End-to-end integrated federated research platform

Abstract

A federated analytics (FA) / federated learning (FL) system configured to implement a federated learning pipeline or a federated analytics pipeline comprises: a centralized FA / FL platform comprising a client environment interface module; and a plurality of local environments, each local environment comprising a respective local memory configured to store local raw data and / or local pre-processed data. The local environments are configured to obtain data from data sources, and to generate local statistical models which are aggregated at the centralized platform to generate a global statistical model, thereby fulfilling a client request.

Description

[0001] END-TO-END INTEGRATED FEDERATED RESEARCH PLATFORM

[0002] BACKGROUND

[0003] Multiple Sclerosis (MS ) is a severely debilitating disease where the underlying pathogenesis and immunological processes of progression are still not fully understood . New approaches are needed to uncover the many remaining questions associated with optimising clinical care and understanding the biology of the disease which is critical for improving our care delivery for people with MS . Acknowledgement of the fact that current research approaches have their limits in unravelling the last gaps in our understanding of MS has driven the collaborative research networks and approaches . The gained momentum has been helped by novel technological and analytical advances that are now, at last , bringing large scale data driven research within our reach .

[0004] In healthcare and the field of Neuroscience , combining heterogeneous and global datasets offers a chance to analyse clinical data at scale leveraging machine learning (ML ) approaches enabling novel insights generation . Big-data driven research approaches can be of particular value in Neuroscience , where studying slow progressive and complex ( rare ) neurological disorders requires large cohorts and longterm follow-up to enable identification of subtle patterns and correlations ( Levine , 2022 ) . Collaborative research and multicohort studies can be a powerful approach to drive innovation by bringing together experts from different fields to share data and expertise facilitating ground breaking discoveries .

[0005] Overall , collaborative research offers a powerful tool for advancing scientific knowledge and improving patient care , and the exponentially growing amounts of heterogeneous data being created in healthcare is a promising avenue for exploring new frontiers in neuroscience research . However , currently collaborating broadly on data is still limited due to data ownership, IP, privacy and regulatory concerns greatly limiting the potential .

[0006] Federated analytics and learning approaches are increasingly emerging as a technological solution to address these data sharing challenges . Federated research approaches allow collaborating institutions to engage in j oint data analysis without the need to move data into a central repository or data clean room as is classically done ( Stripelis 2021 ) . More and more groups are successfully experimenting with federated approaches to drive novel research pathways ( Lee 2018 ; Sheller 2018 ; Silva 2019 ; Rieke 2020 )

[0007] The present invention is directed towards a novel model to successfully build a federated analytics and learning ecosystem which overcomes the limitations of current research networks ( e . g . data sharing challenges and privacy / security concerns ) using a federated data architecture concept . Computation results instead of data itself are shared between sites , allow for broad collaboration on data and help to establish data driven approaches .

[0008] The advent of high efficacy therapy in MS clinical trials has allowed to decipher progression independent of relapse activity ( PIRA) as a key contributor to the accrual of deterioration of neurological function in MS patients . As with several other concepts in the MS field, the adaptability and utility of this concept into patient care settings remains to be demonstrated but has great potential in improving treatment delivery for patients with MS . The inventors leveraged this use-case and unmet need to set up a study, leading to the development of the invention . The aim was to assess the applicability and utility of a federated data infrastructure assessing the clinical observation of "lack of disease stability" as a novel surrogate end-point for deterioration of neurological function in MS in clinical real world as well as clinical trial cohorts on high efficacy antibody therapy . The study established and leveraged a federated architecture for data analysis , and we will assess its applicability and utility for research purposes . The local environments defined later in this application will provide longitudinal , retrospective , standard of care data from existing research institutions , directed towards local cohorts of subj ects with multiple sclerosis , on high efficacy therapies . The applicant will also provide clinical trial data sets . The observation of "lack of disease stability" as a clinical observation of deterioration of neurological function as a result of relapses or relapse independently will be assessed . Real world endpoints may be developed and analysed, and the results indirectly compared to the corresponding clinical trial data to investigate the question whether a real-world definition of "progression independent of relapse activity" can be defined . Federated computations may be executed on each sites ' isolated computing environment or node with the analysis orchestrated through a central aggregation server distributing queries and returning anonymous aggregate study results .

[0009] In conclusion, novel approaches for the adoptability of findings and concepts from clinical trials or single centre observations are required . A federated network infrastructure combining partly heterogeneous real world patient care data together with well curated clinical trial data will allow a network to further scale and accelerate collaborative research in MS and Neuroscience leveraging data driven research approaches to in the future help optimize and improve healthcare delivery to people with MS . As a first example and use-case , this network aims at the characterization and validation of "real world PIRA" as a valid concept and novel end-point for MS understanding and treatment concepts .

[0010] It will be appreciated from the below that the invention extends far beyond the scope of studies related to multiple sclerosis . The underlying technology may be leveraged in many other research contexts .

[0011] THE INVENTION

[0012] Broadly speaking , the present invention relates to a federated analytics ( FA) / federated learning ( FL ) system, comprising a centralised FA / FL platform and a plurality of local environments . The centralised platform is configured to receive a client request for an aggregate result , and the local environments are each configured to generate a local statistical model from local data, based on the client request . The local environments are further configured to transmit the local statistical models to the centralised platform, where they are aggregated into a global statistical model corresponding to the aggregate result . Because it is the local statistical models themselves which are sent to the centralized platform, as opposed to the local data, data privacy can be maintained . Thus , the present invention may allow for broad collaboration . Importantly, according to the present invention the local environments are each configured to execute a data harmonisation protocol to transform local raw data to local pre-processed data according to a common data model , which defines a set of criteria the local pre- processed data must satisfy . The local statistical models are generated using the local pre-processed data . This means that the plurality of local statistical models generated by the respective plurality of local environments are all generated from data meeting a common data standard, and therefore can be aggregated into the global statistical model .

[0013] More specifically then, a first aspect of the present invention provides a federated analytics ( FA) / federated learning ( FL ) system configured to implement a federated learning pipeline or a federated analytics pipeline , the system comprising : a centralized FA / FL platform comprising a client environment interface module ; a plurality of local environments , each local environment comprising a respective local memory configured to store local raw data and / or local pre-processed data , wherein : the platform is configured to receive a client request for an aggregate result via the client environment interface module , the request comprising at least : one or more parameters defining local pre-processed data, local raw data or properties of the local pre-processed data or local raw data to be used to generate the aggregate result , and one or more parameters defining the form of the aggregate result ; the platform is configured to : in response to receiving the client request , generate and transmit a platform query to one or more local environments , the platform query defining or identifying local pre-processed data or local raw data required to fulfil the client request and one or more operations to be executed on the local pre-processed data or local raw data in order to fulfil the query; and each local environment is configured to : acquire local raw data from a data source , and to execute a data harmonisation protocol on the acquired raw data , the data harmonisation protocol configured to transform the local raw data to local pre-processed data according to a common data model , the common data model defining a set of criteria which the local pre-processed data must satisfy; generate a local statistical model corresponding to the platform query, using the local pre-processed data ; and transmit the local statistical model to the platform; and the platform is configured to , in response to receiving a plurality of local statistical models from a respective plurality of local environments , aggregate the plurality of local statistical models to generate a global statistical model ; and either : transmit the aggregate result comprising the global statistical model to a client environment ; or use the global statistical model to generate the aggregate result fulfilling the client request , and transmit the aggregate result to the client environment .

[0014] Advantageously, the data harmonisation protocol may enable standardising and aligning data from multiple decentralised data sources or environments to ensure that it can be effectively used for model generation and / or aggregation . Data harmonisation may be a critical step in federated analytics and / or federated learning processes , because the participating environments may have heterogeneous data sources with varying formats , structures , and quality .

[0015] In the context of the present application, and according to Elkordy et al . ( 2023 )1, "federated analytics" refers to a privacy-preserving framework for computing data analytics over multiple remote parties without sharing the data between the arXiv:2302.01 326; parties . Similarly, "federated learning" refers to a process by which a machine-learning model is trained in different independent sessions , each session using its own dataset . This means that the machine-learning model can be trained without the source of each dataset having access to the data owned by the other sources , increasing overall privacy .

[0016] Transmitting the local statistical model may refer to transmitting an indication of parameters of the local statistical model .

[0017] The plurality local environments may each comprise a local node and a local data pre-processing module . The local data pre-processing module may be configured to acquire the local raw data and to execute the data harmonisation protocol on the local raw data to generate the local pre-processed data . The local node may be configured to use the local pre-processed data to generate the local statistical model , and to communicate with the centralised platform. Examples of communicating with the centralised platform include transmitting / receiving the platform query or the local statistical model to / from the centralised platform.

[0018] In more detail , the plurality of local environments may comprise a respective plurality of local nodes and a respective plurality of local data pre-processing modules , wherein : each node of the plurality of local nodes comprises a respective local node memory configured to store local pre- processed data ; and, each local data pre-processing module of the plurality of local data pre-processing modules comprises a local data pre-processing module memory configured to store local raw data ; and wherein : the platform is configured to , in response to receiving the client request , generate and transmit the platform query to one or more local nodes of the plurality of local nodes , and wherein each local node of the plurality of local nodes is configured to , in response to receiving the platform query : generate or receive a local node query and transmit the local node query to a respective local data pre-processing module , the local node query comprising information defining local pre-processed data or local raw data which is required to fulfil the platform query; each local data pre-processing module is configured to : acquire the local raw data from the data source , and to execute the data harmonisation protocol on the acquired raw data , thereby generating the local pre-processed data, and, after receiving the local node query, to transmit local pre-processed data corresponding to the local node query to the local node from which it received the local node query for storage in the local node memory; each local node which received the platform query is configured to : after receiving the local pre- processed data from the respective local pre-processing module ; generate a local statistical model corresponding to the platform query, using the local pre-processed data; and transmit the local statistical model to the platform; and the platform is configured to : in response to receiving a plurality of local statistical models from a respective plurality of local nodes , aggregate the plurality of local statistical models to generate a global statistical model ; and either : transmit the aggregate result comprising the global statistical model to the client environment ; or use the global statistical model to generate the aggregate result fulfilling the client request , and transmit the aggregate result to the client environment .

[0019] Thus , the local raw data may be harmonised by the local data pre-processing modules , and the local statistical models may be generated by the local nodes . In this way analytical efforts to harmonise data may be reduced for the system component ( i . e . , the local node ) which generates the local statistical model .

[0020] In other embodiments , each of the local nodes may be configured to execute the data harmonisation protocol as part of the generation of the local statistical model .

[0021] In some embodiments , the data harmonisation protocol may be executed by a combination of the local data pre-processing modules and the local nodes . In some embodiments , each local data pre-processing module may be configured to receive the local node query directly, rather than via the local node . In such cases it may not be necessary for each local node to be configured to generate or receive the local node query . Thus , in these cases , the local node query may be referred to as a "local pre-processed data query" .

[0022] Each local node may be configured to access a respective local data pre-processing module or plurality of local data preprocessing modules . Each local data pre-processing module may be inaccessible by the centralised platform .

[0023] The centralized FA / AL platform may be hosted on a centralized FA / FL server which may be a physical , hardware server . Alternatively, the centralized FA / FL platform may be hosted on a cloud computing server (which may be distributed across a plurality of physical servers ) . The centralised platform may correspond to a platform as a service ( PaaS ) . The same may be true of each of the local environments , local nodes and / or local data pre-processing modules . A local node may be hosted on the same physical server as a respective local data preprocessing module or plurality of local data pre-processing modules , or on a different physical server to a respective local data pre-processing module or plurality of local data pre-processing modules . A local node may comprise a compute node . A compute node may refer to an element or a device in the system which is configured to process data . The local environments , or the local nodes , and the centralised FA / FL platform may be connected, or configured to communicate with one another, optionally via a network . Each local node and its corresponding local data pre-processing module or plurality of local data pre-processing modules may be configured to communicate via a network . The local environments or local data pre-processing modules may correspond to research institutions , universities , hospitals , laboratories , or any other site at which raw data may be obtained or generated . The local raw data may comprise scientific data , such as biological data, biochemical data, biomedical data, chemical data, clinical data, medical data, physiological data , physical data, epidemiological data, psychological data , demographic data , or equivalent . In some cases , the local raw data comprises data which is used to track the status or progression of a disease , for example in the form of clinical trial data or standard of care data . The disease may be multiple sclerosis . The data may thus comprise data related to measurements or detection of biomarkers or other relevant species in a bodily fluid ( such as blood ) of a subj ect . The data may also comprise data relating to the measurements of digital biomarkers .

[0024] Herein, "local data" may refer to local raw data and / or local pre-processed data . "Local data" may refer to data which is stored or is accessible locally with respect to a given local environment , local node , or local data pre-processing module . Different local environments may have distinct distributions in their local data . Advantageously, this heterogeneity may improve the robustness and generalisation of the global statistical model . It may be assumed that the local raw data or local pre-processed data of each local environment is independently and / or identically distributed .

[0025] The client environment may correspond to a local environment . Accordingly, the client environment may comprise a local node (which may be referred to as a "client node" ) and / or a local data pre-processing module (which may be referred to as a "client data pre-processing module" ) . A "client" may refer to a client environment , a client node , or a user of a client environment or client node .

[0026] We will now discuss the common data model ( CDM) and the data harmonisation protocol in more detail .

[0027] The common data model defines a set of criteria which the local pre-processed data must satisfy . These criteria may include semantic and / or syntactic criteria ( e . g . , syntactic criteria may comprise a structure of statements or arrangement of words or terms which the local pre-processed data must use , and semantic criteria may comprise meanings which words or terms must have ) , data structure criteria ( e . g . , the structure in which the data must be stored ) , and / or data content criteria ( e . g . , content which the data must / must not include , or a predetermined value range which the data must fall within) . According to the common data model , and / or the data content criteria , local pre-processed data may comprise only de-identif ied or anonymised data . For example , the local pre- processed data may not comprise patient names .

[0028] The common data model may correspond to , or may be derived from an existing data model or standard . For example , the common data model may correspond to or may be derived from an OMOP2CDM or I2B23CDM . The common data model may define criteria derived from interoperability standards such as FIHR / HL74. The common data model may define criteria derived from full semantic models .

[0029] As will be described in further detail below, the common data model may be selected based on the client request , or based on a separate harmonised dataset request received by the centralised platform (which may be received before the client request ) , which may include information defining or indicating the common data model , or information defining a dataset according to the common data model . The data harmonisation protocol may then be executed according to the defined, or indicated common data model .

[0030] In some examples , each local environment , local data preprocessing module , or local node may be configured to automatically execute the data harmonisation protocol . Automatically executing the data harmonisation protocol may comprise executing a data harmonisation machine-learning model , which may execute the data harmonisation protocol . In these examples , each local environment , local data preprocessing module , or local node may be configured to execute the data harmonisation protocol , or the data harmonisation machine-learning model , in response to receiving a query, which may correspond to the platform query, the node query, or

[0031] 2https: / / www.ohdsi.org / data-standardization /

[0032] 3https: / / community.i2b2.org / wiki / display / BU N / i2b2+Common+Data+Model+Documentation

[0033] 4https: / / www.hl7.org / fhir / the local pre-processed data query, or a harmonised dataset query .

[0034] In some examples , each local environment , local data preprocessing module , or local node may be configured to manually execute the data harmonisation protocol . That is , each local environment , local data pre-processing module , or local node may be configured to execute the data harmonisation protocol in response to receiving a manually-input query or request , which may correspond to the client query or request , the platform query, the node query, or the local pre-processed data query, or a harmonised dataset query .

