Federated learning with update level noise perturbation and blockchain audit logging for privacy-preserving healthcare ECG classification

We propose FedChainDP, a federated learning framework that combines update-level noise perturbation with blockchain audit logging for privacy-preserving collaborative ECG classification across multiple healthcare institutions. Healthcare institutions face a fundamental tension: deep learning models require large, diverse training datasets to achieve high diagnostic accuracy, yet strict privacy regulations such as HIPAA and GDPR restrict the sharing of raw patient data across organizational boundaries. FedChainDP resolves this tension by enabling hospitals to collaboratively train a shared CNN model without exchanging raw electrocardiogram (ECG) signals. Each hospital trains locally on its private data and shares only noise-perturbed model updates, to which Gaussian noise is added once per federated round; these updates are encrypted with AES-256-GCM before transmission and logged on an immutable blockchain with Merkle-tree integrity protection and smart-contract policy checks on the reported noise parameters. Because this round-level noise schedule does not satisfy the assumptions of the Rényi differential privacy (RDP) accountant, the accountant output for the main configuration (ε_nom = 7.84 at δ = 10⁻⁵) is reported only as a nominal indicator, and no formal (ε, δ)-differential privacy guarantee is claimed. We evaluate FedChainDP on the MIT-BIH Arrhythmia dataset partitioned across 5 hospitals using Dirichlet-based non-IID distributions. Our CNN model achieves 98.91% ± 0.14% accuracy under federated learning with update-level noise injection (σ_mult = 1.1), compared to 98.81% ± 0.31% for centralized training and 98.57% ± 0.17% for federated learning without noise-based privacy protection. These accuracies were obtained under a beat-level random split performed after duplication-based class balancing, so duplicated minority-class beats and beats from the same patients can occur in both training and test sets; they therefore reflect performance within this resampled benchmark and do not establish generalization to independent unseen beats or patients. A comprehensive privacy-utility analysis across noise multiplier settings (σ_multiplier ∈ {1, 2, 5, 10, 20, 100}) demonstrates that classification accuracy remains above 98% across all evaluated noise levels. A black-box membership inference attack achieved 50.28% accuracy (near random guessing) against the noise-perturbed model; however, comparable near-chance accuracy was also obtained against the models trained without noise (49.16% centralized; 49.48% federated), so this result neither isolates a benefit of the noise mechanism nor substitutes for a formal privacy guarantee. A single-machine scalability simulation across 2 to 20 simulated hospitals produced accuracies of 98.90% (2 hospitals), 95.10% (5 hospitals), 93.80% (10 hospitals), and 97.20% (20 hospitals), respectively, while the simulated blockchain audit trail adds negligible overhead (0.059–0.091 s average mining time per block within the single-machine environment). FedChainDP incorporates technical safeguards relevant to healthcare privacy and accountability objectives across four dimensions: multi-technique privacy integration, blockchain-logged policy checks on reported noise parameters, smart contract access control, and empirical membership-inference evaluation.