Cross-Silo Federated Learning

Unlike cross-device FL involving millions of unreliable smartphones, cross-silo topologies operate with 2–100 institutional clients. Each participant is a known, authenticated entity—such as a hospital PACS system or a research data center—with a persistent identity and stable network connectivity. This small cardinality enables the use of more computationally intensive cryptographic protocols like Secure Multi-Party Computation (SMPC) and Homomorphic Encryption (HE) that would be infeasible at massive scale. Participant dropout is rare, and each node is assumed to be available for the full training duration, simplifying synchronization logic.

Each silo possesses enterprise-grade hardware—multi-GPU servers, high-memory nodes, or dedicated AI accelerators—capable of training large models like Vision Transformers (ViTs) or 3D convolutional networks on volumetric CT scans. This contrasts sharply with cross-device FL, where clients are memory-constrained mobile phones. The abundant compute allows each silo to perform multiple local epochs of full model training per communication round, not just lightweight SGD steps. This enables the use of complex local optimization strategies, including FedProx proximal terms to combat statistical heterogeneity.

Each institutional silo holds a large, domain-specific dataset that has been professionally curated, annotated by clinical experts, and governed by strict data quality protocols. For example, a single hospital may contribute 50,000+ annotated mammography studies with biopsy-confirmed ground truth. These datasets are typically stored in standardized formats like DICOM and linked to structured clinical metadata via FHIR APIs. The data is Non-IID by nature—reflecting the unique patient demographics, scanner vendors, and imaging protocols of each institution—making robust aggregation strategies like FedAvg with server momentum essential.

Cross-silo training is a stateful, orchestrated process spanning days or weeks, not a fleeting opportunistic connection. The central aggregation server maintains a persistent global model checkpoint and tracks per-client contribution history across hundreds of communication rounds. This statefulness enables advanced techniques like:

• Differential privacy accounting with precise epsilon budget tracking across rounds
• Byzantine-robust aggregation (e.g., Krum, Trimmed Mean) to detect anomalous weight updates
• Cross-site validation checkpoints where the global model is evaluated on held-out data from a completely unseen institution The orchestration layer often integrates with hospital Data Use Agreements (DUAs) and maintains an immutable audit trail for regulatory compliance.

Every cross-silo deployment is underpinned by legally binding Data Use Agreements (DUAs) that specify permitted data uses, model ownership, and intellectual property rights among consortium members. The topology is designed to satisfy data residency requirements—raw medical images never leave the originating hospital's firewall; only encrypted gradient updates or secure aggregation ciphertexts are transmitted. This architecture directly addresses HIPAA and GDPR compliance by ensuring that the central server never possesses plaintext access to protected health information (PHI). Consortium governance boards often define shared protocols for model card publication and clinical validation study design.

Although cross-silo nodes have reliable high-bandwidth connections, model updates for architectures like 3D U-Nets or Vision Transformers can still exceed hundreds of megabytes. To reduce overhead, cross-silo systems frequently employ gradient compression techniques:

• Quantization: Reducing weight update precision from FP32 to INT8
• Sparsification: Transmitting only the top-k gradient elements by magnitude
• Federated distillation: Sharing only soft label predictions on a public reference dataset instead of full weight matrices These methods are tuned to balance compression ratio against model convergence speed, and are often combined with error feedback mechanisms to prevent accuracy degradation over successive rounds.

A cryptographic protocol that allows a central server to compute the sum of encrypted model updates from multiple hospitals without being able to inspect any individual hospital's contribution in plaintext. In a cross-silo setting, SecAgg ensures that even if the aggregation server is compromised, raw gradient updates—which can be reverse-engineered to reveal patient data—remain cryptographically opaque. The protocol typically uses pairwise masking and secret sharing among the small, reliable set of silos.

A data distribution characteristic where local datasets on different client nodes are not independently and identically distributed. In cross-silo medical imaging, this is the norm: a rural clinic may have predominantly chest X-rays, while an oncology center has breast MRIs. This statistical heterogeneity causes client drift, where locally trained models diverge from the global optimum. Addressing Non-IID data is the central algorithmic challenge in multi-hospital federated networks.

A mathematical framework that injects calibrated statistical noise into model updates to provide a provable guarantee that an adversary cannot infer whether any single patient's data was used in training. In cross-silo FL, DP is applied via a trusted aggregator that clips and noisifies weight updates before global model integration. The privacy loss is tracked by a parameter called epsilon (ε)—a lower epsilon enforces a stronger, more restrictive guarantee, but may degrade model utility.

A legally binding contract between participating institutions that specifies the terms, conditions, and permitted uses of shared model updates and metadata. In a cross-silo consortium, the DUA forms the governance backbone, defining:

• Purpose limitation: Diagnostic model improvement only
• Prohibition on re-identification: No attempts to extract patient data
• Audit rights: Each silo can verify compliance
• Data residency clauses: Updates must remain within jurisdictional boundaries

The resilience property of a distributed system to continue operating correctly even when some participating nodes exhibit arbitrary or malicious behavior. In a cross-silo medical network, a compromised hospital or a faulty system could send corrupted gradient updates designed to poison the global diagnostic model. Robust aggregation rules like Krum or Trimmed Mean defend against this by statistically filtering out outlier updates before aggregation.