[0035] In some examples , each local data pre-processing module may be configured to manually transmit local pre-processed data to the respective local node . That is , each local data preprocessing module may be configured to transmit local pre- processed data to the respective local node in response to receiving a manually input request , which may correspond to the local node query or the local pre-processed data query .

[0036] The data harmonisation protocol , configured to transform the local raw data to the local pre-processed data according to the common data model , may include the following steps .

[0037] The raw data may be stored according to a raw data model . The raw data model may refer to a form in which the raw data is stored, and / or to the content of the raw data . For example , the raw data may use raw data syntax and or semantics , may be stored in a raw data structure and / or may include raw data content .

[0038] The data harmonisation protocol may comprise : mapping the raw data model to the common data model ; transforming the raw data into local pre-processed data according to the mapping; and, storing the local pre-processed data in the local memory, the local node memory, the local data pre-processing module memory, or a database . Mapping the raw data model to the common data model may comprise deriving and / or defining a relationship between the raw data model and the common data model . For example , mapping a raw data model which uses a raw data syntax (e.g., day-month-year ) to the common data model which uses a common data model syntax (e.g. , month-day-year ) may comprise deriving and defining the relationship between these two syntaxes . Transforming the raw data according to the mapping may comprise adjusting the raw data based on the mapping such that the adjusted raw data (i.e. , the local pre- processed data) meets the common data model (e.g. , adjusting day-month-year dates to become month-day-year dates) . The database may correspond to a Postgres5database. The database may correspond to an SQL database such as a MySQL6database. Advantageously, storing data in a database may enforce constraints on data types, nullability, uniqueness and relationships between tables. Further, the database may allow for large volumes of data to be stored.

[0039] The step(s) of mapping the raw data model to the common data model schema and / or transforming the raw data into local pre- processed data according to the mapping may be dependent on a use case and / or whether a federated analytics or a federated learning pipeline is being implemented. In a federated learning pipeline, the local statistical model may correspond to a machine-learning model trained using the local pre- processed data. The (or a type of) local pre-processed data used / required for training the model may depend on the machine-learning model (e.g. , the type of machine-learning model) , and / or may be defined in an algorithm. The (or a type of) local pre-processed data used / required for a federated analysis pipeline may depend on the specific federated analysis and / or may be defined in an algorithm.

[0040] As the common data model may define semantic criteria and / or syntactic criteria, the mapping may comprise syntactic mapping and / or semantic mapping. As described above, syntactic mapping may comprise deriving and / or defining a relationship between the raw data syntax (i.e., the syntax used in the raw data model) and the common data model syntax (i.e. , the syntax used in the common data model) . Similarly, semantic mapping may

[0041] 5https: / / www.postgresql.org /

[0042] 6https: / / www.mysql.com / comprise deriving and / or defining a relationship between the raw data semantics ( i . e . , the semantics used in the raw data model ) and the common data model semantics ( i . e . , the syntax used in the common data model ) .

[0043] In some examples , each local environment or local data preprocessing module may be configured to : before storing the local pre-processed data , create a common data model schema according to the common data model in the local memory, the local node memory, or the local data pre-processing module memory . The common data model schema may define how data is stored or organised according to the common data model . In some examples , each local environment or local data preprocessing module may be configured to : before storing the local pre-processed data , create and / or store a common data model schema according to the common data model inside the database .

[0044] In some examples , the acquired local raw data may be stored in a raw data table within the local memory, the local node memory, or the local data pre-processing module memory . The data harmonisation protocol may comprise : creating a pre- processed data table according to the common data model and / or within the common data model schema, the pre-processed data table configured to store the local pre-processed data; and storing the pre-processed data table in the local memory, the local node memory, the local data pre-processing module memory, or the database . The data harmonisation protocol may further comprise mapping the raw data table to the common data model or the common data model schema; transforming entries of the raw data table into entries for the pre-processed data table according to the mapping ; and storing the entries for the pre-processed data table in the pre-processed data table . Mapping the raw data table to the common data model may comprise deriving and / or defining a relationship between the raw data table and the common data model . For example , the common data model may require a data table ( e . g . , a pre- processed data table ) with rows which correspond to the columns of the raw data table , and with columns which correspond to the rows of the raw data table . Thus , mapping the raw data table to the common data model may comprise deriving and defining this relationship . Transforming the raw data entries into entries for the pre-processed data table according to the mapping may comprise simply assigning each raw data entry with a pre-processed data table storage location . The entries for the pre-processed data table may then be stored based on the assigned raw data entries . In some examples , transforming the raw data entries may comprise adj usting the raw data , for example adj usting the syntax of the raw data , as described above .

[0045] In some examples the local raw data may be stored in one or more raw data tables . The data harmonisation protocol may comprise : creating one or more pre-processed data tables according to the common data model and / or within the common data model schema, the one or more pre-processed data tables configured to store the local pre-processed data; and storing the one or more pre-processed data tables in the local memory, the local node memory, the local data pre-processing module memory, or the database . The data harmonisation protocol may further comprise mapping the one or more raw data tables to the common data model or the common data model schema ; transforming entries of the one or more raw data tables into entries for the one or more pre-processed data tables according to the mapping ; and storing the entries for the one or more pre-processed data tables in the one or more pre- processed data tables .

[0046] In such cases , transmitting the pre-processed data to the local storage of the local node may comprise transmitting the one or more pre-processed data tables . In some cases , the local environment or local data pre-processing module may be configured to export each pre-processed data table from the database to a separate file . In these cases , transmitting the local pre-processed data to the local storage of the local node may comprise transmitting the one or more files . The one or more files may be comma-separated values ( CSV) files . In some examples , after a pre-processed data table or its corresponding file has been transmitted, the pre-processed data table and / or its corresponding file may be deleted from the memory or database .

[0047] In some examples , the data harmonisation protocol may further comprise : if one or more of the pre-processed data tables already exists in the database or the memory, dropping or deleting these existing tables and re-creating them .

[0048] It may be useful to store a copy of the local raw data in the one or more pre-processed data tables , for example to use in assessing the data quality of the local pre-processed data (which is described in more detail below ) . Accordingly, one or more of the pre-processed data tables may include a raw data column configured to store the local raw data , and the data harmonisation protocol may comprise storing the local raw data in the one or more raw data columns . In this case , each local environment or local data pre-processing module may be configured to delete each raw data column from the one or more pre-processed data tables before the one or more pre-processed data tables are transmitted to the local storage of the local node , or before the one or more pre-processed data tables are each exported to a respective file .

[0049] It may also be useful to log whether one or more of the steps of the data harmonisation protocol have been successfully executed, for example to use in assessing the data quality of the local pre-processed data (which will be described in more detail later in the application) . Therefore , the data harmonisation protocol may comprise , for each local raw data element , logging whether the local raw data element is successfully transformed into a local pre-processed data element . A data element ( e . g . , a local raw data element ) may refer to a single piece of data . The data harmonisation protocol may further comprise logging the number of local raw data elements successfully transformed and / or the number of local raw data elements unsuccessfully transformed . The data harmonisation protocol may further comprise logging the number of transformed raw data tables , that is , the number of raw data tables with entries which have been transformed into entries for one or more pre-processed data tables . Note that each local environment or each local data preprocessing module may store different local raw data ( e . g . , local raw data which uses different semantics or syntax ) , and therefore , the steps of mapping and / or transforming may be different for each local environment or each local data preprocessing module . Thus , each local environment or each local data pre-processing module may be configured to execute a respective data harmonisation protocol . Each data harmonisation protocol may be configured to transform the local raw data to local pre-processed data according to the common data model , and each data harmonisation protocol may comprise one or more of the data harmonisation protocol steps disclosed herein . Of course , the common data model is the same for each local environment or local data pre-processing module .

[0050] One or more steps of the data harmonisation protocol may be generated or created in the local environment ( e . g . , on the local data pre-processing module or local node ) .

[0051] One or more steps of the data harmonisation protocol may be generated or created in an external environment . An external environment may refer to an environment which is separate from a local environment . Such an external environment may be different from the external environment discussed earlier in this application . Each local data environment or each local data pre-processing module may be configured to transmit a local raw data profile to the external environment . The local raw data profile may specify features of the local raw data ( e . g . , its syntax, semantics , or structure ) , without including the local raw data itself . The external environment may be configured to receive a local raw data profile , and based on the local raw data profile , to generate one or more steps of the data harmonisation protocol . The external environment may be configured to generate synthetic data based on the raw data profile , and to use the synthetic data to generate the one or more steps of the data harmonisation protocol . The external environment may then be configured to transmit the one or more steps of the data harmonisation protocol to the local environment or local data pre-processing module . Each local environment or local data pre-processing module may be configured to receive one or more steps of a data harmonisation protocol from the external environment, and to execute the data harmonisation protocol.

[0052] Each local environment or local data pre-processing module may be configured to execute and test the data harmonisation protocol. Each local environment or local data pre-processing module may be configured to transmit results of the test to the external environment, which may be configured to update the data harmonisation protocol in accordance with the results .

[0053] In some examples, each local environment, local data preprocessing module or external environment may be configured to generate synthetic data. The synthetic data may be based on the local raw data, or based on the local raw data profile. Each local environment, local data pre-processing module or external environment may further be configured to use the synthetic data to generate and / or test the one or more steps of the data harmonisation protocol. Each local environment, local data pre-processing module, or external environment may be configured to update the data harmonisation protocol based on the testing. For example, the synthetic data may be used in: (1) data mapping and transformation testing; (2) aligning raw data to a common data model schema; (3) assessing the quality of the local pre-processed data; (4) testing the privacy and security of the local pre-processed data; or, (5) cross-source validation. As will be discussed later in this application, synthetic data may also be used in global model, or master analysis script, development and testing.

[0054] (1) In data mapping and transformation testing, synthetic data may be used to test the mapping and / or transformation steps. By generating synthetic data with known characteristics, the mapping and / or transformation may be tested to ensure that these steps work correctly and do not introduce errors.

[0055] (2) In data harmonisation, aligning data schemas (e.g., database tables or data models) may be a challenge. Synthetic data may help evaluate schema alignment strategies by generating data that adheres to different schemas . This can be especially useful when it is necessary or requested to merge datasets with varying data schemas .

[0056] ( 3 ) The synthetic data may be used as a benchmark for assessing the quality of harmonised data . By comparing the quality and properties of real local pre-processed data with synthetic data , it may be possible to identify discrepancies , errors , or data issues that need to be addressed in the data harmonisation protocol .

[0057] ( 4 ) When executing the data harmonisation protocol on data that may contain sensitive information, it may be crucial to ensure data privacy and security . Synthetic data may be used to simulate sensitive information, allowing testing of security measures and data protection mechanisms without exposing real sensitive data .

[0058] ( 5 ) Data harmonisation may involve combining data from multiple sources . In this case , synthetic data may be used as a means of cross-source validation . By generating synthetic data that mimics the characteristics of real local pre- processed data from different sources , it may be possible to check if the local pre-processed data behaves as expected when integrating diverse datasets .

[0059] In some cases , after the data harmonisation protocol has been applied, the local pre-processed data may be missing content ( e . g . , due to this content not being present in the local raw data ) , may not fully conform to the CDM, and / or there may be errors in the local pre-processed data ( e . g . , due to these errors being present in the local raw data ) . Therefore , it may be useful to gain an understanding of the quality of the local pre-processed data . Accordingly, the local environment or the local data pre-processing module may be configured to : assess the data quality of the local pre-processed data; and, output a data quality report based on the assessment of the data quality . The data quality report may comprise a statistical representation of the local pre-processed data, and / or a statistical representation of the local pre-processed data elements corresponding to a variable of the data . The statistical representation may include a minimum value , a maximum value , a mean, a median, or a list of the values and the frequency of each value . Assessing the data quality of the local pre-processed data may comprise one or more of : assessing a completeness of the local pre-processed data; assessing a conformance of the local pre-processed data with the common data standard; and, assessing a plausibility of the local pre-processed data .

[0060] Assessing the completeness may comprise calculating a number or a proportion of the local raw data elements which are and / or which are not successfully transformed into local pre- processed data elements . Assessing the completeness may comprise calculating a number or a proportion of the local raw data elements corresponding to a given variable which are and / or which are not successfully transformed into local pre- processed data elements . Assessing the completeness may be based on the logging described above . Assessing the completeness may comprise calculating a number or a proportion of non-null local pre-processed data elements corresponding to a given variable . Assessing the completeness may comprise calculating a number of unmapped raw data elements . Assessing the completeness may comprise calculating a number of unmapped local raw data elements corresponding to a given variable . Assessing the completeness may use the local raw data stored in the pre-processed data table . For a date variable , assessing the completeness may comprise calculating a number or a proportion of local pre-processed data elements corresponding to the date variable which are complete ( e . g . , which include a year , a month and a day) and / or which are partially complete ( e . g . , which include a year and a month only, or a year only) .

[0061] Assessing the conformance may comprise determining a number or a proportion of the local pre-processed data elements which conform to the CDM . Assessing the conformance may comprise determining a number or a proportion of the local pre- processed data elements which have a value , such as a test score , out of a predetermined value range required by the CDM, such as a predetermined test score range . Assessing the conformance may comprise determining a number or a proportion of the local pre-processed data elements which have semantics or syntax which does not conform to the CDM . Assessing the conformance may comprise excluding orphan records . Orphan records may refer to data records that are disconnected or not linked to other relevant records in the data or database . Orphan records might lack necessary references or associations with other data elements , making them isolated or irrelevant in the context of the data structure or model . Thus , excluding orphan records may refer to removing these disconnected or unlinked records from the data during the assessment .

[0062] Assessing the plausibility may comprise determining a likelihood of obtaining or measuring one or more of the local pre-processed data elements . Assessing the plausibility may comprise comparing a local pre-processed data element for a given variable with a corresponding local pre-processed data element for another given variable , and determining a compatibility of these local data elements , or determining a likelihood of measuring or obtaining both of these local data elements . A low likelihood may correspond to a low plausibility .

[0063] Advantageously, the data quality report may be used ( either by the local environment , the local data pre-processing module or a user ) to determine whether to re-generate one or more steps of the data harmonisation protocol and subsequently execute the re-generated data harmonisation protocol on the acquired raw data . For example , if the data quality report indicates that the data quality is low, a user may decide to re-generate a data harmonisation protocol and execute a re-generated data harmonisation protocol on the acquired raw data . In some cases , the data quality report may be used to improve the data harmonisation protocol . In such cases , the local environment or the local data pre-processing module may be configured to send the data quality report to the external environment , and the external environment may be configured to re-generate a data harmonisation protocol based on the data quality report .

[0064] The data quality report may be used ( either by the local environment , the local data pre-processing module or the user ) to determine whether to generate a local statistical model from the local pre-processed data . For example , if the data quality report indicates that the data quality is low, a user may decide that a local statistical model should not be generated from this data . The data quality report may be used ( either by the local environment , the local data preprocessing module or the user ) to determine to determine a subset of the local pre-processed data to be used to generate the local statistical model . For example , if the data quality report indicates that a first subset of the local pre- processed data is if high quality and a second subset of the local pre-processed data is of low quality, a user may decide to generate the local statistical model from the first subset of the local pre-processed data and not from the second subset of the local pre-processed data . In this way, the quality of the global statistical model may be maintained .

[0065] In some examples , each of the local environments may be configured to transmit a data quality report to the centralised platform . In this way, data quality reports may be shared across the local environments , thus enabling the local environments to understand the nature of the local data at other local environments . Accordingly, the common data model may be updated to be better adapted to the local data at the local environments . In this way, higher quality local pre- processed data and consequently a higher quality global statistical model may be generated .

