Hospitals and healthcare organizations collect vast amounts of patient data, such as MRI scans, which hold significant potential for advancing automated clinical support systems. However, privacy concerns and the lack of robust data anonymization and protection mechanisms often hinder data sharing and collaborative research. To this end, privacy-preserving and data sanitization techniques have emerged as a promising direction. Among them, Homomorphic Encryption (HE) allows computations to be performed directly on encrypted data without requiring decryption, thereby safeguarding sensitive information throughout the analytical pipeline. In this paper, we investigate the feasibility of leveraging homomorphic encryption to enable Expanded Disability Status Scale (EDSS) classification in Multiple Sclerosis (MS). Thus, we design a dedicated neural network, namelyHybrid AHE-CNN, tailored for processing images together with homomorphically encrypted sensitive data, allowing for secure and privacy-preserving inference without exposing raw patient data. Experimental results demonstrate that our proposed method achieves classification performance comparable to that of models trained and evaluated on plaintext data, highlighting the practical applicability of HE in real-world healthcare settings.
Human error in medicine remains a significant cause of misdiagnosis, and the rapid expansion of medical knowledge makes it increasingly challenging for physicians to keep pace. In this scenario, intelligent systems that support clinical decision-making, such as Computer-Aided Diagnosis (CAD) and Clinical Decision Support Systems (CDSS), are gaining traction in both scientific and medical circles because they can help address longstanding challenges in healthcare. Today’s Decision Support Systems (DSS) often rely on Machine Learning (ML) and Deep Learning (DL) technologies, which can extract valuable insights from healthcare data. By doing so, they enhance diagnostic accuracy, expedite medical decision-making, and streamline clinical workflows.
CAD and CDSS may assist in detecting diseases, predicting conditions, such as Alzheimer’s or Parkinson’s, or suggesting appropriate diagnoses and treatments based on extensive clinical datasets. Moreover, these systems help reduce errors by providing objective, data-driven analys1es].[Additionally, DSS can automate certain aspects of the diagnostic process, enabling physicians to save time and concentrate on more complex or urgent cases. Over the long term, such tools could enhance overall welfare, especially in areas with a shortage of specialists, such as rural regions or developing countries, by enabling the dissemination of digital health solutions in under-resourced settings. However, despite
CEUR Workshop
ISSN1613-0073 their high performance and clear advantages, CAD and CDSS face a significant barrier to widespread adoption: the scarcity of extensive and balanced datasets for many diseases. Although healthcare institutions possess vast amounts of data, sharing and processing this sensitive information without compromising patient privacy requires addressing several key privacy concerns. Patient records often contain critical predictive features that are also highly personal, and any accidental exposure or misuse could lead to severe ethical and legal repercussions. As a result, these challenges significantly slow down the development of collaborative diagnostic systems that depend on data from multiple institutions.
Increasing attention has been given in recent years to privacy-preserving machine learning (ML)
techniques, which aim to enable predictive models to be continuously trained and applied to sensitive
data without compromising its confidentiality [
One of the most promising approaches is Homomorphic Encryption (HE), a form of encryption that allows computations to be performed directly on encrypted data without requiring decryption. This type of encryption enables encrypted inputs to undergo various arithmetic and logical operations as if they were in plaintext. This groundbreaking property makes HE particularly suitable for privacy-preserving healthcare applications. For instance, a hospital could encrypt its patient records and outsource model training or inference tasks to third-party services without revealing any sensitive information. These services can perform ML computations, such as classifying a tumor as benign or malignant, on the encrypted data and return an encrypted result. Only the hospital, with the appropriate decryption key, can then access the final output.
In the context of collaborative learning across multiple institutions, homomorphic encryption enables the development of shared models without requiring any party to expose its patient data. Each institution can encrypt its data, contribute to the training process, and receive updates without ever compromising patient confidentiality. However, the definition of these types of models is highly challenging due to the computational overhead and complexity associated with performing machine learning operations on encrypted data, as well as the fact that most existing algorithms are not naively compatible with the limited set of operations supported by most HE schemes.
