Silent Guardian
Privacy-First Healthcare AI at the Edge
A system that learns from sensitive patient data without ever centralizing it. Combining TinyML, Federated Learning, and Differential Privacy for secure ECG-based AFib detection.
The Hard Problem
How do we train accurate AI models on sensitive healthcare data that we cannot legally or ethically collect in one place?
The Architectural Thesis
“Compute Moves to Data”
AI models travel to wearable devices, learn locally, and only share encrypted insights. Data never leaves the edge.
Key Takeaways
Silent Guardian represents a paradigm shift in medical AI: a system that learns from sensitive patient data without ever centralizing it. Designed for atrial fibrillation (AFib) detection from ECG signals, this prototype combines three cutting-edge technologies to solve healthcare AI's “Hard Problem.”
Core Innovation
Detection Accuracy
AFib detection from ECG signals
RAM Constraint
Edge device deployment target
Privacy Budget
Strong differential privacy guarantee
Report Contents
Machine Learning Fundamentals
Teaching Computers to Learn — Starting from Zero
What is Machine Learning?
Machine learningMachine LearningA subset of artificial intelligence where computers learn patterns from data rather than being explicitly programmed with rules. is programming through examples, not explicit rules. Instead of coding “if heart rate > 100 bpm, flag as abnormal,” we show the computer thousands of ECG recordings labeled “normal” or “AFib,” and it learns the patterns itself.
Intuitive Analogy
Neural Networks
Neural networksNeural NetworksComputing systems inspired by biological neural networks, consisting of interconnected nodes (neurons) organized in layers that process information. mimic the brain's structure: layers of interconnected “neurons” (mathematical functions) that transform input (raw ECG voltage) into output (AFib probability). Each neuron applies weightsWeightsNumerical values that determine the strength of connections between neurons. Adjusting weights during training allows the network to learn patterns. (learned numbers) to its inputs.
The Training Process
- 1
Forward Pass
Input data flows through the network, producing a prediction
- 2
Error Calculation
Compare prediction to actual label, calculate the loss
- 3
BackpropagationBackpropagationAn algorithm for training neural networks by computing gradients of the loss function with respect to weights, then using these gradients to update weights.
Calculate how each weight contributed to the error
- 4
Weight Update
Nudge weights to reduce errors—like tuning radio knobs to clear static
Interactive Neural Network
ECG Signal to AFib Detection
TinyML: AI on a Microcontroller
Target RAM
Maximum memory for MCU deployment
Power Budget
Milliwatt-level operation
Inference Latency
Real-time cardiac monitoring
What is TinyML?
Most AI runs on power-hungry GPUs in data centers. TinyMLTinyMLMachine learning models designed to run on microcontrollers with limited memory (kilobytes) and power budgets (milliwatts). shrinks models to fit microcontrollers (think Arduino) with kilobytes of memory and milliwatt power budgets.
Why Edge Computing?
Model Compression Techniques
QuantizationQuantizationA compression technique that reduces the precision of model weights from floating-point (32-bit) to integers (8-bit), reducing model size by 75% with minimal accuracy loss. compresses models by reducing numerical precision. A weight stored as 32-bit float (e.g., 0.847362) becomes an 8-bit integer (e.g., 217), cutting size by 75% with minimal accuracy loss.
PruningPruningA compression technique that removes unimportant neural network connections (weights close to zero), reducing model size like trimming dead branches from a tree. removes unimportant connections—like trimming dead branches from a tree—further shrinking the model.
| Technique | Size Reduction | Accuracy Impact |
|---|---|---|
| Quantization | 75% | Minimal (<1%) |
| Pruning | 50-90% | Low (1-3%) |
| Knowledge Distillation | 10-100x | Moderate (2-5%) |
Hardware Constraints
| Device | RAM | Power |
|---|---|---|
| Raspberry Pi 4 | 1-8 GB | 5-15W |
| Jetson Nano | 2-4 GB | 5-10W |
| ESP32-S3 | 512 KB | <1W |
| Arduino Nano 33 BLE | 256 KB | <100mW |
Model Compression Simulator
Adjust the sliders below to see how quantization and pruning compress models for edge deployment
Model Size
0.68 MB
83% reduction
Accuracy
95.0%
Clinical grade ✓
Compression
5.9x
Original: 4.0 MB
Lower bits = smaller model, but less precision
Removes weights with absolute value below 30% of maximum
Higher threshold = more weights removed
Understanding the Trade-offs
Quantization
Reduces precision by representing weights with fewer bits. A 32-bit float becomes an 8-bit integer, achieving 4× compression with minimal accuracy loss.
Pruning
Removes weights with small values that contribute little to predictions. Like trimming dead branches, this shrinks the model while preserving core functionality.
Neural Network Weights
Hover over cells to see weight values. Blue = positive, Green = negative, Dashed = pruned
Performance Metrics
5.9x
smaller than originalFederated Learning: Collaboration Without Data Sharing
The Paradigm Shift
Imagine 100 hospitals each have 1,000 AFib patient records. Centralized training demands pooling all 100,000 records—illegal under HIPAA. Federated LearningFederated LearningA machine learning approach where models are trained across multiple decentralized devices or servers holding local data samples, without exchanging raw data. (FL) solves this: a central server distributes a “global model” to each hospital.
