Key-Embedded Privacy for Decentralized AI in Biomedical Omics

Key-Em b edded Priv acy for Decen tralized AI in Biomedical Omics Rongyu Zhang 1,2,3 † , Hongyu Dong 4,5,6 † , Gaole Dai 3 † , Ziqi Qiao 7 † , Shenli Zheng 1 , Y uan Zhang 3 , Aosong Cheng 3 , Xiao wei Chi 3 , Jincai Luo 7 , Pin Li 8 , Li Du 1 , Dan W ang 11 , Y uan Du 1* ‡ , Xudong Xing 9* ‡ , Jianxu Chen 10* ‡ , Shanghang Zhang 3* ‡ 1 Sc ho ol of Electronic Science and Engineering, Nanjing Univ ersity , Nanjing, Jiangsu, 210023, China. 2 Departmen t of Computing, The Hong Kong Polytec hnic Univ ersity , Hong Kong, 999077, China. 3 State Key Lab oratory of Multimedia Information Processing, P eking Universit y , Beijing, 100871, China. 4 College of Computer Science and T ec hnology , Zhejiang Universit y , Hangzhou, Zhejiang, 310058, China. 5 College of Engineering, W estlak e Universit y , Hangzhou, Zhejiang, 310058, China. 6 Zhongguancun Academ y , Beijing, 100094, China. 7 College of F uture T ec hnology , P eking Universit y , Beijing, 100871, China. 8 China Pharmaceutical Univ ersity , Nanjing, Jiangsu, 211122, China. 9 Beijing Institute of Genomics, Chinese Academ y of Sciences and China National Cen ter for Bioinformation, Beijing, 100101, China. 10 Leibniz-Institut f ¨ ur Analytisc he Wissenschaften – ISAS – e.V., Bunsen-Kirc hhoﬀ-Str. 11, Dortmund, 44139, German y . 11 Academ y of Interdisciplinary Studies, Hong Kong Univ ersit y of Science and T ec hnology , Hong Kong, 999077, China. *Corresp onding author(s). E-mail(s): yuandu@nju.edu.cn ; xingxd@big.ac.cn ; jianxu.c hen@isas.de ; shanghang@pku.edu.cn ; † Equal con tribution. ‡ Equal sup ervision. 1 Abstract The rapid adoption of data-driven methods in biomedicine has intensiﬁed con- cerns o ver priv acy , gov ernance, and regulation, limiting raw data sharing and hindering the assem bly of representativ e cohorts for clinically relev ant AI. This landscap e necessitates practical, eﬃcient priv acy solutions, as cryptographic defenses often imp ose hea vy o verhead and diﬀeren tial priv acy can degrade p erfor- mance, leading to sub-optimal outcomes in real-w orld settings. Here, w e presen t a ligh tw eight federated learning metho d, INFL, based on Implicit Neural Represen- tations that addresses these challenges. Our approach in tegrates plug-and-pla y , co ordinate-conditioned modules in to client models, embeds a secret k ey directly in to the architecture, and supp orts seamless aggregation across heterogeneous sites. Across div erse biomedical omics tasks, including cohort-scale classiﬁcation in bulk proteomics, regression for p erturbation prediction in single-cell transcrip- tomics, and clustering in spatial transcriptomics and multi-omics with b oth public and priv ate data, w e demonstrate that INFL ac hieves strong, con trollable priv acy while maintaining utilit y , preserving the p erformance necessary for do wnstream scien tiﬁc and clinical applications. 1 In tro duction In the past decade, w e hav e witnessed a tandem fast-growth in bioinformatic algo- rithms and experimental analytical approaches, whic h ha ve profound transformation on how we conduct biomedical research to wards many diseases. Artiﬁcial in telligence (AI) tec hniques ha ve b ecome an important tool in bioinformatics for man y data-driv en studies, such as genomic analysis [ 1 ], spatical proteomics [ 2 ], drug disco very [ 3 ], etc. Ho wev er, the heterogeneit y in data is still one of the primary challenges for man y tasks, where large institution-spanning or m ulti-center studies ha ve b ecome inevitable. The tremendous eﬀorts in data standardization across v arious scales, from DNA/RNA to proteome and metab olome [ 4 , 5 ], in the past few years, ha ve pav ed the w ay for in ter- op erabilit y , large-scale data integration and consolidation. But, in real-life scenarios, esp ecially in clinical settings, there are still man y practical hurdles, suc h as data pri- v acy , data ownership, go vernance, human-sub jects ethics, in tellectual prop ert y , etc, com bined with stringent and heterogeneous cross-jurisdictional regulations [ 6 ], whic h imp edes the physically aggregation of represen tative cohorts and the dev elopment of large-scale reproducible, clinically relev ant mo dels. This stands in stark con trast to the h uge strides in commercial AI mo dels built on non-sensitiv e data. Consequen tly , enabling cross-site collaboration without exp osing ra w data while preserving mo del utilit y has b ecome a central prerequisite for moving biomedical AI b ey ond isolated data silos tow ard scalable translational impact, motiv ating the adoption of secure, priv acy-preserving distributed learning paradigms. T o alleviate the structural bottlenecks of cen tralized data sharing and mo del train- ing, federated learning (FL) [ 7 ] was prop osed as a priv acy-preserving paradigm for cross-institutional learning consolidation without transferring raw data [ 8 ]. In feder- ated learning, participating clien ts train on sensitive data lo cally and share only mo del 2 up dates, such as parameters or gradients, with a cloud server to form a global con- sensus mo del, thereby preserving data sov ereignt y and regulatory compliance while in tegrating div erse, geographically distributed cohorts. This distributed framew ork has sho wn considerable promise with translational p oten tial in biomedical researc h and clinical practice [ 9 ]. Ho wev er, federated learning is not alw ays “leakpro of”. It is p ossible that un trusted serv er ma y moun t data reconstruction attacks and therefore sensitiv e information could b e leaked. Two common techniques to fortify federated learning as a practi- cal and trustw orthy solution in biomedicine are cryptographic computation [ 10 ] and diﬀeren tial priv acy [ 11 ]. Cryptographic augmen tations , such as secure multi-part y computation (MPC) [ 12 ] and multi-part y homomorphic encryption (MHE) [ 13 , 14 ], could imp ose a strong protection against exp osing raw data while preserving mo del accuracy with cryptographic techniques. F or example, 1) SDF-ASMC [ 12 ] fuses secret shar- ing, Diﬃe–Hellman, and functional encryption to pro vide authenticated, secure MPC without a trusted third part y; 2) optimized fully Byzantine-robust homomorphic encryption [ 13 ] could also b e used to preven t information leak age while enabling fast, practical aggregation. How ev er, MPC and MHE oﬀer strong priv acy with the cost of imposing hea vy comm unication, computation, and storage ov erheads, scale p o orly at large clien t counts, and centralize risk through a single p oint of failure and key managemen t, so a breach can compromise the en tire system. Diﬀeren tial priv acy (DP) [ 15 ] oﬀers a quantiﬁable trade-oﬀ betw een utilit y and priv acy by injecting noise during training or release, thereby main taining protection ev en if the mo del is compromised. F or example, 1) Priv ateKT [ 16 ] transfers knowledge via actively selected small public data under diﬀerential priv acy , remark ably closing the p erformance gap to cen tralized learning; 2) F ed-SMP [ 17 ] sparsiﬁes lo cal mo dels b efore Gaussian p erturbation to improv e accuracy under the DP condition. At the same time, the nature of injecting noise inevitably comprises the accuracy of the mo del to a certain extent. Currently , the excellent priv acy-preserving p erformance of DP makes it emerging as a leading complemen tary safeguard for federated learning, despite the notable degradation in mo del p erformance. F rom a bioinformatic p ersp ectiv e, most federated learning studies that incorp o- rate the aforementioned priv acy-preserving methods remain theoretical or rely on canonical computer vision b enc hmarks with limited systematic ev aluation on noisier and more heterogeneous real-world biomedical data, limiting the practical adoption and generalizability of federated learning in biomedical settings. T o our knowledge, only very few priv acy-preserv ation works ha ve examined federated omics applications. F or example, F AMHE [ 14 ] prop osed a multi-part y homomorphic encryption–based federated analytics system that preserves priv acy while accurately repro ducing cen- tralized biomedical analyses, including surviv al analysis and GW AS, across distributed institutions. PPML-Omics [ 18 ] incorp orated decentralized randomization (DR) with DP to in vestigate cancer classiﬁcation using TCGA [ 19 ] bulk RNA-seq, clustering in single-cell RNA-seq, and in tegrative analyses that couple spatial gene expression with tumor morphology from spatial transcriptomics. How ev er, these works all suﬀer from signiﬁcant computational and comm unication o verhead or inevitable p erformance degradation. In conclusion, the scarcity of such domain-grounded developmen t and 3 ev aluations further calls for a generalized priv acy-preserving federated learning metho d that can accommodate div erse omics mo dalities and biomedical application scenarios. T o address the aforemention ed c hallenges, w e prop ose a light weigh t and priv acy- preserving Implicit Neural F ederated Learning (INFL) approach, which incorporates a plug-and-pla y encryption scheme built upon Implicit Neural Representations (INRs) [ 20 , 21 ] integrated into v arious linear la yers within the clients’ lo cal mo dels, as shown in Figure 1 -a . These mo dules function analogously to low-rank adapta- tion (LoRA) [ 22 ], co-training, and aggregating with the backbone while em b edding a secret key into the mo del architecture. Ho wev er, unlike LoRA that relies on high-level features as input, INFL introduces self-deﬁned co ordinate k eys as inputs to the INR. These keys act as priv ate identiﬁers, enabling the mo del to learn its task while con- ditioning on these unique co ordinates during training. The global mo del parameters serv e as a shared ”global key ,” while the priv ate coordinate k eys act as ”local keys.” During inference, an authorized user with b oth the global parameters and the correct priv ate k ey can generate accurate predictions. In con trast, an unauthorized attack er with only the global parameters would b e forced to guess the k ey , resulting in scram- bled inputs to the INR. This mismatch disrupts the INR mo dulation pro cess, leading to corrupted and non-functional mo del outputs. W e ev aluate INFL on a diverse set of represen tative omics analyses tasks: cohort- scale classiﬁcation in bulk proteomics, regression for p erturbation prediction in single- cell transcriptomics, and clustering in spatial transcriptomics and multi-omics. As sho wn in Figure 1 -b , representativ e deep learning mo dels are tested accordingly . W e demonstrate that INFL outp erforms the state-of-the-art federated learning metho ds, underscoring its versatilit y in join tly preserving mo del performance without sacriﬁcing computation and comm unication o verheads, and providing strong priv acy protection compared to traditional federated learning metho ds. 2 Results The ov erall framew ork of INFL is illustrated in Figure 1 . Assume there are K diﬀer- en t collab orating clients ( C 1 , C 2 , ..., C K ), e.g., diﬀerent participating hospitals, each with their own priv ate data ( D 1 , D 2 , ..., D K ) conforming to the same data format and each with their own priv ate computing resource, i.e., their own model acting as lo cal learners ( LocL 1 , LocL 2 , ..., LocL K ). It is imp ortant to note that INFL is agnos- tic to the underlying deep learning models (e.g, a T ransformer mo del for regression, a ResNet for classiﬁcation, etc.), but they mo dels hav e to be consisten t (i.e., using the same architectural design) across all local learners. As so on as one clien t, say C i , has prepared its priv ate data D i , the local learner LocL i can start training. Subsequen tly , multiple INR mo dules are attached to diﬀerent la y ers of eac h lo cal learner LocL i to function as meta learners M etL i . When training LocL i , clien t data D i are directly fed into LocL i , completing a standard training pip eline. Sim ultane- ously , the meta learner M etL i receiv es either a self-deﬁned key or an authen tically generated one as input. This design prev ents direct exposure of clien t data to the meta learners while preserving their capacity to contribute to the learning pro cess. This k ey-driven design enables meta learners to process encrypted representations rather than raw client data, ensuring strong priv acy protection. A t the same time, the meta 4 Local client Local client Local client Local client Coordinates Implicit Neural Representation (INR) Network In put Coordinate Interlayer Adjustment value Periodical activation Federated A verage Federated Learning with Explicit Safety Lock Federated Learning with Implicit Safety Lock Fig. 1 Overview of Implicit Neural F ederal Learning (INFL). a The left column provides a concise comparison b et ween traditional F ederated Learning using explicit neural netw orks and the proposed approach based on implicit neural net works. In explicit settings, user data utilized for train- ing local models may b e vulnerable to attac ks if not protected by priv acy-preserving mec hanisms such as diﬀerential priv acy (DP) or homomorphic encryption (HE). In contrast, in the implicit frame- work, the mo del is inherently secure because it do es not directly access ra w user data. The right column illustrates the detailed workﬂo w of INFL: each user train Meta Learners alongside the Lo cal Learner and uploads only the Meta Learner parameters. These are then aggregated at the server via the F ederated Averaging algorithm. b The top panel demonstrates the application of INFL to cancer subtyping based on protein expression lev els. A multila yer p erceptron (MLP) classiﬁer (n=14) is ini- tialized on eac h client and serv es as the Lo cal Learner. The middle panel adopts the GEARS mo del as the backbone architecture to p erform gene expression level regression under v arious perturbations, ev aluating b oth in-domain and out-of-domain gene predictions. The bottom panel employs SpaMosaic as the Lo cal Learner for m ulti-mo dal spatial transcriptomics integration, supp orting both horizon- tal in tegration (same modality across diﬀerent sections) and mosaic integration (diﬀerent mo dalities across sections). 