MedSwarm

Privacy-preserving federated agents for multi-hospital genomics research. Hospitals collaboratively train a cancer classifier without ever sharing patient data — while a trust agent quarantines misbehaving nodes and a verifier agent checks every model against biomedical knowledge.

Built with Flower for the Flower Hackathon Berlin 2026.

The problem

Multi-site biomedical studies are blocked by data-sharing restrictions: patient data can't leave the hospital. MedSwarm treats each hospital as an autonomous agent that trains locally on its own data (TCGA-LUAD gene expression, reduced to ~50 Hallmark pathway scores) and shares only model updates, federated via Flower.

Architecture

flowchart TB
    subgraph Server["Flower Server"]
        Agg["SafeFedAvg<br/>(aggregation)"]
        Pol["PolicyAgent<br/>flag · quarantine · rollback"]
        Ver["VerifierAgent<br/>biological grounding"]
        Pol --> Agg
        Ver --> Agg
    end

    subgraph Nodes["Hospital agents &mdash; raw data never leaves"]
        A["Hospital A<br/>(site 1)"]
        B["Hospital B<br/>(site 2)"]
        C["Hospital C<br/>(site 3)"]
    end

    Agg <-->|"model updates only"| A
    Agg <-->|"model updates only"| B
    Agg <-->|"model updates only"| C

    Agg --> Audit["audit_log.jsonl"]

Loading

• PolicyAgent — per-round update inspection (norm-outlier detection), reputation scoring with quarantine + readmission, probe-set validation with rollback, append-only audit log (audit_log.jsonl).

• VerifierAgent — after training, checks the global model's top predictive pathways against curated lung-cancer biology (offline table; PubMed E-utilities as designed upgrade).

• Probe set — held-out cohort kept server-side; rounds that hurt it are rolled back.

Quickstart

pip install -e .
flwr run . --stream    # first run downloads TCGA-LUAD (~200MB) once, then caches

Demo commands

flwr run . --stream                                    # honest federation
flwr run . --run-config "attack-partition=2" --stream  # hospital C goes rogue
streamlit run dashboard.py                             # trust dashboard

Watch the audit log: the poisoned node is flagged within a round, quarantined by round 3, and federated accuracy keeps climbing without it.

Configuration

All in pyproject.toml → [tool.flwr.app.config]: num-server-rounds, num-hospitals, learning-rate, local-epochs, attack-partition (-1 = off, 0/1/2 = simulate a poisoned hospital).

Known limitations (production roadmap)

• (current) Norm statistics are fragile at 3 nodes → (future) trimmed mean / Krum at scale

• (current) Admission control is config-side → (future) cryptographic identity + data-use agreements

• (current) VerifierAgent grounded by Flower Endeavor 1.0 (curated table as offline fallback) → (future) live PubMed/literature grounding

• (current) No differential privacy