Paper deep dive
Adaptive Differential Privacy for Federated Medical Image Segmentation Across Diverse Modalities
Puja Saha, Eranga Ukwatta
Intelligence
Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 97%
Last extracted: 4/10/2026, 3:38:34 AM
Summary
The paper introduces Adaptive Differentially Private Federated Learning (ADP-FL), a framework for medical image segmentation that dynamically adjusts privacy mechanisms—specifically gradient clipping and noise injection—to balance the privacy-utility trade-off. By calibrating these mechanisms to evolving gradient distributions, ADP-FL improves training stability and segmentation accuracy across diverse modalities (dermoscopic images, 3D CT, and multi-parametric MRI) compared to standard DP-FL, achieving performance closer to non-private federated learning.
Entities (5)
Relation Signals (4)
ADP-FL → evaluatedon → HAM10K
confidence 100% · We evaluated ADP-FL across diverse imaging modalities and segmentation tasks, including skin lesion segmentation in dermoscopic images
ADP-FL → evaluatedon → KiTS23
confidence 100% · We evaluated ADP-FL across... kidney tumor segmentation in 3D CT scans
ADP-FL → evaluatedon → BraTS24
confidence 100% · We evaluated ADP-FL across... brain tumor segmentation in multi-parametric MRI
ADP-FL → outperforms → DP-FL
confidence 95% · Compared with conventional federated learning and standard differentially private federated learning, ADP-FL consistently achieves higher accuracy
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Large volumes of medical data remain underutilized because centralizing distributed data is often infeasible due to strict privacy regulations and institutional constraints. In addition, models trained in centralized settings frequently fail to generalize across clinical sites because of heterogeneity in imaging protocols and continuously evolving data distributions arising from differences in scanners, acquisition parameters, and patient populations. Federated learning offers a promising solution by enabling collaborative model training without sharing raw data. However, incorporating differential privacy into federated learning, while essential for privacy guarantees, often leads to degraded accuracy, unstable convergence, and reduced generalization. In this work, we propose an adaptive differentially private federated learning (ADP-FL) framework for medical image segmentation that dynamically adjusts privacy mechanisms to better balance the privacy-utility trade-off. The proposed approach stabilizes training, significantly improves Dice scores and segmentation boundary quality, and maintains rigorous privacy guarantees. We evaluated ADP-FL across diverse imaging modalities and segmentation tasks, including skin lesion segmentation in dermoscopic images, kidney tumor segmentation in 3D CT scans, and brain tumor segmentation in multi-parametric MRI. Compared with conventional federated learning and standard differentially private federated learning, ADP-FL consistently achieves higher accuracy, improved boundary delineation, faster convergence, and greater training stability, with performance approaching that of non-private federated learning under the same privacy budgets. These results demonstrate the practical viability of ADP-FL for high-performance, privacy-preserving medical image segmentation in real-world federated settings.
Tags
Links
- Source: https://arxiv.org/abs/2604.06518v1
- Canonical: https://arxiv.org/abs/2604.06518v1
Trouble viewing inline? Open PDF directly →
Full Text
38,831 characters extracted from source content.
Expand or collapse full text
Further author information: (Send correspondence to P.S.) P.S.: E-mail: psaha03@uoguelph.ca E.U.: E-mail: eukwatta@uoguelph.ca Adaptive Differential Privacy for Federated Medical Segmentation Across Modalities and Complexity Levels Puja Saha College of Engineering, University of Guelph, 50 Stone Road E, Guelph, ON, Canada Eranga Ukwatta College of Engineering, University of Guelph, 50 Stone Road E, Guelph, ON, Canada Abstract Large volumes of medical data remain underutilized because centralizing distributed data is often infeasible due to strict privacy regulations and institutional constraints. In addition, models trained in centralized settings frequently fail to generalize across clinical sites because of heterogeneity in imaging protocols and continuously evolving data distributions arising from differences in scanners, acquisition parameters, and patient populations. Federated learning offers a promising solution by enabling collaborative model training without sharing raw data. However, incorporating differential privacy into federated learning, while essential for privacy guarantees, often leads to degraded accuracy, unstable convergence, and reduced generalization. In this work, we propose an adaptive differentially private federated learning (ADP-FL) framework for medical image segmentation that dynamically adjusts privacy mechanisms to better balance the privacy–utility trade-off. The proposed approach stabilizes training, significantly improves Dice scores and segmentation boundary quality, and maintains rigorous privacy