CoChat
Sign Up
Cited by 267AI in cancer detectionPrivacy-Preserving Technologies in DataRadiomics and Machine Learning in Medical Imaging

Federated learning for computational pathology on gigapixel whole slide images

Open access
Lu, Ming Y., Chen, Richard J., Kong, Dehan, Lipkova, Jana, Singh, Rajendra, Williamson, Drew F.K., Chen, Tiffany Y., Mahmood, Faisal·2022·Medical Image Analysis
DOI 10.1016/j.media.2021.102298PMC PMC9340569
Open this paper in CoChat — free accountOpen PDF

Abstract

Deep Learning-based computational pathology algorithms have demonstrated profound ability to excel in a wide array of tasks that range from characterization of well known morphological phenotypes to predicting non human-identifiable features from histology such as molecular alterations. However, the development of robust, adaptable and accurate deep learning-based models often rely on the collection and time-costly curation large high-quality annotated training data that should ideally come from diverse sources and patient populations to cater for the heterogeneity that exists in such datasets. Multi-centric and collaborative integration of medical data across multiple institutions can naturally help overcome this challenge and boost the model performance but is limited by privacy concerns among other difficulties that may arise in the complex data sharing process as models scale towards using hundreds of thousands of gigapixel whole slide images. In this paper, we introduce privacy-preserving federated learning for gigapixel whole slide images in computational pathology using weakly-supervised attention multiple instance learning and differential privacy. We evaluated our approach on two different diagnostic problems using thousands of histology whole slide images with only slide-level labels. Additionally, we present a weakly-supervised learning framework for survival prediction and patient stratification from whole slide images and demonstrate its effectiveness in a federated setting. Our results show that using federated learning, we can effectively develop accurate weakly-supervised deep learning models from distributed data silos without direct data sharing and its associated complexities, while also preserving differential privacy using randomized noise generation. We also make available an easy-to-use federated learning for computational pathology software package: http://github.com/mahmoodlab/HistoFL.

AI snapshot

Written from the paper’s full text.

TL;DR

This paper presents a privacy-preserving federated learning framework for gigapixel whole slide images in computational pathology, combining weakly-supervised attention multiple instance learning with differential privacy via Gaussian noise. It evaluates the approach on breast and renal cancer subtyping and clear cell renal cell carcinoma survival prediction, showing federated models can be competitive with centralized training while avoiding direct data sharing.

Key findings

  • Federated learning benefited from multi-institutional data compared with single-institution training and was generally competitive with centralized training. For BRCA subtyping, mean test AUC ranged from 0.833 to 0.862 for noise levels α ∈ {0, 0.001, 0.01, 0.1}; for RCC subtyping, macro-averaged test AUC ranged from 0.974 to 0.976.
  • Model performance significantly deteriorated when α was set too high (e.g., α = 1), indicating a trade-off between model performance and privacy protection.
  • For CCRCC survival prediction, all federated models except α = 1 achieved statistical significance (p < 0.05) and reasonable c-Index and average cumulative/dynamic AUC; when trained on single-institution data, only 1 of 3 institutions yielded a model that could stratify patients into distinct survival groups.
  • For survival prediction, R = 8 performed best among R ∈ {2, 4, 6, 8}; a Cox proportional hazard model based on nuclear grade lagged behind the weakly-supervised deep learning approach and only matched its performance when combined with age and gender. Less frequent communication decreased survival c-indices by around 2–3% for E = 4 and E = 8, while weighted versus simple federated averaging showed minimal differences.