5 learners contribute to improving the global mo del by providing additional structured information, enhancing o v erall performance during federated aggregation. After lo cal training on lo cal clients C i , mo del weigh ts of LocL i are transmitted to the cloud server. The weigh ts from all (or a subset of all) local learners are aggregated using the F edAvg [ 7 ] algorithm to update the parameters of the global mo del on the cloud, which are then sen t back to each client C i to up date the weigh ts of LocL i and p erform further local training with D i . Since the meta learners are designed to learn indirectly from clien t data, neither additional computational ov erhead (comparing to employing homomorphic encryption) nor p erformance degradation (comparing to diﬀeren tial priv acy) is observ ed (see Supplemen tary Figure-1 for sanity c hecks.) F ormal pro of of our INR-based framework as a cryptographic lo c k is provided in Section 5.3 . Here, we emphasize that INFL is a general mo del-agnostic mechanism, compatible with standard architectures and federated pip elines, yielding strong p er- formance across heterogeneous biological settings. Concretely , we demonstrate the eﬀectiv eness using distinct base mo dels under v aried federated conﬁgurations: in Section 2.1 , a m ulti-la yer perceptron (MLP) model for proteomics-based cancer sub- t yping; in Section 2.2 , GEARS mo del for transcriptomics p erturbation resp onse; and in Sections 2.3 and 2.4 , SpaMosaic mo del for spatial transcriptomics and spatial m ulti- omics in tegration, respectively . Notably , the SpaMosaic application in Section 2.4 op erates on inheren tly non-iid, multi-modal data (ADT and RNA), illustrating that INFL accommo dates biological heterogeneity without b esp ok e, task-sp eciﬁc tuning across b oth spatial and non-spatial omics. In the Supplementary (Section A.1 ), we further stress-test federated settings on standard vision b enc hmarks with v arying client n umber, participation ratio, INR size, and non-iid sev erit y , demonstrating robustness to data heterogeneity . These con trolled ablations complement our biological results and supp ort INFL as a uniﬁed priv acy- preserving lay er that generalizes to non-iid, m ulti-center–lik e regimes, exempliﬁed by the ADT–RNA in tegration in Section 2.4 . 2.1 INFL Excels in Cancer Subt yping for Bulk Proteomics W e start testing our INFL framew ork with a simple, y et widely applicable task: cancer subt yping using bulk proteomics data from a large p opulation cohort. Remark able results hav e b een achiev ed in cancer subtyping by measuring the human proteome, signiﬁcan tly improving diagnostic and therap eutic accuracy [ 23 ] in clinical practices. With the accumulation of large-cohort p opulation data, it has b ecome p ossible to in tegrate these data to train a universal mo del for cancer diagnosis and treatmen t, whic h is of immense clinical application v alue. How ever, muc h of this cohort data comes from diﬀerent hospitals. Due to concerns ab out patient priv acy and the sensitivity of biological data, hospitals face signiﬁcan t c hallenges in sharing data. F ederated learning oﬀers a viable solution to this problem. By training cancer subt yping models lo cally , follo wed by the transfer, mixing, and iterative training of mo del parameters, the ﬁnal mo del can achiev e accurate and generalizable subt yping without the data ever lea ving the resp ectiv e hospitals, th us fulﬁlling the ultimate ob jectiv e. W e adopted the data released from [ 9 ], containing a large-cohort bulk proteomics data from a large p opulation cohort, comprising a total of 1207 samples. Each sample 6 0 0.2 0.4 0.6 0.8 1 1.2 T est_acc T est_f1 T est_auc V alue Evaluation metrics 0 0.2 0.4 0.6 0.8 1 Adenocarcinoma Basal cell carcinoma Carcinoma Glioblastoma L ymphoma Melanoma Neuroblastoma Neuroendocrine Renal cell carcinoma Sarcoma Squamous Thyroid papillary T ransitional cell carcinoma W ilm's tumour Perclass AUROC performance 0 0.2 0.4 0.6 0.8 1 1.2 T est_acc T est_f1 T est_auc V alue INFL ablation study INFL INFL w/o inr PPML b c d e f g a Fig. 2 Exp erimen tal results on bulk proteomics cancer subt yping task. a Exp erimen tal design of an algorithm for the cancer subt yping task, including training data partitioning, the training workﬂo w, the ﬁnal inference pro cess, and do wnstream tasks. b Overall classiﬁcation p erformance ev aluated by quan titative metrics. Accuracy , F1-score, and A UROC are rep orted, with each metric representing the macro-av erage across all 14 class lab els. c Radar chart displa ying the individual AUR OC metrics for each of the 14 class labels. d-f Interpretabilit y analysis of the classiﬁcation mo del using Shapley values. F or each subt yp e, the top 5 most relevan t proteins are shown. The horizontal axis represents the magnitude of the Shapley value, while the color intensity in each b eeswarm plot indicates the expression level of the corresp onding protein. A p ositiv e Shapley v alue for a highly expressed protein suggests a positive correlation with the cancer subt yp e, whereas a negative v alue indicates a negativ e correlation. d Interpretabilit y analysis for Adenocarcinoma. e Interpretabilit y analysis for Lymphoma. f Interpretabilit y analysis for T ransitional cell carcinoma. g Ablation study of INFL. Experiments w ere conducted after removing the INR mo dule from the original mo del during the inference, and the overall classiﬁcation p erformance w as ev aluated. 7 con tained measurements for 9101 proteins and w as asso ciated with a corresp onding cancer t ype lab el (15 classes in total). As sho wn in Figure 2 a , we assumed the presence of ﬁve clients and partitioned the dataset into ten equal shards and assigned one shard to each of ten clients. W e emplo y ed an MLP as the core classiﬁcation mo del. V arious federated learning strategies w ere applied to this base model to initiate federated learning training. During eac h comm unication round, we sampled ﬁv e clien ts uniformly at random to participate in federated training. Unless otherwise noted, the globally aggregated mo del obtained after the ﬁnal round w as used for inference. During the inference stage, the mo del tak es the protein expression v alues of a sample as input, predicts the probability of each cancer subt yp e, and selects the subtype with the highest probability as the ﬁnal classiﬁcation result. The predicted labels are then compared with the true lab els to calculate performance metrics. W e ﬁrst used quantitativ e metrics to ev aluate the classiﬁcation p erformance of eac h federated learning metho d. As shown in Figure 2 b , we rep orted the ov erall accuracy , F1-score, and A UROC across all 14 labels. The results indicate that INFL p erforms slightly better than traditional F edAvg federated learning strategies (i.e., the ProCanFDL metho d from [ 9 ], where the dataset was originally used for) and signiﬁcan tly outp erforms other federated learning strategies (such as F edAvg with diﬀeren tial priv acy (FL-DP), F edAvg with low-rank adapter and diﬀerential priv acy (FL-LoRA-DP), and PPML-Omics (PPML)). W e further inv estigated the AUR OC for each individual cancer subtype and plotted the radar chart in Figure 2 c . The results sho w that INFL ac hieves the best performance across most cancer types, except for a v ery few (suc h as Carcinoma), demonstrating the generalizabilit y of INFL’s eﬀectiv eness. Subsequen tly , we conducted additional application-appropriate v alidation, i.e., emplo ying analytical metho ds to v alidate the biological signiﬁcance of INFL’s clas- siﬁcation results. Sp eciﬁcally , we calculated Shapley v alues [ 24 ] based on INFL’s classiﬁcations to determine the con tribution of each feature to the prediction result. W e selected the top 5 contributing features for each cancer subt yp e and generated SHAP beeswarm plots to in terpret representativ e examples. As shown in Figure 2 d- f , the mo del results indicate a p ositiv e correlation b et ween the LGALS4 protein and Adeno carcinoma. As reported in the literature, LGALS4 (Galectin-4) is a lectin pro- tein t ypically expressed in normal epithelial cells of tissues lik e the gastrointestinal tract. Its expression is upregulated in v arious adenocarcinomas, particularly colorec- tal cancer (CR C). It is in v olved in cell adhesion, proliferation, and signaling, and its high expression is asso ciated with tumor progression and metastatic p oten tial [ 25 ]. F urthermore, the PR TFDC1 protein show ed a negativ e correlation with Lymphoma. As previously studied [ 26 ], PR TFDC1 is a frequent deletion site in lymphoma, the restoration of whose expression in lymphoma cell lines signiﬁcantly inhibits cell prolif- eration and induces ap optosis, directly demonstrating its tumor suppressor function in lymphoma. F urthermore, KR T85 also sho w ed a p ositive correlation with T ransitional cell carcinoma. Prior works [ 27 ] ha ve shown its role as an oncogene in certain cancers. It is highly expressed in the basal/squamous subtype of urothelial carcinoma, which is t ypically asso ciated with a p oorer prognosis. In summary , the interpretabilit y anal- ysis sho ws that the mo del not only achiev es accurate classiﬁcation but also precisely 8 iden tiﬁes proteins closely related to each speciﬁc subtype. The observed correlations are consistent with the literature, indicating mo del’s biological relev ance. Additionally , w e conducted an ablation study to assess the priv acy-preserving capabilities of INFL. Notably , when unauthorized attack ers input random co ordi- nates without the correct key , the mo del collapsed, outputting N/A and failing to generate meaningful results. Under an ev en more extreme setting where the INR mo dule w as remov ed during inference (Figure 2 g), accuracy dropp ed far b elo w PPML and other baselines. These results highlight the necessity of INFL’s key- conditioned mechanism for robust priv acy while sustaining performance. Importantly , the same mechanism disrupts gradient-based attacks in federated training: with out- put y ′ = α ( Wx + b ) + (1 − α ) ∆ ( π ) and ∆ i ( π ) = Φ θ ( γ ( C ( π ( i )))), an adv ersary who assumes the iden tity key computes INR gradients at mismatched co ordinates, eﬀectiv ely replacing ∂ θ Φ θ ( γ ( C ( π ( i )))) by ∂ θ Φ θ ( γ ( C ( i ))). F or high-frequency INRs, Jacobians at distinct co ordinates are weakly correlated, yielding a non-v anishing gra- dien t gap E !  |∇ θ L ( π ) − ∇ θ L ( π A ) | 2 2  ≳ 2(1 − α ) 2 σ J 2 P i E [( ∂ ℓ/∂ y ′ i ) 2 ] and driving the exp ected cosine similarity tow ard zero. Thus, gradient matching and model inv er- sion lose the one-to-one alignment needed for reconstruction, and adversarial up dates deviate from the true descent direction; an iden tical p erm utation mismatch propa- gates to ∇ W L via bac kpropagation. F ull deriv ations and extensions are provided in Section 5.3 , which also explains why INFL retains its priv acy-preserving b ehavior under such extreme circumstances. 2.2 INFL Excels in P erturbation Resp onse Prediction for Single-Cell T ranscriptomics. W e further tested our INFL framew ork on the task of single-cell transcriptomics per- turbation resp onse prediction, where a sp ecialized bioinformatic mo del is commonly used [ 28 ]. The single-cell transcriptomics-based prediction of cellular resp onses to drug p erturbation is one of the foundational tasks of the “Virtual Cell” mo del [ 29 ], with the promise of in-silico drug screening and great clinical p otenti als. With the increas- ing av ailability of data, it has b ecome p ossible and highly applicable to aggregate p erturbation data from diﬀerent interv en tion conditions to train a uniﬁed mo del. Sp eciﬁcally , the perturbation prediction task refers to training a mo del on a dataset of triplets consisting of con trol group gene expression data, p erturbation condition, and post-p erturbation gene expression data. Subsequen tly , during testing, the mo del predicts gene expression under other p erturbation conditions, which falls under the regression task in machine learning. F or this task, w e adopted the commonly used Adamson dataset [ 30 ] and Norman dataset [ 31 ], together with an additional in-house dataset (see Metho ds), as a representativ e diverse data collection to ev aluate the mo del’s accuracy and generalizabilit y . The Adamson dataset and our in-house dataset con tain only single-gene perturbations, while the Norman dataset contains dual-gene com bination perturbations. W e assumed the presence of ten clien ts and partitioned the dataset in to ten equal shards, assigning one shard to each of the ten clien ts. GEARS, a widely recognized p erturbation prediction algorithm [ 28 ], is adopted as the core mo del. V arious federated learning strategies were applied to this baseline algorithm to initiate federated learning training. During each communication round, we sampled 9 a b c d e f k l 0 1 2 3 4 5 6 Adamson Norman_ unseen_0 Norman_ unseen_1 Norman_ unseen_2 Private data T op20_de_mse value Scenarios INFL ablation study INFL INFL w/o inr PPML 0 0.05 0.1 0.15 0.2 0.25 0.3 MSE (all) MSE (de) De_op_frac Error value Adamson evaluation metrics - 1 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 Pearson (all) Pearson (de) Pearson_delta Pearson value Adamson evaluation metrics - 2 0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 0.45 0.5 MSE (all) MSE (de) De_op_frac Error value Norman_unseen_2 evaluation metrics - 1 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 Pearson (all) Pearson (de) Pearson_delta Pearson value Norman_unseen_2 evaluation metrics - 2 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 MSE (all) MSE (de) Error value Private data evaluation metrics - 1 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 Pearson value Private data evaluation metrics 0 10 20 30 40 50 60 70 80 90 100 F ARSB+ctrl MAP2K6+IKZF3 ZNF318+FOXL2 YWHAE+ctrl Hitrate (%) Different scenarios Hitrate under different scenarios 0 10 20 30 40 50 60 70 80 90 100 CEBPE+RUNX1T1 Hitrate (%) Hitrate g Fig. 3 Exp erimental results on the single-cell transcriptomic perturbation prediction task. a Experimental design of algorithm for the single-cell transcriptomic p erturbation prediction task, including training data partitioning, training workﬂo w, ﬁnal inference pro cess, and downstream tasks. b Ablation study of INFL. Exp erimen ts w ere conducted after removing the INR mo dule from the original algorithm, comparing the MSE metric for the top 20 diﬀerentially expressed genes across v arious scenarios. c-e Model p erturbation prediction p erformance characterized by quantitativ e met- rics. F or each scenario, w e selected three metrics to demonstrate the performance of each method: the MSE for all genes (MSE(all)), the MSE for the top 20 diﬀerentially expressed genes (MSE(de)), and the fraction of top 20 diﬀerentially expressed genes with opp osite prediction direction (De op frac). F or all three metrics, low er v alues indicate b etter performance. c Performance on the Adamson dataset. d Performance on the Norman dataset under the out-of-domain scenario (unseen 2). e Perfor- mance on the priv ate dataset. f Qualitative case study sho wing mo del p erturbation performance. The dual-gene p erturbation ( CEBPE + RUNX1T1 ) from the Norman dataset under the out-of-domain scenario is sho wn. The green dotted line shows mean unperturb ed con trol gene expression. Boxes indicate experimentally measured diﬀerential gene expression after p erturbing the gene com bination CEBPE and RUNX1T1 . Diﬀerent symbols sho ws the mean change in gene expression predicted by diﬀerent metho ds when they have not seen CEBPE nor RUNX1T1 exp erimen tally p erturbed at the time of training. Whiskers represent the last data p oin t within 1.5 × interquartile range. g Perturba- tion p erformance quan titatively display ed using hit rate. A prediction is considered accurate if the mean change in gene expression predicted by a method falls within the boxes range. The hit rate is calculated b y summarizing the prediction accuracy across all 20 genes. 