[0066] Advantageously then, the data quality report may : enable a user of a local environment to evaluate the quality of the data they wish to make available to the federated network; enable sharing of reproducible statistical evaluations of the local environments ' data to allow for greater understanding of the analysis needs of users of the data; and, help local environments profile and understand the local environments ' local raw data and evolve the CDM and the mappings to support these local raw data .

[0067] Each of the local environments or local data pre-processing modules may be associated with a site which is equipped to perform, and / or has performed numerous research studies , preferably medical research studies . As discussed, the client request may comprise one or more parameters defining the local pre-processed data or properties of the local pre-processed data to be used . Additionally, or alternatively, the client request may comprise one or more parameters defining the local raw data or properties of the local raw data to be used . More specifically, the client request may comprise one , some , or all of the following :

[0068] Data identifying a specific study or local ( e . g . , HER) repository from which the raw data is to be retrieved .

[0069] Data identifying a specific type of data which is to be retrieved .

[0070] Data identifying a specific file or data location from which data is to be retrieved .

[0071] Data specifying a range of acquisition time for the data .

[0072] Data defining the subj ects ( or physiological or other clinical attributes of the subj ects , e . g . age , sex, weight , disease status , etc . ) , raw data pertaining to whom is to be retrieved .

[0073] This list is not exhaustive , and it will be appreciated that the client request may comprise other parameters defining or otherwise describing the local pre-processed data or the local raw data or properties of the local pre-processed data or local raw data which may be used to fulfil the client request .

[0074] The purpose of the invention is to enable a client environment or client node to access processed versions of the local data . However, in order to preserve privacy, it must be ensured that the client environment or client node does not have access to the local data itself (i.e., the local raw data or the local pre-processed data) . The client environment or client node is able only to access a processed version of the data (e.g., the global statistical model) .

[0075] The invention also requires that the client request define the form of the aggregate result. More specifically, this may comprise specifying one or more operations (e.g., functions, algorithms or processes, which may be federated functions, algorithms or processes) which are to be applied to the local pre-processed data in order to fulfil the client request. Alternatively, the client request may specify only the form of the aggregate result, and the centralized FA / FL platform may determine the one or more operations (e.g., functions / algorithms / processes , which may be federated functions, algorithms or processes) to be executed on the specified local pre-processed data in order to generate the aggregate result in the form specified in the client request. In this way, the platform query may specify the one or more operations which are to be applied to the local pre-processed data in order to fulfil the client request.

[0076] Specifying the one or more operations may comprise specifying a "master analysis script", which may comprise one or more operations to be executed on local pre-processed data. For example, the master analysis script may comprise or define a machine-learning model to be trained using the local pre- processed data. In some examples, the client request and / or the platform query may include the master analysis script.

[0077] Specifying the one or more operations may comprise specifying a "training script", comprising instructions configured to train the machine-learning model using local data. Thus, the training script may comprise one or more operations to be executed on the local pre-processed data. In some examples, the client request and / or the platform query may include the training script. In some examples , the master analysis script may comprise the training script .

[0078] In some examples , the one or more operations , the master analysis script , and / or the training script may be included in an application . The centralised platform may be configured to transmit the application to the one or more of the local environments or local nodes . The platform query may comprise the application . Thus , the plurality of local environments or local nodes may correspond to a Kubernetes cluster, such as a K8s cluster .

[0079] The one or more operations may be selected from a predetermined list . By only allowing a client environment or client node to specify operations from a predetermined list , it is possible to ensure that only operations which ensure a certain degree of privacy are provided . As mentioned, the operations may comprise federated functions , algorithms and processes , which are functions , algorithms and processes which are specifically designed to generate a meaningful output , e . g . in the form of the global statistical model , or which may be generated using the global statistical model , but which do not require that local raw data or local pre-processed data is shared between the local environments and the centralized FA / FL platform .

[0080] The predetermined list of operations may comprise one or more of the following :

[0081] A function describing the number of rows and columns of the data .

[0082] A function which counts the number of columns in the data .

[0083] Various statistical functions , for example , a mean, median, mode , number of data entries , standard deviation, variance , kurtosis , interquartile range . A function which describes the proportion of the data falling within a specified statistical significance threshold .

[0084] A function which takes a table , and converts it into a grouped table in which operations are performed "by group" .

[0085] A function which counts the number of null values in e . g . a given column or row of the data .

[0086] A function which generates a continuous histogram of the data .

[0087] A function which generates a summary statistics table describing the data .

[0088] Various analytical functions , such as a Kaplan-Meier plot , Cox regression, and Charlson comorbidity index .

[0089] A federated linear or non-linear algorithm.

[0090] Advantageously, the FA / FL system may cater to different operations , thus enabling a multitude of research opportunities , for example .

[0091] As discussed, the one or more operations are preferably adapted such that they may be executed individually on the local pre-processed data of each local environment or local node . The one or more operations may comprise the aggregation of the results into the global statistical model . For example , the master analysis script may comprise an aggregation function configured to aggregate a plurality of local statistical models to generate a global statistical model . Thus , the global statistical model may comprise or may form the results of the one or more operations .

[0092] The one or more operations may be agreed upon by one or more of the local environments and may be shared with one or more of the local environments . For example , as mentioned, the master analysis script may be shared with one or more of the local environments . Thus , each local environment or local node configured to generate a local statistical model may use the same one or more operations to generate the local statistical model . In this way, the local statistical models generated at the plurality of local environments or local nodes may be interoperable and / or may be aggregatable into the global statistical model .

[0093] The client request may further include information defining the common data model .

[0094] The client request may be in the form of a query, and may therefore be referred to as a client query . Alternatively, the client request may comprise unstructured data .

[0095] In the context of the present invention, the term "query" should be understood to mean a precise , preferably structured, request ( i . e . a request which is expressed in computer code ) for information retrieval which is transmitted to a data repository .

[0096] In this case , the data repository is the local environment , the local node , the local module , or a memory thereof . The memory may, for example , store a database comprising the local raw data , or the local pre-processed data . The memory may be the local memory, the local node memory or the local data preprocessing module memory . The centralized FA / FL platform preferably comprises a processor which comprises a query generation module which is configured to generate the platform query in response to receiving the client request .

[0097] When the client request is in the form of unstructured data , the query generation module , or the local environment , the local node or the local data pre-processing module may comprise a natural language processing (NLP ) module which is configured to process the client request in order to generate a structured request or query .

[0098] The platform query comprises information identifying the local pre-processed data or the local raw data which is to be used to fulfil the platform query . This may be specified in the same manner as in the client request ( or equivalently, client query) , as described in detail earlier in this patent application . Accordingly, the information identifying the local pre-processed data or the local raw data may comprise one or more parameters defining the local pre-processed data or the local raw data to be used .

[0099] The platform query may also comprise one or more operations to be executed on the identified data . These operations may comprise the functions outlined earlier in this patent application . In some cases , where the client request defines only the form of the aggregate result , rather than the specific operations , the query generation module may be configured to determine , generate , or select one or more operations to be executed on the local pre-processed data in order to generate the aggregate result in the form specified in the client request . In some examples , each local environment , or local node may be configured to retrieve , from a data source ( e . g . , the local memory, or local node memory) , local pre-processed data "corresponding to the platform query" . This refers to data which is identified by the platform query . The local environments or local nodes may be configured first to identify a subset , or a portion, of local pre-processed data based on the information identifying the local pre-processed data in the platform query, thereby generating or identifying the local pre-processed data "corresponding to the platform query" . Thus , generating the local statistical model corresponding to the platform query using the local pre-processed data may comprise generating the local statistical model corresponding to the platform query using the retrieved local pre-processed data i . e . , using the portion of the local pre-processed data corresponding to the platform query .

[0100] In some examples , the local raw data may be acquired "corresponding to the platform query" or "corresponding to the node query" . In some examples , each local data pre-processing module may be configured to transmit to the respective local node , local pre-processed data "corresponding to the platform query" or "corresponding to the local node query" (which may be a subset , or a portion, of the local pre-processed data ) . Each local data pre-processing module may first be configured to identify a subset , or a portion, of local pre-processed data based on information identifying the local pre-processed data in the node query ( and in the platform query) thereby identifying the local pre-processed data "corresponding to the platform query" or "corresponding to the node query" .

[0101] As mentioned, the client request may include information indicating or defining the common data model , or information defining a dataset according to the common data model . For example , as mentioned, the client request may include one or more parameters defining the local pre-processed data . Such parameters may include details or specifications regarding the structure and / or the format of the local pre-processed data , and thus may correspond to the information indicating or defining the common data model , or to the information defining a dataset according to the common data model . Thus , in some examples , the platform query, which may be based on the client request , may include information defining the common data model . In this case , each local environment may be configured to acquire the local raw data and execute the data harmonisation protocol in response to receiving the platform query . The local node query, which may be based on the platform query, may comprise information defining the common data model . In this case , each local data pre-processing module may be configured to , in response to receiving the local node query : acquire the local raw data, execute the data harmonisation protocol , and transmit the local pre-processed data corresponding to the node query .

[0102] In other examples , the centralised platform may be configured to receive a harmonised dataset request including information indicating or defining the common data model , or information defining a dataset according to the common data model . In these examples , the common data model may be chosen or created by a governance body of the FA / FL system, as will be described in more detail later in this application . The centralised platform may accordingly be further configured to : in response to receiving the harmonised dataset request , generate and transmit a harmonised dataset query to one or more local environments , the harmonised dataset query including information defining the common data model . In this case , each local environment may be configured to acquire the local raw data and execute the data harmonisation protocol in response to receiving the harmonised dataset query, and based on the common data model query . Similarly, each local node may be configured to generate and transmit a preliminary local node query, based on the common data model query, to a respective local data pre-processing module in response to receiving the common data model query . The preliminary local node query may comprise information defining the common data model . Each local data pre-processing module may be configured to , in response to receiving the preliminary local node query : acquire the local raw data and execute the data harmonisation protocol . In these cases , the data harmonisation protocol may be executed independently from the client request .

[0103] The local environments or local nodes may then be configured to execute the one or more operations on the local pre- processed data , thereby generating the local statistical model .

[0104] A key feature of the invention is that the local statistical models themselves are sent to the centralized platform, as opposed to the local data, such that data privacy may be maintained . The local statistical models are then aggregated to generate the global statistical model . Thus , the FA / FL system may execute an orchestration process .

[0105] One way in which this may be achieved is that the platform query may be sent simultaneously to each local environment or local node , and each local environment or local node will return a local statistical model which comprises enough information to allow the central FA / FL platform to aggregate the local statistical models into a meaningful global statistical model .

[0106] For example , in a simple example in which the client request specifies that the client environment or client node would like to receive a mean value of a certain clinical parameter, it would not be sufficient simply to take a mean of the mean values from each localized data processing node . The local statistical model would also need to comprise information indicating , for example , how many samples the mean is calculated over in order to ensure a global statistical model providing a truly representative mean .

[0107] In an alternative case , rather than sending the platform query simultaneously to each of the local environments , the platform query may be sent to the local environments in sequence , along with an output , e . g . the local statistical model (which, recall , is entirely private , and anonymized, so can be shared between local environments ) , such that a subsequent local environment or local node can use the local statistical model from the previous local environment or local node to generate its own respective local statistical model . The chain may then continue accordingly . Such an approach may be referred to as federated transfer learning .

[0108] Each local statistical model may correspond to an analytical model , which may comprise a statistical or analytical representation of one or more variables of the local pre- processed data . For example , as discussed above , each local statistical model may include an average value of a certain variable ( such as a certain clinical parameter ) and a number of samples the average of this variable is calculated over . Thus , the global statistical model may comprise a statistical or analytical representation of the one or more variables , where the global statistical or analytical representation may correspond to a combination of the local statistical or analytical representations . In these cases , the system may be said to implement a federated analytics pipeline , and / or the system may be referred to as a FA system . Alternatively, each local statistical model may comprise a machine-learning model , which may have been trained using the local pre-processed data . In these cases , the system may be said to implement a federated learning pipeline , and / or the system may be referred to as a FL system.

[0109] We will now describe further optional features and advantages , which may relate to the federated analytics system.

[0110] In a federated analytics pipeline , the global statistical model itself may correspond to the aggregate result fulfilling the client request , which may be transmitted to the client environment or client node . For example , as mentioned, the client request may be to receive a global statistical or analytical representation of one or more variables .

[0111] The centralised platform may be configured to aggregate the local statistical models using an aggregation function to generate the global statistical model . The centralised platform may be configured to use a customisable aggregation function to aggregate the local statistical models . For example , the aggregation function may be specified or defined in the client request , allowing flexibility in combining results from diverse sources .

[0112] Generating the global statistical model using federated analytics may advantageously enable multiple parties to analyse each other' s data without sharing the data itself . Federated analytics may address data sovereignty concerns by enabling analysis within the boundaries of each data owner' s j urisdiction, ensuring compliance with data protection regulations . As well as maintaining data privacy, data transfer may be minimised, reducing network bandwidth and storage requirements .

[0113] Federated analytics may further allow for real-time insights , by generating and aggregating the local statistical models in near real-time . Real-time insights may be especially useful for applications that require up-to-the-minute data-driven decisions . Each local environment or local node may be configured to perform steps , such as transmitting a node query or generating the local statistical model , in response to (e.g. , immediately upon) receiving the platform query. Each local data pre-processing module may perform steps, such as transmitting the local pre-processed data, in response to (e.g. , immediately upon) receiving the node query. The centralised platform may be configured to aggregate the local statistical models in response to (e.g., immediately upon) receiving the plurality of local statistical models to generate the global statistical model.

[0114] As a further advantage, the system configured to execute a federated analytics pipeline which may be adaptable to changing data sources or study cohorts, allowing for the addition or removal of data contributors (i.e., local environments) and the addition or removal of variables statistically or analytically represented in the global statistical model as analytics objectives and / or requirements evolve .

[0115] As a further advantage, because different local environments may contribute their domain-specific expertise and respective data modalities, the global statistical model may correspond to a holistic representation of the data. According to the present invention, a data harmonisation protocol is executed to transform local raw data into local pre-processed data which meets the common data model. Federated analytics may lead to the development of new standards (e.g., a new CDM) for data analysis interoperability.

[0116] We will now describe further optional features and advantages, which may relate to the federated learning system.

[0117] Each of the local environments may be configured to train a machine-learning model using the local pre-processed data in order to generate a local statistical model in the form of a trained machine-learning model. The centralized FA / FL platform may then be configured to receive a respective trained machine learning-model from each of the plurality of local environments, and to aggregate those models to generate a global statistical model in the form of a trained machinelearning model generated from the local statistical models. Receiving the trained machine learning model may refer to receiving an indication of the parameters of the machinelearning model . Aggregating models may thus refer to aggregating these parameters .

[0118] Aggregating the local statistical models may comprise federated averaging, for example .

[0119] Advantageously, training at each of the local environments may allow for distributed model training across a network of environments , which may preserve the privacy of the training data ( i . e . , the local pre-processed data ) . By enabling data to remain within the local environment and aggregating the local statistical models , federated learning can harness the power of decentralised data sources while maintaining data privacy and security .

