Source-linked AI summary
Privacy-Preserving Detection of Rare Disease-Associated Cell Subsets via Secure Multi-Party Computation
Ş. Selcan Magara, Esther Havemann, Debora Jutz, Ali Burak Ünal, Mete Akgün
TL;DR
Rare-cell detection needs larger collaborative cohorts, but sensitive single-cell data cannot readily cross institutional boundaries. This paper trains and evaluates CellCnn with secure multi-party computation on secret-shared data, retaining key architecture components and achieving performance close to plaintext while improving on the prior privacy-preserving baseline.
Problem
Reliable rare-cell detection requires larger and more diverse cohorts, while sensitive single-cell data is constrained from being shared across institutions.
Method
The paper implements CellCnn training and inference with three-party secure multi-party computation over additively secret-shared data.
Results
The MPC implementation closely approaches plaintext accuracy across CMV and AML benchmarks, improves on PriCell, and also supports AML MRD-load regression.
Takeaways & Limitations
Secure MPC can preserve key CellCnn components, including ReLU and bias terms, while enabling private classification and regression on secret-shared single-cell data.
Takeaways & Limitations
The evaluation assumes semi-honest non-colluding parties and uses small cohorts plus synthetic regression ground truth, motivating stronger security and larger real-cohort validation.
Abstract
from arXiv · showhide
The detection of rare disease-associated cell subsets from high-dimensional single-cell measurements is critical for understanding diseases such as leukaemia and viral infections. CellCnn, a convolutional neural network (CNN) designed for this task, has demonstrated the ability to identify phenotype-associated cell populations at frequencies as low as 0.01\%. Training such models reliably requires patient cohorts that are larger and more diverse than any single institution can typically assemble, and the underlying single-cell data is too sensitive to share across institutional boundaries under existing privacy regulations. We propose a secure multi-party computation (MPC) framework that enables the training and inference of CellCnn entirely on secret-shared data. This ensures that neither the participants nor the computing servers ever observe raw patient data or intermediate values. Evaluated on benchmark single-cell datasets for cytomegalovirus infection (CMV) and acute myeloid leukaemia (AML), our implementation preserves accuracy close to its plaintext counterpart while outperforming the prior privacy-preserving baseline. In contrast to earlier privacy-preserving approaches that removed components such as ReLU activations and bias terms, our method retains these key parts of the CellCnn architecture and supports accurate analysis without exposing raw patient data.
1 Introduction
Rare disease-associated cell subsets are clinically important but difficult to detect because they occur at very low frequencies. CellCnn addresses this challenge, while privacy constraints and limited institutional cohorts motivate secure collaborative training.
- Motivation: Rare cell populations such as leukaemic blasts and CMV-associated natural killer cells are clinically important yet difficult to detect because of their low frequency.Mass cytometry provides simultaneous measurements of dozens of protein markers across thousands of cells.
- CellCnn: CellCnn jointly learns cell-population representations and their association with disease phenotypes from multi-cell single-cell inputs.Convolutional filters represent molecular profiles of relevant subsets, while pooling captures their presence or frequency.
- Privacy challenge: Robust single-cell models require larger and more diverse patient cohorts than individual institutions typically possess, making multi-centre collaboration necessary.
- Privacy challenge: Sensitive single-cell data cannot be freely shared across institutions because regulations including GDPR and HIPAA impose strict constraints.The measurements can reveal disease status, immune function, and potentially genetic predisposition.
- Prior work: PriCell preserves privacy with polynomial-only encrypted computation but omits ReLU and bias terms, limiting its supported functionality.It supports classification only and uses a single sigmoid head trained with mean-squared error.
- Contribution: The proposed MPC framework evaluates CellCnn on secret-shared data while retaining ReLU and bias terms and supporting continuous outcomes through a tanh regression head.Experiments use CMV and AML benchmarks and report accuracy close to plaintext CellCnn while improving on the prior privacy-preserving baseline.
2 Methods
The method adapts CellCnn for secure computation using a three-party secret-sharing framework and secure arithmetic replacements, then evaluates classification and regression on CMV and AML data.
- CellCnn architecture: CellCnn comprises a 1D convolutional layer with ReLU, a pooling layer, and a fully connected output layer.Inputs have dimension n × m, where n is the number of cells and m is the number of measured markers.