10 ﬁv e clien ts uniformly at random to participate in federated learning. Unless otherwise noted, the globally aggregated model obtained after the ﬁnal round w as used for inference. During the inference stage, the mo del predicts gene expression under a previously unseen p erturbation condition, generating predicted expression v alues for v arious genes. These predictions are then compared with the v alues obtained from real exp erimen ts to calculate quan titative metrics. As sho wn in Figure 3 c-e and Extended Data Figure 1 a-b , we ﬁrst calculated the mean squared error (MSE) for all genes and the MSE for the top 20 diﬀerentially expressed genes. W e also calculated the prop ortion of incorrectly predicted directions for the top 20 diﬀerentially expressed genes (where a predicted direction is incorrect if the mo del predicts do wnregulation while the true change is upregulation). F or all three metrics, low er v alues are better. It is imp ortan t to note that for the Adamson and our in-house datasets, whic h con tain only single-gene perturbations, testing was p erformed on genes not presen t in the training set. F or the Norman dataset, the situation is more complex. W e thoroughly considered the concepts of in-domain and out-of-domain gen- eralisation in machine learning [ 32 ]. T aking the prediction of a dual-gene p erturbation ( X+Y ) as an example: if single-gene p erturbation data for both genes X and Y exist in the training set, it is considered in-domain (full); if p erturbation data for only one gene (e.g., only X ) exists, it is considered in-domain (partial); if p erturbation data for neither X nor Y exists, it is considered out-of-domain. These are represented in the ﬁgures as unseen 0, unseen 1, and unseen 2, respectively . It can be observed that INFL p erforms on par with the centralised algorithm across all scenarios, slightly out- p erforms standard federated learning metho ds, and far surpasses other comparative algorithms (such as FL-DP , FL-LoRA-DP , PPML) in v arious settings. W e also cal- culated the Pearson correlation co eﬃcien t (PCC) for all genes, the PCC for the top 20 diﬀeren tially expressed genes, and the Pearson delta (used to measure the change) to demonstrate the sup eriorit y of our method, with conclusions consisten t with those from the MSE metrics ( Extended Data Figure 1 c-g ). In addition to quan titative metrics, we further qualitativ ely visualized the p ertur- bation responses for certain imp ortan t cases. F or instance, we selected the CEBPE + RUNX1T1 combined p erturbation, whic h b elongs to the out-of-domain (unseen 2) scenario ( Figure 3 f-g ). This com bined perturbation can reliev e m yeloid diﬀeren- tiation blo c k, inhibit leukemia stem cell prop erties, induce ap optosis, and remo del c hromatin structure, representing an imp ortant strategy for reversing the leuk emic phenot yp e [ 33 ]. It can b e observed that compared to other metho ds, INFL’s predic- tions for the top 20 diﬀerentially expressed genes are quite accurate, b oth in terms of the correct trend and the magnitude of c hange. W e also added a hit rate metric to quan titatively measure prediction accuracy (Metho ds). If the mean change in gene expression predicted b y INFL falls within the b o xes range, the prediction is consid- ered accurate. The o v erall prediction p erformance across the 20 genes is summarized to calculate the hit rate v alue. W e found that INFL’s predictions are on par with the cen tralised algorithm, reac hing 95%, signiﬁcantly surpassing other federated learn- ing algorithms. W e further demonstrated the metho d’s sup eriorit y with more cases ( F ARSB+ctrl , ZNF318+F OXL2 , MAP2K6+IKZF3 , YWHAE+ctrl ) on other datasets and scenarios ( Extended Data Figure 2 a-e ). 11 Again, w e conducted an ablation study to assess the priv acy-preserving capabilities of the INR mo dule ( Figure 3 b ). When the INR mo dule was remov ed during the inference, the MSE for the top 20 diﬀerentially expressed genes across v arious scenarios increased dramatically compared to the original mo del and p erformed signiﬁcantly w orse than PPML. This demonstrates that without the INR mo dule or correct key , the model fails to maintain its p erformance, highligh ting the critical role of the INR mo dule in ensuring b oth priv acy protection and reliable results. 2.3 INFL Excels in Horizon tal In tegration T asks for Spatial T ranscriptomics With the dev elopment of omics tec hnologies, spatial omics tec hniques are being widely applied in clinical research [ 34 ]. An imp ortan t task is to in tegrate data from diﬀer- en t patient samples to explore common and diﬀerential features b et w een patients. Ho wev er, the priv acy of clinical data mak es it diﬃcult to aggregate all spatial omics data from diﬀerent sources for integrated training. Here, we demonstrate INFL as a federated learning strategy could yield an in tegration mo del while preserving priv acy . W e ﬁrst explore the horizon tal integration scenario of single omics, namely integrat- ing the same omics data from diﬀeren t samples together and generating informative laten t embeddings for eac h sample while considering in ter-sample diﬀerences. As sho wn in Figure 4 a , sp eciﬁcally , we selected three spatial RNA sections from the human lymph no de dataset [ 35 ]. W e assumed that they belong to three diﬀerent individuals’ data. Simultaneously , we set up three clients, assuming they b elong to three diﬀerent hospitals. Then, w e assigned tw o of the three RNA sections to each client at random, so that each clien t con tains diﬀeren t data. W e adopted the SpaMosaic mo del as our cen tralized algorithm, which is an eﬃcient spatial omics integration algorithm in a horizon tal setting [ 35 ]. W e applied v arious federated learning strategies to the baseline algorithm and initiated federated learning training. All clien ts participated in ev ery comm unication round, including using lo cal data for mo del training, uploading mo del parameters to the cen ter, and up dating the model based on the parameters returned from the cen ter to con tin ue training. Finally , the em beddings were generated using the globally aggregated mo del and all av ailable RNA sections. The em b eddings of each section were then clustered by leiden algorithm to distinguish spatial regions. The clustering lab els were compared with the true lab els to demonstrate the clustering p erformance of diﬀerent federated learning strategies. As sho wn in Figure 4 b , we ﬁrst plot the spatial distribution of clustering lab els to qualitatively demonstrate the clustering eﬀect. The INFL strategy p erforms on par with the cen tralized algorithm, accurately detecting the scattered distribution of follicles and the env eloping distribution of cortex, which is also consisten t with the ground truth. INFL performs far better than other federated learning strategies (FL, FL-DP , FL-LoRA-DP , PPML). Other algorithms p erform p o orly in clustering and iden tifying regions, either failing to restore the en veloping distribution of cortex or accurately identify follicles. Our conclusion can also b e obtained from quantitativ e metrics ( Figure 4 c ), esp ecially on the ARI index, where INFL outp erforms the other algorithms and closely approac hes the cen tralized algorithm. 12 a Section1 Section2 Section3 Ground T ruth Central INFL FL FL- DP FL- LoRA - DP PPML b Clustering domains c d 0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 All Section1 Section2 Section3 V alue ARI 0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 0.45 All Section1 Section2 Section3 V alue AMI 0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 0.45 All Section1 Section2 Section3 V alue NMI 0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 0.45 All Section1 Section2 Section3 V alue HOM 0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 All Section1 Section2 Section3 V alue ARI 0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 0.45 All Section1 Section2 Section3 V alue AMI 0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 0.45 All Section1 Section2 Section3 V alue NMI 0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 0.45 All Section1 Section2 Section3 V alue HOM 0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 All Section1 Section2 Section3 V alue ARI 0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 0.45 All Section1 Section2 Section3 V alue AMI 0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 0.45 All Section1 Section2 Section3 V alue NMI 0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 0.45 All Section1 Section2 Section3 V alue HOM 0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 All Section1 Section2 Section3 V alue ARI 0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 0.45 All Section1 Section2 Section3 V alue AMI 0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 0.45 All Section1 Section2 Section3 V alue NMI 0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 0.45 All Section1 Section2 Section3 V alue HOM e Fig. 4 Exp erimental results on the horizon tal spatial transcriptomics integration task. a Experimental design of the algorithm framework for the spatial transcriptomics horizontal integra- tion task, including training data partitioning, the training w orkﬂow, the ﬁnal inference process and downstream clustering tasks. b Spatial visualization of the clustering results. c Quantitativ e metrics for the clustering p erformance, using four indices: ARI, AMI, NMI, and HOM. d Diﬀeren tial expres- sion analysis p erformed using the INFL clustering results, showing highly diﬀerentially expressed genes for each domain. W e selected the genes CX CL13 and F ABP4 , referenced relev ant literature to conﬁrm their biological signiﬁcance and plotted their spatial distributions. e Spatial distribution maps of the genes CXCL13 and F ABP4 . Comparison with the INFL clustering map in panel b sho ws a strong spatial concordance b et ween the expression of these genes and the lo cations of the follicle and pericapsular adip ose tissue domains resp ectively , conﬁrming the sp eciﬁcity of gene expression. 13 T o further inv estigate whether the INFL clustering lab els hav e biological signiﬁ- cance, we used the INFL clustering results to ﬁnd marker genes for eac h domain and plotted the dotplot as sho wn in Figure 4 d . F rom the dotplot, it can b e seen that eac h domain can ﬁnd its signiﬁcantly expressed marker genes. CXCL13 is sp eciﬁcally expressed in the follicle region, whic h is consisten t with literature records. CXCL13 is a chemokine secreted by follicular dendritic cells (FDC) and follicular reticular cells (B-cell zone reticular cells) within lymph node follicles. It binds to the receptor CX CR5 on the surface of B cells, guiding B cells to migrate to lymph no de follicles, promoting follicle formation and maintenance [ 36 ]. In addition, F ABP4 is mainly expressed by mature adip o cytes and macrophages. In p ericapsular adip ose tissue, F ABP4 acts as a lipid chaperone protein, regulating fatt y acid storage, transport, and metab olism, and also inv olved in inﬂammatory resp onse regulation [ 37 ]. Again, a signiﬁcant p ositiv e correlation b etw een this gene and domain can b e observed in the dotplot. F urthermore, w e displa yed the spatial distribution of case genes ( Figure 4 e ), CXCL13 is actually highly expressed in the follicle region, and F ABP4 is no exception, highly expressed in p ericapsular adip ose tissue. These results further conﬁrms that INFL clustering results can pro vide certain biological signiﬁcance and sho ws the sp ecial spatial distribution of sp eciﬁc genes. 2.4 INFL Excels in Mosaic In tegration T asks for Spatial Multi Omics Bey ond single omics integration, we further verify the eﬀectiveness of INFL on multi- omics scenario, i.e., with sim ultaneous measuremen t of tw o or more t yp es of molecules, b y testing spatial m ulti-omics mosaic integration. As sho wn in Figure 5 a , we used public data from the human tonsil dataset [ 35 ], containing three sections, each with t wo mo dalities (RNA and protein). W e assumed that they b elong to three diﬀerent individuals’ data. The mosaic integration scenario refers to the training setting where some sections hav e paired m ulti-omics data while others p ossess only single-omics data, aiming to generate informative laten t em b eddings for each sample while accoun ting for b oth inter-sample diﬀerences and m ultimo dal information. W e also set up three clien ts and assumed they belong to three diﬀerent hospitals. Then we assigned mosaic data to each client. F or example, for Client 1, we assigned paired RNA and protein mo dalit y data from Section 1, RNA single-modality data from Section 2, and protein single-mo dalit y data from Section 3. The data assigned to eac h client were diﬀeren t. W e employ ed the SpaMosaic mo del as our centralized algorithm under the mosaic setting. V arious federated learning strategies were applied to the baseline algorithm. All clien ts participated in every communication round, which included training the lo cal mo dels using lo cal data, uploading local mo del parameters to the central server, and up dating the lo cal mo dels based on the parameters returned from the central serv er to contin ue training. Finally , the em b eddings were generated using the globally aggregated mo del and all av ailable sections’ multi-modality data. The em b eddings of eac h section were then clustered using the leiden algorithm to distinguish spatial domains. The clustering labels w ere compared with the ground truth lab els to ev aluate the clustering performance of diﬀeren t federated learning strategies. 14 a Section1 Section2 Section3 Ground T ruth Central INFL FL FL - DP FL - LoRA - DP PPML b Clustering domains c d e 0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 All Section1 Section2 Section3 V alue ARI 0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 All Section1 Section2 Section3 V alue AMI 0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 All Section1 Section2 Section3 V alue NMI 0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 All Section1 Section2 Section3 V alue HOM 0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 All Section1 Section2 Section3 V alue ARI 0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 All Section1 Section2 Section3 V alue AMI 0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 All Section1 Section2 Section3 V alue NMI 0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 All Section1 Section2 Section3 V alue HOM 0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 All Section1 Section2 Section3 V alue ARI 0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 All Section1 Section2 Section3 V alue AMI 0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 All Section1 Section2 Section3 V alue NMI 0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 All Section1 Section2 Section3 V alue HOM 0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 All Section1 Section2 Section3 V alue ARI 0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 All Section1 Section2 Section3 V alue AMI 0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 All Section1 Section2 Section3 V alue NMI 0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 All Section1 Section2 Section3 V alue HOM Fig. 5 Exp erimental results on the mosaic spatial multi-omics integration task. a Exp er- imental design of the algorithm framework for the spatial multi-omics mosaic integration task, including training data partitioning, the training w orkﬂow, the ﬁnal inference process, and down- stream clustering tasks. b Spatial visualization of the clustering results. c Quantitativ e metrics for the clustering p erformance, using four indices: ARI, AMI, NMI, and HOM. d Diﬀerential expression analysis p erformed using the INFL clustering results, sho wing highly diﬀerentially expressed genes for each domain. W e selected the genes R GS13 and SDC1 , referenced relev an t literature to conﬁrm their biological signiﬁcance, and plotted their spatial distributions. e Spatial distribution maps of the genes R GS13 and SDC1 . Comparison with the INFL clustering map in panel b shows a strong spa- tial concordance b et ween the expression of these genes and the lo cations of the germinal center and connective and epithelial tissue domains resp ectiv ely , conﬁrming the sp eciﬁcit y of gene expression. 