guarantees. We evaluated ADP-FL across diverse imaging modalities and segmentation tasks, including skin lesion segmentation in dermoscopic images, kidney tumor segmentation in 3D CT scans, and brain tumor segmentation in multi-parametric MRI. Compared with conventional federated learning and standard differentially private federated learning, ADP-FL consistently achieves higher accuracy, improved boundary delineation, faster convergence, and greater training stability, with performance approaching that of non-private federated learning under same privacy budgets. These results demonstrate the practical viability of ADP-FL for high-performance, privacy-preserving medical image segmentation in real-world federated settings. keywords: Optimization, Adaptive Gradient Clipping, Decentralized Learning, HAM10K, KiTS23, BraTS24, Medical Imaging AI, Privacy-Utility Trade-Off. 1 INTRODUCTION Artificial intelligence, particularly deep learning, has demonstrated strong performance in medical imaging tasks such as diagnosis, segmentation, and outcome prediction [10, 21]. Despite these advances, translating AI systems into clinical practice remains challenging due to strict regulatory requirements, the high sensitivity of medical data, and substantial heterogeneity in imaging protocols across institutions. Centralized model training requires aggregating large volumes of patient data, which is often constrained by institutional governance processes, storage limitations, consent requirements, and the need for extensive harmonization of multi-site medical images [15, 13]. Furthermore, variations in acquisition settings, annotation quality, scanner hardware, and patient populations reduce the generalization of centrally trained models and necessitate repeated retraining as clinical data distributions evolve [23, 17]. Federated learning (FL) addresses these challenges by enabling multiple institutions to collaboratively train a shared model without exchanging raw patient data [8, 4]. In FL, clients perform local training and communicate only model updates, reducing regulatory risk and eliminating the need for centralized data transfer. Prior work has shown that FL can improve generalization across heterogeneous clinical sites and enable large-scale collaboration in medical imaging applications [16, 2]. Despite these advantages, FL remains vulnerable to privacy leakage through shared gradients or model parameters. Attacks such as gradient inversion and membership inference have demonstrated that sensitive information can be partially recovered from client updates [26, 14]. To mitigate these risks, differential privacy (DP) has emerged as a principled approach for providing formal privacy guarantees in FL. Standard DP-FL mechanisms typically rely on per-sample gradient clipping and the addition of fixed, calibrated noise prior to aggregation [6, 1]. While effective for privacy protection, this static strategy often leads to degraded performance, particularly for high-dimensional medical image segmentation tasks where gradients exhibit large variance and fine structural details are essential [12, 3]. A key limitation of static DP-FL is that gradient distributions vary across clients and throughout training. Noise levels that are appropriate during early training rounds become excessive as optimization progresses and gradient norms decrease, as illustrated in Figure 1. This imbalance reduces the gradient signal-to-noise ratio, slows convergence, and degrades segmentation quality, especially at anatomical boundaries. Figure 1: Illustrative simulation showing how static differential privacy mechanism fail to adapt with evolving gradient distribution Adaptive differential privacy (ADP) methods aim to address this limitation by dynamically adjusting privacy-related parameters such as clipping thresholds, noise scales, or round-wise privacy allocation. By aligning the injected noise with the evolving gradient distributions of individual clients, ADP approaches can better preserve informative updates and improve training stability. Although adaptive DP strategies have shown promise in improving utility in several learning settings [20, 24, 25], their behavior in federated medical image segmentation remains insufficiently explored. In particular, a noticeable performance gap persists between non-private FL and DP-FL under strict privacy budgets. In this work, we aim to bridge this gap by proposing adaptive differentially private federated learning framework for medical image segmentation. The proposed approach stabilizes training, reduces noise-induced distortion, and improves generalization under strict privacy guarantees. Extensive experiments across multiple imaging modalities and segmentation tasks demonstrate that our method consistently outperforms standard DP-FL and substantially narrows the performance gap between private and non-private FL. 2 Literature Review Federated learning (FL) has been widely studied as a framework for collaborative model training in medical imaging without centralized data sharing [13, 18, 19]. Methods such as FedAvg and its extensions have demonstrated that global optimization is feasible under