A privacy-preserving system kept a cell-analysis model close to the accuracy of CellCnn running directly on the data in small CMV/NK and AML benchmark tests, according to a preprint. The system trains and runs CellCnn on secret-shared data, keeping raw patient data and intermediate values hidden under a threat model that assumes an honest majority and no collusion.
The test datasets
The document is arXiv:2608.20118v1, dated 20 Aug 2026. Rather than one pooled cohort, it uses separate benchmark datasets: the CMV set has 20 donors—11 CMV-negative and nine CMV-positive—with 14 used for training and six for testing; the AML classification set has seven training samples and six test samples.
The protection has a narrow boundary
The method uses additive secret sharing across two computing proxies and one helper. In practical terms, each party works with a share rather than the full value, and only the agreed output is reconstructed. The design retains ReLU activations and bias terms and supports a tanh-based regression head.
The paper’s semi-honest model assumes parties follow the protocol; it also requires an honest majority, no collusion and at most one corrupted party. Raw data, model updates and activations remain secret-shared, but leakage through a released output is outside the MPC protection being evaluated.
Accuracy stayed close in the main comparisons
Researchers compared three implementations—the secure version, plaintext CellCnn and PriCell—on identical train/test splits and mini-batch order. The classification results are means with standard deviations across 10 independent splits.
On CMV/NK, the secure version’s multi-cell-input accuracy averaged 72.7% (standard deviation 14.1 percentage points), compared with 72.1% (17.3 points) for plaintext CellCnn and 63.3% (12.7 points) for PriCell. On the phenotype-level measure, the corresponding averages were 68.1% (14.6 points), 71.6% (15.8 points) and 64.9% (14.6 points).
The secure version’s multi-cell-input score was higher than PriCell’s in the paired comparison (Wilcoxon p=0.004), while the phenotype-level methods were statistically indistinguishable over six test donors.
On AML, plaintext CellCnn reached 100% multi-cell-input accuracy on every one of the 10 splits. The secure version averaged 93.5% (standard deviation 4.7 points) on that measure and 91.6% (8.8 points) on phenotype accuracy, compared with PriCell’s 89.8% (5.5 points) and 90.0% (8.6 points).
The secure version was favored over PriCell in 8 of 10 splits; the Wilcoxon p-value was 0.08.
The continuous test used a synthetic target
The study also tested AML MRD regression, in which the model estimated a spike-in fraction rather than choosing a class. On a patient-held-out test set of 42 multi-cell inputs, with seven spike-in frequencies from 0% to 5% and six replicates at each frequency, the secure model reached Pearson correlation r=0.98 and a mean absolute error of 1.0 percentage points. Plaintext CellCnn reached r=0.99 and 0.8 percentage points.
Those targets came from synthetic spike-in construction, so this result tests recovery of a constructed signal rather than validation against a continuous clinical biomarker.
Faster networks shortened training time
Training took approximately 1,200 seconds for 20 epochs at 5 Gbps, with 0.8 milliseconds of round-trip time between three dedicated MPC parties. At 1 Gbps, the same training took approximately 2,700 seconds. PriCell was reported at approximately 1,550 seconds for 20 epochs at 1 Gbps with 10 active parties, but the deployment models differed, so the timings are not a like-for-like comparison.
Where the evidence stops
The authors acknowledge that the benchmark cohorts are small and that the AML MRD regression uses synthetic ground truth. Validation on larger real cohorts and continuous clinical biomarkers is not provided.
The work does not evaluate malicious security, and the MPC threat model does not cover leakage through released outputs. These results therefore describe benchmark performance under the stated assumptions; they do not establish clinical effectiveness or cover information revealed through released outputs.
Paper data and sources
Original title: Privacy-Preserving Detection of Rare Disease-Associated Cell Subsets via Secure Multi-Party Computation
Authors: Ş. Selcan Magara, Esther Havemann, Debora Jutz et al.
Journal/Repository: arXiv
Status: Preprint, not yet peer-reviewed
First online: 2026-08-20
DOI: Not available
Original paper · Full text