15 As shown in Figure 5 b , w e ﬁrst plotted the spatial distribution of the clustering lab els to qualitativ ely demonstrate the clustering performance. The INFL strategy p er- formed on par with the cen tralized algorithm, accurately detecting lymphoid follicles surrounding the germinal cen ter, as well as connective and epithelial tissue interw o- v en with tonsillar parench yma, which is also consistent with the ground truth. The p erformance of INFL was signiﬁcantly b etter than that of other federated learning strategies (FL, FL-DP , FL-LoRA-DP , PPML). Other algorithms show ed p o or p er- formance in iden tifying spatial domains. F or example, the federated learning metho d resulted in fragmented iden tiﬁcation of lymphoid follicles with substantial noise, while PPML misidentiﬁed connective and epithelial tissue. Quan titative metrics similarly demonstrated this trend (Figure 5 c), where INFL sho wed almost no gap compared to the centralized algorithm but outperformed other algorithms b y appro ximately 5% – 10%. Next, to in v estigate whether the clustering labels generated b y INFL hold biolog- ical signiﬁcance, we used the INFL clustering results to identify marker features for eac h domain. First, w e generated a dot plot as shown in Figure 5 d . The dot plot rev eals that each domain has its signiﬁcantly expressed mark er genes. F or instance, R GS13 was observed to b e enriched in the germinal cen ter region. Literature do cu- men ts that this gene is a key mark er for Germinal Center B cells in tonsillar tissue, closely associated with B cell activ ation, proliferation, and diﬀerentiation [ 38 ]. SDC1 is primarily expressed on the surface of epithelial cells, where it binds to collagen, ﬁbronectin, laminin, and other components in the extracellular matrix (ECM) via its extracellular domain, forming physical connections b et ween epithelial cells and con- nectiv e tissue [ 39 ]. It plays a critical role in the connective and epithelial tissue region. F urthermore, we displa yed the spatial distribution of case genes ( Figure 5 e ), sho wing that RGS13 is indeed highly expressed in the germinal center region and SDC1 show ed mark ed enric hment in its corresp onding domain. Beyond genes, we also presented dif- feren tial protein signals in Extended Data Figure 3 . The CXCR5 protein plays a cen tral role in lymphoid follicle positioning, germinal cen ter zoning, and the core sig- naling axis of T-B cell collaboration [ 40 ]. The ﬁgure sho ws that CXCR5 is diﬀeren tially and signiﬁcantly expressed in the lymphoid follicle and germinal cen ter regions. This further conﬁrms that the clustering results from INFL can provide biological insigh ts, rev ealing speciﬁc spatial distributions of particular genes and proteins. 3 Discussion Our prop osed INFL demonstrates broad applicabilit y across diverse biomedical scenar- ios, oﬀering a comprehensiv e and scalable solution for priv acy-preserving distributed learning. INFL supp orts tasks spanning from single-cell transcriptomics to spatial m ulti-omics, addressing challenges in cohort-scale classiﬁcation, regression for p ertur- bation prediction, and clustering in high-dimensional biological data. This v ersatility enables INFL to eﬀectively handle heterogeneous and sensitive datasets across a v ari- et y of omics modalities, bridging the gap betw een priv acy-preserving methodology and real-w orld biomedical applications. By ensuring robust p erformance in a diverse set 16 of tasks, bulk proteomics classiﬁcation, single-cell regression, and spatial transcrip- tomics clustering, INFL provides a uniﬁed metho d that meets the demands of mo dern biomedical research. Ablation studies further underscore the critical role of the INR mo dule in INFL. The INR mo dule not only enhances mo del p erformance but also provides a robust mec hanism for priv acy protection. Sp eciﬁcally , without the INR mo dule, the mo del exp eriences a signiﬁcant drop in utilit y , whic h inadv ertently reduces the eﬀectiv eness of p oten tial attacks such as data reconstruction or misuse. F urthermore, unautho- rized users lacking the correct INR k ey are unable to pro vide v alid inputs for the co ordinate-based encryption scheme, causing the mo del to output corrupted and mean- ingless results. This ensures that ev en if mo del parameters are exposed, sensitiv e data and intellectual property remain fully protected, as the mo del becomes en tirely non-functional without the correct INR key . Moreo ver, INFL aligns well with the principles of Swarm Learning (SL), a decen- tralized framew ork that enables collab orativ e training across multiple sites without requiring data cen tralization. Similar to FL, INFL ensures data so vereign t y b y keeping sensitiv e datasets lo calized while allo wing the exchange of learned parameters includ- ing the meta learner. This compatibility op ens new av enues for applying INFL in scenarios where SL has b een demonstrated to b e successful, such as molecular clas- siﬁcation in cancer histopathology and m ulti-mo dal clinical data in tegration [ 41 , 42 ]. By in tegrating INR mo dules within SL, INFL could further enhance priv acy and scalabilit y , enabling robust federated learning across geographically disp ersed biomed- ical institutions. This synergy has the p oten tial to demo cratize access to high-quality AI mo dels b y fostering cross-institutional collab orations, ultimately accelerating inno v ation in biomedical researc h while adhering to strict priv acy regulations. Lik e all federated learning metho ds, INFL faces inheren t trade-oﬀs b et ween pri- v acy and p erformance. While federated learning t ypically sacriﬁces some accuracy compared to centralized training due to decentralized data and priv acy constraints, our INR mo dules signiﬁcantly mitigate this limitation by acting as meta-learners, enhancing generalization across heterogeneous datasets. In man y cases, INFL ac hieves p erformance comparable to centralized training, as demonstrated in v arious omics tasks, while sim ultaneously pro viding strong priv acy guaran tees. Ho wev er, challenges suc h as comm unication o v erhead and reliance on consistent clien t participation remain areas for improv ement. F uture research can fo cus on reﬁning the INR architecture and further reducing computational costs. Despite these c hallenges, INFL represen ts a signiﬁcan t step forw ard in priv acy-preserving federated learning, oﬀering a practical, ligh tw eight, and eﬀective solution to drive scalable and secure biomedical AI. 4 Metho d 4.1 Priv ate Data Collection for V alidation T o address the c hallenges of data heterogeneit y and priv acy in biomedical researc h, we collected priv ate datasets sp eciﬁcally tailored to ev aluate the p erformance of our mo del on gene p erturbation tasks. These priv ate datasets were collected to simulate real- w orld exp erimen tal conditions while ensuring compliance with priv acy regulations. 17 They enable the systematic assessmen t of our metho d in mo deling p erturbation eﬀects, including gene knockdo wns and their impact on cellular phenotypes, critical for study- ing complex biological pro cesses and v alidating the robustness of priv acy-preserving INFL. Cell cultures: Human primary umbilical v ascular endothelial cells (HUVECs) w ere isolated and cultured as previously described [ 43 ]. Human em bry onic kidney (HEK293T) cells were cultured at 37 ° C in a humidiﬁed atmosphere with 5% CO2. The culture medium consisted of Dulb ecco’s Modiﬁed Eagle’s Medium (DMEM, C11995500BT, Invitrogen) supplemen ted with 10% fetal b ovine serum (FBS). Virus preparation and infection: A commercial len tiviral system (Sigma) was used to silence three 14-3-3 isoforms enco ding genes, including YWHAB, YWHAE and YWHAH. The target and control scram bled sequences w ere selected from the human shRNA library of Sigma (http://www.sigmaaldric h.com/c hina-mainland/zh/life- science/functionalgenomics- and-rnai/SHRNA/library-information.html). Preparations of lentivirus w ere made in 293T cells. Brieﬂy , 293T cells were seeded at a density of 1 × 10 4 cell s/cm 2 in 2 mL of complete growth medium and incubated for 24 hours until they reached 80–90% conﬂuency . T ransfection complexes were pre- pared by combining p oly eth ylenimine (PEI) with the target and pack aging plasmids in serum-free medium at ro om temperature. The complexes w ere then added drop- wise to the cell culture. After 5 hours of incubation, the transfection medium was replaced with fresh complete medium, and the cells were further incubated for 48 hours. Subsequently , the virus-containing sup ernatan t was collected. F or infection, HUVECs were incubated with a 1:1 mixture of viral sup ernatant and fresh medium, supplemented with p olybrene at a ﬁnal concentration of 8 µ g/mL. After 24 hours, the virus-containing medium was aspirated and replaced with standard culture medium. Single-cell RNA sequencing: Cells were harv ested at 7 da ys p ost-infection for single-cell RNA sequencing (scRNA-seq). Prior to sequencing, the kno ckdo wn eﬃ- ciency of the target gene was preliminarily v alidated by R T-qPCR. scRNA-seq was subsequen tly performed on b oth con trol and YWHA-knockdo wn groups, with all library preparation and sequencing services provided by Shanghai Biotechnology Cor- p oration (Shanghai, China). Brieﬂy , single-cell libraries were prepared using the 10x Genomics platform, where GEMs were formed to partition individual cells, enabling rev erse transcription of mRNA into cDNA tagged with cell-speciﬁc 10x Barco des and transcript-sp eciﬁc UMIs. 4.2 Prepro cessing for the Gene Perturbation Besides our priv ate datasets, we employ ed tw o additional public datasets. First, we utilized the combinatorial CRISPR screening dataset generated in 2019 [ 31 ] (referred as the Norman dataset) to comprehensively ev aluate the p erformance of the INFL on gene p erturbation task. This dataset, generated using the Perturb-seq technol- ogy , proﬁles approximately 200,000 human K562 cells (a leuk emia cell line), co vering single-gene and dual-gene kno c kdown perturbations targeting genes essential for cell gro wth and diﬀerentiation. Additionally , w e incorp orated the dataset released in 2016 18 [ 30 ] (referred as the Adamson dataset), which used Perturb-seq to proﬁle CRISPR- mediated p erturbations in the mammalian unfolded protein resp onse (UPR). By com bining single-cell RNA-seq with CRISPR barco ding, this study analyzed ab out 100 candidate genes identiﬁed from CRISPRi screens for their role in ER homeostasis, rev ealing functional gene clusters, the decoupling of UPR branches, and bifurcated activ ation states within the same p erturbation. The combination of all three datasets pro vides abundant training samples for the mo del to learn the complex, non-linear eﬀects of genetic perturbations. W e applied sp ecialized prepro cessing metho ds tailored to diﬀerent data comp o- nen ts for each dataset, including the Norman, Adamson, and our priv ate dataset. F or the single-cell gene expression count matrix, we ﬁrst split the expression data into p erturbed and control cell p opulations. The control population consists of cells that receiv ed non-targeting guide RNAs, represen ting the basal expression state of the cells without p erturbation. W e normalized the total counts for each cell to match the median of total counts across all cells, and the normalized v alues were subsequen tly log -transformed with an oﬀset of 1. In addition to the expression matrix, the gene perturbation mo del requires a gene regulatory graph as prior kno wledge inputs. W e constructed this graph based on the Gene On tology (GO) database [ 44 ]. In this graph, each gene is represen ted as a node, and an edge is established b et ween tw o genes if they co-b elong to the same GO term. This pro cess yields an undirected adjacency matrix G , where G ij = 1 if gene i and gene j are functionally related, and 0 otherwise. The matrix G is symmetric and includes self-lo ops for all no des, i.e., G ii = 1. 4.3 Prepro cessing for the Spatial Multi-omics In tegration F or the spatial proteome-transcriptome m ulti-omics in tegration task, w e utilized tw o datasets generated by the 10x Genomics Visium platform for spatial RNA and pro- tein co-proﬁling [ 45 ]: a human tonsil dataset and a human lymph no de dataset. These datasets, derived from immune-related tissues, oﬀer v aluable insigh ts into the human imm une micro en vironment. T o achiev e comprehensive in tegration, we performed b oth horizon tal integration, aligning mo dalities within the same sections to correct for tec h- nical v ariability , and mosaic integration, bridging complementary mo dalities across diﬀeren t sections to construct a uniﬁed multi-omics represen tation. W e applied distinct prepro cessing metho ds tailored to diﬀerent modalities. F or the spatial transcriptomics coun t matrix, we normalized the total count of each sp ot to matc h the median total counts across all sp ots. The normalized v alues w ere subse- quen tly log -transformed with an oﬀset of 1. W e then selected the top 3,000 highly v ariable genes (HVGs) to serve as input to the mo del [ 46 ]. F or the spatial proteomics coun t matrix, we performed the centered log ratio (CLR) transformation across spots, as deﬁned by: CLR( p ) =  log  p 1 g ( p )  , . . . , log  p n g ( p )  (1) 19 where p = ( p 1 , . . . , p n ) represen ts the count vector of protein epitop es for eac h sp ot, and g ( p ) denotes the geometric mean of v ector p . In addition to the count matrices, the model requires a spatial adjacency graph as input. W e constructed a k-nearest neighbors (kNN) graph based on the spatial co ordinates of the sp ots, with eac h sp ot represented as a no de, while the edges w ere deriv ed from the Euclidean distances b et ween the sp ots [ 47 ]. The parameter k was set to 10 by default for the tonsil data, while for the human lymphoid dataset, it w as adjusted to 2 to minimize ov er-smo othing. This yielded an undirected adjacency matrix A , where A ij = 1 if sp ot i is among the k nearest neighbors of sp ot j , and 0 otherwise. The matrix A is symmetric and includes self-lo ops, i.e., A ii = 1. 