Scope and contributions of this work. We propose a neural network that enables secure training and inference on encrypted multimodal medical data using approximate homomorphic encryption (AHE). As a use case, we focus on Multiple Sclerosis classification and grading problems (MSCGP), combining MRI images with sensitive clinical data to enable the privacy-preserving classification task. We introduce a new CNN adapted for encrypted computation, namelyHybrid AHE-CNN, for binary and multiclass classification tasks. To preserve patient confidentiality, we adopt the CKKS scheme, which supports computations on encrypted clinical features without revealing sensitive clinical data. Therefore, the contributions of this paper are: • A new Hybrid AHE-CNN architecture that integrates encrypted clinical data with unencrypted MRI slices to improve diagnostic performance while preserving privacy; • A comparative evaluation of the encrypted neural network with traditional CNN on both binary and multiclass EDSS classification tasks.
The remainder of the paper is organized as follows. In Sectio2n, we describe relevant studies concerning homomorphic encryption and its application in medical image classification, with a focus on MRI data. In Section 3, we provide a brief overview of the dataset used, including the characteristics of the brain MRI dataset. In Section 4, we first formalize the problem of working with encrypted MRI images, and then we present the new Hybrid AHE-CNN. In Section 5, we discuss the results achieved from the experimental evaluations, including both binary and multiclass classification performance with respect to the homomorphic encryption approach. Finally, conclusions and future directions are provided in Sectio7n.
Computer-Aided Diagnosis (CAD) and Clinical Decision Support Systems (CDSS) have shown great potential in
assisting clinicians in early diagnosis, prognosis, and treatment planning, especially in complex neurological
disorders such as Multiple Sclerosis (MS)4[
In this scenario, Fully Homomorphic Encryption (FHE) is emerging as a promising solution, thanks to its ability to allow inference directly on encrypted data. FHE helps preserve patient confidentiality without sacrificing model performance. In this scenario, FHE can facilitate collaborative training and inference across institutions while ensuring regulatory compliance and enabling privacy-preserving deep learning methodologie1s1][.
Recent studies have demonstrated the feasibility of performing deep learning inference under FHE. For instance,
in [
Another recent proposal is CaRENets 1[
Other contributions have extended the application of FHE beyond inference to support training as well. The
MORE framework [
Recently, more hardware-aware frameworks have emerged, such as HoRNS-CNN15[] that leverages FPGAbased encryption modules and low-degree polynomial approximations of ReLU to enable eficient end-to-end encrypted MRI classification. Their design achieves strong privacy-utility trade-ofs, particularly in energy and latency metrics. Another recent framework is PervPPML16[] that integrates lightweight symmetric encryption with homomorphic methods to reduce the overhead of FHE on edge devices, showing its applicability in ECG classification with minimal accuracy loss.
Other recent studies have investigated new strategies, such as using binarized networks under encryption
[
In our study, we propose a novel hybrid neural network that processes MRI images along with encrypted clinical data to classify EDSS points with diferent levels of granularity. Unlike prior works that either process plaintext data or consider only a single type of data, our approach combines MRI images with sensitive clinical data encrypted using approximate homomorphic encryption (AHE). This enables secure classification of Multiple Sclerosis patients in both binary and multiclass settings, preserving patient privacy while maintaining reasonable diagnostic performances.
In this section, we describe the datasets and preprocessing steps used to evaluate our proposeHdybrid AHE-CNN for Multiple Sclerosis classification. We first outline the characteristics of the brain MRI dataset and the associated clinical metadata. Then, we provide an overview of the preprocessing steps adopted for labeling datasets and addressing data imbalance.
To enable the classification of disability severity in Multiple Sclerosis (MS) patients from MRI scans, we use one
multi-sequence MRI dataset related to 60 MS patients with consensus manual lesion segmentation, EDSS, general
patient information, and clinical information2[
2D axial MRI slices were extracted from each patient’s 3D scan for both datasets and stored as individual grayscale images. Each image was labeled according to the EDSS-based class assigned to the corresponding (a) FLAIR (b) T1 patient. The resulting datasets were stored in separate folders and loaded via a custom PyTorDcahtaset class that records patient identifiers and slice indices, facilitating data stratification and per-patient evaluation.
This dual-dataset approach allows the exploration of both simplified and nuanced diagnostic models, enabling the evaluation of classifier performance across diferent levels of clinical relevance and computational complexity.
Starting from this, we consider two diferent sets of labels associated with the original imaging and metadata sources. These datasets difer in their target labeling strategy and correspond to two diferent levels of granularity in the clinical assessment of disease severity.
