Cross-Silo Federated Learning

The topology is architected for a fixed set of known, trusted institutions—typically 2 to 100 organizations such as hospitals, banks, or pharmaceutical research centers.

• Stateful Participation: Every client is expected to be available and contribute to every global aggregation round.
• No Dropout Tolerance: Unlike cross-device FL, the system does not need to handle massive client churn or straggler mitigation.
• Strong Identity: Clients are authenticated via public-key infrastructure, enabling accountability and non-repudiable audit trails.

Each silo possesses a substantial, independently managed data lake that is orders of magnitude larger than a single edge device's storage.

• High-Quality Labels: Data is typically curated by domain experts, such as radiologists annotating scans or pathologists grading tissue samples.
• Statistical Significance: A single silo's data may be large enough to train a locally meaningful model, making local fine-tuning a viable strategy.
• Non-IID by Nature: Despite curation, data distributions vary significantly between sites due to differing patient demographics, equipment vendors, or clinical protocols.

A central parameter server coordinates the training lifecycle, often operated by a consortium lead or a neutral third-party orchestrator.

• Federated Averaging (FedAvg): The server initializes the global model, distributes it, and aggregates locally computed weight updates via weighted averaging.
• Secure Aggregation: Cryptographic protocols ensure the server can compute the sum of model updates without being able to inspect any individual hospital's gradient contributions in plaintext.
• Synchronous Rounds: Training proceeds in lock-step barriers, where the server waits for all designated clients to report before computing the next global model.

Cross-silo deployments demand defense-in-depth against sophisticated threats, including honest-but-curious aggregators and malicious insider adversaries.

• Differential Privacy (DP): Calibrated noise is added to model updates to provide a provable mathematical guarantee against membership inference attacks.
• Trusted Execution Environments (TEEs): Hardware-enforced enclaves ensure aggregation logic runs in an isolated, verifiable environment inaccessible to the cloud provider.
• Homomorphic Encryption (HE): Enables computation directly on encrypted gradients, ensuring the aggregator never sees plaintext updates while still producing a valid global model.

The architecture is purpose-built to satisfy data residency and sovereignty mandates such as HIPAA, GDPR, and 21 CFR Part 11.

• Data Never Moves: Raw patient records, financial transactions, or proprietary formulas remain physically within the institution's firewall.
• Auditable Lineage: Every model update is cryptographically signed, creating an immutable provenance trail for regulatory inspection.
• Model Governance: Federated approval workflows ensure no single institution can unilaterally deploy a model update without consortium consensus.

Addressing statistical heterogeneity is the central algorithmic challenge. Local data distributions diverge due to demographic skew, equipment bias, and labeling differences.

• FedProx: Adds a proximal term to the local objective function, penalizing large deviations from the global model to stabilize convergence under non-IID conditions.
• Personalized FL (pFL): Balances a shared global representation with locally adapted model heads, allowing each hospital to maintain a bespoke model while benefiting from consortium knowledge.
• Federated Transfer Learning (FTL): Handles scenarios where silos have different feature spaces or label ontologies by aligning representations in a shared latent space.

The foundational aggregation algorithm for cross-silo settings. Each hospital computes local model updates on its private data, and a central server combines these updates via a weighted average to produce the global model. Key characteristics:

• Communication occurs after local training epochs, not every batch
• Weights are typically proportional to local dataset size
• Converges reliably when client data is IID; requires modifications for heterogeneous data

A mathematical guarantee that the global model reveals no information about any single patient's record. In cross-silo FL, DP is applied by clipping per-client gradient norms and injecting calibrated Gaussian noise before aggregation. Critical parameters:

• Epsilon (ε): Privacy budget; lower values mean stronger privacy (typical healthcare range: 1–8)
• Delta (δ): Probability of catastrophic privacy failure; must be cryptographically small
• Provides plausible deniability against membership inference attacks

A cryptographic protocol ensuring the central server can only see the sum of model updates, never individual hospital contributions. Uses Shamir secret sharing and pairwise masking:

• Each client generates random masks shared with other clients
• Masks cancel out during summation, revealing only the aggregate
• Protects against honest-but-curious servers; robust to client dropout up to a configurable threshold

Hospital datasets are inherently heterogeneous—different patient demographics, equipment, and clinical practices create statistical skew. Cross-silo strategies include:

• FedProx: Adds a proximal term to local loss functions, preventing client updates from diverging too far from the global model
• SCAFFOLD: Uses control variates to correct for client drift during local training
• FedBN: Maintains local batch normalization layers to absorb domain shift while sharing feature extractors

Hardware-enforced secure enclaves (e.g., Intel SGX, AMD SEV) that protect computation from the host OS and cloud provider. In cross-silo FL, TEEs provide:

• Attestation: Cryptographic proof that the correct code is running unmodified
• Confidential computing: Model aggregation occurs in encrypted memory invisible to infrastructure admins
• Eliminates the need for complex cryptographic protocols when hardware trust is acceptable

Resilience against arbitrary failures or malicious behavior from participating hospitals. In a cross-silo context with 5–20 reliable institutions, BFT mechanisms include:

• Krum: Selects the single update most similar to its peers, discarding outliers
• Trimmed Mean: Aggregates coordinate-wise after removing extreme values
• Median aggregation: Replaces averaging with coordinate-wise median for robustness
• Critical when one site may have corrupted data or compromised infrastructure