Can split federated ECG learning stay private? Heart signals were reconstructed from shared activations
An Indian team reduced the client-side model to 28.4 KiB and matched leading federated baselines on a patient-independent ECG benchmark. But an attack recovered ECG waveforms from transmitted activations, while rare arrhythmia classes remained weak.
The short version
- What happened
- FedIoMT-RPM placed a 28.4 KiB network on each client—6.8 times smaller than full-model federated learning—and achieved 93.97% accuracy, 0.731 MCC and 60.07% macro-F1 across six seeds.
- Who it affects
- Wearable users could benefit from smaller on-device training workloads, but the tested architecture did not keep transmitted representations private against reconstruction.
- What remains unproven
- The experiments used public retrospective ECG databases and simulated clients rather than physical wearables or a prospective service.
Keep in mind
The experiments used public retrospective ECG databases and simulated clients rather than physical wearables or a prospective service.
Supraventricular test beats were heavily concentrated in one record, and fusion-beat detection was near zero.
Zero-shot comparisons were against research baselines, not predefined clinical safety thresholds or patient outcomes.
The reconstruction attack demonstrates leakage, but the paper does not validate a complete privacy defence for clinical deployment.
Source analysis · 1 linked source. Primary analysed source date: 4 November 2026.
Read the full report · 8 min The evidence, methods, implications and limitations
The direct finding: a smaller edge workload did not deliver privacy by architecture alone
A Scientific Reports paper introduces FedIoMT-RPM, a split federated learning system intended for wearable or hospital ECG devices that cannot train a full neural network locally. Each client runs a 28.4 KiB front section, 6.8 times smaller than the full-model federated baseline, then sends intermediate activations to a server that completes training. On the patient-independent MIT-BIH benchmark, the method reached 93.97% accuracy, a Matthews correlation coefficient of 0.731 and macro-F1 of 60.07%, averaged across six random seeds. Its overall detection performance was statistically comparable to the strongest federated baselines reported in the study.
The privacy result is the more consequential finding. The system does not transmit raw ECG recordings, but the researchers' reconstruction attack recovered ECG signals from the activations that crossed the network boundary. Membership-inference tests stayed near chance, meaning the tested attacker struggled to tell whether a particular sample was in training, yet that does not neutralise waveform reconstruction. Split learning changes where computation occurs; it does not automatically make what crosses the split unintelligible. The authors explicitly say the activations need protection before clinical use, so this is a research architecture rather than a deployable privacy guarantee.[1]
How the system divides work and adapts each client's influence
In split federated learning, a patient device or hospital client processes each heartbeat through early layers and sends the resulting representation—often called smashed data—to a server. The server continues the forward and backward passes, while model updates from several clients are aggregated. FedIoMT-RPM combines that split with a bounded adaptive weighting rule. A client's contribution depends partly on sample size and partly on a smoothed measure of its local validation performance, with limits intended to prevent a temporarily strong client from dominating the shared model. Five clients held complete patient records rather than randomly mixed beats.
That patient-level separation is important. If beats from one person appear in both training and test data, a classifier can exploit person-specific signal patterns and look more general than it is. The study used an inter-patient MIT-BIH protocol and repeated each method with six seeds, making the estimate more credible than a single convenient split. The proposed client network is small enough to support the engineering case for constrained devices, and the method averaged 18.9% less communication than SplitFed among the split approaches. Those are computational results, not measurements of battery life, network latency or reliability on an actual wearable.[1]
The distinction that matters
What crosses the split—and where the evidence breaks
Moving early layers to the client reduced local model size, but intermediate signals still carried recoverable information.