The first configuration aims to address a binary classification task, in which the patients are grouped into two classes based on their Expanded Disability Status Scale (EDSS) score, i.e., clas0sthat includes all patients with an EDSS value less than or equal to 2.0, and class1 with all patients with EDSS greater than2.0. It is important to notice that a patient belonging to class0 is a patient that does not show significant lesions and minimal or no functional impairment, whereas clas1s contains patients with evident neurological lesions and clinical symptoms.
The second configuration aims to address a multi-class classification task. In this case, EDSS scores were mapped to three categories,normal, mild, and severe. Specifically, scores from 0 to 2.0 were labeled as normal, indicating little to no disability; scores between 2.5 and 4.0 were labeled amsild, capturing patients with moderate impairment but preserved ambulation, and scores greater than 4.0 were labeled saesvere, corresponding to individuals with significant motor or systemic dysfunction.
Following the introduction of both binary and multiclass labeling strategies based on EDSS scores, a significant class imbalance was observed in the resulting dataset.
Table 1 summarizes the data distribution across the diferent configurations for both binary and multiclass classification tasks. As we can see, there is a significant class imbalance in the original dataset in both configurations. In fact, for the binary task, we have3, 765 and 424 instances for class0 and class1, respectively, whereas for the multiclass we have 2, 071, 1, 233, and 885 instances labeled as Normal, Mild, and Severe, respectively.
Since class imbalance can negatively impact the performance of predictive models in classification tasks, we adopted several undersampling and oversampling techniques to mitigate this issue. These techniques were applied
15% test sets. The validation and test sets were left unchanged to preserve their statistical representativeness.
The undersampling was performed by randomly reducing the number of instances in the majority class to match the minority classes. This resulted in a balanced dataset containing848 instances for the binary task and 2, 655 instances for the multiclass task, with equal representation for each class.
Instead, for augmenting data, we applied both transformations and the SMOTE (Synthetic Minority
Oversampling Technique) on the original data. Concerning the transformations, each original image was first resized
to 128 × 128 pixels and normalized to zero mean and unit variance. Augmented samples were then generated
by applying a random combination of horizontal flips, small-angle rotations (up to20∘), and afine translations,
within a 10% range along both axes. These transformations preserved the anatomical structure while introducing
controlled variability in orientation and positioning. Conversely, the SMOTE technique allowed us to generate
synthetic samples of minority classes by interpolating feature vectors2[
Homomorphic Encryption (HE) is a class of encryption schemes that allows computations to be performed directly on encrypted data, without needing to decrypt it first. This property is especially valuable in privacy-sensitive domains like medical imaging, where sensitive data must remain confidential even when outsourced to untrusted servers for analysis. Depending on the scheme, HE supports either exact arithmetic over integers or approximate arithmetic over real numbers. In both cases, the goal is to ensure that operations performed on ciphertexts correspond, up to some approximation, to operations on the original plaintexts.
In this section, we provide an overview of the techniques underlying our work, including the application of Approximate Homomorphic Encryption (AHE) on data processed with Convolutional Neural Networks (CNNs).
Let = {
}=1 be a set of Magnetic Resonance Imaging (MRI) scans, where each image ∈ ℝℎ× is a grayscale image of resolutionℎ × . Let = {
1, 2, … , } be a set of patients where each is associated with a sensitive patient-specific variables, such as age and diagnostic codes. The goal is to enable secure and privacy-preserving computation on this data by processing it with encrypted weights, aiming to output an encrypted representation of the feature maps conditioned by the related clinical information.
Let f ∈ ℝ be the clinical feature vector associated with a patient, to preserve privacy, we encryptedf using a homomorphic encryption scheme, resulting from the encryption operation under a public kpeyk and denoted as: f̃= Encrypt(f , pk, ). (1) where is the encryption context, whose exact parameters depend on the chosen scheme. For example, in CKKS, which is designed for approximate real arithmetic, typically includes the following parameters: , the degree of the polynomial modulus, which determines the ciphertext size and the number of available slots; = { log2 0, log2 1, … , log2 }, a modulus chain that supports a multiplicative depth , thus afecting both precision and computational capacity; andΔ, a global scaling factor used for fixed-point encoding of real numbers.