Methods

  • The framework used a master-server federated averaging architecture: each participating institution trained a local attention-based MIL model, uploaded trainable parameters each epoch, and the central server averaged them and sent updated weights back. Differential privacy was implemented by adding Gaussian noise to shared weights, with α varied over {0, 0.001, 0.01, 0.1, 1.0}; communication frequency E was varied over {1, 2, 4, 8}, and weighted versus uniform averaging was compared.
  • Data included TCGA and Brigham and Women’s Hospital in-house WSIs. BRCA subtyping used 2126 breast WSIs (369 lobular, 1757 ductal); RCC subtyping used 1184 kidney WSIs (703 CCRCC, 337 PRCC, 144 CHRCC); CCRCC survival prediction used 511 patient cases from TCGA-KIRC. Classification used four simulated institutional sites (BWH plus three TCGA tissue-source-site partitions); survival prediction used three simulated sites. Data were split 70/15/15% for training/validation/test per site, repeated with 5 random seeds, with stratified sampling.
  • WSIs were processed at 20× magnification using the CLAM pipeline to segment tissue and extract 256×256 patches, embedded as 1024-dimensional feature vectors via a pretrained ResNet50 encoder truncated after the third residual block. Models used gated attention MIL with a projection to 512 dimensions, 256-dimensional attention hidden layers, dropout p = 0.25, and either cross-entropy for classification or a discrete-time hazard loss for survival prediction with R bins and β = 0.15.

Limitations

  • The paper does not include a dedicated limitations section. Stated caveats include a trade-off between model performance and privacy protection when α is too high, and dataset-size imbalance among participating institutions, where single sites with insufficient data may not yield meaningful generalizable models.
  • The text makes evident that federated learning was simulated by partitioning TCGA and in-house data into institutional sites rather than deploying across actual independent institutions.
  • The differential privacy analysis assumes Δ₂(f) = 1 because computing sensitivity for a multi-layer neural network is intractable, and the privacy guarantee is linked to an adjustable noise parameter rather than a formal end-to-end accounting in the experiments.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

Crossref · 10.1016/j.media.2021.102298

Cites

67 of 67 references verified0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Claims the paper makes

0 of 19 cited sources checked · 0 supported · 0 flagged

  • Findingreasoning

    The model trained using data local to site 3 delivered performance comparable to that of centralized training and using federated learning.

    “Notably, we observed that the model trained using data local to site 3 delivered performance comparable to that of centralized training and using federated learning.”
    Quote in the paperNot a substantial claim
  • Findingown data

    Model performance benefited significantly from training on multi-institutional data using federated learning compared to learning from data within a single institution.

    “We found that the model performance benefited significantly from training on multi-institutional data using federated learning, compared to learning from data within a single institution.”
    Quote in the paperSubstantial claim
  • Findingown data

    All models trained in the federated framework, except when α = 1, produced reasonable performance in terms of c-Index values and average cumulative/dynamic AUC.

    “we found that federated learning can overcome this challenge as all models trained in the federated framework (with the exception of when using α = 1) resulted in statistical significance (p-value < 0.05) and produced reasonable performance both in terms of c-Index values and average cumulative/dynamic AUC.”
    Quote in the paperSubstantial claim
  • Findingown data

    Models trained using federated learning are generally competitive in performance compared to centralized training that pools all training data from each institution.

    “In fact, we found the models trained using federated learning to be generally competitive in performance even when compared to scenario 2), where model is trained by first centralizing (sharing) all training data from each institution.”
    Quote in the paperSubstantial claim
  • Findingown data

    When trained using data from a single institution, only 1 out of 3 institutions was able to yield a model that can stratify patients into distinct survival groups based on predicted risk scores.

    “When trained using data from a single institution, only 1 out of 3 institutions was able to yield a model that can stratify patients into distinct survival groups based on predicted risk scores.”
    Quote in the paperSubstantial claim
  • May combine two claims. 7
  • Classified as probably not a substantial claim. 7

  • May combine two claims.

    Findingown data

    Models trained using privacy-preserving federated learning can saliently localize regions of high diagnostic relevance and identify morphological features characteristic of each underlying tumor subtype.

    “In addition to strong performance, in Fig. 3, we also demonstrated that models trained using privacy-preserving federated learning can saliently localize regions of high diagnostic relevance and identify morphological features characteristic of each underlying tumor subtype.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    The performance difference between the deep learning model trained using different values of R is under a few percents, with R = 8 performing the best for the particular task.

    “We observed that in general the performance difference between the deep learning model trained using different values of R are under a few percents, with R = 8 performing the best for the particular task (Table 11).”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data

    Minimal differences between weighted averaging and uniform averaging aggregation were observed for both classification and survival tasks and for different levels of α.

