Differential privacy gives federated learning a formal guarantee — and a brutal trade-off screen. We walk through what DP budgets mean when twelve simulated hospitals train one medical imaging model.
Why hospitals cannot just share data
Rare diseases need large datasets. Hospitals cannot combine datasets, because regulations are written to prevent exactly that. Federated learning — one model, many sites, gradients instead of records — looks like the escape hatch, but gradient inversion attacks have shown the escape hatch leaks.
What the noise budget buys
Differential privacy comes in one currency: utility spent per unit of guarantee. On chest X-ray classification across twelve simulated hospital nodes, our DP-FLMed experiments place the usable frontier squarely around strong ε values with gradient clipping — every attempt to buy more accuracy at a weaker ε produced models we would not defend in front of a clinical reviewer.
The uncomfortable finding is that the noise calibration question is dataset shape, not architecture. Non-IID splits across hospitals changed the optimal noise multiplier more than changing the encoder did.
Open evaluation
We will publish the privacy-utility Pareto frontier for MIMIC-CXR and CheXpert splits as part of the problem's deliverables, including the accounting configuration that produced every point on the curve. If your threat model differs from ours, you will be able to re-price the frontier instead of re-running the training.