Let x be the flattened version of an image , to process privatized data together with MRI images, it is necessary to compute arithmetic operations betwee n and weights w by using an AHE scheme. Thus, given a convolutional filter w ∈ ℝ×× , where is the number of input channels and the kernel size, the filter is flattened and encrypted asw̃= Encrypt(w , pk, ) .
A homomorphic element-wise multiplication is then performed betweenw̃and f̃, resulting in a patient-specific encrypted weight tensorw̃= w̃∘ f̃. This operation allows for personalizing the convolutional weights with respect to encrypted patient features, without ever revealing their plaintext values. The encrypted tenswor̃is then decrypted under a private keysk to obtain the conditioned filter w = Decrypt(w ̃,sk, ) . The convolution image and sensitive data while preserving privacy throughout the training phase. x ∗ w produces a feature map that conveys personalized representations of the input imagxe , reflecting the patient-specific characteristics encoded in f . This approach enables the model to adapt its processing to both
We developed a conditioned CNN architecture specifically designed to classify EDSS scores from MRI brain slices, with the distinctive integration of homomorphic encryption to modulate part of the model’s parameters securely.
Figure2 shows an overview of the architecture of the proposedHybrid AHE-CNN. A first convolutional block,
denoted Conv2 and parameterized by a weight tenso r ∈ ℝ 1×1×3×3, operates on the 128 × 128 single-channel
input slice. Before every forward pass, the nine-dimensional clinical vect orassociated with the current patient
is encrypted using the CKKS scheme. TenSEAL then performs an element-wise product between the encrypted
weights and the encrypted vector, after internally repeating until the shapes match. The modulated weights are
then decrypted and clipped to[
Dec(Enc( ) ⊙ Enc( ) ), batch ← clip( ,̃−1, 1 ).
(2)
A parallel unconstrained3 × 3 convolution, Conv2_2, is applied to the same input. The output is then concatenated with that of Conv2, yielding a two-channel feature map. The network follows a pyramidal pattern of channel expansion 2 → 8 → 16 → 32, with each block composed of a 3 × 3 convolution, batch normalization, a ReLU activation and 2 × 2 max-pooling. After flattening (8,192 units), the representation passes through a fully connected layer with 512 neurons, spatial dropout wit h= 0.4 , and a final three-way softmax classifier. Only the weight-modulation step is executed on encrypted data, whereas all subsequent convolutions, normalizations, and dense layers run in plaintext. This hybrid design preserves the privacy of sensitive clinical variables while minimizing the latency overhead associated with fully homomorphic inference.
Figure3 shows the convolutional layer conditioning procedure. As we can see, convolutional weights are first initialized and stored under CKKS homomorphic encryption. For each MRI slice, the corresponding encrypted feature vector is retrieved and used to modulate the encrypted weights via homomorphic multiplication. The modulated weights are then decrypted for gradient-based optimization on the clear-text data, re-encrypted before the next slice, and never expose patient features in clear throughout the process.
The most distinctive aspect ofHybrid AHE-CNN is the encrypted conditioning mechanism applied to theConv2 layer. Clinical metadata were encrypted using the CKKS scheme from the TenSEAL library. These encrypted vectors modulated the layer’s convolutional weights before inference. Specifically, the original weights were lfattened and encrypted, homomorphically multiplied with the encrypted clinical features, decrypted, reshaped, and reinserted into the network. This process enables secure, privacy-preserving influence of sensitive patient information on model behavior without exposing the data in plaintext form.
In this Section, we outline the experimental evaluation performed to address the EDSS classification in Multiple Sclerosis (MS). In particular, we provide the details about the experimental setting, training protocols, and performance metrics employed to assess the efectiveness of the proposed hybrid CNN in classifying the disability severity in Multiple Sclerosis (MS). Then in Section5.1, we describe the results achieved in the two classification tasks, i.e., binary and multiclass.
Experimental Settings The CNN has been implemented using Python version 3.9 and with the support of PyTorch 2.7.1, CUDA 12.6, Scikit-learn 1.6.1, and TensorFlow 2.19.0. All the experiments have been executed on a workstation with an Intel i9 CPU at5 GHz, 14-core, and64GB of memory, equipped with a NVIDIA 3060 GPU.