- MPC framework: The three-party MPC framework uses 2-out-of-2 additive secret sharing over Z264, with two computing proxies and a helper party.Data owners split each value into random shares sent to the proxies.
- MPC framework: Under the semi-honest honest-majority assumption, raw data, model updates, and intermediate activations remain secret-shared until the agreed output is reconstructed.At most one party may be corrupted, and parties do not collude.
- MPC adaptations: Secure adaptations replace expensive operations with MPC-compatible equivalents while retaining bias terms and the ReLU activation.Mini-batch SGD with momentum replaces Adam, and mean pooling avoids communication between parties.
- MPC adaptations: The classification head uses clipped per-class sigmoids approximated by a degree-three polynomial, while regression uses a tanh output with mean-squared error.
- Datasets: The evaluation covers CMV classification, three-class AML classification, and AML MRD-load regression using donor-held-out or patient-disjoint protocols.The CMV benchmark uses 14 training and 6 testing donors; AML classification uses 7 training and 6 test samples, while regression uses synthetic spike-in fractions.
3 Results
Across CMV and AML classification and AML MRD-load regression, the MPC implementation remains close to plaintext CellCnn while generally outperforming PriCell where comparisons are reported. Runtime depends strongly on bandwidth, and the fixed-party deployment differs from PriCell’s active-party model.
- CMV/NK: 0.727 ± 0.141 multi-cell-input accuracy versus 0.721 ± 0.173 for plaintext CellCnn on CMV, while phenotype accuracy is 0.681 ± 0.146 versus 0.716 ± 0.158.Both differences are within one standard deviation across ten splits; PriCell scores 0.633 ± 0.127 and 0.649 ± 0.146 on the respective metrics.
- AML: 0.935 ± 0.047 multi-cell-input accuracy and 0.916 ± 0.088 phenotype accuracy show that MPC tracks AML CellCnn’s 1.000 ± 0.000 multi-cell-input ceiling closely.The AML benchmark uses ten independent train/test splits and only seven training samples.
- AML MRD-load regression: r = 0.98 and MAE = 1.0 percentage points show that MPC recovers AML MRD blast fractions close to CellCnn’s r = 0.99 and MAE = 0.8 percentage points.Evaluation used 42 patient-held-out multi-cell inputs spanning seven spike-in frequencies with six replicates each.
- Runtime: Approximately 1,200 s trains the CMV/NK model for 20 epochs over a 5 Gbps, 0.8 ms RTT LAN between three dedicated MPC parties.Reducing bandwidth to 1 Gbps increases training time to approximately 2,700 s, indicating bandwidth is a major bottleneck.
- Runtime: The runtime comparison with PriCell is deployment-dependent: PriCell reports approximately 1,550 s with ten active parties, whereas MPC uses fixed dedicated parties and tolerates unbalanced contributions.The two systems therefore differ in how computation is distributed across data holders and dedicated computing parties.
4 Conclusion
The paper presents end-to-end CellCnn training and inference under secure MPC, retaining architectural components omitted by earlier privacy-preserving implementations. It preserves high benchmark accuracy and adds continuous AML MRD-load prediction, while larger real-cohort validation remains needed.
- Conclusion: End-to-end MPC performs CellCnn training and inference on additively secret-shared data without exposing plaintext records or intermediate values.The implementation replaces strictly non-polynomial primitives with secure-arithmetic counterparts.
- Conclusion: Retaining the ReLU layer and multi-class head preserves high accuracy relative to plaintext CellCnn on CMV/NK and AML benchmarks.Earlier privacy-preserving CellCnn implementations had to omit these components.
- Conclusion: The pipeline extends privacy-preserving CellCnn to continuous AML MRD-load prediction and recovers the unconstrained baseline’s ranking quality on patient-held-out test donors.This regression setting was not supported by homomorphic-encryption-based predecessors.
- Limitations: Validation remains limited by small benchmark cohorts and a synthetic regression ground truth, motivating larger real cohorts and continuous clinical biomarkers.The semi-honest, non-colluding honest-majority model could also be strengthened to malicious security; released-output leakage motivates pairing with differential privacy.