[0120] In such arrangements , the client request may be to receive the trained machine-learning model so that they can apply it to data on a client environment or client node . Alternatively, the client request may further comprise or specify data on which they would like to apply the trained machine-learning model , and after generating it , the centralized FA / FL platform, or a local environment or local node , may be configured to apply the trained machine-learning model to the specified data , thereby generating the aggregate result which is subsequently transmitted to the client environment or client node . Specifying the data may comprise indicating local data on which they would like to apply the trained machinelearning model . In this case , a local node , corresponding to the indicated local data , may be configured to apply the trained machine-learning model to its local data . In this case , using the global statistical model to generate the aggregate result may comprise transmitting the global statistical model to the local environment or local node corresponding to the indicated local data, wherein the local environment or local node may apply the global statistical model to the local data to generate the aggregate result . The client request may include information defining the machine learning model , which may be referred to as a "global model" , to be trained by the local pre-processed data .

[0121] The centralised platform may be configured to transmit the global model , to one or more of the local environments or local nodes . For example , the platform query may comprise the global model . Accordingly, each local environment or local node may be configured to receive the global model from the centralised platform . Then, generating the local statistical model may comprise training the global model using the local pre-processed data .

[0122] As a specific example , as discussed the global model may be defined or included in the master analysis script . Thus , the centralised platform may be configured to transmit the master analysis script , to one or more of the local environments or local nodes . The master analysis script may be included in the platform query . The centralised platform may be configured to , in response to generating the global statistical model , replace the global model defined or included in the master analysis script with the global statistical model . In this way, the master analysis script may define or include the latest global statistical model .

[0123] The global model may be an untrained machine-learning model or a pre-trained machine learning model . The pre-trained machine learning model may have been trained using synthetic data , which may have been generated and transmitted by one or more of the local environments . The generation and the use of the synthetic data will be described in further detail later in this application .

[0124] The client environment or client node ( or another local environment or local node ) may be configured to be usable ( for example by a data scientist ) to develop a training script configured to train the global model using local data . A training script may refer to a training code . Each local environment or local node may be configured to receive a training script . For example , the platform query may include the training script. The training script may be used by the local environment or the local node to train the global model using the local pre-processed data. The training script may comprise one or more operations to be executed on the local pre-processed data. The master analysis script may comprise the training script.

[0125] The centralised platform may be configured to iteratively: receive a plurality of local statistical models, aggregate the plurality of local statistical models to generate the global statistical model, and transmit the global statistical model to one or more of the local environments or local nodes for further training. Each local environment may be configured to iteratively receive and train global statistical models . In more detail, the centralised platform may be configured to: (a) receive a respective plurality of local statistical models from each of the plurality of local environments or local nodes; (b) aggregate the plurality of local statistical models to generate a global statistical model; and, (c) transmit the global statistical model to one or more of the local environments or local nodes for further training. Each local environment or local node may be configured to: (d) receive a global statistical model from the platform; (e) train the global statistical model using the local pre-processed data to generate a local statistical model according to the platform query; and (f) transmit the local statistical model to the platform. In this way, the quality of the global statistical model may be improved. The system may be configured to execute steps (a) to (f) until a predetermined end condition, such as a predetermined number of iterations, is met. The centralised platform may be configured to execute steps (a) to (c) until the predetermined end condition is met. Thus, after each training round, the local environments or local nodes may update the parameters of the received global statistical model (e.g. , the weights and / or gradients of the global statistical model) using their local pre-processed data. Thus, step (f) may refer to transmitting an indication of the updated parameters. For the avoidance of doubt, we note that each local statistical model may be generated using the most recently received global statistical model, and the global statistical model may be generated using the most recently received local statistical models .

[0126] The centralised platform may be configured to , in response to generating the ( new) global statistical model , replace the global model defined or included in the master analysis script with the ( new) global statistical model . In this way, the master analysis script may define or include the latest global statistical model .

[0127] In some examples , the centralised platform may be configured to execute an automated governance protocol which may be configured to approve or disapprove the master analysis script . For example , the master analysis script may be approved if it runs without errors on test data , which may include synthetic data .

[0128] In some examples , the federated learning system may be configured to execute the iterative training of the global statistical model in an energy-efficient manner . For example , the centralised platform or each local environments or each local node may be configured to intelligently schedule generating a local statistical model for a pre-determined time , e . g . , a time at which energy demand is low . Similarly, the centralised platform may be configured to intelligently schedule generating the global statistical model for a predetermined time , e . g . , a time at which energy demand is low .

[0129] In some examples , to ensure more efficient collaboration, the federated learning system may be configured to dynamically select the local environments or local nodes to be involved in a given iterative training round ( or a given model update ) . In this way, participants in the iterative training round may be selected based on their relevance to the current training round ( or a current model update ) . As such, the centralised platform may be configured to : select a plurality of local environments or local nodes to be involved in a training round; and, transmit the global statistical model to the selected local environments or local nodes for further training . The selecting may comprise determining the relevance of one or more local environments or local nodes to a current training round .

[0130] The local environments or local nodes may be configured to perform the training using the global model as a reference or baseline model . Thus , the global model may serve as a comparison or co-ordination across multiple environments of the system .

[0131] In some examples , the centralised platform, the client node , the local environments or the local nodes may be configured to validate the global statistical model using validation or test data . In this way, the performance of the global statistical model may be assessed, and / or overfitting or underfitting of the global statistical model , due to data heterogeneity for example , may be monitored or detected . For example , when the local environments or the local nodes are configured to validate the global statistical model using local data as the test data, the local environments or local nodes may be configured to transmit feedback based on the validation to the centralised platform . The centralised platform, or the local environments or local nodes themselves , may be configured to refine the global statistical model based on the validation or the feedback . In this way, the global statistical model may be refined using decentralised data . The refined global statistical model may be transmitted to the centralised platform and / or transmitted to the client node , or may be used to generate the aggregate result .

[0132] In some examples , the centralised platform may be configured to transmit the global statistical model (which may correspond to the refined global statistical model ) to one or more of the local environments or local nodes . For example , the centralised platform may be configured to transmit the master analysis script comprising the global statistical model . One or more of the local environments or local nodes may be configured to use the global statistical model for example , to generate an aggregate result from input real-world data ( e . g . , the local data ) . As will be discussed in further detail below, the centralised platform may be configured to transmit the global statistical model only to local environments or local nodes with access rights data indicating that they are permitted to use or access the global statistical model . Similarly, the centralised platform may be configured to transmit an aggregate result from the global statistical model or the refined global statistical model to one or more of the local environments or local nodes . Again, the centralised platform may only transmit the aggregate result to local environments or local nodes with access rights data indicating that they are permitted to access the aggregate result .

[0133] The centralised platform may be configured to monitor the performance of the global statistical model (which may correspond to the refined global statistical model ) . Each local environment or local node may be configured to transmit feedback on the performance of the global statistical model ( e . g . , when applied to the local data ) to the centralised platform . The centralised platform may be configured to receive feedback on the performance of the global statistical model from one or more of local environments or local nodes . The centralised platform may further be configured to refine ( or further refine ) the global statistical model based on the feedback or may be configured to transmit the global statistical model to a local environment , where it may be refined ( or further refined) based on the feedback . The feedback may be in relation to a standard benchmark or may correspond to a predetermined evaluation metric . In this way, fair comparisons and improvements may be made .

[0134] One or more of the local environments or local nodes may be configured to determine whether the received global statistical model (which may correspond to a refined global statistical model ) model runs without errors . For example , the local environment or local node may be configured to execute the global statistical model on the local data . Then, the local environment or local node may be configured to transmit this determination to the centralised platform. The centralised platform or a governance body (which will be described later ) may be configured to , if the global statistical model runs without errors , approve the global statistical model, or an aggregate result generated by the global statistical model. The local environment or local node or the client environment or client node may be configured to, if the global statistical model runs with errors, debug and update the global statistical model and / or the master analysis script (which may include the updated global statistical model) . The local environment, local node, client environment, or client node may be configured to transmit the updated global statistical model and / or master analysis script to the centralised platform for transmitting to one or more of local environments or local nodes. The one or more local environments may then be configured to generate local statistical models, for aggregating to generate a (new) global statistical model, using the updated global statistical model and / or master analysis script. These steps may be executed iteratively until the generated global statistical model runs without errors .

[0135] Further features and advantages of the system configured to implement federated learning pipelines will now be described.

[0136] Advantageously, when the system is configured to implement a federated learning pipeline, the system may be configured to handle unstructured data types, such as images, audio, and text, thus enabling a wide range of applications for the system. In this case, the global statistical model may correspond to an unstructured data processing algorithm (e.g. , an image processing algorithm) . Unstructured data processing algorithms may require the data at each site to be harmonised (i.e. , to be according to the common data model) , as is achieved by the present invention.

[0137] In some examples, the system may be configured to implement a vertical federated learning pipeline. That is, the local data of two or more local environments may correspond to the same set of parties (e.g. , the same set of patients) , but may include data corresponding to different data variables for this set of parties. Advantageously, vertical federated learning may enable collaboration on different features of data, allowing participants (i.e., local environments) to contribute complementary information without sharing their data .

[0138] As discussed, in some examples the system may be configured to implement a federated transfer learning pipeline .

[0139] In federated learning, a balance must be made between model accuracy and data privacy . Often, the higher the data privacy, the lower the model accuracy . Accordingly, the system configured to implement a federated learning pipeline may be configured to conduct privacy budgeting techniques , as will be discussed in further detail later in this application . Privacy budgeting techniques may manage and allocate privacy resources to maintain a balance between data privacy and model accuracy .

[0140] As will be discussed in detail later in this application, the system may be configured to operate according to a governance model . The governance model may regulate the federated learning pipeline and / or the generation and / or use of the global statistical model . The governance model may be decentralised, which may ensure fairness and compliance .

[0141] In some examples , one or more steps of the federated learning pipeline may be executed by edge computing devices . For example , the local nodes may correspond to edge computing devices . Thus , devices ( e . g . , local nodes ) at the network edge may be configured to collaboratively train local statistical models , while minimizing data transmission to centralised platform ( e . g . , by transmitting the local statistical models as opposed to the data itself to the centralised platform) .

[0142] In some examples , the system may comprise an Internet of Medical Things ( loMT ) network . For example , each of the local environments , local data pre-processing modules or local nodes may be configured to store and execute operations on medical data . Each of the local environments , local data preprocessing modules or local nodes may correspond to medical devices . Thus , the loMT network may collectively learn from the local data , enhancing device intelligence and user experience . Advantageously, federated learning may be beneficial in the healthcare sector due to its privacy-preserving capabilities . For example , models may be trained across hospitals without sharing sensitive patient data .

[0143] The system may be configured to enable collaborations between different industries . For example , the local environments may correspond to a variety of data sources , or to data sources from different industries . In this way, insights may be shared across different domains without sharing raw data .

[0144] Advantageously, the system may be configured to implement security protocols to ensure the system is robust against adversarial attacks across the decentralised local environments , thus enhancing security and reliability .

[0145] The security protocols may include or implement the following , some of which are discussed in further detail elsewhere in this application .

[0146] ( 1 ) Secure Communication : Transport Layer Security (TLS ) may be used to encrypt data transmitted between the centralised platform and participating local environments or nodes . This may ensure that data in transit remains confidential and cannot be intercepted by malicious actors .

[0147] ( 2 ) User Authentication and Authorization :

[0148] Authentication : Strong user authentication mechanisms may be implemented to ensure that only authorized users , environments or nodes can participate in federated learning .

[0149] Authorization : Access controls and authorization rules may be defined to specify who has permission to access and contribute data to the federated learning system.

[0150] ( 3 ) Data-at-Rest Encryption : Encrypted data may be stored on environments , nodes , servers and platforms to protect it from unauthorized access in case of a breach .

[0151] ( 4 ) Secure Model Updates : Model Signatures : Local environments or local nodes may be configured and / or required to sign their local statistical model updates with digital signatures to ensure the authenticity and integrity of updates .

[0152] Model Verification : Mechanisms may be implemented to verify the validity and consistency of model updates before aggregation .

[0153] ( 5 ) Secure Model Deployment :

[0154] Model Encryption : The global statistical model may by encrypted after it is generated and before it is transmitted . This may ensure that the model ' s architecture and parameters remain confidential .

[0155] ( 6 ) Secure Model Serving :

[0156] Access Controls : Access controls and authentication mechanisms maybe implemented for model serving endpoints to restrict who can access the model .

[0157] ( 7 ) Secure Aggregation :

[0158] Secure Multi-Party Computation (MPC ) : MPC protocols may be used to perform secure aggregation of model updates without revealing the updates themselves .

[0159] Homomorphic Encryption : Homomorphic encryption may be used to enable computations on encrypted data, allowing secure aggregation of updates .

[0160] ( 8 ) Audit Trails and Monitoring : Comprehensive logging and auditing mechanisms may be implemented to monitor all activities in the system . This may help in identifying and responding to security incidents .

[0161] ( 9 ) Incident Response Plan : An incident response plan may be developed to address security breaches or incidents promptly . This plan may include steps for investigation, containment , mitigation, and recovery . ( 10 ) Security Training and Awareness : It may be ensured that all stakeholders involved in the federated learning process are trained in security best practices and are aware of potential security threats and ris ks .

[0162] ( 11 ) Third-Party Audits and Assessments : Third-party security audits and assessments may be considered to evaluate the security posture of the federated learning system and identify vulnerabilities .

[0163] In some examples , the system may be configured to combine the federated learning pipeline (which is decentralised ) with a centralised approach . For example , as mentioned, the centralised platform may be configured to refine , or further train, the global statistical model using data transmitted to the centralised platform . Thus , the system may leverage the benefits of both decentralised and centralised paradigms , optimising privacy, scalability and model performance . Before the local statistical models are generated according to the federated learning or the federated analytics pipeline , each local environment or local data pre-processing module may be configured to perform preliminary pre-processing on the local raw data or the local pre-processed data . Similarly, each local environment or local node may be configured to perform preliminary processing on the local pre-processed data .

[0164] For example , the preliminary pre-processing or the preliminary processing may include data cleaning , feature extraction and / or feature engineering .

[0165] The preliminary pre-processing or the preliminary processing may comprise applying a privacy preservation algorithm to the local raw data or the local pre-processed data . The privacy preservation algorithm may be configured to anonymise the local raw data or the local pre-processed data . For example , the privacy preservation algorithm may correspond to a differential privacy algorithm . That is , each local environment or each local data pre-processing module may be configured to execute anonymization of the local raw data or the local pre-processed data . The anonymization may comprise , for example , removing any irrelevant identifying data from the local raw data or from the local pre-processed data . The privacy preservation algorithm may correspond to a homomorphic encryption algorithm . The privacy preservation algorithm may require a predetermined minimum number of rows in the data, for example the privacy preservation algorithm may require a predetermined minimum number of aggregated rows which may be exposed to a client . The privacy preservation algorithm may use or add Laplacian noise .

[0166] The privacy algorithm may be configured to block results , or rows of the data or database , which have less than a predetermined privacy budget value . For example , if the privacy budget value is set to 5 that means only 10 rows in the data or database will be included in the result . The pre-determined privacy budget value may be set at the local level .

[0167] Differential privacy may refer to a formal framework for adding controlled noise to data or queries to protect individual privacy while still providing useful aggregate statistics . In federated learning, differential privacy techniques may be applied to add noise to the model updates , ensuring that even if an adversary gains access to the aggregated updates , they cannot extract sensitive information about individual data points . Differential privacy may introduce the concept of a privacy budget , which quantifies the allowable amount of noise that can be added to a given computation . By setting an appropriate privacy budget , federated learning systems can balance privacy and utility, ensuring that the model remains useful for its intended purpose while offering strong privacy guarantees .