The CNN was trained using the AdamW optimizer with a mini-batch size of 32. To improve convergence, we employed the Reduce Learning Rate on Plateau strategy, which monitors training performance at each epoch and automatically reduces the learning rate if no improvement is observed for 15 consecutive epochs. Moreover, a class-weighted cross-entropy loss was adopted to address the natural imbalance in the class distributions. The weights of the classes were calculated on the basis of the inverse frequency of each class.
For the oversampling, we used the functions of thetorchvision library for multidimensional image processing, which contains several functions and filters for multidimensional image processing. The images have been transformed through thetransform method, which enables to combine of multiple transformations to be applied to an image. To evaluate the efectiveness of the proposed Hybrid AHE-CNN, we compare its performance with CNNs operating on unencrypted data, taking into account all the variations applied to the dataset in each experimental setup.
Concerning the homomorphic settings, we employed an approximate homomorphic encryption scheme based on the CKKS protocol, which supports arithmetic operations on encrypted floating-point numbers. The encryption context was instantiated with a polynomial modulus degree of8192 and coeficient modulus bit sizes set to [60, 40, 40, 60], providing a balance between computational eficiency and encryption depth. We set the global scale to 240, ensuring suficient precision for encrypted tensor operations during inference. Evaluation Metrics. To evaluate the performance of the proposed CNNs, we use Accuracy, Precision, Recall, and F1-score metrics. The latter are defined in terms of the number of True Positives (TP), i.e., when an instance of an EDSS type is identified to belong to its true class, e.g., a patient belonging to the class EDSS 1, is correctly classified as EDSS 1. False Positive (FP), i.e., when an instance is incorrectly predicted to belong to a class other than its true class, e.g., a patient belonging to the class EDSS1, is incorrectly classified as EDSS 0. True negative (TN), i.e., an instance of the 0 class is correctly predicted as0. False Negative (FN), i.e., a patient belonging to the class 1, is incorrectly predicted as0.
For both binary classification, where models aim to distinguish betweenEDSS 1 and EDSS 0, and multiclass classification, where the goal is to diferentiate between multiple severity levels such as normal, mild, and severe, the corresponding evaluation metrics are reported in Tab2le.
In this Section, we discuss the results of the proposedHybrid AHE-CNN in identifying both the EDSS score and the severity level, for binary and multiclass classification tasks, respectively. All models were evaluated on encrypted inputs using the AHE scheme, with intermediate feature maps decrypted before being forwarded to the final classification layers, as described in Section 4.1.
Binary Classification. In the binary task, the classification task involves distinguishing between patients with an EDSS lower than or equal to2.0, labeled as the class indicating the absence of significant lesions and minimal or no functional impairment, labeled as the negative class, and those with an EDSS greater tha2n.0, corresponding to the presence of neurological lesions and clinically relevant symptoms, labeled as the positive class. We evaluated the proposed encrypted CNN architecture under diferent training conditions, including
Accuracy Precision Recall F1-score
+ + + + + + binary task classification, considering diferent training setups.
As we can see, for the dataset Brain MRI Dataset, without data augmentation techniques, theHybrid AHE-CNN achieves an accuracy of0.90, with a value of 0.32 for precision,0.33 for recall, and0.31 for F1-score. Instead, for Plaintext CNN, it achieves values of 0.99, 0.33, 0.33, 0.33, for accuracy, precision, recall, and F1-score.
While they have achieved higher accuracy0.90 and 0.99, they exhibit similarly low precision and recall, suggesting that both models sufer from class imbalance in the original dataset. This suggests that both models are overfitting to the majority class, and they fail to reflect their poor ability to detect the minority class.
When class imbalance is mitigated through undersampling, both models show similar performances. The Hybrid AHE-CNN achieves an accuracy value of0.69, a precision of0.73, a recall of 0.59, and a F1-score of0.65, while the plaintext CNN achieved accuracy, precision, recall, and F1-score values o0f.68, 0.70, 0.68, and 0.67. These results demonstrate that both models perform better in classifying both classes. In particular, the CNN demonstrates significantly higher accuracy than the plain CNN, indicating a tendency to classify most instances as instances with neurological lesions and clinically relevant symptoms.
