A model predicts a tumor condition from six patient vitals — while the vitals stay encrypted the entire time. The server computes on ciphertext it can't read, and returns a prediction only the patient can decrypt.
Clinical models need vitals sharp enough to flag a tumor; privacy rules insist those same vitals stay confidential. Of the privacy-preserving options — differential privacy, federated learning, secure multi-party computation, and homomorphic encryption — Fully Homomorphic Encryption (FHE) is the one that lets a server run ordinary classification math directly on encrypted inputs, with no plaintext ever leaving the client.
The server in the middle never holds a decryption key — it computes blind.
On a stratified 30% hold-out fold, the plaintext and FHE paths agree on every single label. Because that fold is tiny, a 5-fold cross-validation gives the honest performance estimate.
| Inference path | Accuracy | F1 |
|---|---|---|
| Plaintext | 1.00 | 1.00 |
| FHE (on ciphertext) | 1.00 | 1.00 |
| 5-fold CV (honest estimate) | — | 0.85 ± 0.13 |
Each patient's six vitals become a single opaque ciphertext like this
(18 of them, one per test patient, in results/EncryptedVitals.csv):
| Choice | Detail |
|---|---|
| Features | BP_sys, BP_dia, HR, O2, Smoking, Alcohol |
| Model | Logistic Regression, balanced class weights |
| Quantization | 7-bit (keeps the FHE circuit small) |
| FHE framework | Concrete ML 1.9 (Zama), TFHE backend |
Blood pressure is split into systolic/diastolic, oxygen and heart rate parsed
to numbers, and smoking/alcohol encoded as flags — six interpretable
inputs, standardized, then handed to a Concrete ML classifier whose
predict(…, fhe="execute") path runs entirely on encrypted data.