Security & Privacy¶
Read this page before drawing conclusions about what Fed-MaxFuse protects. It is deliberately explicit about what is not guaranteed.
Threat model¶
Fed-MaxFuse assumes:
- Honest-but-curious server. It follows the protocol correctly, but may attempt to infer private information from the messages it legitimately receives.
- Non-malicious participants. Nodes do not deviate from the protocol.
- A secure channel. Communication travels over a VPN or other private network, so interception by external parties is out of scope.
These assumptions simplify the security landscape considerably, and they limit real-world applicability. They are stated here rather than buried because the difference between them and a stronger model is the difference between "data minimisation" and "privacy guarantee".
The privacy honesty ladder¶
| Level | Claim | Status |
|---|---|---|
| 1 | Data minimisation by construction β raw data never leaves the node; only smoothed, normalised, projected representations are exchanged | β Demonstrated |
| 2 | Partial privacy preservation by design β matching and embedding quality preserved while raw data stays local | β οΈ Claimed, hedged |
| 3 | Formal guarantees β resilience to poisoning, network attacks, message dropping | β Not established |
| 4 | Reconstruction resistance β provable inability to rebuild private data | β Not established |
Claim level 1. Hedge level 2. Never claim level 3 or 4.
Message safety analysis¶
Every object that crosses the wire, and what it could reveal:
| Variable | Sent during | What it is | Exposure assessment |
|---|---|---|---|
| \(\widetilde{\mathbf{X}}'\) | init, refinement loop, final matching | L2-normalised, fuzzily smoothed feature matrix | Highest risk. Smoothing toward neighbourhood centroids reduces direct leakage, but local structural patterns could be exposed if intercepted. Only three restricted forms are ever sent: smoothed shared columns, smoothed CCA embeddings, and smoothed full data for the final matching. |
| \(\Pi\) | init, loop, final | Matched indices and similarity scores | Index exposure alone reveals no feature content, but could hint at sample relationships if improperly aggregated. Mostly serverβnode; propagation matching is the exception, requiring a server-side join. |
| \(\xi_k,\ \omega_k\) | SVPM inner loop | Latent projections during CCA fitting | Capture directional trends in local data; individual cell-level detail remains obscured. |
| \(\delta\) | SVPM inner loop | Scalar convergence norm \(\lVert u_k - u_{k-1}\rVert\) | No identifiable information. Safe. |
Defence in depth β by construction¶
Several design choices reduce exposure, each for its own reason:
| Mechanism | Effect |
|---|---|
| Fuzzy smoothing | Each cell is pulled toward its neighbourhood centroid before transmission, so individual values are no longer recoverable in isolation |
| L2 normalisation | Removes scale information; the server sees direction only |
| CCA projection | Dimensionality collapses (e.g. 1,707 β 20) before anything is sent in the refinement loop |
| Split-Ξ | Each node holds only its own indices; the identity mapping is knowledge the server alone has |
| Noise interpolation | No real data column is shared at SVPM initialisation |
Smoothing was not added for privacy
Fuzzy smoothing exists in centralized MaxFuse for signal-to-noise reasons; it is load-bearing algorithmic machinery. Fed-MaxFuse inherits a privacy benefit from a choice made for accuracy. That is worth stating accurately rather than claiming as a privacy design.
What a curious server could attempt¶
Tracing one cell's exposure: for a given cell, the server observes its smoothed 32-dimensional shared-feature row at initialisation, then its smoothed 20-dimensional CCA projection once per refinement iteration, then its contribution buried inside \(N\)-length latent score vectors during SVPM, then a final smoothed row.
Whether repeated observations across \(T\) iterations enable reconstruction is mathematically nontrivial but unestablished. The thesis explicitly recommends investigating "the possibility of rebuilding it, if feasible, and the extent of the reconstruction" as future work. Nothing here should be read as a claim that reconstruction is impossible.
Limitations¶
1. No formal privacy guarantees. No defence against active adversaries, poisoning, network attacks, or message dropping. This was not the focus of the work.
2. Centralised server architecture. A single point of failure and a message-complexity bottleneck. The CCA sub-protocol needs up to \(T \times C \times K\) round trips, all through one server. Decentralised topologies and communication-efficient CCA variants (MAX-VAR, communication-efficient distributed CCA) are the natural next step.
3. Evaluation breaks federation. This is the deepest conceptual problem. Most validation metrics (FOSCTTM, FOSKNN, and the label-based scores) require complete embeddings and explicit cell-level correspondences in one place, which is exactly what the method exists to avoid. Benchmark datasets permit supervised evaluation because ground truth exists; practical federated deployments do not have that luxury. New cross-silo evaluation metrics are needed, and this is arguably the strongest open research direction arising from the work.
4. Two modalities only. Extending to three or more, or to highly heterogeneous multi-omic data, is unresolved. Tri-omic analysis has been done centrally via a merged generalized CCA applied to fitted and filtered pivots. Whether that approach is best, and how to federate it, remains open.
5. Metric memory cost. The unsupervised metrics rely on full distance matrices, distance-rank matrices, or zero-dominated sparse matrices. Datasets above 100,000 cells at 32-bit precision needed at least 37 GB, scaling as \(O(n^2)\). This capped what could be evaluated.
How to describe this work accurately¶
A calibrated statement, for reuse in papers and talks:
Federated MaxFuse performs diagonal integration without centralising raw data, exchanging only fuzzily-smoothed, L2-normalised representations, latent score vectors, and match indices. Under an honest-but-curious server model over an assumed-secure channel, it achieves matching and embedding quality statistically indistinguishable from centralized MaxFuse on neighbourhood-preservation and cluster-reliability metrics. Formal privacy guarantees β including resistance to reconstruction, poisoning, and active adversaries β are not established and remain future work.
Each clause is doing work: it names the threat model, enumerates exactly what is exchanged, scopes the equivalence claim to the metrics that actually support it, and closes the door on over-reading.