In the health domain, identifying diseases or lesions is a critical challenge, as misclassifications of an image can lead to a missed early diagnosis, with potentially severe consequences for the patient. Therefore, in case of ambiguity, it is more appropriate to identify the presence of a disease so that patients and clinicians can proceed with further diagnostic tests.
On the other hand, a model that tends to classify cases as non-pathological may reduce the number of false positives, but at the cost of misclassifying actual disease cases.
Concerning the oversampling technique applied to the dataset Brain MRI Dataset, as we can see, plaintext CNN achieves higher performances than theHybrid AHE-CNN, reaching a value of 0.82 for accuracy,0.84 for precision,0.82 for recall, and0.82 for F1-score. Instead, theHybrid AHE-CNN achieved a value of 0.67 for accuracy, 0.64 for precision,0.76 for recall, and0.69 for F1-score. These results indicate that, althoughHybrid AHE-CNN is less accurate, it achieves a high level of recall, suggesting that it is more efective in identifying lesions. However, this leads to an increase in false positives, which is shown by its lower precision. Although the plain CNN achieves higher accuracy and a better balance between precision and recall, its lower recall suggests that it may fail to detect some pathological cases.
With SMOTE augmentation, both CNNs exhibit higher performances and a more balanced trade-of between precision and recall. In particularH, ybrid AHE-CNN performs slightly better than the plain CNN, achieving values of 0.84 for accuracy,0.80 for precision,0.85 for recall, and0.82 for F1-score. Similarly, the plain CNN achieved a value of accuracy of0.82, a precision value of0.81, a recall value of 0.82, and an F1-score of0.82. This result suggests that SMOTE augmentation efectively mitigates class imbalance, allowing both encrypted and unencrypted models to generalise classification instances better.
The multiclass classification task extends the binary setting by splitting patients into three distinct clinical severity levels, i.e.N,ormal EDSS scores from0 to 2.0, Mild, i.e., EDSS scores between 2.5 and 4.0, and Severe, i.e., EDSS scores greater than4.0. This task allows for a more detailed categorisation of neurological impairment, providing a classification framework that closely reflects clinical practice in multiple sclerosis assessment.
As shown in Table 4, the plaintext CNN generally outperforms the encrypted CNN in the original setting, reaching an accuracy of0.64, with a precision of0.67, but exhibiting lower recall and F1-score, both a0t.50. This indicates that while the plaintext model is better calibrated in terms of correct predictions overall, it may struggle to correctly identify all severity levels, especially the minority class. While the CNN achieved slightly lower precision, a value of0.60, and accuracy, a value of0.58, in the encrypted setting, it reached higher recall, a value of 0.58, and F1-score, a value of0.57, compared to the plaintext CNN. This suggests that the encrypted model, despite achieving lower performance, may ofer better sensitivity to minority classes, probably due to the conditioning implemented during the training phase of the encrypted model. These results highlight a trade-of between model precision and class sensitivity, which is particularly relevant in medical contexts where the cost of misclassifying serious cases can be high.
About the results achieved by the application of the undersampling approach, the encrypteHdybrid AHE-CNN outperforms the plaintext CNN across all metrics, achieving an accuracy o0f.38, a precision of0.39, a recall of 0.38, and an F1-score of0.36. Instead, the plaintext CNN exhibits lower performance, achieving a value of accuracy of 0.31, a precision of0.32, a recall of 0.33, and an F1-score of0.31, suggesting that the encrypted model is more robust to synthetic data than the plaintext CNN and benefits more from augmentation in imbalanced scenarios.
Regarding the oversampling augmentation, theHybrid AHE-CNN performs slightly better than the plaintext CNN, achieving values for accuracy, precision, recall, and F1-score o0f.39, 0.40, 0.39, and 0.38. For the plaintext, it achieved for all metrics a value of0.33.