4.4 Prepro cessing for Proteomic Analysis Proteomic data were collected exclusiv ely from Cohort 1 of the ProCan Comp endium, consisting of 766 tumor samples and 494 tumor-adjacen t normal samples, deriv ed from a total of 638 patien ts [ 9 ]. All biospecimens were obtained from pathology laboratories and biobanks, including the Victorian Cancer Biobank, the Gynaecological Oncology Biobank (GynBiobank) at W estmead Hospital, and the Children’s Medical Research Institute Legacy sample set in Australia. Ethical appro v als for the collection and use of these samples w ere obtained prior to analysis. The raw DIA-MS data were pro cessed into a protein quantiﬁcation matrix, where ro ws represent samples and columns corresp ond to protein abundances. Proteins detected in fewer than 50% of samples were excluded. Missing v alues w ere imputed with zeros, and protein abundance v alues were log 2 -transformed. No cohort-level normalization was applied to av oid in tro ducing biases into the analysis. Samples w ere ﬁltered based on strict quality con trol criteria. Only those with tech- nical replicate correlations abov e 0.9 were included to ensure data reliability . Samples that failed histopathologic v alidation, exhibited tumor con tent b elow 20%, or had necrosis levels exceeding 80% were excluded from downstream analyses. In addition, data from Hepatoblastoma, Retinoblastoma, Ganglioneuroblastoma, and Rhab doid T umor samples were excluded from the analysis due to their limited sample size, whic h w as insuﬃcien t to allo w practical train–test split. 4.5 Design of Computational Exp erimen ts Baselines: W e ev aluated INFL against the traditional F edAvg algorithm [ 7 ] and three represen tative priv acy-preserving federated learning (FL) baseline metho ds, describ ed as follows: • FL : The traditional F edAvg algorithm [ 7 ], which aggregates client parameters on a cen tral serv er through simple a veraging. This serves as the foundational approac h in federated learning. • FL-DP : A priv acy-preserving v ariant of the F edAvg algorithm that incorp orates diﬀeren tial priv acy (DP) [ 15 ]. This metho d enhances the priv acy of federated learn- ing by adding noise to the mo del up dates, mitigating the risk of exp osing sensitiv e clien t information. 20 • FL-LoRA-DP : An extension of FL-DP that in tegrates low-rank adaptation (LoRA) mo dules [ 22 ] into the local mo dels. By introducing LoRA, this approach not only preserves priv acy through DP but also improv es mo del p erformance b y ﬁne-tuning mo del representations in resource-eﬃcient w ays. • PPML : A more adv anced priv acy-preserv ed PPML-Omics [ 18 ] building up on FL- LoRA-DP . It incorp orates a decentralized randomization (DR) algorithm [ 48 ] to further enhance priv acy by applying randomized transformations at a decen tralized lev el, oﬀering stronger protection while main taining mo del accuracy . These baselines pro vide a comprehensive ev aluation setup, encompassing b oth traditional and state-of-the-art priv acy-preserving tec hniques in federated learning. Data Distribution and F ederated Scenarios : W e ev aluated the INFL under three distinct data distribution scenarios: • INFL-Proteomic : The dataset was partitioned in to ﬁv e groups. Eac h of the ﬁve clien ts w as assigned one group. • INFL-P erturbation : The dataset w as partitioned into ten equal, non-o verlapping shards. Each of the ten clien ts was assigned one shard. • INFL-SpaIn tegration-Horizontal : Three clien ts were instan tiated. F rom a dataset comprising three RNA data slices, each client w as randomly assigned tw o of the three slices. This sim ulates the scenario where collab orators hav e partially o verlapping datasets. • INFL-SpaIn tegration-Mosaic : T o simulate a more complex, realistic scenario of non-I ID and multi-modal data o verlap, w e distributed data from three slices (Slice 1, 2, 3) with tw o mo dalities (RNA, ADT) among three clients as follows: – Clien t 1 : RNA from Slices 1 & 2; ADT from Slices 1 & 3. – Clien t 2 : RNA from Slices 1 & 2; ADT from Slices 2 & 3. – Clien t 3 : RNA from Slices 2 & 3; ADT from Slices 1 & 3. This conﬁguration ensures no client possesses the complete dataset, making federated collab oration essential. Implemen tation Details and Hyperparameters: All mo dels were imple- men ted using Python with the PyT orc h and PyT orch Geometric libraries and trained on NVIDIA GeF orce R TX 3090 GPUs. It is worth noting that INFL can be applied in t wo scenarios: parameter-eﬃcient ﬁne-tuning for traditional vision tasks using Vision T ransformers, as detailed in the supplementary material, and mo del pretraining, as discussed in the main manuscript. • F or INFL-Proteomic , training w as conducted for 200 global rounds with 5 clients, a clien t participation fraction of 1.0, and 50 lo cal ep ochs p er round. The Adam optimizer was used with a learning rate of 1 × 10 − 4 . The hidden size of the INR mo dule is set to 8 with 3 la yers. • F or INFL-P erturbation , training w as conducted for 200 global rounds with 10 clien ts, a client participation fraction of 0.5, and 2 lo cal ep ochs p er round. The Adam optimizer was used with a learning rate of 5 × 10 − 3 . The hidden size of the INR mo dule is set to 8 with 3 la yers. 21 • F or INFL-SpaIn tegration , training ran for 50 global rounds with 3 clients, a clien t participation fraction of 1.0, and 2 lo cal ep o c hs p er round. The Adam optimizer w as use d with a learning rate of 10 − 3 . The hidden size of the INR mo dule is set to 8 with 3 la yers. • F or DP settings , we used a gradient clipping norm of C = 1 . 0, a target delta of δ = 10 − 5 , and noise m ultipliers of σ = 1 . 29 (DP-series) and σ = 2 . 36 (PPML) [ 18 ]. • F or the LoRA settings , we set the rank to 4 and the scaling parameter α to 1.0. The LoRA weigh ts are initialized using Kaiming initialization [ 49 ], which ensures stable training by adjusting the v ariance of the weigh ts based on the num b er of input units. 4.6 Implicit Neural F ederated Learning Proto col and Mo del Encryption T o enable collab orativ e mo del developmen t on sensitive, decentralized datasets, we dev elop ed Implicit Neural F ederated Learning (INFL), a metho d that integrates a priv acy-preserving training proto col with a robust mechanism for in tellectual property (IP) protection. F or the priv acy-preserving comp onen t, INFL utilizes the F ederated Av eraging ( FedAvg ) algorithm to train a global model across a netw ork of clien ts without centralizing their priv ate data. The pro cess is organized into discrete global comm unication rounds, indexed by t ∈ { 1 , . . . , T } , and pro ceeds as follows: 1. Initialization : The central server initializes a global mo del, M 0 G , with randomly initialized parameters. 2. Clien t Selection : At the start of eac h round t , the server selects a subset of clien ts, S t , comprising a fraction C of the total K a v ailable clients. 3. Model Distribution : The server transmits the current global mo del parameters, M t − 1 G , to all selected clients k ∈ S t . 4. Local T raining : Eac h clien t k p erforms local training on its priv ate dataset D k for E ep o c hs. The client up dates the model parameters b y minimizing a task-sp eciﬁc ob jective function using sto c hastic gradient descent, yielding a lo cal model up date M t k . 5. Model Aggregation : All participating clien ts in S t transmit their updated param- eters M t k to the server. The server then aggregates these lo cal models to compute the new global model M t G b y a veraging their parameters: M t G = 1 | S t | X k ∈ S t M t k (2) While the federated proto col protects the training data, the resulting global mo del itself constitutes v aluable IP . T o secure it against unauthorized use, we developed a nov el, co ordinate-based encryption sc heme built up on Implicit Neural Representa- tions (INRs). This metho d embeds a secret k ey directly into the mo del’s architecture, rendering the parameters non-functional without it. The core of this approac h is the replacemen t of standard fully-connected la yers ( nn.Linear ) in the mo del’s deco der with a custom INRLinear mo dule. A standard linear lay er computes its output as y = Wx + b . Our INRLinear mo dule mo diﬁes this b y incorp orating a mo dulation 22 term, ∆ ∈ R N out , generated b y a small MLP known as the INR net work, Φ θ . The ﬁnal la yer output y ′ is a balanced com bination: y ′ = α ( Wx + b ) + (1 − α ) ∆ (3) where α is a hyperparameter. The encryption is em b edded in the generation of ∆ . W e introduce a secret key , π , which is a random p erm utation of the output indices { 0 , 1 , . . . , N out − 1 } . F or each output neuron i , its co ordinate c ′ i is derived from this secret p erm utation, not its natural index: c ′ i = 2 π ( i ) N out − 1 − 1 , for i ∈ { 0 , 1 , . . . , N out − 1 } (4) These k ey-dep enden t coordinates are then mapped to a high-dimensional feature space using a sinusoidal positional enco ding function, γ ( · ), to capture high-frequency details: γ ( c ) =  sin(2 0 π c ) , cos(2 0 π c ) , . . . , sin(2 L − 1 π c ) , cos(2 L − 1 π c )  (5) The INR netw ork Φ θ tak es these enco ded co ordinates as input to pro duce the mo d- ulation for eac h neuron: ∆ i = Φ θ ( γ ( c ′ i )). During training, the en tire model learns to p erform its task conditioned on the co ordinate system deﬁned by π . An authorized user, p ossessing b oth the mo del parameters and the key , can generate the correct mo dulation ∆ for v alid predictions. Conv ersely , an attac ker with only the parameters w ould b e forced to use a default p erm utation, feeding scrambled co ordinates to the INR, resulting in a meaningless mo dulation and a corrupted, non-functional mo del output. Th us, INFL achiev es b oth data priv acy during training and IP protection for the ﬁnal model. 5 INFL Mo del Arc hitectures INFL-P erturbation Model Arc hitecture: The foundation for our p erturbation prediction exp eriments is based on a Graph Neural Net work (GNN) designed to pre- dict transcriptomic resp onses to genetic p erturbations. The mo del, which uses a hidden dimension of 64, utilizes t wo separate GNNs. First, a 1-la yer Simple Graph Con volu- tion (SGC) netw ork op erates on a gene co-expression graph to learn p ositional gene em b eddings. This graph is constructed b y connecting genes with a P earson correlation greater than 0.4, k eeping up to 20 neigh b ors per gene. Second, a parallel 1-lay er SGC net work processes a Gene On tology (GO) similarit y graph (connecting up to 20 most similar genes) to learn embeddings for p erturbations. T o predict the outcome of a sp e- ciﬁc p erturbation, the mo del adds the learned p erturbation embedding to the basal gene em b eddings. This com bined representation is then pro cessed b y a hierarchical deco der, which comprises a shared MLP and t wo subsequent gene-sp eciﬁc linear la y- ers, to generate the ﬁnal post-p erturbation expression vector. The mo del is trained by minimizing the discrepancy betw een prediction and ground-truth expression proﬁles. INFL-SpaIn tegration Mo del Architecture: F or spatial transcriptomics inte- gration, we emplo y ed a multi-lev el graph construction strategy and a W eigh ted Graph 23 Con volutional Netw ork (WLGCN) enco der. Intra-modality graphs are built by con- necting sp ots within a spatial radius of 2000 units or based on the 10 nearest neighbors. T o bridge diﬀeren t mo dalities and batches, the mo del identiﬁes the 10 mutual nearest neigh b ors (MNNs) in the PCA-reduced expression space, assigning these in ter-graph edges a w eigh t of 0.8. The core of the mo del is the WLGCN, whic h acts as an enco der. The forw ard pass proceeds as follows: (1) Principal Comp onen t Analysis (PCA)-reduced expres- sion proﬁles serve as initial no de features. (2) A series of 8 WLGCN lay ers p erform message passing, correctly accounting for edge w eights to diﬀeren tiate b et ween spatial and MNN connections. The outputs from the initial features and all subsequent lay ers are concatenated to form a multi-scale feature represen tation. (3) This representation is passed through a fully connected la yer pro jecting to a hidden dimension of 512, fol- lo wed b y batch normalization, a LeakyReLU activ ation with a negative slop e of 0.2, and drop out with a probabilit y of 0.2 to pro duce a lo w-dimensional latent em b ed- ding. (4) The ﬁnal embedding is L2-normalized for use in downstream analyses. A parallel decoder mo dule, conﬁgured b y default as a single linear la yer, reconstructs the initial no de features from this latent embedding, enabling the computation of a reconstruction loss for model training. INFL-Proteomic Mo del Architecture: The foundation of our proteomic clas- siﬁcation framework is built on a neural netw ork mo del designed to classify proteomic proﬁles into distinct cancer subtypes. The model employs a mo dular architecture that incorp orates em b edding, residual learning, and hierarc hical decoding lay ers to capture the high-dimensional and complex nature of proteomic data [ 9 ]. The mo del b egins with an em b edding la yer, a linear transformation that pro jects the input proteomic features into a hidden feature space of dimension 64. This rep- resen tation is then passed through tw o sequential residual blo c ks, each designed to enhance feature extraction while preserving the original input information. Within eac h residual blo c k, tw o fully connected la yers are interlea ved with non-linear activ a- tion functions ( ReLU ), batc h normalization (or lay er normalization, dep ending on the v arian t), and drop out lay ers to preven t o verﬁtting. A residual connection is applied to ensure stable gradien t propagation, with the output of eac h blo c k normalized and summed with the input. The output of the second residual block is further processed by a hierarchical deco der, consisting of tw o fully connected lay ers. The ﬁrst la yer reduces the dimen- sionalit y of the learned features to 32, follo wed b y a second lay er that outputs predictions corresponding to the n umber of target classes 15. The deco der incorp orates drop out regularization and a non-linear activ ation ( ReLU ) to ensure robust feature transformation and classiﬁcation. The model is trained by minimizing the cross-entrop y loss b et w een the predicted and true class lab els, using the Adam optimizer for parameter up dates. The architec- ture’s mo dular design, with residual connections and hierarc hical deco ding, ensures eﬀectiv e learning from high-dimensional proteomic data while maintaining stabilit y during training. 