non-IID data distributions, which are common in multi-institutional clinical settings [13]. Prior work has applied FL to a range of medical imaging tasks, including segmentation, classification, and multi-modal analysis, while also highlighting challenges related to client heterogeneity and communication efficiency [18, 8]. Although FL avoids direct exchange of raw patient data, it does not inherently guarantee privacy. Several studies have shown that sensitive information can be inferred from shared gradients or model updates through gradient reconstruction and inversion attacks [26, 7]. Membership inference attacks further demonstrate the risk of identifying whether specific samples participated in training [14]. These findings have motivated the integration of formal privacy-preserving mechanisms into FL frameworks for clinical deployment [18]. Differential privacy (DP) provides mathematically provable privacy guarantees and has become a common approach for securing FL. In DP-FL, clients typically apply per-sample gradient clipping followed by Gaussian noise injection prior to aggregation [6, 1]. While effective for privacy protection, multiple studies report substantial performance degradation when DP is applied to high-dimensional medical imaging tasks, particularly segmentation, due to aggressive clipping and noise amplification [12, 3]. To address this issue, adaptive DP strategies have been proposed that adjust clipping thresholds, noise scales, or privacy allocation during training based on gradient statistics or sensitivity estimates [20, 24, 25]. These approaches generally improve the privacy–utility trade-off compared to fixed DP settings; however, most existing methods are designed for centralized learning or low-dimensional tasks. Their effectiveness in federated medical image segmentation, which involves complex spatial structures and heterogeneous client distributions, remains less explored. Only limited work has examined adaptive DP mechanisms in federated medical imaging tasks that include segmentation. Jiang et al. [11] proposed an adaptive intermediary framework evaluated on prostate MRI segmentation and intracranial hemorrhage diagnosis. Their method improves performance over standard DP-FL, but still exhibits a notable gap compared to non-private FL under strict privacy settings. For example, in prostate MRI segmentation, non-private FL achieved Dice scores 87.69±0.12, while the adaptive intermediary recovered performance to 63.28±4.69 at moderate noise levels. This suggests that structural adaptations alone may be insufficient to fully close the privacy–utility gap in high-dimensional federated segmentation. 3 METHODOLOGY We introduce the Adaptive Differentially Private Federated Learning (ADP-FL) framework for medical image segmentation tasks. ADP-FL optimizes the privacy–utility trade-off by synergizing gradient sparsification, adaptive clipping, and dynamic noise injection. Figure 2: Overview of the proposed ADP-FL framework. Consider a federated system consisting of K clients, where each client k maintains a private local dataset kD_k of size nkn_k. At each communication round t, the central server broadcasts the global model parameters wtw^t. Each client k performs local training by minimizing the empirical risk: Fk(w)=1|k|∑(xi,yi)∈kℓ(w;xi,yi)F_k(w)= 1|D_k| _(x_i,y_i) _k (w;x_i,y_i) (1) where ℓ(⋅) (·) denotes the segmentation loss. Following E local epochs, the client computes the model update: Δwkt=wkt−wt w_k^t=w_k^t-w^t (2) To mitigate communication overhead, each client applies a sparsification mask, retaining only the top q%q\% of components. Unlike static approaches, ADP-FL dynamically calibrates the clipping threshold γkt _k^t based on the observed distribution of the sparsified gradients: γkt=Percentilep(|Δwkt|) _k^t=Percentile_p (| w_k^t| ) (3) The local updates are then projected to ensure the ℓ2 _2-norm does not exceed this adaptive threshold, bounding the sensitivity for privacy purposes: Δwkt←Δwktmax(1,‖Δwkt‖2γkt) w_k^t← w_k^t (1, \| w_k^t\|_2 _k^t ) (4) To provide formal Differential Privacy (DP) guarantees, we employ Dynamic Laplace Interference. By coupling the interference scale to the adaptive threshold γkt _k^t, the framework prevents excessive noise injection as the model converges: w~kt=Δwkt+Laplace(0,σγktϵ) w_k^t= w_k^t+Laplace (0, σ _k^tε ) (5) where ϵε represents the privacy budget and σ denotes the interference scale. Finally, the server performs a weighted aggregation of the sanitized updates: wt+1=wt+∑k=1KnkNw~kt,N=∑k=1Knkw^t+1=w^t+ _k=1^K n_kN w_k^t, N= _k=1^Kn_k (6) Algorithm 1 One Communication Round of ADP-FL 1:Global model wtw^t, clients K, Epoch E, percentile p, sparsification q, privacy budget ϵε, noise scale σ 2:Server broadcasts wtw^t to all clients 3:for each client k in parallel do 4: Train locally for E epochs to obtain wktw_k^t 5: Compute update: Δwkt=wkt−wt w_k^t=w_k^t-w^t ⊳ Equation 2 6: Sparsify update by retaining top q% components 7: Compute adaptive clipping threshold: γkt=Percentilep(|Δwkt|) _k^t=Percentile_p(| w_k^t|) ⊳ Equation 3 8: Clip update: Δwkt←Δwkt/max(1,‖Δwkt‖2/γkt) w_k^t← w_k^t/ (1,\| w_k^t\|_2/ _k^t) ⊳ Equation 4 9: Inject adaptive noise: w~kt=Δwkt+Laplace(0,σγkt/ϵ) w_k^t= w_k^t+Laplace(0,σ _k^t/ε) ⊳ Equation 5 10: Send w~kt w_k^t to server 11:end for 12:Aggregate client updates: wt+1=wt+∑k=1KnkNw~ktw^t+1=w^t+ _k=1^K n_kN w_k^t ⊳ Equation 6 4 Experimental Setup 4.1 Datasets and Preprocessing We evaluated the proposed framework across three medical imaging modalities: 2D dermatoscopic images, 3D CT scans, and 3D multi-parametric MRI, using publicly available benchmarks. For each dataset, a centralized hold-out test set was reserved for global evaluation, while the remaining data were partitioned among simulated client sites for federated training. HAM10K: The Human Against Machine dataset consists of 10,015 dermoscopic images of pigmented skin lesions [22]. We employed a 2D U-Net architecture with an input size of 256×256256× 256. Preprocessing included resizing, pixel intensity normalization to [0,1][0,1], and mask binarization for two target classes (lesion and background). For federated training, 500 images were held out for testing, while 9,515 images were distributed across five sites: Site-1 (2,260), Site-2 (2,110), Site-3 (1,940), Site-4 (1,640), and Site-5 (1,565), using a 75% training and 25% validation split per site. KiTS23: The Kidney Tumor Segmentation-2023 challenge dataset contains 489 abdominal 3D CT scans annotated for kidney, cyst, and tumor regions [9]. We used the SegResNet architecture with an input volume of 256×256×256256× 256× 256 to segment these three target classes. After reserving 50 cases for testing, 439 scans were distributed among three sites: Site-1 (155), Site-2 (145), and Site-3 (139). Data amount were kept different to emulate clinical setup. Preprocessing involved 3D cropping, resizing, resampling, and intensity rescaling followed by a sigmoid activation. BraTS24: The Brain Tumor Segmentation-2024 challenge dataset includes 1,621 multi-parametric MRI scans (T1, T1c, T2, FLAIR) [5]. A SegResNet architecture with an input size of 176×208×176176× 208× 176 was utilized to segment six target classes: four tumor subregions (NETC, SNFH, ET, RC) and two composite targets (Tumor Core and Whole Tumor). Following the exclusion of 210 test cases, 1,411 scans were distributed across four sites: Site-1 (378), Site-2 (369), Site-3 (356), and Site-4 (308). Preprocessing steps included 3D cropping, resampling, and intensity normalization. 4.2 Training, Privacy and Implementation Clients were trained using the Adam optimizer (learning rate 1×10−41× 10^-4, weight decay 1×10−51× 10^-5) with Dice Loss. Each client performed 1 local epoch per communication round for a total of 400 rounds. Model updates were aggregated using data-weighted averaging. Dropout (0.2) and cosine annealing were applied to stabilize the learning process. To ensure privacy, gradients were sparsified (top 90% retention) and perturbed via Adaptive Differential Privacy (ADP) using Laplacian noise (ϵ=0.001,σ=1ε=0.001,σ=1), with clipping thresholds set at the 95th percentile of gradient norms. Due to DP-induced fluctuations, we maintained a dual-model saving strategy, independently tracking the best-performing and the most recent global models. Performance was measured via the Dice Similarity Coefficient (DSC). All experiments were repeated three times to report global mean ± standard deviation, while the best overall run was used to calculate the patient-level mean±stdmean± std across individual cases. All experiments were implemented using Python 3.12, NVFlare for federated orchestration, PyTorch, and MONAI. Training was conducted on Linux-operated Compute Canada clusters equipped with NVIDIA H100 GPUs. 5 Results and Discussion This section presents comprehensive experimental results and discussion on three different medical image segmentation tasks: skin lesion segmentation (HAM10K), kidney tumor segmentation (KiTS23), and multi-subregion brain tumor segmentation (BraTS24). Results are organized into two parts: (i) comparison with baseline methods and (i) hyperparameter sensitivity analysis. All evaluations are performed on centrally held-out test sets, incorporating quantitative metrics, convergence analyses, and qualitative visual assessments. 5.1 Comparison with Baseline Methods We compare the proposed Adaptive Differentially Private Federated Learning (ADP-FL) framework with Non-Private Federated Learning (NP-FL) and standard Differentially Private Federated Learning (DP-FL) to quantify performance degradation due to privacy constraints and to evaluate how effectively ADP-FL mitigates this trade-off at same privacy budget. 