Federated AI Learns to Spot Hospital Device Hacks Without Ever Seeing Patient Data

Connected medical devices have quietly become the nervous system of modern hospitals, streaming heart rhythms, glucose readings and respiration rates from bedside sensors to clinicians in real time. That connectivity saves lives, but it also exposes healthcare networks to serious security risks. Now, researchers have unveiled a security framework that trains an intrusion-detection artificial intelligence across distributed medical devices while keeping sensitive patient data locked on the devices themselves, and then explains every alarm it raises in terms a human analyst can audit.

They call their system a federated recurrent short-term memory network, and it combines three technologies that have mostly been explored separately: federated learning, a hybrid deep recurrent neural network with long short-term memory layers, and Shapley Additive Explanations, a mathematical technique for opening up the black box of deep learning decisions. The motivation is stark. The authors cite 2025 research from Claroty reporting that 99 percent of healthcare organizations were running IoMT devices with known exploited vulnerabilities, while 20 percent of hospital systems showed such vulnerabilities associated with ransomware. A separate analysis highlighted by the team estimated that roughly 60 percent of IoMT devices are vulnerable to potential attacks. Because these devices transmit data over wireless links, they are also exposed to man-in-the-middle attacks, in which an adversary intercepts and alters messages in transit. Compromised telemetry is not merely an IT problem: corrupted physiological data could lead to misdiagnosis or mistreatment, and in the worst cases, patient injury or death.

Traditional defenses have struggled to keep up. Encryption and trust-based systems are difficult to implement across heterogeneous device fleets, so intrusion detection systems serve as a second line of defense. Machine learning is a natural fit for that role, but most existing ML security models are centralized: raw data flows to a single server for training, creating both a privacy hazard, since patient information is exceptionally sensitive and valuable on the black market, and a single point of failure that could bring down the whole network if compromised. Many prior studies also trained their models on generic network datasets such as KDDcup-99 or NSL-KDD, which the authors argue do not reflect the traffic patterns of real medical device networks. Federated learning inverts that architecture. Instead of shipping data to the model, the model travels to the data.

In the proposed system, each IoMT device or edge gateway trains a local copy of the detection model on its own private telemetry, then transmits only the learned weight updates to a central server. The server merges these updates using a federated averaging algorithm and sends the improved global model back out for the next round of training. Raw medical records never leave the local device, which reduces bandwidth consumption, mitigates the single-point-of-failure risk, and supports alignment with privacy regulations such as HIPAA and GDPR. The team also applied model quantization and weight sparsification, zeroing out most model parameters to shrink the payload and cut the communication energy required for each training round.

At the heart of the detector is a hybrid architecture designed around the fact that network traffic is inherently sequential. A deep recurrent neural network first extracts short-term temporal features, such as sudden spikes in packet rate or changes in flow duration that often betray an attack. A learnable fusion gate then dynamically weighs these temporal representations against the original normalized traffic features before passing the combined signal to an LSTM layer, whose input, forget and output gates preserve long-range dependencies that plain recurrent networks lose to vanishing gradients. This matters because multi-stage and slowly evolving attacks unfold over extended sequences of communications rather than in a single anomalous packet. A dense softmax layer finally classifies each sequence as normal or malicious.

Tuning such a network is a non-convex optimization problem, meaning the performance landscape is riddled with local optima and each candidate configuration requires an expensive multi-round federated training cycle. The researchers therefore employed Bayesian optimization, which builds a probabilistic surrogate of the objective function using a Gaussian process with a Matérn kernel and selects the next configuration to test by maximizing an Expected Improvement acquisition function. In a head-to-head comparison on the CIC-IoMT2024 dataset, Bayesian optimization reached 99.94 percent validation accuracy, statistically indistinguishable from exhaustive grid search at 99.95 percent, while consuming roughly 29 times less compute, about 3.5 GPU-hours against 100.8. Training used the Adam optimizer with a learning rate of 0.001 and sparse categorical cross-entropy loss.

Evaluation rested on three benchmark datasets chosen for their realism: WUSTL-EHMS2020, collected from a simulated healthcare monitoring testbed with spoofing, man-in-the-middle and data injection attacks; CIC-IoMT2024, built from 14 attack scenarios against 40 real and emulated IoMT devices; and BoT-IoT, which captures denial-of-service, DDoS, scanning and keylogging attacks in a realistic IoT testbed. The results were striking. On CIC-IoMT2024, the framework achieved detection rates of 99.94 percent for DoS attacks and 100 percent for both DoS SYN and DoS TCP variants, with exceptionally high precision for DoS SYN, DDoS TCP and ARP spoofing classes and false alarm rates that were remarkably low. On BoT-IoT, DoS UDP attacks were detected at 99.65 percent, and data theft attacks reached 99.87 percent accuracy. On WUSTL-EHMS2020, the attack class detection rate was 94.53 percent, with an area under the ROC curve exceeding 92 percent.

Crucially, the framework is built to explain itself. SHAP analysis decomposes each prediction into per-feature contributions, and the results were clinically and operationally meaningful. On WUSTL-EHMS2020, heart rate variability, respiratory rate and temperature emerged as the dominant predictors of anomalies, meaning an alert can be read as a signal to check the patient, the sensor connection, or the possibility of telemetry manipulation. On CIC-IoMT2024, flow duration, total forward packets, average packet size and forward header length topped the importance ranking, attributes that shift characteristically during reconnaissance, flooding and spoofing activity and can guide responses such as isolating a gateway or rate-limiting suspicious flows. The authors frame this transparency as supporting, though not automatically certifying, compliance with HIPAA, GDPR, WHO and ISO expectations for interpretable AI in healthcare.

The team also stress-tested practicality and rigor. Repeated runs across ten random seeds produced tight 95 percent confidence intervals, and paired significance tests with Holm-Bonferroni correction confirmed that the gains over ablated variants were statistically significant, with Bayesian optimization contributing the largest effect. The trained global model is compact at 8.46 megabytes, with inference times of 2.84 to 3.91 milliseconds per sample on standard hardware and detection latency below 7 milliseconds; on a Raspberry Pi 4, a stand-in for a low-cost hospital edge gateway, it still processed about 67 samples per second. A centralized version of the same model performed only marginally better, showing that the privacy-preserving design costs little in accuracy.

The authors are candid about limitations: benchmark datasets cannot fully capture the noise, device diversity and heterogeneity of live hospital networks, federated learning does not eliminate all privacy risks since model updates can leak information under inference attacks such as membership inference or gradient inversion, and regulatory certification, clinician usability and incident-response workflows remain future work. Validation on live hospital traffic and cross-institutional data is still needed before large-scale clinical adoption. Still, the study offers a compelling template for how hospitals might defend their device fleets collaboratively, without ever pooling a single patient record.

Subject of Research: A federated learning explainable deep learning framework for intrusion detection in Internet of Medical Things systems

Article Title: Federated learning explainable deep learning framework for enhanced internet of medical things security

Article References: Saheed, Y. K., & Chukwuere, J. E. (2026). Federated learning explainable deep learning framework for enhanced internet of medical things security. Discover Artificial Intelligence, 6(1), Article 990. https://doi.org/10.1007/s44163-026-02034-0

Image Credits: AI Generated

DOI: 10.1007/s44163-026-02034-0

Keywords: Internet of Medical Things, federated learning, intrusion detection, deep learning, LSTM, explainable AI, SHAP, Bayesian optimization, healthcare cybersecurity, privacy preservation, HIPAA, GDPR