A Privacy-Preserving Federated Learning Framework for Multi-Institutional Healthcare AI with Differential Privacy, Byzantine Fault Tolerance, and Gradient Inversion Defence

Healthcare AI models trained on multi-institutional electronic health records (EHR) demonstrate substantially superior clinical performance compared to models trained on single-institution datasets — a phenomenon well-documented across diabetic retinopathy screening, cardiac risk stratification, and sepsis prediction tasks — yet the pooling of patient data across hospital boundaries is legally impermissible under India's Personal Data Protection framework (DPDPA 2023), HIPAA's cross-border transfer restrictions, and institutional ethics protocols that prohibit patient-identifiable data leaving the originating facility. Federated Learning (FL) addresses this by enabling distributed model training where only model gradients, not raw patient data, are communicated from participating sites to an aggregation server. However, recent cryptanalytic work has demonstrated that naive FL is not intrinsically private: gradient inversion attacks can reconstruct individual training images from shared gradients with near-pixel accuracy, and Byzantine poisoning attacks by malicious clients can corrupt the global model with as few as one compromised participant.This paper presents SecFed-HC, a comprehensive privacy-preserving federated learning framework designed for Indian multi-institutional healthcare AI deployment, combining four defence mechanisms: Gaussian differential privacy (DP) noise injection (ε=2.0, δ=10⁻⁵) into gradient updates; Paillier homomorphic encryption of gradients before transmission; Byzantine-robust Krum aggregation replacing FedAvg; and an adaptive gradient clipping schedule that prevents gradient inversion without excessive accuracy degradation. The framework is evaluated on three clinical classification tasks — diabetic retinopathy grading from fundus images (8 hospital sites, South India), cardiac risk classification from ECG features (6 sites, Tamil Nadu and Andhra Pradesh), and CKD staging from biochemical markers (5 sites) — using a total of 84,731 de-identified patient records distributed across 19 participating hospital nodes.SecFed-HC achieves AUC-ROC of 96.4%, 95.1%, and 93.8% for the three clinical tasks respectively, compared to 91.3%, 88.7%, and 87.4% for FedAvg baseline and 97.1%, 96.2%, and 94.7% for a centralised (privacy-violating) upper bound, narrowing the federated-to-centralised performance gap to under 1.5% while providing mathematically rigorous (ε, δ)-differential privacy guarantees. The framework completely defeats gradient inversion attacks in adversarial simulation testing and reduces Byzantine client impact to < 0.3% accuracy degradation even with 20% malicious participants.