[0168] Different local environments or local data pre-processing modules may perform different privacy preservation algorithms and / or anonymization techniques .

[0169] As mentioned, in some examples , data according to the common data model may include only de-identif ied or anonymised data . Thus , executing the data harmonisation protocol on the local raw data may result in the anonymisation of the data . Advantageously, each local environment , local data preprocessing module , or local node being configured to apply a privacy preservation algorithm ( e . g . , a differential privacy algorithm) to the local raw data or the local pre-processed data may protect data privacy when transmitting a local statistical model to the centralised platform .

[0170] Further, the preliminary processing may reduce bias in the local pre-processed data to ensure the fairness and accuracy of the local statistical model . Each local environment or local node may further be configured to perform postprocessing of the local statistical model . For example , each local environment or local node may be configured to : assess the generated local statistical model ; and, based on the assessment , approve or disapprove the local statistical model for transmitting to the centralised platform. Assessing the local statistical model may comprise assessing whether the privacy of the local statistical model meets a predetermined criterion .

[0171] The post-processing may comprise applying a privacy preservation algorithm to the local statistical model . Transmitting the local statistical model to the centralised platform may comprise transmitting the local statistical model after the privacy preservation algorithm has been applied to the local statistical model . The local statistical model before the privacy preservation algorithm has been applied may be referred to as a "local model" . Thus , the privacy preservation algorithm may be applied to the local model to generate the local statistical model . In more detail , generating the local statistical model may comprise : generating a local model corresponding to the platform query using the local pre-processed data ; and, applying a privacy preservation algorithm to the local model to generate the local statistical model . The privacy preservation algorithm may correspond to a privacy preservation algorithm as described above .

[0172] The FA / FL system may be configured to execute a zero-knowledge protocol , secure aggregation and / or a secure multi-party computation ( SMPC ) when aggregating the local statistical models to generate the global statistical model . In this way, data privacy may be ensured .

[0173] Each local environment or local node may further be configured to execute an optimised communication protocol to communicate with the centralised platform. In this way, the amount of data transferred between each local environment or local node and the centralised platform may be reduced . For example , each local environment or local node may have limited bandwidth resources , so their communication protocol may be based on such limitations . For example , to reduce communication overhead, a local environment or local node may be configured to perform local aggregation of the local statistical model , or of the updated parameters of the local statistical model , before transmitting the local statistical model , or the indication of the updated parameters , to the centralised platform . In federated learning, local aggregation may refer to the process of combining or aggregating model updates generated by individual participants at the local level ( e . g . , the local environments or the local nodes ) , typically before sending those updates to the centralised platform .

[0174] Each local environment or local node may be configured to communicate with the centralised platform via HTTPS .

[0175] The communication protocol may correspond to a secure communication protocol .

[0176] Similarly, each local environment or local node may have limited computing resources . Each local environment or local node may be configured to generate the local statistical model according to its computing resources . For example , each local environment or local node may be configured to generate the local statistical model at a time at which the local environment or local node has a predetermined amount of computing resources available .

[0177] The FA / FL system may operate according to a governance model . The FA / FL system may comprise a plurality of participating entities, including the local environments and the client environment. Each participating entity may include a node, for example, such that the participating entity may communicate with the centralised platform, for example to receive an aggregate result or other information from the centralised platform.

[0178] The governance model may outline roles and / or responsibilities of the participating entities (such as the local environments, or client environments) of the FA / FL system. These roles may include data providers, model developers, data scientists, system administrators, and compliance officers. Clear delineation of responsibilities ensures accountability and helps in efficient coordination.

[0179] One or more participating entities (such as the local environments or client environments) may form a governance body such as committee, an assembly, or an office of the system. For example, an investigator assembly may review a project pipeline (e.g. , a federated analytics or federated learning pipeline) and make recommendations. The investigator assembly may further elect entities to form the consortial steering committee. The consortial steering committee may shape a research strategy (e.g., may determine which local environments may be included in a federated analytics or federated learning pipeline) . The consortial steering committee may further serve as a consortial decision body on projects, new participating entities, or issues. An integrated operations office may implement a scientific strategy, for example by designing studies and projects. The integrated operations office may further enable federated analytics and federated learning through infrastructural and technology support. The integrated operations office may further oversee project execution and provide operational support.

[0180] The governance model may outline operation guidelines for the FA / FL system, local environments, local nodes, or local modules within the FA / FL system. The operation guidelines may include data usage policies, data sharing agreements, security protocols, decision-making processes, monitoring and auditing mechanisms, transparency requirements and / or reporting requirements . One or more of the operation guidelines may be automated. Hence, the governance model, or at least a portion of the governance model, may be automated.

[0181] As mentioned, the common data model assessments may be chosen by a governance body, and thus agreed by all parties (e.g., the local environments) . Similarly, the data quality assessments may be chosen by a governance body, and agreed by all parties. Thus, the common data model and / or the data quality assessments may be implemented or required by the governance model .

[0182] For example, to address privacy concerns, the governance model may outline comprehensive data usage policies, which may be integrated into the FA / FL system. These data usage policies may define how data can be accessed, used, and shared between participants (e.g. , the local environments) . They may ensure that data privacy and security regulations are adhered to and that sensitive information remains protected. The FA / FL system may be configured to implement one or more data usage protocols, which may correspond to the data usage policies. The one or more data usage protocols may be automated. For example, the one or more data usage protocols may prevent a local environment being able to access data of another local environment. The one or more data usage protocols may prevent the centralised platform being able to access local data of a local environment, but may enable the centralised platform to access the local statistical models of each environment.

[0183] The governance model may facilitate the implementation of data sharing rules between data providers (e.g., the local environments) and model developers (e.g. , the client environment) . The data sharing rules may be agreed upon by the participating entities of the FA / FL system. These agreed data sharing rules may establish terms for automated data access, usage, and ownership. They also address issues related to intellectual property, data anonymization, and data retention. As another example, the governance model may outline security measures implemented in the FA / FL system. The security measures may include encryption standards, authentication protocols, and access controls to ensure that data remains secure throughout the federated learning / analytics pipeline. Further detail on access controls is provided later in this application. The FA / FL system may be configured to conduct regular security audits, which may check the security measures, and may be configured to update the security measures .

[0184] As mentioned, the local environments, local data preprocessing modules, and / or local nodes may be configured to execute a privacy preservation algorithm. Each local environment or local node may be further configured to assess the privacy of the local statistical model. The privacy preservation algorithm and / or the assessment of the privacy may be implemented or required by the governance model. For example, the local environments may agree to conduct certain privacy preservation algorithms and / or privacy assessments. As further mentioned, the FA / FL system may employ techniques such as secure aggregation, differential privacy, homomorphic encryption, secure multi-party computation (SMPC) , and zeroknowledge proofs to protect data during processing and aggregation. These measures may benefit consortium members, data custodians, privacy and security experts, and AI / ML researchers. Privacy preservation algorithms or privacy assessments may be selected based on the use case (e.g. , the client request) , the data used (e.g. , the local data) , the federation functions (e.g. , the master analysis script) , and / or the research goal (e.g. , the client request) .

[0185] In some examples, the governance model may define how decisions may be made within the FA / FL system. Such decisions may include decisions around what data can be used for what purposes or for what analysis in line with the determinations by the steering committee. These decisions may operate certain automated tasks / analysis . As discussed, the governance model may establish decision-making committees . The governance model may also establish voting procedures, and mechanisms for resolving disputes . This may ensure that the interests of all participants are considered in a fair and transparent manner.

[0186] In some examples, the FA / FL system may be configured to conduct continuous monitoring and auditing mechanisms . These processes may track data usage, model performance (e.g. , global statistical model performance) , and compliance with regulations . Any deviations from the governance model may trigger corrective actions .

[0187] In some examples, to maintain transparency, the governance model may include provisions for regular reporting on model performance (e.g., global statistical model performance) , model versioning (e.g. , global statistical model versioning) , data volume and data quality contributions, and compliance status. Advantageously, this may promote trust among participants and allow an assessment of contributivity to model updates.

[0188] Thus, the governance model may outline rules, processes and / or structures which guide the operation, management and / or decision-making within the FA / FL system. Advantageously, the governance model may ensure that the collaborative efforts in the FA / FL system remain organised, transparent, and aligned with the objectives of all participating entities (such as the local environments) . The governance model may establish a framework that fosters collaboration, data privacy, and effective decision-making among the participating entities (such as the local environments) . By the governance model setting out roles, responsibilities, and guidelines within the FA / FL system, and integrating this with actual processes and decision-making, it may be ensured that the federated learning ecosystem functions cohesively and efficiently while safeguarding data security and privacy.

[0189] Advantages of the governance model may thus be summarised as enabling :

[0190] 1. Collaborative Innovation: An integrated governance model may promote collaboration by establishing a structured framework for sharing resources and expertise. 2 . Data Privacy Assurance : Robust data usage policies and security protocols may ensure that data privacy and confidentiality are maintained .

[0191] 3 . Trust Building : Transparent decision making processes and reporting may build trust among participating entities and stakeholders .

[0192] 4 . Adaptability : The governance model may adapt to changes in regulations , technology, and participant dynamics , ensuring its relevance over time .

[0193] 5 . Conflict Resolution : Clearly defined dispute resolution mechanisms may prevent conflicts from derailing the progress of the federated learning initiative .

[0194] In conclusion then, the integrated governance model within the FA / FL system may serve as a guiding framework that enables collaborative research while upholding data privacy, security, and effective management . It may ensure that all participants ( e . g . , local environments and client environments ) work together seamlessly, achieving the goals of federated learning / analytics while adhering to ethical , legal and operational standards .

[0195] Certain optional features of the FA / FL system, which may be outlined or required by the governance model , are described in further detail below .

[0196] Different clients may have different access rights . This may be defined in terms of e . g . the local raw data or the local pre-processed data on which the processes / functions / operations are executed, and / or the processes / functions / operations which are executed themselves . Access rights in federated learning may refer to the permissions and / or privileges granted to different entities ( such as local nodes , users , or organizations or institutes ) regarding their ability to participate in or interact with the federated learning system and the data and models involved . The governance model may define rules determining which users and / or roles in an institute can perform which operations on data . Roles may include data owner , data scientist and data administrator . Permissions may be granted based on user' s role . Each client may have associated therewith access rights data, the access rights data specifying one or more permissions indicating which data the client is permitted to access , and / or which functions / processes the client is permitted to execute . Herein, by "access" , we do not mean that the client is able to obtain the local raw data or the local pre- processed data itself , but rather to cause the local environments , local nodes , or local modules to execute functions , operations , and / or processes on the local raw data or the local pre-processed data . In response to receiving the client request from the client , the centralized FA / FL platform may be configured to retrieve the access rights data for that client .

[0197] In some examples , the client environment or client nodemay be configured to transmit a client ID to the centralised platform . The centralised platform may be configured to retrieve the access rights data associated with the client ID, in response to receiving the client ID . The client ID may be unique to a client environment or client node , or unique to a user of the client environment or client node .

[0198] For example , the client request may include a client ID and the centralized FA / FL system may be configured to retrieve the access rights data associated with the client ID, and to determine , from the access rights data , whether the client is permitted to access data forming the subj ect of the request ( e . g . , local pre-processed data forming the subj ect of the request ) , and only if it is determined that the client is permitted to access the data , transmitting the platform request to the local environments corresponding to the data . The determination may be executed by an access control module of the centralized FA / FL platform.

[0199] Alternatively, or additionally, the access control module and the query generation module of the centralized FA / FL platform may interact in order to ensure that the client request is fulfilled to the greatest extent possible in view of their access rights . Specifically, the query generation module may be configured to generate the platform query based on the client request and the retrieved access rights data . The query generation module may do so by generating a query which will only return local statistical models which are generated from local pre-processed data or local raw data which the client is permitted to access , based on governance rules and / or based on the access rights .

[0200] As explained previously, the client request comprises one or more parameters defining the local pre-processed data , or local raw data or properties of the local pre-processed data or local raw data to be used . The one or parameters may define a first subset of local pre-processed data or local raw data and a second subset of local pre-processed data or local raw data . Note that the client request need not explicitly specify two subsets , but the local pre-processed data or local raw data specified in the client request may be considered to comprise a first subset and a second subset . The access rights data may stipulate that the client is permitted to access the first subset of the local pre-processed data or local raw data , and that that client is not permitted to access the second subset of the local pre-processed data or local raw data . In that case , the query generation module may be configured to generate a platform query identifying only the first subset of local pre-processed data or local raw data . In other words , the platform query excludes the second subset of local pre-processed data or local raw data . To use a simple example , the client request may specify all data obtained between the years 2000 and 2020 . However, the client' s access rights data may specify that the client only has access to data from the years 2000 to 2010 . In this case , the first subset of local pre-processed data or local raw data is the local pre-processed data or local raw data covering the years 2000 to 2010 , and the second subset of local pre- processed data or local raw data is the local pre-processed data or local raw data covering the years 2011 to 2020 . The query generation module would then generate a platform query identifying only the local pre-processed data or local raw data from the years 2000 to 2010 . By having a centralized FA / FL platform and effectively encoding the access rights in the platform query ( i . e . rather than filtering out the results ) , it is possible to ensure that this takes place in a centralized location, rather than having to make a determination regarding access rights at each localized data processing node .

[0201] This process is not restricted to a determination regarding which data is accessible to the client . The access rights may also specify which operations the client has permission to execute ( or more specifically, the client has permission to cause the local environments or the local nodes to execute ) on the local pre-processed data . This may be achieved in the same manner as for the local pre-processed data or local raw data .

[0202] As explained previously, the client request may also comprise one or more parameters defining the form of the aggregate result . This may be enabled by the client request specifying one or more functions , processes or operations to be executed on the local pre-processed data . Alternatively, as outlined previously, the query generation module may be configured to determine , generate , or select the functions , processes or operations to be executed on the local pre-processed data in order to generate an aggregate result as defined in the client request . In the explanation below, for brevity, we refer only to an "operation" , but it should be understood that the same applies to e . g . functions and processes , too .

[0203] The client request may define a first operation and a second operation to be executed on the local pre-processed data in order to generate an aggregate result having the requisite form. Alternatively, the query generation module may be configured to identify a first operation and a second operation to be executed on the local pre-processed data in order to generate an aggregate result having the requisite form. The access rights data may stipulate that the client is permitted to execute the first operation, and that the client is not permitted to execute the second operation . In that case , the query generation module may be configured to generate a platform query comprising or otherwise identifying only the first operation . In other words , the platform query excludes the second operation .

[0204] For completeness , it should be noted that in some cases , the client request may specify a first subset of local pre- processed data or local raw data and a second subset of local pre-processed data or local raw data , and a first operation, and a second operation . In these cases , the query generation module may be configured to take account of the access rights data pertaining to both the local pre-processed data or local raw data and the operations when generating the query . Also for completeness , it should be noted that the invention is by no means restricted only to a first subset and a second subset , or a first operation and a second operation . It will be readily appreciated by the skilled person that this can be extended to a general plurality of subsets of local pre- processed data or local raw data and operations .

[0205] The centralised platform may be configured to assign access rights data to a local environment , local node , or a user of a local environment or local node . Assigning access rights data to a local environment , a local node , or a user may comprise assigning access rights data indicating whether the local environment , local node or user is permitted to use or access a global statistical model . In this way, only local nodes or local environments permitted to use a global statistical model may apply the global statistical model to their local data, for example .

[0206] In this way, each local environment or local node may be configured to communicate with the centralised platform using IAM calls , API calls or using automated data provisioning .