Concerning the SMOTE-based balanced setting, the encrypted model achieves lower accuracy, 0.43, compared to the plaintext CNN, which reaches 0.49. However, the encrypted CNN outperforms the plaintext model in terms of precision, exhibiting a value of0.44 and 0.39, and an F1-score of 0.42 and 0.33, respectively. These results indicate that, with increased SMOTE, the unencrypted CNN benefits most in terms of accuracy and recall, while the Hybrid AHE-CNN shows a more balanced compromise between precision and recall, leading to a higher F1-score. This suggests that the encrypted model may be better at handling synthetic samples in order to preserve class-level discrimination, especially in multi-class scenarios. Despite the improvements introduced by augmentation strategies, overall performance across all models remains belo5w0% for most metrics. This can be attributed to several factors: (i) the multiclass classification task is inherently more complex than the binary case, due to the presence of three clinically adjacent severity levels with overlapping EDSS score ranges, which can complicate classification between classes; (ii) the dataset exhibits significant class imbalance, particularly afecting minority classes, i.e. “Mild” and “Severe”, which restricts the model’s ability to learn representative features for all groups; (iii) oversampling and undersampling techniques may introduce synthetic artifacts or remove informative instances, reducing the quality of the training. Indeed, as we can see from the result achieved from the original dataset, both theHybrid AHE-CNN and the Plaintext model achieved results equal to or close to 50%.
Privacy-preserving models are essential in the clinical domain to protect sensitive patient data, with homomorphic encryption (HE) techniques playing a key role due to their ability to perform computations directly on encrypted data. However, HE presents important limitations that impact its practical application. One major challenge is the significant computational overhead introduced by homomorphic operations. Our proposed model relies on the TenSEAL (CKKS) library, which causes notable latency during both encryption and decryption phases. Frequent serialization and deserialization of encrypted data further slow down training and inference.
Although the proposed model computes only one layer on encrypted data, the end-to-end execution time is significantly increased compared to a completely plaintext version. In addition, the proposedHybrid AHE-CNN works on 2D MRI images and considers a limited set of clinical features provided with the dataset. Nevertheless, it has the potential to be adapted to larger sets of clinical data. Moreover, it is necessary to consider that the encryption of data can lead to introducing some approximation in the data due to the encryption schemes adopted. This can lead to an approximation in the classification results, due to minor rounding errors at each operation, yielding a slight degradation of the overall performance.
In a real-world clinical scenario, clinicians need precise responses and not overly expensive infrastructure. The encryption of clinical data requires competitive hardware requirements, making it challenging to integrate these solutions into existing clinical workflows without a secure and solid client-server infrastructure. Moreover, it is necessary to consider the complexity of integrating with legacy healthcare systems. In fact, many hospital information systems and electronic health records (EHRs) were not designed with privacy-preserving machine learning in mind and may lack the necessary interfaces to support encrypted computation workflows. This creates integration challenges that require technical adaptations for the definition of support systems that comply with strict healthcare regulations and data privacy laws, such as HIPAA and GDPR.
In this work, we addressed the EDSS classification tasks for Multiple Sclerosis patients while preserving the privacy of sensitive clinical data. To this end, we proposedHybrid AHE-CNN, a convolutional neural network that integrates homomorphically encrypted patient metadata with MRI images through an encrypted weight conditioning mechanism. Unlike traditional models that rely solely on plaintext inputs, ouHrybrid AHE-CNN enables secure, patient-specific inference without revealing raw clinical information. Experimental results demonstrate that the proposed hybrid model achieves classification performance comparable to that of conventional plaintext CNNs. These findings confirm the practical feasibility of applying homomorphic encryption in real-world clinical scenarios, showing that privacy preservation does not necessarily come at the cost of diagnostic accuracy.
In the future, we would like to investigate methods to improve the scalability and eficiency of our encrypted computation framework for practical deployment. This includes reducing computational overhead to handle more complex data, such as high-resolution 3D MRI volumes and deeper neural networks, by optimizing the homomorphic encryption pipeline. We will explore cryptographic enhancements like ciphertext packing, faster bootstrapping, and key-switching, alongside hardware acceleration using GPUs, FPGAs, or ASICs. Additionally, we plan to study algorithmic strategies such as low-precision and quantized networks to reduce encrypted computation complexity. Research on hybrid privacy-preserving techniques combining homomorphic encryption with other methods could also balance security and performance. Finally, we would like to simplify key management and integrate encrypted models into clinical workflows will be essential to enable real-time and privacy-preserving AI in healthcare.
D3 4 Health – Digital Driven Diagnostics, Prognostics and Therapeutics for Sustainable Health Care (Project PNC0000001 – CUP: B53C22006090001), funded by the European Union – NextGenerationEU under the National Plan for Complementary Investments to the NRRP.
The author(s) have not employed any Generative AI tools.