5.1.1 HAM10K The performance metrics for NP-FL, DP-FL, and the proposed ADP-FL are summarized in Table 1, reporting both inter-run stability (mean ± std across three runs) and patient-level reliability (mean ± std across patients). The results show that ADP-FL recovers nearly all performance lost under standard DP-FL and, at the patient level, even slightly exceeds the non-private baseline. Table 1: Comparative performance (DSC %) for NP-FL, DP-FL, and ADP-FL. Results are reported as mean ± std across three runs / mean ± std across patients for the best model update. Method NP-FL (N=500) DP-FL (N=500) ADP-FL (N=500) DSC (%) 93.12 ± 0.04 / 95.18 ± 6.51 85.38 ± 0.04 / 86.88 ± 14.38 92.81 ± 0.06 / 96.27 ± 6.93 Crucially, ADP-FL maintains high consistency; its patient-level standard deviation (6.93%6.93\%) is remarkably close to that of NP-FL (6.51%6.51\%), whereas DP-FL exhibits much higher variability (14.38%14.38\%). This indicates that while standard DP-FL leads to inconsistent segmentation across different cases, ADP-FL provides a robust and reliable model for diverse patient data. As illustrated in Figure 3, the convergence analysis at site-5 confirms that ADP-FL stabilizes the training process and closely tracks the NP-FL trajectory, whereas DP-FL remains noisy and delayed. The qualitative masks (Figure 3, right) further validate these findings; ADP-FL preserves sharp lesion boundaries and fine structural details that are often blurred or lost under the rigid gradient clipping of standard DP-FL. By replacing static constraints with an adaptive clipping and noise mechanism, ADP-FL successfully mitigates the primary sources of accuracy degradation in private federated learning. Figure 3: HAM10K results: (Left) DSC convergence trajectory for site-5. (Right) Qualitative segmentation comparisons between methods. 5.1.2 KiTS23 Table 2 summarizes NP-FL, DP-FL, and ADP-FL segmentation performance on KiTS23 across Kidney (KTC), Tumor+Cyst, and Tumor regions, reporting both inter-run stability and patient-level reliability on 50 test cases. Standard DP-FL shows substantial degradation in tumor-related accuracy, with mean DSC dropping to 69.08%69.08\% for Tumor+Cyst and 66.29%66.29\% for Tumor. ADP-FL mitigates this loss, improving DSC by 8.188.18 and 6.556.55 points across runs, and by over 1010 points at the patient level, bringing performance closer to the non-private baseline while reducing case-to-case variability. These improvements suggest that adaptive clipping better preserves task-relevant gradients in critical tumor regions and complex 3D structures. Convergence analysis and qualitative visualizations (Figure-4) further demonstrate smoother optimization dynamics and more coherent recovery of tumor and cystic structures under ADP-FL. Table 2: KiTS23 Dice Similarity Coefficient (DSC %). Results are reported as Mean across three runs / Patient-level Mean for the best run. Method KTC (N=50) Tumor+Cyst (N=50) Tumor (N=50) NP-FL 94.92 ± 0.36 / 95.22 ± 1.92 81.00 ± 1.03 / 81.93 ± 17.60 79.79 ± 1.06 / 80.94 ± 18.18 DP-FL 91.94 ± 0.27 / 91.72 ± 5.89 69.08 ± 0.98 / 68.00 ± 23.85 66.29 ± 1.09 / 65.34 ± 26.38 ADP-FL 93.63 ± 0.60 / 93.96 ± 2.80 77.26 ± 0.60 / 78.96 ± 19.95 72.84 ± 2.25 / 76.09 ± 22.71 Figure 4: KiTS23: (Left) Convergence graph for site-3. (Right) Qualitative segmentation masks for Patient case 00581. 5.1.3 BraTS24 Table 3 summarizes NP-FL, DP-FL, and ADP-FL segmentation performance on BraTS24 across six tumor subregions, reporting mean DSC ± std across three runs. Standard DP-FL suffers severe degradation in low-contrast and heterogeneous regions such as NETC and ET, with mean DSC dropping below 26%26\% and 57%57\%, respectively. In contrast, ADP-FL substantially narrows this gap, achieving mean DSC of 42.05%42.05\% for NETC and 72.27%72.27\% for ET, while also improving performance across all other subregions. Patient-level results (Table 4) highlight that DP-FL exhibits high variability across cases, particularly in challenging subregions, whereas ADP-FL reduces this variance and maintains mean DSC values much closer to the non-private baseline. These improvements indicate that adaptive clipping preserves task-relevant gradient information for complex multi-subregion segmentation under privacy constraints. Convergence behavior and qualitative visualizations (Figure-5) further demonstrate smoother optimization and more anatomically coherent tumor core predictions under ADP-FL, compared to the fragmented and unstable segmentations observed with rigid DP-FL. Table 3: BraTS24 DSC (mean ± std) across three runs for NP-FL, DP-FL, and ADP-FL. Method ET (N=165) NETC (N=92) SNFH (N=210) RC (N=179) TC (N=165) WT (N=210) NP-FL 77.56 ± 0.21 57.64 ± 0.56 87.28 ± 0.06 76.86 ± 0.74 76.46 ± 0.19 88.62 ± 0.06 DP-FL 56.77 ± 0.33 24.69 ± 0.78 72.89 ± 0.40 55.01 ± 0.07 56.22 ± 0.77 76.72 ± 0.48 ADP-FL 72.27 ± 0.22 42.05 ± 4.60 85.18 ± 0.13 72.04 ± 0.22 70.97 ± 0.24 86.78 ± 0.06 Table 4: BraTS24 DSC (mean ± std) across patients for the best run for NP-FL, DP-FL, and ADP-FL. Method ET (N=165) NETC (N=92) SNFH (N=210) RC (N=179) TC (N=165) WT (N=210) NP-FL 77.85 ± 23.04 58.38 ± 29.41 87.36 ± 13.90 77.47 ± 24.97 76.72 ± 23.40 88.71 ± 12.22 DP-FL 57.51 ± 26.64 25.97 ± 24.69 73.70 ± 18.68 56.10 ± 29.86 57.88 ± 26.80 76.48 ± 17.02 ADP-FL 72.06 ± 24.75 46.27 ± 29.50 85.35 ± 15.78 72.31 ± 27.03 71.29 ± 24.57 86.86 ± 13.96 Figure 5: BraTS24: (Left) Convergence graph of site-4. (Right) Qualitative segmentation masks. 