[0207] The FA / FL system may enable local environments to dynamically j oin or leave the FA / FL system, and / or the FA / FL pipeline . In this way, the FA / FL system may be flexible and adaptable . To achieve this , the FA / FL system may implement a scalable and flexible infrastructure . For example the FA / FL system may implement cloud-based solutions and container orchestration systems such as Kubernetes . As discussed, the FA / FL system may implement mechanisms such as selective monitoring of model (e.g. , global statistical model) quality, transparency, and collaboration on model calculation mechanisms as well as mechanisms to recognize key collaborators. Such mechanisms may assist the FA / FL system to scale across a plurality of local environments. The FA / FL system may be configured to scale based on research objectives. Additionally, or alternatively, the FA / FL system may be configured to scale based on costs, taking into account for example, minimising workload processing windows, node registration, or mechanisms of notifications for collaborators (e.g. , local environments) .

[0208] To efficiently engage new sites or environments, it may be necessary to deploy a secure compute node to the new site or environment. It may be necessary to deploy the node within the site or environment premises or in a significant cloud laaS environment, for example.

[0209] The FA / FL system may be configured to implement a user onboarding and training protocol. The user onboarding and training protocol may provide a role-based and interactive training, which may enable users to learn how to use the FA / FL system, create computation requests (e.g., client requests) , and interpret the results. The user onboarding and training protocol may further comprise a guide on how to get started in a federated multi-site research project. The FA / FL system may be configured to implement a support model, for example an LILS support model. The support model may correspond to an effective, structured and sustainable model. Advantageously, this may enable release and change management, continuous improvements of the system, and collaboration between all participants (e.g. , local environments) including third-party vendors .

[0210] The FA / FL system, for example the centralised platform of the FA / FL system, may be configured to document an entire federated learning pipeline, including data sources (e.g. , the local environments) , model architectures (e.g., global statistical model architectures or local statistical model architectures) , algorithms (e.g. , the master analysis script) , privacy measures, and results (e.g., the aggregate result) . Advantageously, the documentation may enable the FA / FL system to create a comprehensive report for stakeholders, compliance, and auditing purposes.

[0211] The FA / FL system may be configured to continuously improve based on assessments of the system, and / or global statistical models, and evolving requirements.

[0212] As discussed, the client request and / or the platform query may comprise a master analysis script and / or a training script, which may define one or more operations to be executed on local pre-processed data to generate a local statistical model .

[0213] The client environment or client node (or another local environment or local node) may be used (by e.g. , a data scientist / a user of the client environment or client node) to generate or create the master analysis script and / or the training script. To create the master analysis script and / or the training script, the data scientist / user may need to understand the nature of the local data of each of the local environments accessible to the user. The master analysis script and / or the training script may comprise one or more python script. The master analysis script and / or the training script may be created in a Jupyter notebook.

[0214] Therefore, the FA / FL system may be configured to transmit to the client environment / client node information indicating which data (e.g. , the local data of which local environments) the client is permitted to access.

[0215] In more detail, the centralised platform may be configured to receive a client ID via the client environment interface module. The centralised platform may be configured to retrieve access rights data associated with the client ID in response to receiving the client ID. The client environment or client node may be configured to receive the client ID from the user and to transmit the client ID to the centralised platform via the client environment interface module. This process may be referred to as a client "logging onto" the centralised platform .

[0216] The centralised platform may be configured to transmit information indicating which data ( e . g . , the local data of which local environments ) the client is permitted to access , based on the retrieved access rights data .

[0217] In some examples , the FA / FL system may be configured to transmit to the client environment / client node ( or another local environment or local node ) one or more synthetic data sets , each synthetic data set having the same properties as the local raw data or the local pre-processed data which the client is permitted to access . Although each synthetic data set may have the same properties as the local raw data or the local pre-processed data , the synthetic data set may be anonymised . In this way, a user may gain an understanding of the nature of local data accessible to the client .

[0218] In more detail , the centralised platform may be configured to receive a synthetic data request via the client environment interface module , the synthetic data request including a request for one or more synthetic data sets from a respective one or more local environments . The centralised platform may be configured to transmit a synthetic data query to one or more of the local environments indicated in the synthetic data request . Each of the local environments may be configured to generate a synthetic data set , the synthetic data set having the same properties as the local raw data or the local pre- processed data , but the synthetic data set comprising only anonymised data . The synthetic data set may be according to the common data model . Each of the local environments may be configured to generate the synthetic data set in response to receiving the synthetic data query . Each of the local environments may be configured to transmit the synthetic data set to the centralised platform, which may in turn be configured to transmit each of the synthetic data sets to the client environment or the client node ( or another local environment or local node ) . The synthetic data set having the same properties as the local data may comprise the synthetic data set having the same statistical properties ( e . g . , mean, mode , median, variance , standard deviation) as the local data . Each of the local environments may be configured to generate the synthetic data set by applying a machine-learning model to the local raw data or to local pre-processed data .

[0219] The local data pre-processing module of each local environment may be configured to generate the synthetic data set . Each of the local data pre-processing modules may be configured to transmit the synthetic data set to the respective local node , which may in turn be configured to transmit the synthetic data set to the centralised platform.

[0220] As mentioned, the centralised platform may be configured to transmit the synthetic data sets to the client environment or the client node ( or another local environment or local node ) . The client environment or the client node ( or the local environment or local node ) may be configured to use the one or more synthetic data sets to create the master analysis script and / or the training script . For example , the client environment , client node , or centralised platform may be configured to execute a preliminary master analysis script on the one or more synthetic data sets to test the preliminary master analysis script . In a federated analysis system, for example , the preliminary master analysis script may be executed on the synthetic data to assess and solve errors in the preliminary master analysis script . In a federated learning system, creating the master analysis script may comprise defining a machine-learning model ( a "global model" ) to be trained by one or more local environments . The master analysis script may define or may comprise the global model . In this case , using the synthetic data sets to create the master analysis script may comprise using the synthetic data to test a machine learning model and / or a machine learning model architecture defined or included in a preliminary master analysis script . Creating the master analysis script may comprise configuring the machine-learning model to be compatible with a federated analysis and / or a federated learning framework, considering, for example , communication and aggregation requirements . In a federated learning system, the centralised platform may be further configured to transmit the master analysis script to one or more of the local environments , and each local environment may be configured to generate a test local statistical model using its respective synthetic data set .

[0221] Each local environment may further be configured to transmit a synthetic data set to the centralised platform, and the centralised platform may be configured to aggregate the test local statistical models to generate a test global statistical model . In this way, the master analysis script may be tested .

[0222] The client node or client environment may be configured to test the master analysis script ( e . g . , the global model or the global statistical model of the master analysis script ) using client data ( i . e . , local data of the client environment or client node ) as the input data . The master analysis script may be debugged in this way .

[0223] The client node or environment may be configured to transmit the master analysis script to the centralised platform ( e . g . , as part of a client request ) once the master analysis script has been created, tested, and debugged .

[0224] Then, the centralised platform may be configured to transmit the master analysis script to one or more of the local environments or local nodes , for example as part of the platform query, to generate the local statistical models .

[0225] In some examples , one or more of the local environments may be configured to determine whether a master analysis script runs without errors , and, based on this determination, to approve or disapprove the master analysis script , and transmit the approval or disapproval to the centralised platform .

[0226] The FA / FL system may additionally or alternatively be configured to use synthetic data , generated at local environments or local data pre-processing modules in other ways .

[0227] For example , the client environment or the client device or the centralised platform may be configured to pre-train a machine-learning model using one or more of the synthetic data sets , the global model corresponding to the pre-trained machine-learning model .

[0228] Thus , synthetic data may be used in script development and testing . Training federated learning models and / or federated analytics functions on realistically synthesized data , combined with specific disease area generalization techniques , may result in scripts that can then be more rapidly tested and successfully run on the actual study data ( i . e . , the data specified in the client request ) . This pre-evaluation step and script development step may be essential for accelerating and complementing real model development and optimization .

[0229] A second aspect of the present invention provides a method which may be executed by the system according to the first aspect for the invention . Specifically, the second aspect of the present invention provides a method of implementing a federated learning pipeline or a federated analytics pipeline , the method comprising : receiving a client request for an aggregate result , the request comprising at least : one or more parameters defining local pre-processed data or properties of local pre-processed data to be used to generate the aggregate result ; and, one or more parameters defining the form of the aggregate result ; in response to receiving the client request , generating and transmitting a platform query, the platform query defining local pre-processed data required to fulfil the client request and one or more operations to be executed on the identified pre-processed data in order to fulfil the query; receiving the platform query; acquiring local raw data from a data source executing a data harmonisation protocol on the acquired raw data, the data harmonisation protocol configured to transform the local raw data to local pre- processed data according to a common data model , the common data model defining a set of criteria which the local pre- processed data must satisfy, in response to receiving the platform query : generating a local statistical model corresponding to the platform query, using the local pre- processed data ; and transmitting the local statistical model to the platform; receiving a plurality of local statistical models ; and, in response to receiving a plurality of local statistical models , aggregating the plurality of local statistical models to generate a global statistical model ; and either : transmitting the aggregate result comprising the global statistical model ; or using the global statistical model to generate the aggregate result fulfilling the client request , and transmitting the aggregate result .

[0230] The method according to the second aspect may include one or more of the features of the invention set out with respect to the system according to the first aspect . The invention includes the combination of the aspects and preferred features described except where such a combination is clearly impermissible or expressly avoided .

[0231] THE DRAWINGS

[0232] Fig . 1 is a high-level diagram illustrating an example of the overall system architecture .

[0233] Fig . 2 presents a flow diagram of steps which the centralised platform may be configured to execute .

[0234] Fig . 3 presents a flow diagram showing steps which each local environment may be configured to execute .

[0235] Fig . 4 presents a flow diagram showing steps which each local node may be configured to execute . .

[0236] Fig . 5 presents a flow diagram showing steps which each local data pre-processing module may be configured to execute .

[0237] Fig . 6 is a high level diagram illustrating an example of the overall system architecture and steps which each component may be configured to execute .

[0238] Fig . 7 shows an example of a common data model . Fig . 8 is a diagram illustrating the generation of a data harmonisation protocol .

[0239] Fig . 9 presents a flow diagram of a data science workflow which the FA / FL system may be configured to carry out .

[0240] Fig . 10 is a Table showing federated patient baseline characteristics of the real world and the randomised clinical trial cohorts .

[0241] Fig . 11 shows two plots showing the proportion of patients with a lack of disease stability event over time , the proportion of patients with a rwPIRA event over time , and the proportion of patients with a PIRA event over time .

[0242] DETAILED DESCRIPTION

[0243] Fig . 1 shows a high-level diagram illustrating an example of the architecture of an FA / FL system 100 according to the present invention . As shown, the system comprises a centralised FA / FL platform 102 and a plurality of local environments 104 . The centralised platform 102 and the plurality of local environments 104 are connected to one another via a network 106 . Each local environment 104 comprises a local node 108 and local data pre-processing module 110 . Although not shown, each local data pre-processing module 110 comprises a local data pre-processing module memory configured to store local raw data , and each local node 108 a local node memory configured to store local pre-processed data . Further, the centralised FA / FL platform comprises a client environment interface module configured to receive a client request .

[0244] The operations which each component of the FA / FL system may be configured to implement will now be described with reference to Figs . 2 to 5 .

[0245] Fig . 2 shows a flow diagram 200 of steps which the centralised platform may be configured to execute . As shown, at a first step 202 , the centralised platform 102 receives a client request for an aggregate result . The client request is received via the client environment interface module , and comprises one or more parameters defining local pre-processed data, or properties of the local pre-processed data , to be used to generate the aggregate result , and one or more parameters defining the form of the aggregate result . As a simple example , the client request may identify a specific type of data which is to be retrieved and may define that the aggregate result should comprise one or more statistical representations of such data . At a second step 204 , the centralised platform 102 , in response to receiving the client request , generates and transmits a platform query to one or more local environments 104 ( or specifically, to one or more local nodes 108 , as will be described below ) . The platform query identifies local pre-processed data required to fulfil the client request , and one or more operations to be executed on the local pre-processed data in order to fulfil the client request . The one or more local environments 104 which receive the platform query then generate respective local statistical models based on the platform query, as will be described with reference to Figs . 3 to 5 . At a third step 206 for the centralised platform 102 , the centralised platform 102 receives a plurality of local statistical models from the one or more local environments 104 . Then, at a fourth step 208 , the centralised platform 102 aggregates the local statistical models to generate a global statistical model . Finally, at a fifth step 210 , the centralised platform transmits an aggregate result to the client environment . The aggregate result may comprise the global statistical model itself ( e . g . , the global statistical model may comprise a statistical representation of the identified data ) , or the aggregate result may be generated from the global statistical model ( e . g . , if the global statistical model is a machine-learning model ) .

[0246] The client request received at the first step 202 may include a master analysis script , which may define the one or more operations to be executed on the local pre-processed data . Accordingly, the platform query generated at the second step 204 may also comprise the master analysis script .

[0247] Fig . 3 shows a flow diagram 300 of steps which each local environment 104 may be configured to execute . At a first step 302 , the local environment receives the platform query from the centralised platform . In response to receiving the platform query at a second step 304 , the local environment acquires local raw data from the local memory . Then, at a third step 306 , the local environment 104 executes a data harmonisation protocol on the acquired raw data , the data harmonisation protocol configured to transform the local raw data to local pre-processed data according to a common data model which defines a set of criteria which the local pre- processed data must satisfy . The steps of the data harmonisation protocol are described in more detail below with reference to Fig . 8 . At the fourth step 208 , the local environment 104 generates a local statistical model corresponding to the platform query using the local pre- processed data . Finally, at the fifth step 210 , the local environment 104 transmits the local statistical model to the centralised platform 102 .

[0248] In the example shown in Fig . 3 , the common data model may be specified in the platform query, for example , as a result of the common data model being specified in the client request . Thus , the local environment may execute the data harmonisation protocol in response to receiving the platform query . In other examples , a common data model query may be received by the local environment 104 prior to receiving the platform query 202 . In this case , the steps of acquiring the local raw data 204 and executing the data harmonisation protocol 206 may be executed in response to receiving the common data model query, which may be prior to receiving the platform query 202 . The local statistical model may then be generated 208 using the local pre-processed data in response to receiving the platform query 202 .

[0249] As discussed, each local environment 104 may include a local node 108 and a local data pre-processing module 110 . Fig . 4 shows a flow diagram 400 of steps which each local node 108 may be configured to execute . At a first step 402 , the local node receives the platform query . In response to receiving the platform query, at a second step 404 the local node generates a local node query and transmits the local node query to a respective local data pre-processing module . The local node query comprises information defining the local pre- processed which is required to fulfil the platform query, and information defining the common data model . The respective local data pre-processing module , which receives the node query, then generates and transmits local pre-processed data based on the node query, as will be described with reference to Fig . 5 . Thus , in the third step 406 , the local node 108 receives the local pre-processed data from the respective local data pre-processing module 110 , and in the fourth step 408 , the local node 108 generates the local statistical model corresponding to the platform query using the local pre- processed data . Finally, at a fifth step 410 , the local node 108 transmits the local statistical model to the centralised platform 102 .

[0250] As is discussed above for the example shown in Fig . 3 , in the example shown in Fig . 4 , the common data model may be specified in the platform query, for example , as a result of the common data model being specified in the client request . Thus , the local node 108 may generate and transmit the node query, which comprises information defining the common data model , in response to receiving the platform query . In other examples , a common data model query may be received by the local node 108 prior to receiving the platform query 402 , the common data model query comprising information defining the common data model . In this case , the local node may be configured to generate and transmit a preliminary local node query comprising information defining the common data model to a respective local data pre-processing module in response to receiving the common data model query . These steps may be executed prior to receiving the platform query 402 .