Key Insight
The FedAvg Algorithm
The server aggregates client updates via FedAvgFedAvgFederated Averaging algorithm that aggregates client model weights using a weighted average based on the number of training samples at each client. (weighted averaging based on dataset sizes) into an improved global model, which is then redistributed for the next round.
FL Training Workflow
- 1
Global Distribution
Server distributes global model to K participating clients
- 2
Local Training
Each client trains on local data (1 epoch per FL round)
- 3
Gradient Upload
Clients upload encrypted weight updates (not raw data)
- 4
Secure Aggregation
Server aggregates weights via FedAvg algorithm
- 5
Repeat
Updated global model redistributed; cycle continues
Straggler Handling: The server uses asynchronous updates with 80% participation thresholds to handle slow or disconnected clients.
Interactive Federated Learning Workflow
Federated Learning Cycle
Ready
Click on any stage to learn more, or press Play to watch the complete cycle.
Key Points
- The global model resides on the central server
- Client nodes (hospitals) are ready to participate
- No raw patient data is ever centralized
Differential Privacy: Quantifying Privacy Loss
Re-identification Risk
Census records identified from summary statistics
Strong Privacy
Minimal information leakage
Balanced Mode
Better utility, moderate privacy
Noise Magnitude
Calibrated Gaussian noise injection
What is Differential Privacy?
Differential privacyDifferential PrivacyA mathematical framework that provides provable privacy guarantees by limiting what can be inferred about any individual's data from the output of an algorithm. (DP) mathematically limits what attackers can infer about individuals from model outputs. The key parameter, epsilon (ε)Epsilon (ε)The privacy budget parameter in differential privacy. Lower ε means stronger privacy but potentially less model utility. ε bounds the probability ratio of any outcome occurring with vs. without a specific individual's data., bounds the probability ratio of any outcome occurring with vs. without your data.
The Privacy Budget
Noise Injection Mechanisms
DP works by injecting noise (random values) into gradients before upload:
- Laplacian noiseLaplacian NoiseSymmetric, double-exponential noise distribution commonly used in differential privacy for counting queries and sparse data. — Symmetrically distributed, suits counting queries
- Gaussian noiseGaussian NoiseBell-curved noise distribution that better fits gradient perturbation in deep learning, providing smoother privacy guarantees. — Bell-curved, better fits gradient perturbation
Intuitive Analogy
Noise Calibration Formula
Where σ is noise magnitude, sensitivity is the maximum gradient change from one record, δ is failure probability, and ε is the privacy budget.
Privacy-Utility Tradeoff
Silent Guardian uses Opacus to inject Gaussian noise calibrated to the epsilon budget. This guarantees differential privacy—an adversary cannot determine if any individual's data influenced the model.
Privacy-Utility Tradeoff Explorer
Adjust epsilon to see how privacy budget affects model accuracy
Strong Privacy (ε = 1)
~78% accuracyIndustry gold standard. An adversary gains almost no information about whether any specific ECG was in the training set.
Clinical Pipeline: From ECG Signal to AFib Detection
Clinical Evaluation Metrics
| Metric | Formula | Interpretation |
|---|---|---|
| Sensitivity | TP / (TP + FN) | % of actual AFib cases correctly detected |
| Specificity | TN / (TN + FP) | % of normal rhythms correctly identified |
| F1-Score | 2 × (P × R) / (P + R) | Balanced measure for imbalanced datasets |
Silent Guardian Performance
Real-Time Requirements
Cardiac monitoring demands sub-second latency (<500ms) for life-threatening arrhythmia detection. Edge deployment eliminates cloud round-trip delays while preserving battery life through model quantization.
ECG Datasets Overview
| Dataset | Records | Patients | Duration | AFib Labels |
|---|---|---|---|---|
| MIT-BIH Arrhythmia | 48 | 47 | 30 min | Manual annotations |
| PTB-XL | 21,837 | 18,885 | 10 sec | 71 SCP-ECG statements |
| PhysioNet 2020 | 43,059 | 43,059 | 6-60 sec | Multi-label (IID/Non-IID) |
Live ECG Waveform Comparison
Normal Sinus Rhythm vs Atrial Fibrillation
Normal Sinus Rhythm
60-100 BPMA healthy heart rhythm with consistent timing between beats. Notice the clear P wave before each QRS complex, indicating normal atrial contraction.
Atrial Fibrillation (AFib)
IrregularChaotic atrial activity replaces normal P waves with fibrillatory (f) waves. The varying R-R intervals are the hallmark sign that Silent Guardian detects.
AFib detection relies on two primary features: absent P waves (replaced by chaotic f waves) and irregularly irregular R-R intervals. Silent Guardian's ML model learns to recognize these patterns with 96% accuracy.