5.2 Hyperparameter Sensitivity Analysis We analyze the sensitivity of ADP-FL to the clipping percentile (p), which is introduced as an additional hyperparameter governing the degree of gradient truncation and interference. Experiments are conducted with p ranging from the 70th to the 95th percentile to examine the trade-off between gradient information retention and noise injection. From a theoretical perspective, lower values of p lead to excessive truncation of informative updates, whereas higher values increase the clipping threshold γkt _k^t and consequently amplify the magnitude of noise required to maintain differential privacy. This analysis assesses whether a single clipping percentile can generalize across datasets of varying complexity, including HAM10K, KiTS23, and BraTS24, or whether task-specific tuning is necessary to get optimal performance. 5.2.1 HAM10K Table 5 summarizes segmentation performance on the HAM10K dataset across different clipping percentiles, while Figure-6 illustrates the corresponding convergence behavior and qualitative segmentation results. Although convergence trajectories and predicted masks exhibit nearly identical optimization dynamics and visual consistency across all tested configurations, quantitative performance shows a gradual improvement as the clipping percentile increases from the 70th to the 95th percentile, reaching a maximum Dice Similarity Coefficient (DSC) of 92.81%92.81\%. Importantly, performance variability remains minimal at both the inter-run and patient levels, indicating that ADP-FL is highly robust to the choice of clipping percentile for this 2D dermoscopic segmentation task. Table 5: Impact of clipping percentiles on HAM10K DSC performance. Results highlight inter-run stability and intra-patient reliability. Metric (%) 70th 75th 80th 85th 90th 95th Mean Across Runs 92.37±0.1492.37± 0.14 92.57±0.2092.57± 0.20 92.71±0.1492.71± 0.14 92.61±0.0292.61± 0.02 92.61±0.0892.61± 0.08 92.81±0.0692.81± 0.06 Mean Across Patients 95.67±8.1195.67± 8.11 96.06±7.6296.06± 7.62 95.99±7.8795.99± 7.87 96.24±7.3796.24± 7.37 96.26±7.2996.26± 7.29 96.27±6.9396.27± 6.93 Figure 6: HAM10K sensitivity analysis: (Left) DSC convergence trajectories for various percentiles at site-5. (Right) Qualitative comparison demonstrating visual invariance to percentile shifts. 5.2.2 KiTS23 Sensitivity to clipping is more pronounced on KiTS23 due to heterogeneous tumor morphology and the inherently challenging 3D nature of the segmentation task. As reported in Tables 6 and 7, aggressive clipping at lower percentiles substantially degrades performance for the Tumor and Tumor+Cyst regions, increasing variability across runs. Performance improves markedly at the 80th and 85th percentiles, with the 85th percentile achieving the highest overall DSC across tumor-related classes. The 95th percentile remains stable and competitive, indicating that ADP-FL maintains robust performance across a reasonably wide range of higher clipping percentiles. Figure-7 further illustrates the convergence behavior and qualitative segmentations, highlighting that higher percentiles better preserve task-relevant gradients, leading to improved accuracy in complex 3D tumor structures. Table 6: KiTS23 DSC (mean ± std) across three runs for different clipping percentiles. Class 70th 75th 80th 85th 90th 95th KTC* 94.51 ± 0.40 93.64 ± 1.48 93.27 ± 1.32 93.97 ± 0.38 93.69 ± 0.27 93.63 ± 0.60 Tumor+Cyst 60.64 ± 18.51 66.82 ± 8.72 70.75 ± 6.21 77.39 ± 0.49 77.36 ± 1.40 77.26 ± 0.60 Tumor 66.89 ± 4.25 64.55 ± 5.05 70.39 ± 5.64 75.28 ± 1.02 74.62 ± 1.31 72.84 ± 2.25 *KTC: Kidney + Tumor + Cyst Table 7: KiTS23 patient-level DSC (mean ± std) for the best run across clipping percentiles. Class 70th 75th 80th 85th 90th 95th KTC* 92.15 ± 6.19 91.63 ± 6.18 95.02 ± 2.07 94.65 ± 2.78 94.78 ± 2.52 93.96 ± 2.80 Tumor + Cyst 70.21 ± 20.82 68.35 ± 22.82 74.23 ± 26.07 64.36 ± 30.89 77.27 ± 22.51 78.96 ± 19.95 Tumor 67.49 ± 23.36 65.33 ± 24.98 72.13 ± 27.53 63.07 ± 31.01 75.25 ± 24.61 76.09 ± 22.71 *KTC: Kidney + Tumor + Cyst Figure 7: KiTS23 sensitivity analysis: (Left) DSC convergence trajectories for various percentiles at site-3. (Right) Qualitative comparison demonstrating visual invariance to percentile shifts. 5.2.3 BraTS24 BraTS24 demonstrates the highest sensitivity to gradient clipping, which can be attributed to the combination of multi-class targets, multi-modal inputs, and pronounced class imbalance across tumor subregions. As shown in Tables 8 and 9, restrictive clipping at lower percentiles substantially suppresses informative gradients, particularly for the NETC and TC classes, resulting in notable degradation of segmentation performance and increased variability across runs and patients. As the clipping percentile increases, performance improves consistently across most classes, indicating more effective preservation of task-relevant gradient information. The highest overall DSC is achieved at the 95th percentile, while the 90th percentile occasionally yields comparable performance for select classes but with reduced robustness. Figure 8 further illustrates the associated convergence behavior and qualitative segmentation outcomes, confirming that higher clipping thresholds lead to more stable optimization and more accurate delineation of complex tumor structures in this challenging multi-class setting. Table 8: BraTS24 DSC (mean ± std) across three runs for different clipping percentiles. Class 70th 75th 80th 