[0251] Fig . 5 shows a flow diagram 500 of steps which each local data pre-processing module 110 may be configured to execute . At a first step 502 , the local data pre-processing module 110 receives a node query from a respective local node 108 . As mentioned, the node query comprises information defining the local pre-processed which is required to fulfil the platform query, and information defining the common data model . In response to receiving the node query, at a second step 504 the local data pre-processing module acquires local raw data from the local data pre-processing module memory, and at a third step 506 executes a data harmonisation protocol on the acquired local raw data, based on the node query . As mentioned, the data harmonisation protocol is configured to transform the local raw data to local pre-processed data according to the common data model . Finally, at a fourth step 508 , the local data pre-processing module transmits a subset of the local pre-processed data to the local node , corresponding to the node query .

[0252] Fig . 6 shows a high-level diagram illustrating an example of the architecture of an FA / FL system 100 according to the present invention, as well as steps which each component may be configured to implement .

[0253] Again, the FA / FL system comprises a centralised platform 102 and plurality of local environments 104 , each including a local data pre-processing module 110 and a local node 108 .

[0254] Fig . 6 shows that each local data pre-processing module 110 comprises a memory 602 which is configured to store local raw data 604 . Each local data pre-processing module 110 further comprises an analytics platform 606 which is configured to execute the data harmonisation protocol 608 to transform the local raw data 604 into local pre-processed data, and to select a subset 610 of the local pre-processed data for transmitting to a respective local node 108 . The subset 610 may be selected corresponding to the node query, which comprises information identifying the local pre-processed data which is required to fulfil the platform query .

[0255] As discussed, each local node 108 is configured to generate a local model 612 (which may have been referred to generally as a "local statistical model" ) using the received local pre- processed data 610 . The local node 108 may further be configured to apply a privacy preservation algorithm 614 to the local model 612 to generate the local statistical model 616 for transmitting to the centralised FA / FL platform 102 .

[0256] In some examples , each local node 108 may further be configured to assess whether the privacy of the local statistical model 616 meets a predetermined criterion, and based on the assessment , approve or disapprove the local statistical model 616 for transmitting to the centralised platform 102 .

[0257] The centralised platform 102 is configured to receive a plurality of local statistical models 616 from a respective plurality of local nodes 108 , and to aggregate these local statistical models 616 to generate a global statistical model 618 .

[0258] We will now describe examples of the common data model and the data harmonisation protocol , executed to generate local pre- processed data according to the common data model .

[0259] Fig . 7 shows an example of a common data model schema 700 according to a common data model . The common data model schema 700 may be created within a database within which the local pre-processed data according to the common data model may be stored . As can be seen in Fig . 7 , the common data model schema 700 defines data structure criteria, data content criteria semantic criteria . In more detail , the common data model schema 700 shown in Fig . 7 , defines a plurality of tables (which may be pre-processed data tables ) , and defines relationships between the tables , the data which should be present in the tables , and the semantics used in the tables .

[0260] Fig . 8 is a diagram 800 illustrating an example of the generation of a data harmonisation protocol . As shown in Fig . 8 , the data harmonisation protocol may be generated by an external environment 802 . Each local data pre-processing module 110 is configured to transmit a local raw data profile to the external environment 802 , the local raw data profile specifying features of the local raw data, without including the local raw data itself . The external environment 802 may be configured to receive the local raw data profile , to generate synthetic data based on the local raw data profile , and to use the synthetic data to generate the data harmonisation protocol . The external environment 802 may then be configured to transmit the generated data harmonisation protocol to the local data pre-processing module 110 . The local data preprocessing module 110 then executes and tests the data harmonisation protocol , and transmit results of the test to the external environment , updates the data harmonisation protocol in accordance with the results . These steps are carried out iteratively to optimise the data harmonisation protocol . The local data pre-processing module 110 then executes the optimised data harmonisation protocol on the local raw data to transform the local raw data into the local pre-processed data . Before the local pre-processed data is transmitted to the local node 108 , the data pre-processing module may convert the local pre-processed data into a CSV file .

[0261] Fig . 9 presents a flow diagram of a data science workflow which the FA / FL system may be configured to carry out .

[0262] The first few steps of this flow diagram ( specifically, steps 1 to 5 ) are steps which enable the data scientist / a user of the client node to create a master analysis script , which is used for generating the local statistical models at the local environments , ultimately allowing the generation of the global statistical model . To create the master analysis script to transmit to one or more of the local environments 104 , the data scientist / user of the client node which transmits the client request may need to understand the nature of the local data available at each of the local environments 104 .

[0263] Thus , at a first step 902 , a data scientist / a user of the client node , wishing to obtain a global statistical model and / or an aggregate result from a global statistical model , logs onto the centralised platform 102 by inputting their client ID into their client node , which transmits the client ID to the centralised platform . In response to receiving the client ID, the centralised platform retrieves access rights data associated with that client ID .

[0264] Based on the retrieved access rights data, at a second step 904 , the centralised platform 102 transmits to the client node information indicating which data ( e . g . , the local data of which local environments ) the client is permitted to access . Thus , the data scientist / user of the client node understands which data may be used for generating the local statistical model .

[0265] Then, to assist with creating the master analysis script , the client node may transmit a request for one or more synthetic data sets to the centralised platform 102 . Accordingly, the centralised platform 102 may transmit a synthetic data request to one or more of the local environments 104 , and each of these local environments 104 may generate a synthetic data, the synthetic data having the same statistical properties as the local raw data or the local pre-processed data, but the synthetic data being anonymised, and the local environments may transmit the synthetic data to the centralised platform 102 . At a third step 906 , the centralised platform 102 transmits to the client node the one or more synthetic data sets .

[0266] Using the one or more synthetic data sets , at a fourth step , 908 , the data scientist may create the master analysis script , the master analysis script defining one or more operations to be executed on input local pre-processed data to generate a local statistical model . For example , in the case of federated learning , the master analysis script may include a machinelearning model ( a "global model" ) to be trained using the local pre-processed data . During the creation of the master analysis script , the synthetic data may be used to test the master analysis script . Then, at a fifth step 910 , the master analysis script may be tested on the client node using client data ( i . e . , local data of the client environment or client node ) . The master analysis script may be created, tested and debugged in this way . Once the master analysis script has been tested and debugged, at a sixth step 912 , the master analysis script may be transmitted to the centralised platform 102 , for example as part of a client request . The client request may comprise the master analysis script , and one or more parameters defining local pre-processed data or properties of the local pre- processed data which should be used to generate the aggregate result . In the case of the master analysis script being for federated learning , the client request may specify the data on which the final global statistical model should be applied . The centralised platform 102 may then transmit a platform request , including the master analysis script , to one or more local environments 104 , the local environments with local data corresponding to the client request and which the client is permitted to access .

[0267] Next , at an approval step 913 , an automated governance protocol may approve , or may not approve the master analysis script .

[0268] If the master analysis script is approved, the one or more local environments 104 may each execute the master analysis script on local pre-processed data to generate a local statistical model at a seventh step 914 . Then, at an eighth step 916 , each local environment may approve the master analysis script . For example , if the master analysis script runs on the local data without errors , the local environments may send the results to the centralised platform. Each local statistical model may then be transmitted to the centralised platform and aggregated to generate the global statistical model . In the case of federated learning , the global model in the master analysis script may be replaced with the global statistical model . At a ninth step 918 , the centralised platform may assign access rights for the master analysis script and / or the global statistical model (which may be defined in the master analysis script ) to one or more of the local environments , and / or or users of the local environments .

[0269] In the case of federated learning where the global statistical model is machine-learning model , at a tenth step 920 , the master analysis script , which includes the global statistical model , may be applied to local data (which may have been specified in the client request ) of a local environment which has access rights to the global statistical model , to generate an aggregate result . Although not shown in Fig . 9 . , at an eleventh step, it may be determined by this local environment whether master analysis script and / or the global statistical model runs without errors , and this determination may be transmitted to the centralised platform. If the master analysis script and / or the global statistical model runs without errors , the centralised platform or a governance body may approve the aggregate result at the thirteenth step . If the master analysis script and / or the global statistical model runs with errors , the one or more of the local environments , including the client environment , may debug the master analysis script and / or the global statistical model at a twelfth step , update the master analysis script and / or the global statistical model at a fourteenth step , and again transmit the updated master analysis script to one or more of the local environments . The one or more local environments may then generate local statistical models , for aggregating to generate a ( new global statistical model , using the updated master analysis script . Steps six 912 to fourteen may be executed iteratively until the generated global statistical model runs without errors .

[0270] At the approval step 913 , if the master analysis script is not approved, then at a fifteenth step 922 , one or more of the local environments , or the client environment , may work offline to debug the master analysis script , and may update the master analysis script at a sixteenth step .

[0271] Steps six 912 to sixteen 924 ( including the approval step 913 ) , or a subset thereof , may be executed iteratively until the generated global statistical model runs without errors .

[0272] To summarise , the crux of the present invention is the e2e process and ecosystem set-up where data pre-processing modules ensure flexible and f it-f or-purpose standards dependent on the use-case , a plurality of local nodes enable federated analysis execution with clear automated collaborative governance processes dictating precise study execution without the client ( can be multiple clients in each study) ever needing direct access to the data on any other node . And, finally the centralized FA / FL platform never accesses the data stored on any of the local nodes but orchestrating the analysis or algorithm across sites for study execution . In addition, novel end-point generation in MS related to PIRA enabled by the collaborative federated architecture .

[0273] Case Study

[0274] This case study, by the inventors , assesses the applicability and utility of the FA / FL system in assessing the clinical observation of "lack of disease stability" as a novel surrogate end-point for deterioration of neurological function in MS in clinical real world as well as clinical trial cohorts on high efficacy antibody therapy .

[0275] The concept of Multiple Sclerosis (MS ) as a ' two-staged' disease with initial inflammatory relapsing-remitting course that after several years turns into a primarily neurodegenerative secondary progressive course seems to be oversimplified and has therefore frequently been challenged .

[0276] Emerging clinical observational data show that progression occurs even in the earliest stages of the disease ( Cree et al . 2019 ; Portaccio et al . 2022 ) . Contrary to previous assumptions , confirmed disability accumulation (CDA) in relapsing-remitting MS ( RRMS ) is - in the vast maj ority of patients - not driven by relapse-associated worsening ( RAW) but rather by progression independent of relapse activity ( PIRA) as shown in both clinical trials ( Kappos et al . 2020 ; Lublin et al . 2022 ) and observational data (Graf et al . 2021 ; Portaccio et al . 2022 ) .

[0277] It is still unclear if relapsing MS ( RMS ) patients showing predominantly relapses or early PIRA have different long-term prognoses and the implications and clinical relevance of PIRA remain unexplored . Likewise , the underlying pathogenesis and immunological processes of disease progression in MS are still not fully understood . Nevertheless , it is clear that MS is a progressive disease from onset and further understanding meaningful patterns in relapse and progression features , especially in early MS , has the potential to further improve care delivery for MS patients .

[0278] The advent of highly effective disease modifying therapies ( DMTs ) for RMS patients has caused a significant reduction of focal inflammatory activity, represented clinically by relapses and radiologically by gadolinium-enhancing lesions or lesion load . This enables us to primarily study progression unrelated to relapses or focal inflammation .

[0279] The primary aim of this retrospective study is to explore different academic sites ' definitions of ' lack of disease stability' and its implications for clinical decision-making over time . MS patient cohorts treated with high-efficacy treatment ( HET ) across the multi-sites are studied . The focus will be on progression that appears to occur independent of relapse activity and investigating other clinically relevant parameters , possibly related to compartmentalized inflammation and neurodegeneration . The inventors leverage federated analysis approaches to explore the feasibility of using this novel analytical approach . Various parameters contributing to disease worsening are compared, reflecting the heterogeneity of data accrued in clinical practice across multi-sites .

[0280] Compared to clinical trials , data collected in a clinical real-world setting tend to be sparser and less curated . The inventors leverage the heterogeneous data across sites to test the utility of published and unpublished definitions of PIRA and aim to deduce a meaningful real-world definition of PIRA ( rwPIRA) as a putative key component of the disease state ' lack of disease stability' , that can be adapted to clinical practice . Inferring rwPIRA may thus differ from trial-defined PIRA.

[0281] A clinical trial cohort with standardized longitudinal data acquisition is used bidirectionally to provide input into the rwPIRA definition as well as assess its applicability . As such, the trial cohort will serve as a reference for indirect comparison and potential validation . Finally, the inventors assess the applicability and utility of a federated infrastructure and analysis approach to address the described study obj ectives .

[0282] Successful implementation of this study and its infrastructure may greatly enable collaborative research between multi-sites , accelerate drive-data driven research approaches and forward our understanding of the disease which holds significant potential to optimize and improve healthcare delivery to patients with MS .

[0283] Primary Obj ectives :

[0284] 1 . Assess and describe ' lack of disease stability' across multi-sites and cohorts (up to 4 large MS clinical cohorts with a clinical trial cohort as indirect comparator of people with MS treated with HET ) .

[0285] 2 . Assess the proportional contribution of parameters to ' lack of disease stability' and map them to different existing PIRA definitions providing novel real world end-points related to "lack of disease stability" and PIRA in MS .

[0286] 3 . Assess the applicability and utility of a federated infrastructure and analysis approach to study MS in a federated consortial research setting .

[0287] Secondary Obj ectives :

[0288] 1 . Perform exploratory descriptive statistics on additional clinical and imaging endpoints that may be relevant to better capturing ' lack of MS disease stability' and survey other potentially available resources across the sites , including biosamples and related data .

[0289] 2 . Define how PIRA can be inferred from sparse clinical data available in a real-world setting and derive a robust definition of rwPIRA from these clinical cohorts .

[0290] Research Design : 16

[0291] This is a multi-center, multi-country, retrospective longitudinal cohort study of MS patients in clinical practice and clinical trials. The study involves MS patient cohorts from sites collaborating in the setting of the federated data network. The study is descriptive and exploratory in nature.

[0292] Research Period:

[0293] The main study period will be from 1 January 2004 to 31 December 2022.

[0294] The setting:

[0295] People with MS being treated with HET (including ofatumumab, ocrelizumab, natalizumab, fingolimod and alemtuzumab) are eligible for inclusion into the study.

[0296] Baseline (TO) is defined as the latest visit before first HET initiation during the study period.

[0297] Inclusion / Exclusion Criteria:

[0298] Patients must meet the following inclusion criteria:

[0299] 1. Diagnosis of MS by a neurologist according to McDonald criteria (revised) .

[0300] 2. People with MS receiving any of the following approved high-efficacy DMTs (HET) : ofatumumab, ocrelizumab, natalizumab, fingolimod and alemtuzumab in any-line between 01 / 01 / 2004 and 12 / 31 / 2022.