    “The results are shown for both classification and survival tasks and for different levels of α (Fig. 5), where minimal differences between the two design choices were observed.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data

    The Cox proportional hazard model based on nuclear grade lags behind the weakly-supervised deep learning-based approach, and only matches its performance when combined with additional variables including age and gender.

    “Additionally we note that the cox proportional hazard model based on nuclear grade lags behind the weakly- supervised deep learning-based approach, and only matches its performance when combined with additional variables including age and gender, beyond histologic features made available to the deep learning model.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationown data

    Using federated learning, accurate weakly-supervised deep learning models can be developed from distributed data silos without direct data sharing and its associated complexities, while preserving differential privacy using randomized noise generation.

    “Our results show that using federated learning, we can effectively develop accurate weakly-supervised deep learning models from distributed data silos without direct data sharing and its associated complexities, while also preserving differential privacy using randomized noise generation.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    A popular strategy in the medical field for increasing differential privacy is contamination of the input data or the model parameters with certain levels of noise, which decreases individually recognizable information while preserving the global distribution of the data.

    “A popular strategy in the medical field is a contamination of the input data (Cheu et al., 2019) or the model parameters (Dong et al., 2019) with certain levels of noise. This de- creases the individually recognizable information while preserving the global distribution of the data (Kaissis et al., 2020).”
    Quote in the paperNot a substantial claim0 of 3 sources checked
    • cites Cheu et al., 2019

      Not checked in the free run.

    • cites Dong et al., 2019

      Not checked in the free run.

    • cites Kaissis et al., 2020 source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S2 (checkable).

    Premisecitation

    Computational pathology would strongly benefit from the federated framework.

    “One of the fields that would strongly benefit from the federated framework is computational pathology (Andreux et al., 2020b, a; Rieke et al., 2020).”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites Andreux et al., 2020b

      Not checked in the free run.

    • cites Rieke et al., 2020 source

      Not checked in the free run.

  • Classified as probably not a substantial claim.

    Premisereasoning

    Weakly-supervised approaches such as MIL simplify collaborative efforts by alleviating the requirement for pixel-level annotation based on pathologist expertise and the burden of creating pixel-level labels under a unified annotation protocol in all participating institutions.

    “Furthermore, while fully-supervised approaches are burdened by the need for time-costly pixel-level annotation based on pathologist expertise, weakly-supervised approaches such as MIL simplify collaborative efforts by alleviating the requirement for such human expertise and the burden of creating pixel-level labels under unified annotation protocol in all participating institutions.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Premisecitation

    In federated learning, sensitive patient data are never transferred beyond institutional firewalls; model training and validation occur locally and only model specifics such as parameters or gradients are transferred.

    “In this way, sensitive patient data are never transferred beyond the safety of institutional firewalls, and instead, the model training and validation occur locally at each institution and only the model specifics (e.g. parameters or gradients) are transferred.”
    Quote in the paperSubstantial claim0 of 3 sources checked
    • cites Yang et al., 2019 source

      Not checked in the free run.

    • cites Konecˇny’ et al., 2016

      Not checked in the free run.

    • cites McMahan et al., 2017

      Not checked in the free run.

    • Rests on an assumption: Each medical institution will not share data with other parties due to institutional policies, incompatible data sharing protocols, technical difficulties, or fear of privacy loss.

  • Probably not a substantial claim: may not pass S4 (based).

    Premisenone given

    In the federated learning setting, the function f involves a neural network consisting of many layers of trainable parameters, making computing Δ2(f) intractable.

    “In our federated learning setting, f involves a neural network consisting of many layers of trainable parameters making computing Δ2(f) intractable.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationreasoning

    Federated learning would in principle enable deep learning models to learn from much larger and more diverse multi-institutional data sources without the challenges associated with data centralization and healthcare interoperability.

