important participation and communication trade-offs. Objective This study proposes FedDeepRiskNet-Audit, a privacy and attack-aware FL framework for clinical time-series analysis that integrates privacy accounting, protected client screening, and encrypted aggregation within an auditable architecture. Methods FedDeepRiskNet-Audit combines a convolutional neural network-long short-term memory (CNN-LSTM) predictor with record-level differential privacy (DP) using Rényi differential privacy accounting, Cheon-Kim-Kim-Song (CKKS) homomorphic encryption, protected update sketches, common-mask sparsification, and an Adaptive Privacy and Byzantine-Resilience Scheduler (APBS). Evaluation using the PhysioNet/Computing in Cardiology Challenge 2012 dataset separately examined predictive discrimination, privacy-budget accumulation, attack behavior, scheduler performance, and analytical communication overhead. The centralized predictive benchmark and privacy-accounting experiments were evaluated over ten runs. Results The centralized CNN-LSTM benchmark achieved a mean area under the receiver operating characteristic curve (AUROC) of 0.781 (95% CI: 0.773–0.790) and an area under the precision-recall curve (AUPRC) of 0.380 (95% CI: 0.363–0.396), compared with a mortality prevalence of 0.14. In the 100-round privacy-accounting simulation, the Audit policy remained within ε = 3 at δ = 10 −5 , while accepting approximately 30 of 400 planned client-rounds; unconstrained DP-FedAvg accepted all 400 and reached ε ≈ 90. Analytical communication was 7.01 MiB per round, representing a 74.8% reduction relative to CKKS-FedAvg (27.84 MiB). In a separate scheduler ablation, full APBS produced a worst-client ε of approximately 2.3 with an executed client-round fraction of 0.60. Conclusion FedDeepRiskNet-Audit provides an integrated framework for examining the interactions among privacy accounting, attack-aware client screening, encrypted aggregation, and communication efficiency in clinical FL. The results demonstrate explicit privacy-participation and encrypted-communication trade-offs, rather than establishing end-to-end clinical superiority or universal resistance to adaptive attacks. Further end-to-end and multi-institutional validation is required before clinical deployment.