FedMedSecure: federated few-shot learning with cross-attention mechanisms and explainable AI for collaborative healthcare cybersecurity

The proliferation of Internet of Medical Things (IoMT) devices has created cybersecurity challenges that requiring advanced threat detection techniques along with preserving patient privacy. This paper introduces FedMedSecure, a federated few-shot learning framework to provide privacy-preserving and collaborative learning, explainable AI, and adaptive ensemble mechanisms for IoMT cybersecurity. Our approach combines CrossTransformer with learnable attack signature queries, FEAT, RelationNetwork with adaptive prototypes, and regularized MAML within a confidence-weighted ensemble architecture. The framework implements differential privacy with [Formula: see text] while achieving 75% communication reduction through efficient gradient compression. The evaluation implemented on two datasets-CICIoMT2024 (8.7M healthcare IoT samples across 19 attack categories) and CIDC2017 (2.8M general IoT samples across 14 attack categories)-We have achieved an exceptional performance as the following: 99.9% accuracy on CICIoMT2024 and 93.3% on CIDC2017 in supervised learning, 99.7-99.8% and 91.0-99.3% respectively in few-shot scenarios, and 99.8% while the global accuracy in federated learning experiments across 8 institutions. Cross-dataset validation confirms robust generalization capabilities, with few-shot learning achieving rapid adaptation from 91.0% with 5 shots to 99.3% with 50 shots on CIDC2017. Counterintuitively, the original 19-class taxonomy outperformed theoretically optimized 5-class clustering in few-shot learning, providing new insights for meta-learning research. The multi-level explainable ai (XAI) framework shown the packet timing and protocol features as primary discriminators, and shown analyst trust. Our FedMedSecure enables collaborative healthcare cybersecurity without compromising privacy that establishing a new paradigm for trustworthy AI in sensitive domains like healthcare with broader applicability to financial services, critical infrastructure, and government networks that requiring privacy-preserving collaborative threat detection.