    “Federated learning would in principle enable deep learning models to learn from much larger and more diverse multi-institutional data sources without the challenges associated with data centralization and healthcare interoperability.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: Model accuracy and robustness can be significantly increased by incorporating diverse data reflecting variations in underlying patient populations, as well as data collection and preparation protocols.

  • May combine two claims.

    Interpretationown data

    The proposed framework opens the possibility for multiple institutions to integrate their WSI datasets and train a more robust model that tends to generalize better on unseen data than models developed on data from a single institution.

    “Our proposed framework opens the possibility for multiple institutions to integrate their WSI datasets and train a more robust model that tends to generalize better on unseen data than models developed on data from a single institution, while also allowing participating institutions to preserve differential privacy via a randomized mechanism.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: The development and validation of AI algorithms in pathology have been mainly limited to single-institutional datasets.
    • Rests on an assumption: Single-institutional datasets may not generalize at deployment time due to variations in the underlying patient population, staining protocols, and scanner hardware.
    • Rests on an assumption: Dataset-size imbalance among different participating institutions frequently occurs in the real world.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Interpretationreasoning

    The decrease in survival prediction performance for larger E could potentially be explained by the smaller training set sizes available for the task, which makes it easier for client models to overfit on their local training data when a longer communication pace is used.

    “This could potentially be explained by the smaller training set sizes available for the task, which makes it easier for client models to overfit on their local training data when a longer communication pace is used.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationnone given

    The proposed framework allows participating institutions to preserve differential privacy via a randomized mechanism.

    “while also allowing participating institutions to preserve differential privacy via a randomized mechanism.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: The randomized mechanism (Gaussian noise) used in federated averaging preserves differential privacy.
14 of 14

  • The authors state this as an assumption.

    The l2 sensitivity of the neural network function, Δ2(f), is 1.

    “However, without loss of generality, if we assume Δ2(f)=1, we see that for a given level of δ, increasing σ will enable a smaller ε to be satisfied.”

  • The paper relies on this without support.

    Each medical institution will not share data with other parties due to institutional policies, incompatible data sharing protocols, technical difficulties, or fear of privacy loss.

    “Since each medical institution will not share data with other parties due to various issues (e.g. institutional policies, incompatible data sharing protocols, technical difficulties associated with sharing large amount of data or fear of privacy loss), we cannot pool together their data and train a single deep learning model fcentralized for solving the desired task.”

  • The authors state this as an assumption.

    The global model is hosted on a central server hub.

    “In this paper, we adapted a master-server architecture, where each client node, representing each medical institution, locally utilizes the same deep learning architecture as one another and the global model, which we assume to be hosted on a central server hub.”

  • The paper relies on this without support.

    Model accuracy and robustness can be significantly increased by incorporating diverse data reflecting variations in underlying patient populations, as well as data collection and preparation protocols.

    “As in all machine learning affairs, the model’s accuracy and robustness can be significantly increased by incorporating diverse data reflecting variations in underlying patient populations, as well as data collection and preparation protocols.”

  • The paper relies on this without support.

    Whole slide images used for computational analysis exhibit immense heterogeneity arising from patient group, tissue preparation, fixation and staining protocols, and scanner hardware.

    “Specifically, in pathology, whole slide images (WSIs) used for computational analysis can exhibit immense heterogeneity. Such diversities arise from not only the patient group corresponding to the histology specimens and variations in the tissue preparation, fixation and staining protocols, but also different scanner hardware that are used for digitization.”

  • The paper relies on this without support.

    Histology data might allow indirect patient identification, e.g., in the case of rare diseases.

    “Even though histology data do not hold such a direct link with patient identity, it might still allow an indirect patient identification e.g. in the case of rare diseases.”

  • The paper relies on this without support.

    The development and validation of AI algorithms in pathology have been mainly limited to single-institutional datasets.

    “Despite these breakthroughs, the development and validation in AI algorithms in pathology have been mainly limited to single-institutional datasets”

  • The paper relies on this without support.

    Single-institutional datasets may not generalize at deployment time due to variations in the underlying patient population, staining protocols, and scanner hardware.

    “which may not generalize at deployment time due to variations in the underlying patient population, staining protocols, and scanner hardware.”