24 5.1 Ev aluation and Metrics Mo del performance was assessed using a combination of metrics tailored to each task. F or the classiﬁcation tasks, we adopted the metrics below to ev aluation the p erformance: • Classiﬁcation Accuracy : The prop ortion of correctly classiﬁed samples among all test samples, measuring the ov erall predictive accuracy of the mo del across all cancer subtypes. It is deﬁned as: Accuracy = Num b er of Correct Predictions T otal Number of Samples • F1-Score : The harmonic mean of precision and recall, computed for each cancer subt yp e and a veraged (macro-F1) to assess the model’s abilit y to balance false p ositiv es and false negativ es across all classes. F or each class, the F1-score is deﬁned as: F1 = 2 · Precision · Recall Precision + Recall where: Precision = T rue Positiv es T rue Positiv es + F alse P ositives , Recall = T rue Positiv es T rue Positiv es + F alse Negativ es • Area Under the Receiver Op erating Characteristic Curv e (A UC) : The A UC is calculated for each cancer subtype in a one-vs-rest setting and av eraged (macro-A UC) to ev aluate the mo del’s abilit y to discriminate b et ween classes based on predicted probabilities. • Macro-Av eraged A UROC : The a verage of the AUR OC v alues computed for eac h cancer subt yp e in a one-vs-rest setup, providing an ov erall measure of the mo del’s abilit y to distinguish b et ween all cancer subtypes. It is deﬁned as: Macro-Av eraged A UROC = 1 C C X c =1 A UROC c where C is the total num b er of cancer subt yp es, and A UROC c is the A UROC for eac h class c . • SHAP (SHapley Additive exPlanations) V alues : SHAP v alues quan tify the contribution of eac h protein feature to individual cancer t yp e predictions b y fairly distributing the diﬀerence b et w een the mo del’s output and exp ected baseline across all features. Based on co op erativ e game theory , SHAP v alues satisfy desirable prop erties including eﬃciency , symmetry , dummy feature, and additivity . It is calculated as: ϕ j ( f , x ) = X S ⊆ F \{ j } | S | !( | F | − | S | − 1)! | F | ! [ f ( S ∪ { j } ) − f ( S )] 25 where ϕ j ( f , x ) is the SHAP v alue for protein feature j , F is the set of all protein features, S is a subset of features excluding j , f ( S ) is the model’s exp ected output giv en feature subset S , and the sum is ov er all p ossible subsets S of features not including j . F or the prediction tasks (i.e., INFL-P erturbation), we need to ev aluate the predictiv e performance, where the following metrics are used: • Ov erall Mean Squared Error (MSE) : The MSE b et ween predicted ( ˆ y g ) and true ( y g ) expression v alues across all G genes, measuring global prediction accuracy . It is deﬁned as: MSE = 1 G G X g =1 ( ˆ y g − y g ) 2 • MSE on DE genes with opp osite direction of change (MSE de ) : The MSE computed exclusiv ely on the top 20 most diﬀerentially expressed (DE) genes for a giv en p erturbation where the predicted expression c hanges in the opp osite direc- tion of the true c hange. This metric assesses the mo del’s abilit y to av oid incorrect directional predictions for k ey biological signals. It is deﬁned as: MSE de = 1 | G opp | X g ∈ G opp ( ˆ y g − y g ) 2 where G opp is the set of top 20 DE genes for which the predicted c hange is in the opp osite direction of the true change, i.e., ( ˆ y g − y g ) · y g < 0, and | G opp | is the n umber of suc h genes. • F raction of top 20 diﬀeren tially expressed genes with opp osite prediction direction (De op frac) : The p ercentage of the top 20 most diﬀerentially expressed genes that are predicted to change expression in the opp osite direction compared to the true direction of change. This metric identiﬁes cases where the mo del not only fails to predict the correct magnitude but also predicts the wrong regulatory direction. It is calculated as: De op frac = 1 N N X i =1 1 20 X j ∈ T op20 DE I [sign(∆ y ij )  = sign(∆ ˆ y ij )] where ∆ y ij and ∆ ˆ y ij are the true and predicted expression changes for gene j in sample i , and I [ · ] is the indicator function. • Ov erall P earson Correlation ( ρ ) : The P earson correlation betw een the vectors of mean predicted and mean true gene expression, measuring the preserv ation of linear relationships in the expression proﬁles. It is deﬁned as: ρ = P G g =1 ( ˆ y g − ¯ ˆ y )( y g − ¯ y ) q P G g =1 ( ˆ y g − ¯ ˆ y ) 2 q P G g =1 ( y g − ¯ y ) 2 where ¯ ˆ y and ¯ y are the mean predicted and true expression v alues, resp ectiv ely . 26 • P earson correlation on DE genes with correct direction of c hange (P earson de ) : The Pearson correlation co eﬃcien t computed on the top 20 most diﬀeren tially expressed (DE) genes for a giv en p erturbation where the predicted expression changes in the **same direction** as the true c hange. This metric assesses the mo del’s abilit y to capture the correct trend of biological signals. It is deﬁned as: P earson de = Co v( y g , ˆ y g ) σ y g σ ˆ y g where: – G correct is the set of top 20 DE genes for which the predicted change is in the same direction as the true c hange, i.e., ( ˆ y g − y g ) · y g > 0. – Co v( y g , ˆ y g ) is the cov ariance betw een the true expression v alues ( y g ) and predicted v alues ( ˆ y g ) for genes in G correct . – σ y g and σ ˆ y g are the standard deviations of the true and predicted expression v alues, resp ectiv ely , for genes in G correct . • P earson correlation on Delta Expression (Pearson ∆ ) : The Pearson correla- tion co eﬃcien t computed b etw een the **predicted change** in p ost-p erturbation gene expression relative to the unp erturbed control expression and the **true c hange** in p ost-p erturbation gene expression relative to the con trol. This met- ric ev aluates the model’s ability to capture the relative changes in gene expression induced by p erturbations. It is deﬁned as: P earson delta = Co v(∆ ˆ y g , ∆ y g ) σ ∆ ˆ y g σ ∆ y g where: – ∆ ˆ y g = ˆ y g − ˆ y g , con trol is the predicted change in gene expression for gene g after p erturbation relativ e to the control. – ∆ y g = y g − y g , con trol is the true c hange in gene expression for gene g after p erturbation relativ e to the control. – Co v(∆ ˆ y g , ∆ y g ) is the co v ariance b et ween predicted and true c hanges in gene expression. – σ ∆ ˆ y g and σ ∆ y g are the standard deviations of the predicted and true changes, resp ectiv ely . F or the task where the eﬀectiveness of data in tegration is the key (i.e., INFL- SpaIn tegration), we adopt the following ev aluation metrics for computing data in tegration eﬃciency: • Biological Structure Preserv ation (ARI) : The Adjusted Rand Index (ARI) compares the clustering of the in tegrated embeddings ( C ) against ground-truth cell t yp e lab els ( T ), where an ARI score close to 1 signiﬁes excellen t preserv ation. It is 27 deﬁned as: ARI = P i,j  n ij 2  − h P i  a i 2  P j  b j 2  i /  n 2  1 2 h P i  a i 2  + P j  b j 2  i − h P i  a i 2  P j  b j 2  i /  n 2  where n ij is the n um b er of samples in b oth cluster i and ground-truth j , a i is the size of cluster i , b j is the size of ground-truth j , and n is the total n um b er of samples. • Normalized Mutual Information (NMI) : The Normalized Mutual Information (NMI) quantiﬁes the agreemen t b et w een the clustering of in tegrated em b eddings ( C ) and ground-truth lab els ( T ). NMI is normalized to a range of [0, 1], where 1 indicates p erfect alignment. It is deﬁned as: NMI = 2 · I ( C ; T ) H ( C ) + H ( T ) where I ( C ; T ) is the mutual information b et ween C and T , and H ( C ) and H ( T ) are the entropies of C and T , resp ectiv ely . • Adjusted Mutual Information (AMI) : The Adjusted Mutual Information (AMI) adjusts the raw mutual information to correct for c hance, pro viding a more robust comparison of clustering quality . Like NMI, AMI ranges from 0 to 1, with higher v alues indicating better alignment. It is deﬁned as: AMI = I ( C ; T ) − E [ I ( C ; T )] max( H ( C ) , H ( T )) − E [ I ( C ; T )] where E [ I ( C ; T )] is the expected m utual information under random clustering. • Batc h Eﬀect Remov al (HOM) : The Homogeneity (HOM) metric quantiﬁes the abilit y to remo ve batch eﬀects while main taining biological signal. HOM is calculated using the entrop y of batc h lab el distributions within clusters. A low er HOM score indicates b etter batch mixing, while preserving biological structure. It is deﬁned as: HOM = − 1 C C X c =1 B X b =1 p cb log( p cb ) where C is the num ber of clusters, B is the n um b er of batches, and p cb is the prop ortion of batc h b samples in cluster c . A lo wer HOM score reﬂects b etter batch eﬀect remov al with minimal disruption of biological structure. 5.2 Biological Analysis and In terpretation of Mo del Outputs Analysis of INFL-Proteomic: T o interpret the contributions of individual pro- tein features to the model’s predictions, we emplo yed SHapley Additive exPlanations (SHAP), a game-theory-based framework for explaining machine learning mo del out- puts. Sp eciﬁcally , w e used the shap.GradientExplainer , which lev erages the mo del’s gradien t information to eﬃciently appro ximate Shapley v alues for eac h input feature. 28 The input feature matrix, comp osed of protein expression data, was passed through a trained federated learning model in ev aluation mode. SHAP v alues were computed to quan tify the marginal contribution of each protein feature to the predicted p ost- p erturbation cancer t yp e classiﬁcation relative to a control baseline. This analysis enabled the identiﬁcation of key protein features driving the mo del’s predictions and pro vided insigh ts into their biological relev ance. T o interpret the classiﬁcation results for eac h cancer type, w e selected the top ﬁve proteins with the greatest contributions and visualized them using b eeswarm plots. This allow ed us to elucidate the magni- tude and direction (p ositive or negativ e correlation) of the asso ciation b et w een each protein and the cancer classiﬁcation. W e also searched literature evidence to supp ort our observ ation results. Analysis of INFL-Perturbation: W e used the gears.plot perturbation func- tion to visualize the actual expression changes (display ed as box plots) of the top 20 diﬀeren tial genes under a sp eciﬁc p erturbation condition, along with the mean change in gene expression predicted b y diﬀeren t methods. T o quantitativ ely c haracterize the prediction p erformance, we in tro duced the hit rate metric. A prediction is considered accurate if the mean change in gene expression predicted by a metho d falls within the range of the b o x plot; the ov erall prediction accuracy for the 20 genes is then calculated as the hit rate. This can b e expressed by the formula: Hit rate = Num b er of correctly predicted genes T otal num b er of genes (generally 20) Analysis of INFL-SpaIntergration: After mo del integration to obtain the em b eddings, w e p erformed clustering using Leiden algorithm, implemented via the Scanpy pack age [ 50 ], and annotated each domain with a name. By comparing cluster- ing results from diﬀerent metho ds ov erlaid with the ground truth on the same can v as, the qualitative accuracy of clustering was assessed. W e used the sc.pl.embedding function to visualize the clustering results. T o reveal the biological signiﬁcance of the clusters, we identiﬁed mark er genes for each domain using sc.rank genes groups , visualized their spatial distributions, and v alidated whether these mark er genes are indeed sp eciﬁcally expressed in the corresp onding regions with supp ort from the literature. 5.3 Theoretical Analysis of the INR Encryption Mec hanism W e provide a formal analysis to demonstrate that the INRLinear mo dule, conditioned on a secret permutation key π , functions as a cryptographic lo ck. W e sho w that without kno wledge of π , the mo del’s output is mathematically equiv alen t to adding a high- v ariance, structured noise term, rendering the mo del non-functional. Deﬁnition 1 (Model Output) . L et an INRLinear layer b e p ar ameterize d by its b ase weights W , b , the INR network Φ θ , and a se cr et p ermutation key π over the indic es { 0 , 1 , . . . , N out − 1 } . F or an input x , the output y ′ ∈ R N out is given by: y ′ i = α ( Wx + b ) i + (1 − α ) ∆ i (6) 29 wher e the mo dulation term ∆ i is gener ate d using the se cr et key π : ∆ i = Φ θ  γ  2 π ( i ) N out − 1 − 1  (7) Prop osition 1 (Unauthorized Access) . A n unauthorize d p arty p ossesses the mo del p ar ameters ( W , b , θ ) but lacks the se cr et key π . The most r ational str ate gy for the attacker is to assume a default, or identity, p ermutation, π A ( i ) = i . Under this assumption, the attack er computes an output, which w e denote y ′ A , using π A . The attac k er’s computed mo dulation term, ∆ A , is therefore: ( ∆ A ) i = Φ θ  γ  2 π A ( i ) N out − 1 − 1  = Φ θ  γ  2 i N out − 1 − 1  (8) The resulting output computed by the attack er is: ( y ′ A ) i = α ( Wx + b ) i + (1 − α )( ∆ A ) i (9) T o quantify the functional diﬀerence, we analyze the error vector ϵ = y ′ − y ′ A . The error for the i -th output neuron is: ϵ i = ( y ′ i ) − ( y ′ A ) i (10) = [ α ( Wx + b ) i + (1 − α ) ∆ i ] − [ α ( Wx + b ) i + (1 − α )( ∆ A ) i ] (11) = (1 − α ) ( ∆ i − ( ∆ A ) i ) (12) The core of the encryption lies in the relationship b et ween the true mo dulation ∆ and the attac ker’s computed mo dulation ∆ A . Let us examine the comp onen ts. The true modulation for neuron i uses the co ordinate derived from π ( i ). The attack er’s mo dulation for neuron i uses the co ordinate derived from i . W e can deﬁne a mapping for the co ordinate generation from C ( j ) = 2 j N out − 1 − 1: ∆ i = Φ θ ( γ ( C ( π ( i )))) (13) ( ∆ A ) i = Φ θ ( γ ( C ( i ))) (14) Notice that the set of all coordinates used is the same for both the authorized user and the attack er: { C (0) , C (1) , . . . , C ( N out − 1) } . How ever, the k ey π shuﬄes the assignmen t of these coordinates to the output neurons. W e can deﬁne a new v ector ∆ ∗ whose j -th comp onen t is the modulation generated b y the j -th canonical coordinate: ∆ ∗ j = Φ θ ( γ ( C ( j ))) (15) Using this deﬁnition, w e can express b oth ∆ and ∆ A more clearly: ∆ i = ∆ ∗ π ( i ) (16) 30 ( ∆ A ) i = ∆ ∗ i (17) This rev eals that the attack er’s mo dulation vector ∆ A is simply the canonical modu- lation v ector ∆ ∗ . The authorized user’s modulation vector ∆ is a permutation of ∆ ∗ (or equiv alently , of ∆ A ) according to the secret k ey π . Sp eciﬁcally , ∆ is obtained by applying the permutation π to the indices of the elements of ∆ A . Substituting this bac k into the error term ϵ i : ϵ i = (1 − α )  ∆ ∗ π ( i ) − ∆ ∗ i  (18) The error at output i is proportional to the diﬀerence betw een the modulation v alue that should be at index π ( i ) and the mo dulation v alue that should b e at index i . Since π is a random p erm utation, for a large N out , π ( i )  = i with high probability . The INR netw ork Φ θ , com bined with the sinusoidal p ositional encoding γ , is trained to b e a high-frequency function that maps sp eciﬁc co ordinates to sp eciﬁc mo dulation v alues required for the task. The v alues in ∆ ∗ are therefore highly structured and non-uniform. The term ∆ ∗ π ( i ) − ∆ ∗ i represen ts the diﬀerence b et ween tw o distinct, quasi-randomly chosen comp onen ts from the learned mo dulation v ector. Assuming the comp onen ts of ∆ ∗ are learned v alues with zero mean ( E [ ∆ ∗ j ] = 0) and v ariance σ 2 ∆ , the expected v alue of the error at an y given neuron is: E [ ϵ i ] = (1 − α )  E [ ∆ ∗ π ( i ) ] − E [ ∆ ∗ i ]  = 0 (19) Ho wev er, the expected squared error (v ariance) is substantial. Assuming ∆ ∗ π ( i ) and ∆ ∗ i are uncorrelated for i  = π ( i ): E [ ϵ 2 i ] = (1 − α ) 2 E [( ∆ ∗ π ( i ) − ∆ ∗ i ) 2 ] (20) = (1 − α ) 2  E [( ∆ ∗ π ( i ) ) 2 ] − 2 E [ ∆ ∗ π ( i ) ∆ ∗ i ] + E [( ∆ ∗ i ) 2 ]  (21) ≈ (1 − α ) 2 ( σ 2 ∆ + σ 2 ∆ ) = 2(1 − α ) 2 σ 2 ∆ (22) This demonstrates that the attack er’s output y ′ A is corrupted by an additive, zero- mean error term with a v ariance prop ortional to the v ariance of the learned modulation signal. This error term is not random noise but a deterministic scrambling of the necessary correction signal. The scrambling op eration, dictated b y the unknown p er- m utation π , eﬀectiv ely decouples the corrective mo dulation from its intended neuronal target, corrupting the ﬁnal output and rendering the mo del’s predictions meaningless. Th us, the secret k ey π acts as a functional lo c k on the mo del, providing robust IP protection. Extreme Case Analysis: Inference without the Mo dulation Netw ork W e now analyze a more severe scenario of unauthorized access, where an attac ker p ossesses the base mo del weigh ts ( W , b ) but has no access to the parameters θ of the INR netw ork Φ θ . This represents a situation where the IP protection mechanism is completely remov ed. In this case, the attack er is unable to compute the mo dulation term ∆ at all. The most logical course of action for the attac ker is to treat the 31 INRLinear lay er as a scaled standard linear lay er, eﬀectively setting the modulation term to zero. Prop osition 2 (Inference without INR Parameters) . A n unauthorize d p arty p ossesses the b ase weights ( W , b ) but not the INR p ar ameters θ . The attacker’s c ompute d output for the layer, denote d y ′ A , is: ( y ′ A ) i = α ( Wx + b ) i (23) This is b e c ause the term (1 − α ) ∆ i c annot b e c ompute d and is ther efor e omitte d. The correct output y ′ i , as computed by an authorized user with the k ey π and the INR netw ork Φ θ , remains: y ′ i = α ( Wx + b ) i + (1 − α ) ∆ i (24) where ∆ i = Φ θ ( γ ( C ( π ( i )))). W e can now directly compute the error v ector ϵ = y ′ − y ′ A resulting from the absence of the INR netw ork. The error for the i -th output neuron is: ϵ i = ( y ′ i ) − ( y ′ A ) i (25) = [ α ( Wx + b ) i + (1 − α ) ∆ i ] − [ α ( Wx + b ) i ] (26) = (1 − α ) ∆ i (27) This result is critically imp ortan t. The error in the attack er’s computation is not a complex, scram bled signal as in the previous case; it is directly prop ortional to the mo dulation signal ∆ itself. This rev eals the fundamental role of the INR during training. The optimization process does not treat the base linear transformation and the INR mo dulation as indep endent. Instead, it co-adapts them to solv e the task join tly . The base w eights ( W , b ) are trained to produce an ”incomplete” or ”biased” output, with the full exp ectation that the INR netw ork will provide the necessary , precisely structured correction signal ∆ to arriv e at the ﬁnal, correct output. Let the ideal, task-solving output of the lay er b e y ideal . During training, the en tire la yer is optimized suc h that y ′ ≈ y ideal . Therefore: α ( Wx + b ) + (1 − α ) ∆ ≈ y ideal (28) The attack er, by computing only y ′ A = α ( Wx + b ), is eﬀectiv ely computing: y ′ A ≈ y ideal − (1 − α ) ∆ (29) The attac k er’s output is systematically biased a wa y from the ideal output b y the exact amoun t of the missing correctiv e signal. The term (1 − α ) ∆ is not random noise; it is a vital comp onen t of the learned function. Its absence guaran tees a functional failure. W e can quan tify the magnitude of this failure by analyzing the exp ected squared error. Using the canonical mo dulation vector ∆ ∗ deﬁned previously , we hav e ∆ i = 32 ∆ ∗ π ( i ) . The expected squared error at neuron i is: E [ ϵ 2 i ] = E [((1 − α ) ∆ i ) 2 ] (30) = (1 − α ) 2 E [( ∆ ∗ π ( i ) ) 2 ] (31) Assuming that the p ermutation π is chosen uniformly at random, the exp ectation o ver the choice of π for a giv en i is equiv alent to av eraging ov er all p ossible indices j ∈ { 0 , . . . , N out − 1 } . Let σ 2 ∆ b e the v ariance of the comp onents of ∆ ∗ (assuming zero mean for simplicit y). E π [ E [ ϵ 2 i ]] = (1 − α ) 2 1 N out N out − 1 X j =0 ( ∆ ∗ j ) 2 = (1 − α ) 2 σ 2 ∆ (32) The resulting error has a substantial, non-zero v ariance that is directly dep enden t on the magnitude of the learned modulation signal. Since the model relies on this signal to function, σ 2 ∆ will b e signiﬁcan tly greater than zero. Therefore, completely removing the INR netw ork is equiv alent to remo ving a core computational block of the model, leading to a systematic and catastrophic collapse in p erformance. The base model on its o wn is not merely a degraded v ersion of the full model; it is functionally incomplete and incapable of performing the learned task. Resistance to gradient-based attac ks in federated training. Beyond the no-k ey inference settings, we further analyze the case where an adversary observ es (or ev en controls) gradients during federated learning. Let a client hold a mini-batch B and consider one INRLinear la yer with parameters ( W , b , θ ) and secret p erm utation π . F or an input x , the la yer output is: y ′ ( x ) = α ( Wx + b ) + (1 − α ) ∆ ( π ) , ∆ i ( π ) = Φ θ ( γ ( C ( π ( i )))) , (33) with C ( j ) = 2 j N out − 1 − 1. Let ℓ ( x , t ) b e the sample loss and L = 1 |B| P ( x , t ) ∈B ℓ ( x , t ) the batch loss. W e compare the true gradient under the secret k ey π and the adversary’s sur- rogate gradient computed under an iden tity-k ey assumption π A ( i ) = i . Denote by g = ∇ θ L ( π ) and g A = ∇ θ L ( π A ) the corresponding gradients w.r.t. INR parameters, and similarly ∇ W L ( π ) vs. ∇ W L ( π A ) for the base weigh ts. Key observ ation (gradient p erm utation mismatch). By the c hain rule, ∂ L ( π ) ∂ θ = X ( x , t ) ∈B N out − 1 X i =0 ∂ ℓ ∂ y ′ i ( x , t ) | {z } task gradient · (1 − α ) ∂ Φ θ ( γ ( C ( π ( i )))) ∂ θ | {z } INR Jacobian at C ( π ( i )) . (34) An adversary who assumes π A computes instead ∂ L ( π A ) ∂ θ = X ( x , t ) ∈B N out − 1 X i =0 ∂ ℓ ∂ ˜ y i ( x , t ) · (1 − α ) ∂ Φ θ ( γ ( C ( i ))) ∂ θ , (35) 33 where ˜ y is computed with π A . The sets of coordinates { C ( π ( i )) } and { C ( i ) } are iden tical, but their assignment to output indices i is permuted. Assuming (i) E [ ∂ ℓ/∂ y ′ i ] = 0 at stationarity and (ii) for i  = j , the task gradients and INR Jacobians at diﬀeren t co ordinates are weakly correlated (a standard assumption for high-frequency INR features), we obtain: E h   g − g A   2 2 i = (1 − α ) 2 E "    X i ∂ ℓ ∂ y ′ i  ∂ θ Φ θ ( γ ( C ( π ( i )))) − ∂ θ Φ θ ( γ ( C ( i )))     2 2 # ≈ (1 − α ) 2 X i E   ∂ ℓ ∂ y ′ i  2  E h ∥ ∂ θ Φ θ ( γ ( C ( π ( i )))) − ∂ θ Φ θ ( γ ( C ( i ))) ∥ 2 2 i . (36) Because π is a random p erm utation, with high probability π ( i )  = i , and for high- frequency INRs the Jacobians at distinct coordinates behav e like high-v ariance, w eakly correlated features. Hence E h ∥ ∂ θ Φ θ ( γ ( C ( π ( i )))) − ∂ θ Φ θ ( γ ( C ( i ))) ∥ 2 2 i ≳ 2 σ 2 J , (37) where σ 2 J denotes the per-co ordinate Jacobian v ariance. Substituting in to ( 36 ) yields E h   g − g A   2 2 i ≳ 2(1 − α ) 2 σ 2 J X i E   ∂ ℓ ∂ y ′ i  2  , (38) whic h is strictly p ositiv e unless all task gradients v anish. Therefore, the adversary’s surrogate gradient is systematic al ly biase d relative to the true gradien t. Implications for gradient leak age and mo del inv ersion. Common federated attac ks (e.g., gradient matching, mo del in v ersion) rely on the ﬁdelity of observ ed gradien ts to the true per-example gradients. F rom ( 34 )– ( 38 ), an y gradien t constructed using the wrong key (or assuming iden tity) replaces the correct p er-neuron alignment with a permutation-mismatc hed one. Consequen tly: • The attack er’s p er-example gradients are scrambled b y an unkno wn p ermutation at the INR in terface, breaking the one-to-one correspondence betw een output-residuals and INR coordinates required for gradient matching. • The expected cosine similarity E [ ⟨ g , g A ⟩ / ( ∥ g ∥ ∥ g A ∥ )] is driv en to w ard 0 under w eak- correlation assumptions, degrading reconstruction attacks. • Ev en if the attack er up dates θ using g A , the up date direction deviates from the true descent direction, yielding optimization failure or con vergence to a suboptimal, non-functional mo del. An analogous argument holds for base w eights ( W , b ): via the chain rule, their gradien ts inherit the same p erm utation mismatch through the error signal bac kprop- agated from the INR branch, yielding a non-v anishing gradient gap E  ∥∇ W L ( π ) − ∇ W L ( π A ) ∥ 2  under the same conditions. 34 5.4 Statistics and Repro ducibilit y F or all exp erimen ts, data were randomly selected from public or priv ate datasets and no statistical metho ds were used to predetermine sample sizes. In addition, for the ease of the exp erimen ts, we leverage the co ordinate inputs generated according to the shape of the w eight tensor as the meta learners input. T o ensure repro ducibilit y , all mo del training pro cesses w ere conducted with ﬁxed random seeds (1 for INFL- P erturbation, 1234 for INFL-SpaIntegration, and 0 for Proteomic). All co de and exp erimen tal conﬁgurations are a v ailable up on reasonable request. Additionally , w e conducted an ablation study to assess the priv acy-preserving capabilities of INFL. Notably , when unauthorized attac kers input random co ordinates without the correct k ey , the mo del completely collapsed, outputting N/A and fail- ing to generate any meaningful results. F urthermore, under a more extreme scenario where the INR mo dule w as remov ed during inference ( Figure 2 g ), the mo del’s accu- racy dropp ed signiﬁcan tly , falling far b elo w PPML and other baselines. These ﬁndings underscore the imp ortance of INFL’s key-conditioned mec hanism in ensuring robust priv acy protection while main taining reliable performance. A detailed theoretical anal- ysis is provided in Section 5.3 to demonstrate how INFL retains its priv acy-preserving capabilities under suc h extreme circumstances. 6 Data Av ailabilit y The data used in this work were partly obtained from the public dataset, do wnloaded according to the instructions provided in each corresp onding reference, and partly collected by ourselves. W e also upload the collection of the self-collected data for repro duction in https://doi.org/10.6084/m9.ﬁgshare.30763670 . 7 Co de Av ailabilit y Co de to repro duce the exp erimen ts in this work or to compress your own data can be found at h ttps://gith ub.com/RoyZry98/INFL- Pytorc h . 8 Ac kno wledgemen ts 9 Author Con tributions Statemen t R.Z. designed the main methodology , performed the primary exp erimen ts, and wrote the original draft. H.D. and G.D. con tributed to parts of the inv estigation, algorithm dev elopment, and writing. S.Z., Y.Z., A.C., and X.C. con tributed to parts of the exp erimen ts. Z.Q., J.L., and P .L. assisted with data collection, curation and pro vided guidance on the biomedical application and man uscript editing. Y.D., X.X., J.C., and S.Z. sup ervised the research, acquired funding, administered the pro ject, and were resp onsible for reviewing and editing the ﬁnal man uscript. All authors reviewed and appro ved the ﬁnal man uscript. 35 10 Comp eting In terests Statemen t The authors declare no comp eting interests. 36 App endix A Supplemen tary Materials A.1 Supplemen tary Figure 1 W e conducted a comprehensive ev aluation of INFL on four canonical vision scenarios: (i) ﬁne-grained classiﬁcation on Stanford Cars and Stanford Dogs [ 51 , 52 ], (ii) coarse- grained classiﬁcation on CIF AR-100 [ 53 ], (iii) ob ject coun ting on CLEVR [ 54 ], and (iv) mono cular distance estimation using KITTI [ 55 ]. W e compared INFL against the four baselines introduced in the main text and further included a homomorphic-encryption v arian t (FL-HE) instantiated on a Vision T ransformer (ViT) backbone [ 56 ]. Unlik e the pretraining proto col used elsewhere in this pap er, here we adopt a parameter-eﬃcient ﬁnetuning regime based on linear probing (LP) [ 57 ] as a standard PEFT setting [ 22 ] to demonstrate that INFL remains eﬀective across diverse training mo dalities. First, INFL attains the highest accuracy and the fastest conv ergence across all ﬁve b enc hmarks ( Supplemen tary Figure A1 a–b ), with esp ecially pronounced gains o ver DP-based baselines on ﬁne-grained recognition (Stanford Cars). These results suggest that the plug-in INR mo dules capture subtle, class-discriminativ e cues with- out the utility losses typically asso ciated with noise-injected training. Notably , INFL also surpasses FL-LP , which do es not incur explicit priv acy-driv en degradation and matc hes or exceeds FL-LP-HE while av oiding the heavy cryptographic ov erhead. In particular, whereas FL-LP-HE introduces substantial run time and compute costs ( Supplemen tary Figure A1 b ), INFL adds less than 0.1% incremen tal o verhead relativ e to FL-LP on our setup, underscoring a fav orable accuracy–eﬃciency trade-oﬀ. W e further ablate three factors—data heterogeneit y (non-IID level), client count, and INR capacity alongside a priv acy stress test ( Supplementary Figure A1 c–d ). F or non-I ID splits, w e employ Diric hlet partitioning with concentration α ∈ { 0 . 3 , 0 . 4 , 0 . 5 , 0 . 6 , 0 . 7 } follo wing standardfederated learningpractice [ 58 ]. Across all α and datasets, INFL consisten tly outp erforms comp eting metho ds, indicating robust- ness to cross-client distribution shift. V arying the num ber of clien ts and the INR size on Stanford Cars yields the same conclusion: INFL maintains a clear margin ov er FL-LoRA [ 22 ] and PPML baselines, suggesting that the INR provides a stable and scalable adaptation c hannel under federation. Finally , w e probe priv acy by considering an aggressive attac ker that discards the meta-learner and attempts direct inference without the correct co ordinate key ( Supplemen tary Figure A1 c–d ). In practical conditions, unauthorized guessing of the priv ate co ordinate key collapses INR mo dulation, driving accuracy to near- zero. Consisten t with this exp ectation, INFL without the meta-learner fails to deliver usable p erformance (e.g., CIF AR-100 drops to ≈ 0 and remains b elow PPML across tasks). These ﬁndings reinforce that INFL’s k ey-conditioned INR design pro vides strong protection while preserving utilit y , deliv ering state-of-the-art p erformance on priv acy-preserving vision tasks with negligible computational ov erhead. 