# Privacy-preserving federated tensor decomposition of single-cell immune data: recovering multicellular programs across institutions

arXiv: https://arxiv.org/abs/2606.24938 · HTML: https://mlsanity.com/paper/2606.24938/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 11 of its 46 references that are in the map.
- First posted on arXiv 22 Jun 2026.

## Builds on (most cited first, 11 of 11)

- [Communication-Efficient Learning of Deep Networks from Decentralized Data](https://mlsanity.com/paper/1602.05629/) (2016)
- [Advances and Open Problems in Federated Learning](https://mlsanity.com/paper/1912.04977/) (2019)
- [Deep Learning with Differential Privacy](https://mlsanity.com/paper/1607.00133/) (2016)
- [Membership Inference Attacks against Machine Learning Models](https://mlsanity.com/paper/1610.05820/) (2016)
- [Membership Inference Attacks From First Principles](https://mlsanity.com/paper/2112.03570/) (2021)
- [The Future of Digital Health with Federated Learning](https://mlsanity.com/paper/2003.08119/) (2020)
- [Concentrated Differential Privacy: Simplifications, Extensions, and Lower Bounds](https://mlsanity.com/paper/1605.02065/) (2016)
- [The Noisy Power Method: A Meta Algorithm with Applications](https://mlsanity.com/paper/1311.2495/) (2013)
- [DP-PCA: Statistically Optimal and Differentially Private PCA](https://mlsanity.com/paper/2205.13709/) (2022)
- [Privately Learning Subspaces](https://mlsanity.com/paper/2106.00001/) (2021)
- [Routes for breaching and protecting genetic privacy](https://mlsanity.com/paper/1310.3197/) (2013)

## Abstract (arXiv)

Tensor decomposition of donor × cell-type × gene single-cell data recovers multicellular programs: coordinated axes of inter-individual transcriptional variation that span cell types and stratify disease. Yet immune single-cell atlases are increasingly multi-institution, multi-ancestry, and governed, so patient cells often cannot be pooled. We present a federated estimator: each site computes a local program subspace, and a coordinator merges these by stacked SVD under federated global-mean centering, provably equivalent (up to truncation) to the centralised decomposition. This centering makes the merge robust to site-label confounding (program AUC 0.957 vs. 0.861 for naive per-site centering). Only program subspaces leave a site, and aggregation is compatible with secure aggregation. On a 261-donor systemic lupus erythematosus atlas it recovers the canonical interferon program (ISG enrichment AUC 0.998; case--control separation 0.958; bootstrap DeltaAUC=-0.000, 95% CI [-0.004,+0.012] vs. centralised), across institution-scale and multi-ancestry partitions, and across three real COVID-19 sites (subspace correlation 0.989). It recovers the program when no site observes all cell types (correlation 1.000, exact by construction), which fixed-feature federated PCA cannot. On an interstitial-lung-disease atlas the recovered program predicts disease better than the best single cell type (AUC 0.96 vs. 0.91; gap 95% CI excludes zero) and the advantage survives federation; a liver cohort is consistent (p=0.005). Membership-inference shows secure aggregation cuts attack AUC from 0.91 to 0.61. The method enables cross-institution, cross-ancestry recovery of multicellular immune programs without sharing cells.