85th 90th 95th ET 47.43 ± 5.63 44.59 ± 5.47 55.82 ± 13.40 66.79 ± 2.92 69.19 ± 1.44 72.27 ± 0.22 NETC 18.23 ± 1.28 10.69 ± 5.72 26.32 ± 11.43 26.54 ± 11.62 38.24 ± 9.04 42.05 ± 4.60 SNFH 75.77 ± 9.95 81.44 ± 2.91 85.02 ± 0.63 84.96 ± 0.84 85.03 ± 0.27 85.18 ± 0.13 RC 53.20 ± 7.07 59.29 ± 8.98 59.54 ± 9.09 60.87 ± 12.12 67.63 ± 3.17 72.04 ± 0.22 TC 45.51 ± 13.98 36.69 ± 21.02 55.54 ± 7.53 67.98 ± 0.74 67.72 ± 1.25 70.97 ± 0.24 WT 83.16 ± 3.28 86.12 ± 0.42 86.41 ± 0.32 86.39 ± 0.28 86.63 ± 0.18 86.78 ± 0.06 Table 9: BraTS24 DSC (mean ± std) across patients for different clipping percentiles. Class 70th 75th 80th 85th 90th 95th ET 57.03 ± 26.15 55.59 ± 25.27 68.04 ± 25.96 63.18 ± 26.55 47.52 ± 27.50 72.06 ± 24.75 NETC 25.29 ± 24.74 25.35 ± 24.86 16.96 ± 20.30 32.66 ± 27.67 33.84 ± 26.64 46.27 ± 29.50 SNFH 73.85 ± 18.25 72.62 ± 18.11 85.71 ± 15.54 85.55 ± 15.05 84.14 ± 17.24 85.35 ± 15.78 RC 56.33 ± 29.49 55.72 ± 29.44 70.47 ± 28.26 66.24 ± 29.60 68.07 ± 28.87 72.31 ± 27.03 TC 57.88 ± 27.22 56.86 ± 27.05 68.64 ± 26.55 68.69 ± 25.67 66.40 ± 27.09 71.29 ± 24.57 WT 77.29 ± 15.68 76.11 ± 15.73 86.57 ± 14.34 86.66 ± 13.77 86.64 ± 14.66 86.86 ± 13.96 Figure 8: BraTS24 sensitivity analysis: (Left) convergence graph of site-4. (Right) Qualitative results. 5.3 Discussion Across all datasets, ADP-FL consistently outperforms standard DP-FL while approaching the accuracy of non-private FL (NP-FL), demonstrating a favorable privacy–utility trade-off across diverse segmentation settings. On simpler tasks such as HAM10K, ADP-FL recovers nearly all performance lost under DP-FL, while maintaining high inter-run stability and strong patient-level consistency. In these settings, adaptive clipping effectively preserves informative gradients, enabling the model to retain fine structural details in qualitative segmentation masks and achieve convergence behavior that closely mirrors NP-FL. For more complex and heterogeneous tasks, including KiTS23 and BraTS24, the benefits of adaptive clipping are more pronounced. These datasets exhibit substantial anatomical variability, class imbalance, and low-contrast regions, which exacerbate the impact of overly restrictive clipping under standard DP-FL. In such cases, ADP-FL substantially improves the segmentation of clinically critical subregions, reduces patient-level performance variability, and stabilizes training dynamics relative to the noisy and often unstable optimization observed with fixed clipping thresholds. This stabilization is reflected in both improved convergence profiles and more coherent qualitative predictions. Sensitivity analyses further indicate that ADP-FL is largely robust to the choice of clipping percentile for simpler tasks, and only moderately sensitive for more challenging multi-class segmentation problems, where higher percentiles better preserve task-relevant gradient information. Overall, these results suggest that adaptive clipping, when combined with dynamic noise injection, provides an effective mechanism for mitigating the adverse effects of differential privacy on optimization. By improving robustness, reducing variance across patients, and narrowing the performance gap with NP-FL, ADP-FL emerges as a reliable and scalable framework for privacy-preserving medical image segmentation across a wide range of modalities and clinical tasks. 6 Conclusion This study introduces and validates an Adaptive Differentially Private Federated Learning (ADP-FL) framework designed to bridge the gap between rigorous patient privacy and high-fidelity medical image segmentation. Our results across three distinct modalities: 2D dermatoscopic images, 3D CT scans, and multi-parametric MRI, demonstrate that ADP-FL effectively mitigates the utility loss inherent in standard DP-FL. By dynamically adjusting clipping thresholds to the gradient distribution of clinical data, the framework achieves a near-optimal balance, tracking the performance of non-private models while operating under strict privacy guarantees. The practical implications of this work are twofold. First, ADP-FL addresses the ”utility wall” that often prevents the adoption of differential privacy in clinical settings, particularly for complex 3D tasks like multi-subregion brain tumor segmentation where signal preservation is critical. Second, the framework’s robustness across diverse datasets with minimal hyperparameter tuning suggests a high degree of ”out-of-the-box” readiness for real-world medical AI orchestration. By enabling decentralized training without exposing sensitive raw data, ADP-FL provides a viable pathway for multi-institutional collaboration that complies with stringent global data governance regulations. Despite these contributions, future research is warranted to evaluate ADP-FL within authentic, heterogeneous multi-institutional deployments to further assess cross-site generalization. Additionally, while this work focused on segmentation, exploring the framework’s efficacy in classification and longitudinal disease tracking could expand its clinical utility. In conclusion, ADP-FL represents a scalable, low-overhead solution for privacy-preserving medical analysis, ensuring that the advancement