  • The paper relies on this without support.

    Dataset-size imbalance among different participating institutions frequently occurs in the real world.

    “Similar dataset-size imbalance among different participating institutions frequently occurs in the real-world and is also reflected in the imbalanced distribution of patient cases among the original tissue source sites in the TCGA.”

  • The paper relies on this without support.

    The randomized mechanism (Gaussian noise) used in federated averaging preserves differential privacy.

    “while also allowing participating institutions to preserve differential privacy via a randomized mechanism.”
10 of 10

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • The above UDA approaches need access to both source and target data despite less annotation requirements.

    “Despite less annotation requirements, the above UDA approaches need access to both source and target data [33], [34].”

    From Memory-aware curriculum federated learning for breast cancer classification (2023) · cites this paper as [33]

  • A weakly supervised multiple instance learning approach based on FL for gigapixel whole slide images in computational pathology achieves balanced accuracy of disease detection up to 90% in various parameter settings.

    “Simulations show that the FL approach can achieve the balanced accuracy of disease detection up to 90% in various parameter settings”

    From Federated learning for smart healthcare: A survey (2023) · cites this paper as [106]

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

Each contradiction between two passages listed here was confirmed by an independent check.

  • Event-probability identity conflicts with the survival loss

    Minor

    The stated rewrite multiplies the hazard at time r by survival through time r. Equation (10) instead uses survival through time r−1 for an observed event, so the two expressions cannot both define the same event probability.

  • Survival-function product omits the first supported time bin

    Minor

    The hazard's support includes time 0, but the survival-function product starts at 1. At r=0 the product is 1, whereas its stated probability P(Tj>0∣hbagj) depends on whether an event occurs at time 0.

2 of 2

Cites

Flagged first, then by citations

Research works printed but not linked: 1

  1. Carlini, N., Liu, C., Erlingsson, Ú., Kos, J. and Song, D., 2019. The secret sharer: Evaluating and testing unintended memorization in neural networks. In 28th {USENIX} Security Symposium ({USENIX} Security 19) (pp. 267-284).

Cited by

Sorted by citations

Related

Authors
Lu, M. Y., Chen, R. J., Kong, D., Lipkova, J., Singh, R., Williamson, D. F. K., Chen, T. Y., & Mahmood, F.
Affiliations
  • Broad Institute (US)
  • Brigham and Women's Hospital (US)
  • Northwell Health (US)
Corresponding author
Mahmood, Faisal
ORCID
Venue
Medical Image Analysis
Publisher
Elsevier BV
Published
2022-02
Volume
76
Pages
102298
ISSN
1361-8415 (ISSN-L)
DOI
10.1016/j.media.2021.102298
PMC
PMC9340569
OpenAlex
W3089056520
Semantic Scholar
f979f3571772b7ee16c24a1c135e1a87e86ba043
Cited by
267
References
65
Citations by year
2026: 52 · 2025: 62 · 2024: 60 · 2023: 49 · 2022: 36 · 2021: 8
FWCI
13.47
Type
journal article
Language
en
Open access
Licence
Locations
  • Medical Image Analysis (publishedVersion, cc-by-nc-nd)
  • PubMed (publishedVersion)
  • PubMed Central (acceptedVersion, cc-by-nc-nd)
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University)
Funders
  • Brigham and Women's Hospital
  • National Institutes of Health
  • Google
  • National Human Genome Research Institute
  • National Science Foundation
  • National Institute of General Medical Sciences (R35GM138216)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › AI in cancer detection
  • Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
  • Health Sciences › Medicine › Radiology, Nuclear Medicine and Imaging › Radiomics and Machine Learning in Medical Imaging
Keywords
federated learning, computational pathology, whole slide images, differential privacy, weakly supervised learning, survival prediction, patient stratification, privacy-preserving data sharing, histology, multicenter collaboration
MeSH terms
Algorithms, Histological Techniques, Humans, Privacy

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Claims read by deepseek-v4.1-flash under definition version 3 (extract-v3) on 2026-10-09.

Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-10-09.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review