🤖 AI Summary
In multi-institutional medical federated learning, standard conformal risk control (CRC) struggles to guarantee individual coverage for underperforming hospitals, leading to uncontrolled false negative rates. This work proposes a federated CRC protocol based on risk curve shrinkage: each participant uploads only its empirical risk curve, and the server applies shrinkage regularization to generate personalized thresholds for every hospital, ensuring both coverage validity and prediction set efficiency without exchanging any patient-level data. The study quantifies, for the first time on real-world multicenter brain tumor data (FeTS-2022), the coverage failure of federated CRC and introduces a hyperparameter to smoothly balance worst-case coverage–efficiency trade-offs. Experiments show the method reduces the proportion of institutions violating coverage guarantees from 40% to 13.5%, with only a 2.0× increase in prediction set size—dramatically lower than the 83× inflation observed with local baselines.
📝 Abstract
Conformal risk control (CRC) provides distribution-free guarantees on segmentation quality by calibrating a prediction-set threshold on held-out data. In federated deployments, the standard approach pools calibration scores across sites into a single threshold. We provide the first quantification, on real multi-institutional brain tumor data (FeTS-2022, 1,251 subjects, 20 institutions), showing that this naive pooled CRC protects the average hospital but violates coverage at 40% of individual institutions, with the worst site exceeding the target false-negative rate by 7.8 percentage points. The naive alternative, per-site local CRC, largely restores coverage but inflates prediction sets by 83x, rendering them clinically useless. We propose a shrinkage-based federated CRC protocol: each site transmits only its empirical risk curve (G scalars) to a server, which computes a shrinkage-regularized threshold per site. A single hyperparameter n0 smoothly trades worst-case coverage for prediction-set efficiency; leave-one-site-out sensitivity analysis identifies n0=19, achieving 2.7/20 violations at 2.0x stretch. We further show that direct Lagrangian optimization of coverage budgets fails, concentrating risk on vulnerable hospitals, and that the finite-sample correction term is essential: removing it triples violations. The marginal CRC guarantee is preserved by construction under the stated site-mixture assumption; per-site coverage is validated across four targets with three seeds. No patient-level images, masks, or per-volume scores leave any site.