of diagnostic AI does not come at the cost of patient confidentiality. Acknowledgments The author gratefully acknowledges the support of the University of Guelph and the scholarships and research grants that made this work possible. The author also thanks colleagues and mentors for their valuable guidance and constructive feedback throughout the course of this research. References [1] M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang (2016) Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (CCS), Cited by: §1, §2. [2] S. T. Arasteh, C. Kuhl, M. Saehn, P. Isfort, D. Truhn, and S. Nebelung (2023) Enhancing domain generalization in ai-based analysis of chest radiography. Scientific Reports. Cited by: §1. [3] Y. Chen and et al. (2022) Differentially private federated learning for medical image segmentation. Medical Image Analysis. Cited by: §1, §2. [4] F. R. da Silva, R. Camacho, and J. M. R. S. Tavares (2024) Federated learning in medical image analysis: a systematic survey. Electronics. Cited by: §1. [5] M. C. de Verdier, R. Saluja, L. Gagnon, and et.al. (2024) The 2024 brain tumor segmentation (brats) challenge: glioma segmentation on post-treatment mri. External Links: 2405.18368, Link Cited by: §4.1. [6] C. Dwork (2008) Differential privacy: a survey of results. Theory and Applications of Models of Computation (TAMC). Cited by: §1, §2. [7] J. Geiping, H. Bauermeister, H. Dröge, and M. Moeller (2020) Inverting gradients – how easy is it to break privacy in federated learning?. In Advances in Neural Information Processing Systems (NeurIPS), Cited by: §2. [8] H. Guan, P. Yap, A. Bozoki, and M. Liu (2024) Federated learning for medical image analysis: a survey. Pattern Recognition 151, p. 110424. External Links: Document Cited by: §1, §2. [9] N. Heller, F. Isensee, and et.al. (2023) The kits21 challenge: automatic segmentation of kidneys, renal tumors, and renal cysts in corticomedullary-phase ct. External Links: 2307.01984 Cited by: §4.1. [10] A. Holzinger, C. Biemann, C. S. Pattichis, and D. B. Kell (2017) What do we need to build explainable ai systems for the medical domain?. arXiv preprint arXiv:1712.09923. Cited by: §1. [11] M. Jiang, Y. Zhong, A. Le, X. Li, and Q. Dou (2024) Client-level differential privacy via adaptive intermediary in federated medical imaging. External Links: 2307.12542, Link Cited by: §2. [12] X. Li and et al. (2021) Differentially private federated learning for multi-institutional medical image segmentation. IEEE Transactions on Medical Imaging. Cited by: §1, §2. [13] B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. Arcas (2017) Communication-efficient learning of deep networks from decentralized data. In Proceedings of the 20th International Conference on Artificial Intelligence and Statistics (AISTATS), Cited by: §1, §2. [14] M. Nasr, R. Shokri, and A. Houmansadr (2019) Comprehensive privacy analysis of deep learning: passive and active white-box inference attacks against centralized and federated learning. In IEEE Symposium on Security and Privacy (SP), Cited by: §1, §2. [15] W. N. Price (2019) Privacy‐preserving methods for health data analysis. Nature Medicine. Cited by: §1. [16] G. Rashidi, D. Bounias, M. Bujotzek, A. M. Mora, P. Neher, and K. H. Maier-Hein (2024) The potential of federated learning for self-configuring medical detection tools. Scientific Reports. Cited by: §1. [17] A. Raza, A. Guzzo, M. Ianni, R. Lappano, A. Zanolini, M. Maggiolini, and G. Fortino (2025) Federated learning in radiomics: a comprehensive meta‑survey on medical image analysis. Computer Methods and Programs in Biomedicine 267, p. 108768. External Links: Document Cited by: §1. [18] N. Rieke and et al. (2020) The future of digital health with federated learning. npj Digital Medicine 3 (1). Cited by: §2. [19] M. Sheller, B. Edwards, G. A. Reina, J. Martin, and S. Bakas (2020) Federated learning in medicine: facilitating multi-institutional collaborations without sharing patient data. Scientific Reports 10 (1). Cited by: §2. [20] S. Talaei and et al. (2024) Adaptive clipping and noise scheduling for differentially private federated learning. Pattern Recognition Letters. Cited by: §1, §2. [21] E. Topol (2019) High‐performance medicine: the convergence of human and artificial intelligence. Nature Medicine. Cited by: §1. [22] P. Tschandl, C. Rosendahl, and H. Kittler (2018) The ham10000 dataset, a large collection of multi-source dermatoscopic images of common pigmented skin lesions. Scientific Data 5, p. 180161. Cited by: §4.1. [23] H. Ying, Y. Lia, and Z. Fu (2025) A survey of generalization and adaptation in medical imaging foundation models. Preprints.org. Cited by: §1. [24] Z. Zhang and et al. (2023) Adaptive differential privacy for federated learning via gradient sensitivity estimation. Neurocomputing. Cited by: §1, §2. [25] X. Zheng and et al. (2025) Sensitivity-aware differential privacy in federated learning for medical image segmentation. IEEE Transactions on Neural Networks and Learning Systems. Cited by: §1, §2. [26] L. Zhu, Z. Liu, and S. Han (2019) Deep leakage from gradients. In Advances in Neural Information Processing Systems (NeurIPS), Cited by: §1, §2.