Federated Bayesian method improves detection of thrombectomy device risks
Federated Bayesian Surveillance of Mechanical Thrombectomy Adverse Events: A Population Risk Layer for Surgical Digital Twins
Cryptography and SecurityRobotics
Summary
Finding out how often surgical devices cause harm is hard because data is spread across many hospitals and must stay private. The authors created a way for hospitals to share safety information without revealing sensitive data by using a privacy-focused Bayesian approach. They tested it on a large dataset of reports about clot-retrieval devices and found their method better at identifying different complication patterns than existing techniques. This makes it easier to estimate relative safety risks across manufacturers while protecting patient privacy.
What this means in practice
- •For hospital data teams: Use federated Bayesian methods to monitor device-related complications while keeping patient data private across multiple hospitals.
- •For medical device manufacturers: Identify manufacturer-specific risks from adverse event reports without centralized data collection, supporting safer device improvements.
Authors
Damini Rijhwani
Abstract
Learned surgical simulators and world models can roll out plausible procedural futures, but they carry no grounded estimate of how often interventional devices actually harm patients. We propose treating population-scale adverse-event surveillance as a distinct belief layer of the surgical digital twin, and we evaluate a federated Bayesian protocol for learning it under formal privacy guarantees. Each site holds per-class Gamma-Poisson posteriors over adverse-event rates and exchanges only Rényi-differentially-private natural-parameter updates. We benchmark on the complete FDA MAUDE cohort for thrombus-retrieval catheters (product code NRY): 8,617 reports, of which 6,491 are classified by transparent keyword rules into five thrombectomy complication classes and partitioned across $K=8$ manufacturer sites. At a matched privacy budget of $(\\varepsilon \\approx 2.09, \δ= 10^{-5})$, the conjugate protocol attains a held-out Poisson score of -5.78 per test event versus -26.58 for FedAvg with differential privacy. The non-private federated model also outperforms centralized pooling (+3.19 vs +2.93), evidence that manufacturer-specific complication profiles are real and that federation preserves them. Because MAUDE lacks procedure denominators, outputs are relative rate orderings rather than absolute risks, and we report all privacy-utility operating points.