System Architecture Design
Three-layer architecture: Edge devices, FL server, and privacy layer working together to enable secure, distributed learning.
Edge Device Layer
Raspberry Pi/Jetson with 12-lead ECG sensor, quantized TinyML model, and local gradient computation.
- • 16-second ECG segments @ 257 KHz
- • 1 epoch per FL round
- • Battery-optimized training
FL Server Layer
Cloud orchestration using Flower framework with FedAvg aggregation and client management.
- • Distribute global model to K clients
- • Weighted averaging by dataset size
- • 80% participation threshold
Privacy Layer
Opacus-powered DPDifferential PrivacyMathematical framework guaranteeing individual data points cannot be identified from aggregated results. integration with configurable epsilon budgets.
- • Gaussian noise injection
- • ε=1.0 (strong) to ε=8.0 (balanced)
- • Gradient clipping before upload
Sample Implementation
import flwr as fl
from opacus import PrivacyEngine
class PrivateFlowerClient(fl.client.NumPyClient):
def __init__(self, model, train_loader, privacy_engine):
self.model = model
self.train_loader = train_loader
self.privacy_engine = privacy_engine
def fit(self, parameters, config):
# Set model parameters from server
self.set_parameters(parameters)
# Local training with DP
self.train_with_privacy()
# Return updated weights (not raw data!)
return self.get_parameters(), len(self.train_loader), {}
def train_with_privacy(self):
# Opacus automatically clips gradients
# and adds calibrated Gaussian noise
for batch in self.train_loader:
loss = self.compute_loss(batch)
loss.backward()
self.optimizer.step()Privacy Layer Integration
Silent Guardian Architecture
Click on each layer to explore how TinyML, Federated Learning, and Differential Privacy work together to protect patient data.
Security Model & Regulatory Compliance
Unique Security Challenges
Federated learning systems face unique threats because the server cannot directly verify client behavior. Trust is distributed across multiple edge devices—any of which could be compromised.
Security Threats in FL
| Threat | Impact | Defense |
|---|---|---|
| Model Poisoning | Critical | Byzantine-robust aggregation (Multi-Krum) |
| Gradient Leakage | High | Differential Privacy noise injection |
| Byzantine Attacks | High | Coordinate-wise median aggregation |
| Man-in-the-Middle | Medium | TLS 1.3 encryption via gRPC |
Regulatory Compliance
HIPAA Compliance
Health Insurance Portability and Accountability Act mandates safeguards for Protected Health Information (PHI).
- ✓ Encryption of PHI in transit and at rest
- ✓ Audit logs for all data access
- ✓ Business associate agreements
- ✓ Raw ECG data never leaves edge devices
GDPR Compliance
Article 32 requires “appropriate technical and organisational measures” for data security.
- ✓ Pseudonymization via FL architecture
- ✓ Encryption for all transmissions
- ✓ Data residency maintained
- ✓ EU patient data stays on EU devices
FDA Pathway
FDA classifies AI-enabled diagnostic tools as Class II or III medical devices requiring 510(k) clearance or PMA approval.
- • 950+ AI-enabled devices FDA-authorized
- • 2025 guidance on AI lifecycle management
- • Predetermined change control plans
- • Pre-submission consultations planned
| Regulation | Jurisdiction | Key Requirement | Status |
|---|---|---|---|
| HIPAA | USA | PHI encryption, audit logs, BAAs | Compliant |
| GDPR Article 32 | EU | Pseudonymization, encryption | Compliant |
| FDA SaMD | USA | 510(k) clearance for Class II devices | Pathway Defined |
Federated Learning Security Threat Matrix
Hover over threats for analogies. Click defenses for detailed explanations.
| Threat | Impact | Description | Defense Mechanism |
|---|---|---|---|
Model Poisoning | Critical | Malicious clients submit corrupted model updates to manipulate the global model, potentially causing it to misclassify AFib as normal rhythm. | |
Gradient Leakage | High | Model updates can inadvertently leak patient information. Gradient vectors may contain enough information to reconstruct original training samples. | |
Byzantine Attacks | High | Named after the Byzantine Generals Problem, these attacks involve clients sending arbitrary, contradictory updates that prevent model convergence. |
Commercial Viability & Monetization Strategy
Silent Guardian addresses a trillion-dollar opportunity at the intersection of remote patient monitoring, data privacy, and collaborative medical research.
Market Size (2024)
Global RPM market valuation
Projected (2033)
CAGR of 19.8%
North America Share
Largest regional market
Annual Reimbursement
Per Medicare RPM patient
Monetization Strategies
Provider SaaS Model
Tiered subscriptions (Starter/Professional/Enterprise) priced per-patient-per-month or per-bed, with Device-as-a-Service bundling to reduce CAPEX.
Payer Enterprise Model
Per-member-per-month licensing or value-based contracts sharing fraud prevention savings.
Research Network
Free platform access for data contributors (hospitals); paid query subscriptions for consumers (pharma, MedTech) creating high-margin revenue from network effects.
Three Pillars of Revenue
Remote Patient Monitoring Market Growth
Global market projection 2024-2033