Client device
Process ECG with a 28.4 KiB network
6.8× smaller than full-model FL
Network boundary
Transmit intermediate activations
No raw file, but recoverable waveform information
Server
Complete training and return gradients
Shared computation across five clients
Benchmark
Test patient-independent classification
93.97% accuracy; 60.07% macro-F1
Privacy test
Run reconstruction attack
ECG recovered; protection still required
Accuracy conceals the weakest and most concentrated classes
The 93.97% accuracy headline is dominated by common heartbeat categories. Macro-F1, which gives each class more equal weight, was much lower at 60.07%. Sensitivity for supraventricular beats was 64.8%, and fusion-beat detection was near zero. Those rare classes matter precisely because a remote-monitoring system cannot claim broad arrhythmia recognition if it mainly succeeds on abundant normal or ventricular examples. Matthews correlation of 0.731 offers a more balanced summary than accuracy, but clinical readers still need the per-class confusion matrix and the consequence of each missed rhythm.
The distribution is also unusually concentrated: 1,381 of the 1,781 supraventricular test beats came from a single record. A model may therefore appear to learn a class while its estimate depends heavily on one person's physiology and annotation. The authors surface this limitation rather than smoothing it away, which is valuable. It also means the 64.8% sensitivity is not a stable estimate of performance across diverse patients. Confidence would require more people contributing each rare class, patient-level uncertainty intervals and testing that reflects the prevalence and recording noise of the intended care setting.[1]
The external checks test transfer, but not a clinical deployment
The researchers ran zero-shot evaluations on INCART and PTB-XL without retraining and found performance comparable to their federated baselines. That is stronger than reporting only MIT-BIH results because the external datasets differ in provenance and recording context. Yet comparable-to-baseline is a relative technical claim. It does not show that either system reaches a clinically acceptable threshold, that alert calibration is useful, or that clinicians can act on its classifications. The datasets are public and anonymised, and no new patients or prospective monitoring episodes were enrolled.
MIT-BIH is a long-standing research resource with limited numbers of records and legacy acquisition conditions. INCART and PTB-XL broaden the test, but the study still does not reproduce the messy pipeline of a consumer wearable or hospital telemetry service: motion artefact, intermittent connectivity, device variation, software updates, missing leads and an intervention workflow. A real deployment would also need to define whether inference stays on-device, what the server retains, how clients authenticate and what happens when a model update fails. The paper evaluates an algorithmic training design, not an end-to-end regulated monitoring service.[1]
Why reconstruction changes the privacy claim for hospitals and patients
Health data can leak through derived representations even when the source file never leaves a device. An ECG waveform can contain clinically sensitive patterns and may support linkage with other records. If an honest-but-curious server or an attacker controlling part of the training path can reconstruct the signal, saying that raw data were not shared offers little practical comfort. The attack in this paper is a controlled test, not evidence that a patient system was breached. It is nevertheless direct evidence against treating split placement as sufficient protection.
Possible defences include adding carefully calibrated noise, encrypting computation, compressing or perturbing activations, changing the cut layer, applying secure aggregation and reducing what the server can observe. Each can cost accuracy, bandwidth, latency or battery. The correct defence depends on a threat model that names the adversary, access and protected information. It also requires repeat attacks after every architectural change. Hospitals would need conventional controls too: contracts, data minimisation, key management, access logs, retention limits, vulnerability testing and incident response. Federated or split learning should be one control inside that system, not a privacy label attached to it.[1]
What would change this assessment
The evidence would strengthen if the authors or independent teams reproduce the efficiency results on physical low-power devices, measure energy and end-to-end latency, and test larger multi-institution datasets with enough patients in each clinically important rhythm. Prospective silent deployment could assess calibration and false alerts without influencing care. Privacy evaluation should include stronger reconstruction and gradient attacks under realistic server and network access, report waveform similarity and clinically recognisable features, and demonstrate that a defence blocks recovery while preserving acceptable performance.
The assessment would weaken if rare-class performance falls further in new populations, if adaptive weighting amplifies a narrow client's quirks, or if privacy defences erase the claimed efficiency advantage. The authors report no external funding or competing interests, and Vellore Institute of Technology provided facilities and open-access funding. This peer-reviewed accepted version is citable but may still receive publisher edits. It is consequential because it joins an engineering gain to an explicit privacy failure, not because it proves a clinical tool is ready. It is not Breaking: no live breach, recall or patient incident is reported.[1]