37 a 0 0.05 0.1 0.15 0.2 0.25 0.3 MSE (all) MSE (de) De_op_frac Error value Norman_unseen_0 evaluation metrics - 1 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 Pearson (all) Pearson (de) Pearson_delta Pearson value Norman_unseen_0 evaluation metrics - 2 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 Pearson (all) Pearson (de) Pearson_delta Pearson value Adamson evaluation metrics - 2 De_op_frac 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 Pearson (all) Pearson (de) Pearson_delta Pearson value Norman_unseen_1 evaluation metrics - 2 0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 0.45 0.5 MSE (all) MSE (de) De_op_frac Error value Norman_unseen_2 evaluation metrics - 1 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 Pearson (all) Pearson (de) Pearson_delta Pearson value Norman_unseen_2 evaluation metrics -2 - 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 Pearson (all) Pearson (de) Pearson_delta Pearson value Private data evaluation metrics - 2 0 0.05 0.1 0.15 0.2 0.25 0.3 MSE (all) MSE (de) De_op_frac Error value Norman_unseen_0 evaluation metrics - 1 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 Pearson (all) Pearson (de) Pearson_delta Pearson value Norman_unseen_0 evaluation metrics - 2 0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 MSE (all) MSE (de) De_op_frac Error value Norman_unseen_1 evaluation metrics - 1 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 Pearson (all) Pearson value Norman_unseen_1 evaluation metrics b c d e f g Extended Data Fig. 1 Supplemen tary quantitativ e metrics for p erturbation prediction p erformance. a-b Model p erturbation prediction p erformance characterized by quantitative met- rics. The metrics are the same as in Figure 3 c-e, where lo wer v alues indicate b etter performance. a P erformance on the Norman dataset under the in-domain (full) scenario. b Performance on the Norman dataset under the in-domain (partial) scenario. c-g Model p erturbation prediction p erfor- mance characterized by other quan titative metrics. F or each scenario, w e selected three metrics to demonstrate the performance of each metho d: the Pearson correlation coeﬃcient (PCC) for all genes (Pearson(all)), the PCC for the top 20 diﬀerentially expressed genes (Pearson(de)), and the P ear- son delta (measuring the change). F or all three metrics, higher v alues indicate b etter p erformance. c Performance on the Adamson dataset. d Performance on the Norman dataset under the in-domain (full) scenario. e Performance on the Norman dataset under the in-domain (partial) scenario. f Per- formance on the Norman dataset under the out-of-domain scenario. g Performance on the priv ate dataset. 38 0 10 20 30 40 50 60 70 80 90 100 F ARSB+ctrl MAP2K6+IKZF3 ZNF318+FOXL2 YWHAE+ctrl Hitrate (%) Different scenarios Hitrate under different scenarios 0 10 20 30 40 50 60 70 80 90 100 CEBPE+RUNX1T1 Hitrate (%) Hitrate a b c d e Extended Data Fig. 2 Qualitative presen tation of additional cases and hit rate analysis. a-d Qualitative case studies showing mo del perturbation performance. The green dotted line shows mean unp erturbed control gene expression. Bo xes indicate exp erimentally measured diﬀerential gene expression after p erturbing some genes. Diﬀerent symbols sho ws the mean change in gene expression predicted by diﬀerent metho ds. Whiskers represent the last data p oint within 1.5 × interquartile range. a Case of F ARSB single-gene p erturbation (from the Adamson dataset). b Case of ZNF318 and FOXL2 combined p erturbation (from the Norman dataset, under the in-domain (full) scenario). c Case of MAP2K6 and IKZF3 combined perturbation (from the Norman dataset, under the in- domain (partial) scenario). d Case of YWHAE single-gene p erturbation (from the priv ate dataset). e Perturbation p erformance for diﬀeren t cases quantitativ ely display ed using hit rate. 39 a b Extended Data Fig. 3 Additional exp erimen tal results on protein v alidation for the mosaic in tegration task. a Diﬀerential expression analysis based on the INFL clustering results, showing the most highly diﬀerentially expressed proteins for eac h domain. W e selected the protein CXCR5, consulted relev an t literature to conﬁrm its biological signiﬁcance, and plotted its spatial distribution. b Spatial distribution of the protein CXCR5. Compared with the INFL clustering map in Figure 5 b, its expression shows strong spatial concordance with the germinal center and lymphoid follicle domains, conﬁrming the sp eciﬁcity of this protein. 40 Alpha=0.3 Alpha=0.4 Alpha=0.3 Alpha=0.4 Alpha=0.5 Alpha=0.6 Alpha=0.7 10 22 34 46 58 70 Stanford Cars Alpha=0.3 Alpha=0.4 Alpha=0.4 Alpha=0.5 Alpha=0.6 Alpha=0.7 70 74 78 82 86 90 Stanford Dogs Alpha=0.3 Alpha=0.3 Alpha=0.4 Alpha=0.3 Alpha=0.4 Alpha=0.5 Alpha=0.6 Alpha=0.7 75 79 83 87 91 95 CIF AR100 Alpha=0.3 Alpha=0.4 Alpha=0.3 Alpha=0.4 Alpha=0.5 Alpha=0.6 Alpha=0.7 15 19 23 27 31 35 CLEVR Count Alpha=0.3 Alpha=0.4 Alpha=0.3 Alpha=0.4 Alpha=0.5 Alpha=0.6 Alpha=0.7 25 31 37 43 49 55 KITTI Distance 0 10 20 30 40 50 60 70 80 90 100 Stanford Cars Stanford Dogs CIF AR100 CL VER Count KITTI Distance A verage Accuracy (%) Computational Cost (G) Accuracy (%) INFL FL-LP FL-LP-HE FL-LP-DP FL-LoRA-DP PPML 0 10 20 30 40 50 60 70 10/3 10/5 20/5 20/10 20/15 Accuracy (%) Clinet Number 0 10 20 30 40 50 60 70 3/16 3/32 3/64 6/32 6/64 Accuracy (%) INR Size a. b. c. d. 0 2 4 6 8 10 48 51 54 57 60 63 66 69 0.3 0.21 4.2 0.21 0.89 0.3 0 10 20 30 40 50 60 70 80 90 100 Stanford Dogs Stanford Cars CIF AR100 CL VER Count KITTI Distance A verage Accuracy (%) e. INFL INFL (w/o Meta Learner) 0 10 20 30 40 50 60 70 80 1.5 2 2.5 3 3.5 4 4.5 5 1 21 41 61 81 101 121 141 161 181 V alidation Accuracy (%) V alidation Loss Epoch 0 10 20 30 40 50 60 70 80 90 100 0 0.2 0.4 0.6 0.8 1 1.2 1.4 1.6 1.8 2 1 11 21 31 41 51 61 71 81 91 V alidation Accuracy (%) V alidation Loss Epoch 0 10 20 30 40 50 60 70 80 90 100 0 1 2 3 4 5 6 1 6 11 16 21 26 31 36 41 46 V alidation Accuracy (%) V alidation Loss Epoch 10 15 20 25 30 35 1.5 1.7 1.9 2.1 2.3 2.5 2.7 2.9 1 11 21 31 41 51 61 71 81 91 V alidation Accuracy (%) V alidation Loss Epoch 0 10 20 30 40 50 60 1 1.2 1.4 1.6 1.8 2 2.2 2.4 2.6 2.8 3 5 10 15 20 25 30 35 40 45 50 V alidation Accuracy (%) V alidation Loss Epoch Supplemen tary Fig. A1 Sanity c heck on general classiﬁcation tasks. a Performance com- parison of INFL against four baselines (FL-LP , FL-LP-HE, FL-LP-DP , FL-LoRA-DP , PPML) across ﬁve b enc hmarks (Stanford Cars, Stanford Dogs, CIF AR-100, CLEVR Count, and KITTI Distance), showing accuracy (bar charts). b Computational cost versus accuracy trade-oﬀ analysis, highlighting INFL’s eﬃciency compared to the high-ov erhead FL-LP-HE baseline. c Robustness ev aluation against data heterogeneit y under diﬀeren t non-IID lev els (Diric hlet concen tration α ∈ { 0 . 3 , . . . , 0 . 7 } ) and con- vergence curv es (righ t column). d Ablation studies examining the impact of v arying client num b ers (top) and INR sizes (b ottom) on mo del p erformance. e Priv acy stress test comparing the standard INFL against a v ariant without the meta-learner (simulating an unauthorized attack), demonstrat- ing the necessit y of the key-conditioned design for maintaining utility . 41 References [1] Przyb yla, L. & Gilb ert, L. A. A new era in functional genomics screens. Natur e R eviews Genetics 23 , 89–103 (2022). [2] Mund, A. et al. Deep visual proteomics deﬁnes single-cell identit y and hetero- geneit y . Natur e Biote chnolo gy 40 , 1231–1240 (2022). [3] Askr, H. et al. Deep learning in drug discov ery: an integrativ e review and future c hallenges. Artiﬁcial Intel ligenc e R eview 56 , 5975–6037 (2023). [4] Oberacher, H. et al. A europ ean prop osal for qualit y con trol and qualit y assurance of tandem mass sp ectral libraries. Envir onmental Scienc es Eur op e 32 , 43 (2020). [5] P erez-Riv erol, Y. et al. The pride database at 20 y ears: 2025 up date. Nucleic acids r ese ar ch 53 , D543–D553 (2025). [6] V oigt, P . & V on dem Bussc he, A. The eu general data protection regulation (gdpr). A pr actic al guide, 1st e d., Cham: Springer International Publishing 10 , 10–5555 (2017). [7] McMahan, B. Comm unication-eﬃcient learning of deep netw orks from decentral- ized data 1273–1282 (2017). [8] Da y an, I. et al. F ederated learning for predicting clinical outcomes in patien ts with covid-19. Natur e me dicine 27 , 1735–1743 (2021). [9] Cai, Z. et al. F ederated deep learning enables cancer subtyping by proteomics. Canc er Disc overy 15 , 1803–1818 (2025). [10] Joseph, D. et al. T ransitioning organizations to p ost-quantum cryptograph y . Natur e 605 , 237–243 (2022). [11] Islam, M. M., Mohammed, N., W ang, Y. & Hu, P . Diﬀeren tial priv ate deep learning mo dels for analyzing breast cancer omics data. F r ontiers in onc olo gy 12 , 879607 (2022). [12] Chen, L., Xiao, D., Xiao, X. & Zhang, Y. Secure and eﬃcient federated learning via nov el authen ticable m ulti-part y computation and compressed sensing. IEEE T r ansactions on Information F or ensics and Se curity (2024). [13] Jiang, S. et al. T ow ards compute-eﬃcien t byzan tine-robust federated learning with fully homomorphic encryption. Natur e Machine Intel ligenc e 1–12 (2025). [14] F ro elic her, D. et al. T ruly priv acy-preserving federated analytics for precision medicine with multipart y homomorphic encryption. Natur e c ommunic ations 12 , 5910 (2021). 42 [15] Dw ork, C. Diﬀerential priv acy 1–12 (2006). [16] Qi, T. et al. Diﬀeren tially priv ate kno wledge transfer for federated learning. Natur e Communic ations 14 , 3785 (2023). [17] Hu, R., Guo, Y. & Gong, Y. F ederated learning with sparsiﬁed model per- turbation: Improving accuracy under clien t-level diﬀeren tial priv acy . IEEE T r ansactions on Mobile Computing 23 , 8242–8255 (2023). [18] Zhou, J. et al. Ppml-omics: A priv acy-preserving federated machine learning metho d protects patients’ priv acy in omic data. Scienc e A dvanc es 10 , eadh8601 (2024). [19] T omczak, K., Czerwi´ nsk a, P . & Wiznerowicz, M. Review the cancer genome atlas (tcga): an immeasurable source of knowledge. Contemp or ary Onc olo- gy/Wsp´ o lczesna Onkolo gia 2015 , 68–77 (2015). [20] Sitzmann, V., Martel, J., Bergman, A., Lindell, D. & W etzstein, G. Implicit neural represen tations with p erio dic activ ation functions. A dvanc es in neur al information pr o c essing systems 33 , 7462–7473 (2020). [21] Dai, G. et al. Implicit neural image ﬁeld for biological microscopy image compression. Natur e Computational Scienc e 1–10 (2025). [22] Hu, E. J. et al. Lora: Low-rank adaptation of large language mo dels. ICLR 1 , 3 (2022). [23] Sun, Y. et al. A protein-based classiﬁer for diﬀeren tiating follicular thyroid adenoma and carcinoma. EMBO Mole cular Me dicine 1–20 (2025). [24] Shapley , L. S. in A value for n-p erson games (eds Kuhn, H. W. & T uck er, A. W.) Contributions to the The ory of Games (V ol. 2) 307–317 (Princeton Universit y Press, 1953). [25] Ha y ashi, T. et al. Galectin-4, a nov el predictor for lymph no de metastasis in lung adeno carcinoma. PL oS One 8 , e81883 (2013). [26] Huang, P . et al. Phosphorib osyl transferase domain con taining 1: A prognostic biomark er in testicular germ cell tumors. Mole cular Ther apy Onc olo gy 33 (2025). [27] Lopez-Beltran, A. et al. Molecular classiﬁcation of bladder urothelial carcinoma using nanostring-based gene expression analysis. Canc ers 13 , 5500 (2021). [28] Roohani, Y., Huang, K. & Lesk ov ec, J. Predicting transcriptional outcomes of no vel m ultigene perturbations with gears. Natur e Biote chnolo gy 42 , 927–935 (2024). 43 [29] Bunne, C. et al. Ho w to build the virtual cell with artiﬁcial in telligence: Priorities and opp ortunities. Cel l 187 , 7045–7063 (2024). [30] Adamson, B. et al. A multiplexed single-cell crispr screening platform enables systematic dissection of the unfolded protein resp onse. Cel l 167 , 1867–1882 (2016). [31] Norman, T. M. et al. Exploring genetic interaction manifolds constructed from ric h single-cell phenot yp es. Scienc e 365 , 786–793 (2019). [32] Zhou, K., Liu, Z., Qiao, Y., Xiang, T. & Loy , C. C. Domain generalization: A survey . IEEE tr ansactions on p attern analysis and machine intel ligenc e 45 , 4396–4415 (2022). [33] Derevy ank o, P . K. et al. F usion gene depletion eliminates stemness and induces bidirectional diﬀerentiation of acute my eloid leuk emia. Blo o d (2025). [34] W alker, C. & Angelo, M. T ow ard clinical applications of spatial-omics in cancer researc h. Natur e Canc er 5 , 1771–1773 (2024). [35] Y an, X. et al. Mosaic integration of spatial multi-omics with spamosaic. BioRxiv 2024–10 (2024). [36] Cosgro v e, J. et al. B cell zone reticular cell micro en vironmen ts shap e cxcl13 gradien t formation. Natur e c ommunic ations 11 , 3677 (2020). [37] Liu, S. et al. F abp4 in obesity-associated carcinogenesis: No v el insigh ts in to mec hanisms and therapeutic implications. F r ontiers in Mole cular Bioscienc es 9 , 973955 (2022). [38] Y u, Z. et al. Parallel comparison of t cell and b cell subp opulations of adenoid h yp ertroph y and tonsil hypertrophy of children. Natur e Communic ations 16 , 3516 (2025). [39] Kumar-Singh, A. et al. Nuclear syndecan-1 regulates epithelial-mesench ymal plasticit y in tumor cells. Biolo gy 10 , 521 (2021). [40] W u, B.-x., Zhao, L .-d. & Zhang, X. Cxcr4 and cxcr5 orchestrate dynamic ger- minal center reactions and may contribute to the pathogenesis of systemic lupus erythematosus. Cel lular & Mole cular Immunolo gy 16 , 724–726 (2019). [41] W arnat-Herresthal, S. et al. Swarm learning for decentralized and conﬁdential clinical machine learning. Natur e 594 , 265–270 (2021). [42] Saldanha, O. L. et al. Swarm learning for decentralized artiﬁcial intelligence in cancer histopathology . Natur e me dicine 28 , 1232–1239 (2022). 44 [43] Han, X. et al. Zyxin regulates endothelial von willebrand factor secretion by reorganizing actin ﬁlamen ts around exo cytic gran ules. Natur e c ommunic ations 8 , 14639 (2017). [44] Consortium, G. O. The gene ontology (go) database and informatics resource. Nucleic acids r ese ar ch 32 , D258–D261 (2004). [45] Kiessling, P . & Kuppe, C. Spatial m ulti-omics: no vel to ols to study the complexit y of cardiov ascular diseases. Genome me dicine 16 , 14 (2024). [46] Yip, S. H., Sham, P . C. & W ang, J. Ev aluation of to ols for highly v ariable gene disco very from single-cell rna-seq data. Brieﬁngs in bioinformatics 20 , 1583–1589 (2019). [47] Danielsson, P .-E. Euclidean distance mapping. Computer Gr aphics and image pr o c essing 14 , 227–248 (1980). [48] Massoulie, L., Twigg, A., Gk an tsidis, C. & Ro driguez, P . Randomized decentral- ized broadcasting algorithms 1073–1081 (2007). [49] He, K., Zhang, X., Ren, S. & Sun, J. Delving deep into rectiﬁers: Surpassing h uman-level p erformance on imagenet classiﬁcation 1026–1034 (2015). [50] W olf, F. A., Angerer, P . & Theis, F. J. Scanpy: large-scale single-cell gene expression data analysis. Genome biolo gy 19 , 15 (2018). [51] Krause, J., Stark, M., Deng, J. & F ei-F ei, L. 3d ob ject represen tations for ﬁne- grained categorization 554–561 (2013). [52] Khosla, A., Jay adev aprak ash, N., Y ao, B. & F ei-F ei, L. No vel dataset for ﬁne- grained image categorization: Stanford dogs 1–2 (2011). [53] Krizhevsky , A. Learning multiple lay ers of features from tiny images. T ech. Rep. TR-2009, Universit y of T oronto (2009). [54] Johnson, J. et al. Clevr: A diagnostic dataset for comp ositional language and elemen tary visual reasoning 2901–2910 (2017). [55] Geiger, A., Lenz, P . & Urtasun, R. Vision meets rob otics: The kitti dataset. The International Journal of R ob otics R ese ar ch (IJRR) 32 , 1231–1237 (2013). [56] Doso vitskiy , A. et al. An image is worth 16x16 words: T ransformers for image recognition at scale (2021). [57] Alain, G. & Bengio, Y. Understanding in termediate la yers using linear classiﬁer prob es (2017). 45 [58] Hsu, T.-M. H., Qi, H. & Bro wn, M. Measuring the eﬀects of non-identical data distribution for federated learning (2019). 46

Key-Embedded Privacy for Decentralized AI in Biomedical Omics

Original Paper

Comments & Academic Discussion

Leave a Comment

Original Paper

Related Papers

Comments & Academic Discussion

Leave a Comment