[0301] 3. Assessments must have been performed at least twice

[0302] Variables :

[0303] Variables refer to structured data elements to be extracted or derived from the sites' legacy databases. They are grouped into five categories: demographics, diagnosis, outcome measures, therapies, and biosamples. The variables are designated as primary if their acquisition is essential to the project and secondary if they are of interest but optional. Primary Variables:

[0304] The primary variables for this project are as follows and are collected at diagnosis and / or relapse / progression or change in therapy:

[0305] 1. Demographics :

[0306] • Age at assessment initiation

[0307] • Sex

[0308] • Date of death, month and year (if applicable)

[0309] 2. Diagnosis (at initial MS diagnosis and if / when a change in subtype is detected) :

[0310] • Date of first symptoms

[0311] • Date of diagnosis

[0312] • MS subtype (e.g. RRMS, SPMS, PRMS, PPMS)

[0313] • Presenting symptoms

[0314] 3. Outcome measures (including date, results, reference values at initial MS diagnosis and at follow-up visits) :

[0315] • Expanded Disability Status Scale (EDSS) score, 9-Hole Peg Test (9HPT) , Timed 25-Foot Walk Test, Symbol Digit Modalities Test (SDMT) , Multiple Sclerosis Functional Composite (MSFC)

[0316] • Relapses (patient, physician defined, inferred or derived)

[0317] • MRI T1 gadolinium-enhancing lesions compared to prior scans

[0318] • MRI T2 new or enlarging lesions compared to prior scans

[0319] 4. Therapies (at initial diagnosis and every subsequent change in therapy)

[0320] • DMT name(s) (Brand or Generic)

[0321] • Start date, end date (if available)

[0322] • Reason for discontinuation (efficacy, safety, other reason) Secondary Variables:

[0323] The secondary variables for this project are as follows:

[0324] 1. Demographics :

[0325] • Vocational status

[0326] • Education

[0327] 2. Outcome measures :

[0328] • Clinicians' Global Impression of Change

[0329] • Other outcome measures collected at each site

[0330] 3. Therapies:

[0331] • Non-DMT MS therapies

[0332] Other Data Elements:

[0333] 1. Biosamples

[0334] • Biosample data (i.e. , location, type of sample, aliquots)

[0335] Endpoints :

[0336] Primary Endpoints:

[0337] Proportion of MS patients with (recurrent) lack of disease stability over time as per composite measures and in different sub-groups .

[0338] 1. Number of recurrent real world PIRA events

[0339] 2. Number of recurrent "Lack of disease stability" events

[0340] 3. Rate of "lack of disease stability" accumulation

[0341] Secondary Endpoints:

[0342] 1. Proportion of MS patients with CDA over time

[0343] 2. Time to first Confirmed Disability Accumulation (CDA) 3 . Proportion of MS patients with Relapse associated Worsening ( RAW ) of disease over time

[0344] 4 . Proportion of MS patients with rwPIRA over time

[0345] 5 . Annualized Relapse Rate (ARR) in different sub-groups

[0346] Data analysis and other statistical considerations :

[0347] A data assessment is performed involving the participating sites . Descriptive statistics describe the sites ' patient populations and provide a view of data availability and quality .

[0348] The inventors perform a retrospective analysis of patients ' records and extract relevant clinical and paraclinical information including patients ' demographics , disease duration, therapy duration, previous therapy, and, if applicable , reason for discontinuation, symptomatic treatment , EDSS , relapses and MRI activity as well as clinical signs of progression or lack of disease stability as measured by clinical and paraclinical variables collected at the sites during routine clinical visits . Patients with diagnosis of MS and available longitudinal clinical and paraclinical routine data with an observation period of 1 year under HET ( including ofatumumab , fingolimod, ocrelizumab, natalizumab, and alemtuzumab ) are included for analysis . Lack of disease stability assessments must have been performed at least twice .

[0349] Real-world endpoints are analyzed across participating sites excluding the clinical trial data . The results are then be indirectly compared to the corresponding endpoints in the clinical trial data as a sensitivity analysis .

[0350] To describe rwPIRA patient populations across sites the inventors first perform descriptive analysis of CDA mechanisms and / or RAW events using clinical assessments or derivatives of lack of disease stability . Different n-week confirmed CDA and RAW events are defined to describe the prevalence of these events in the MS population of the federated network over time .

[0351] These results are qualitatively compared to literature on CDA and RAW in clinical trials as well as other real-world cohorts .

[0352] Proposed Definitions for the Implementation Study :

[0353] The following definitions are provided at a high level :

[0354] Patients with a stable disease course and those with CDA, lack of disease stability or RAW during the observational period are identified and divided into distinct sub cohorts .

[0355] • CDA here is defined as EDSS worsening ( If available ) 1 point ( EDSS 1-5 ) or 0 . 5 ( EDSS 5 . 5 ) which is sustained for 6 months from reference . The inventors choose to define EDSS worsening independent of the baseline EDSS ( i . e . rebaseline ) to be able to detect even slight signs of progression that might be overlooked otherwise .

[0356] • 'Lack of disease stability' is defined as disease progression measured by the clinical and paraclinical variables collected at the sites during routine clinical visits . The different ( derived ) variables that will be evaluated for utility in assessing lack of disease stability are neurologist-assessed progression, reduction of walking distance , walking aid, worsening of fatigue , motor fatigue , spasticity or pain, visual acuity, cognitive deterioration, micturition disturbances , changes in MRI measures or changes in vocational status amongst others .

[0357] • RAW is defined as CDA or ' lack of disease stability' between clinic visits with documentation of a relapse at any time point in between within relative proximity . Relapses are defined by reports from either the patient or physician . A stable disease course is defined as no CDA, lack of disease stability or RAW during the entire observation period .

[0358] Results

[0359] Patient baseline characteristics of the real world ( RW) study and randomised clinical trial ( RCT ) cohorts are well balanced in terms of sex, age , baseline EDSS score and follow-up time .

[0360] Fig . 10 is a Table showing federated patient baseline characteristics of the real world and the randomised clinical trial cohorts .

[0361] Fig . 11 shows two plots showing the proportion of patients with a lack of disease stability event over time in blue , the proportion of patients with a rwPIRA event over time in yellow, and the proportion of patients with a PIRA event over time in black . The plot on the left hand side shows the results for the randomised clinical trial cohort , and the plot on the right hand side shows the results for the real world cohort .

[0362] Exploratory analysis of the correlation / relationship between lack of disease stability, rwPIRA and PIRA:

[0363] • Lack of disease stability : o In the real world cohort , a mean 18 . 0% of patients experienced a lack of disease stability event per year . o In the randomised clinical trial cohort , a mean 13 . 3% of patients experienced a lack of disease stability even per year .

[0364] • rwPIRA: o rwPIRA and lack of disease stability events in the real world cohort and randomised clinical trial cohort showed similar patterns over time , showing an associative relationship between these concepts . o The maj ority of lack of disease stability events ( 61 . 3% ) were attributable to rwPIRA. o rwPIRA event rates were comparable in the real world cohort and randomised clinical trial cohort : 8 . 9% of all patients experienced a rwPIRA event per year .

[0365] • PIRA: o Lack of disease stability events , rwPIRA events , and PIRA events showed similar patterns over time in the randomised clinical trial cohort , suggesting an associative relationship between these concepts . o Lack of disease stability events showed similar patterns to the rate of rwPIRA events and randomised clinical trial-defined PIRA over time .

[0366] GENERAL STATEMENTS

[0367] The features disclosed in the foregoing description, or in the following claims , or in the accompanying drawings , expressed in their specific forms or in terms of a means for performing the disclosed function, or a method or process for obtaining the disclosed results , as appropriate , may, separately, or in any combination of such features , be utilised for realising the invention in diverse forms thereof .

[0368] While the invention has been described in conj unction with the exemplary embodiments described above , many equivalent modifications and variations will be apparent to those skilled in the art when given this disclosure . Accordingly, the exemplary embodiments of the invention set forth above are considered to be illustrative and not limiting . Various changes to the described embodiments may be made without departing from the spirit and scope of the invention . For the avoidance of any doubt , any theoretical explanations provided herein are provided for the purposes of improving the understanding of a reader . The inventors do not wish to be bound by any of these theoretical explanations .

[0369] Any section headings used herein are for organizational purposes only and are not to be construed as limiting the subj ect matter described .

[0370] Throughout this specification, including the claims which follow, unless the context requires otherwise , the word "comprise" and "include" , and variations such as "comprises" , "comprising" , and "including" will be understood to imply the inclusion of a stated integer or step or group of integers or steps but not the exclusion of any other integer or step or group of integers or steps .

[0371] It must be noted that , as used in the specification and the appended claims , the singular forms "a , " "an, " and "the" include plural referents unless the context clearly dictates otherwise . Ranges may be expressed herein as from "about" one particular value , and / or to "about" another particular value . When such a range is expressed, another embodiment includes from the one particular value and / or to the other particular value . Similarly, when values are expressed as approximations , by the use of the antecedent "about , " it will be understood that the particular value forms another embodiment . The term "about" in relation to a numerical value is optional and means for example + / - 10% .

Claims

CLAIMS1 . A federated analytics ( FA) / federated learning ( FL ) system configured to implement a federated learning pipeline or a federated analytics pipeline , the system comprising : a centralized FA / FL platform comprising a client environment interface module ; a plurality of local environments , each local environment comprising a respective local memory configured to store local raw data and / or local pre-processed data , wherein : the platform is configured to receive a client request for an aggregate result via the client environment interface module , the request comprising at least : one or more parameters defining local pre- processed data , local raw data or properties of the local pre-processed data or local raw data to be used to generate the aggregate result , and one or more parameters defining a form of the aggregate result ; the platform is configured to : in response to receiving the client request , generate and transmit a platform query to one or more local environments , the platform query defining or identifying local pre- processed data or local raw data required to fulfil the client request and one or more operations to be executed on the local pre-processed data or local raw data in order to fulfil the client request ; and, each local environment is configured to : acquire local raw data from a data source , and to execute a data harmonisation protocol on the acquired raw data, the data harmonisation protocol configured to transform the local raw data to local pre-processed data according to a common data model ,the common data model defining a set of criteria which the local pre-processed data must satisfy, generate a local statistical model corresponding to the platform query, using the local pre-processed data ; and transmit the local statistical model to the platform; and the platform is configured to : in response to receiving a plurality of local statistical models from a respective plurality of local environments ; aggregate the plurality of local statistical models to generate a global statistical model ; and either : transmit the aggregate result comprising the global statistical model to a client environment ; or use the global statistical model to generate the aggregate result fulfilling the client request , and transmit the aggregate result to the client environment .2 . A federated analytics ( FA) / federated learning ( FL ) system according to claim 1 , wherein the plurality of local environments includes a respective plurality of local nodes and a respective plurality of local data pre-processing modules , wherein : each node of the plurality of local nodes comprises a respective local node memory configured to store local pre- processed data ; and, each local data pre-processing module of the plurality of local data pre-processing modules comprises a local data preprocessing module memory configured to store local raw data ; and,wherein : the platform is configured to : in response to receiving the client request , generate and transmit the platform query to one or more local nodes of the plurality of local nodes , and wherein : each local node of the plurality of local nodes which received the platform query is configured to , in response to receiving the platform query : generate a local node query and transmit the local node query to a respective local data pre-processing module , the local node query comprising information defining local pre- processed data or local raw data which is required to fulfil the platform query; each local data pre-processing module is configured to acquire the local raw data from the data source , and to execute the data harmonisation protocol on the acquired raw data, thereby generating the local pre- processed data and, after receiving the local node query, to transmit local pre-processed data corresponding to the local node query to the local node from which it received the local node query for storage in the local node memory; each local node which received the platform query is configured to : after receiving the local pre-processed data from the respective local pre-processing module : generate a local statistical model corresponding to the platform query, using the local pre-processed data; and transmit the local statistical model to the platform; and the platform is configured to : in response to receiving a plurality of local statistical models from a respective plurality of local nodes :aggregate the plurality of local statistical models to generate a global statistical model ; and either : transmit the aggregate result comprising the global statistical model to the client ; or use the global statistical model to generate the aggregate result fulfilling the client request , and transmitting the aggregate result to the client .3 . A federated analytics ( FA) / federated learning ( FL ) system according to claim 1 or claim 2 , wherein each local environment or local data pre-processing module is configured to : create a common data model schema inside a database , the common data model schema being according to the common data model .4 . A federated analytics ( FA) / federated learning ( FL ) system according to claim 3 , wherein the local environment and / or each local data pre-processing module is configured to store the raw data according to a raw data model , and wherein the data harmonisation protocol comprises : mapping the raw data model to the common data model schema; transforming the raw data into local pre-processed data according to the mapping ; and, storing the local pre-processed data in the database .5 . A federated analytics ( FA) / federated learning ( FL ) system according to claim 4 , wherein the acquired raw data is stored in a raw data table , and wherein the data harmonisation protocol comprises : creating a pre-processed data table according to the common data model schema , the pre-processed data table configured to store the local pre-processed data; and, storing the pre-processed data table in the database .6 . A federated analytics ( FA) / federated learning ( FL ) system according to claim 5 , wherein the data harmonisation protocol comprises : mapping the raw data table to the common data model schema; transforming entries of the raw data table into entries for the pre-processed data table according to the mapping ; and, storing the entries for the pre-processed data table in the pre-processed data table .7 . A federated analytics ( FA) / federated learning ( FL ) system according to any one of claims 4 to 6 , wherein the data harmonisation protocol comprises : for each local raw data element , logging whether the local raw data element is successfully transformed into a local pre-processed data element .

8. A federated analytics ( FA) / federated learning (FL) system according to any one of the preceding claims, wherein generating the local statistical model further comprises: generating a local model corresponding to the platform query using the local pre-processed data; and, applying a privacy preservation algorithm to the local model to generate the local statistical model.

9. A federated analytics ( FA) / federated learning (FL) system according to any one of the preceding claims, wherein the platform query further comprises a global model, the global model being a machine-learning model, and wherein generating the local statistical model comprises training the global model using the local pre-processed data.

10. A federated analytics ( FA) / federated learning (FL) system according to claim 9, wherein, the platform is configured to:(a) receive a respective plurality of local statistical models from each of the plurality of localised nodes;(b) aggregate the plurality of local statistical models to generate a global statistical model; and,(c) transmit the global statistical model to one or more of the local environments or local nodes for further training, and, wherein each local environment / local node is configured to:(d) receive a global statistical model from the platform;(e) train the global statistical model using the local pre-processed data to generate a local statistical model according to the platform query; and,(f) transmit the local statistical model to the platform.11 . A federated analytics ( FA) / federated learning ( FL ) system according to any one of the preceding claims , wherein each of the local environments is configured to generate a synthetic data set , the synthetic data set having the same properties as the local raw data or the local pre-processed data, but the synthetic data set comprising only anonymised data .12 . A federated analytics ( FA) / federated learning ( FL ) system according to any one of the preceding claims , wherein the client request includes a client ID and wherein, the platform is configured to : retrieve access rights data for the client associated with the client ID; determine , from the access rights data , whether the client is permitted to access local pre-processed data forming the subj ect of the request ; and, only if it is determined that the client is permitted to access the local pre-processed data, transmitting the platform request to the local environments corresponding to the local pre-processed data .13 . A federated analytics ( FA) / federated learning ( FL ) system according to any one of the preceding claims wherein the client request comprises one or more functions or processes which are to be applied to the local pre-processed data in order to fulfil the client request .14 . A federated analytics ( FA) / federated learning ( FL ) system according to any one of the preceding claims , wherein the raw data comprises data which is used to track the status orprogression of a disease ; and, wherein the client request comprises one or more of : data identifying a specific study from which the raw data is to be retrieved; data identifying a specific type of data which is to be retrieved; data identifying a specific file or data location from which data is to be retrieved; data specifying a range of acquisition time for the data; and data defining the subj ects , raw data pertaining to whom is to be retrieved .15 . A computer-implemented method of implementing a federated learning pipeline or a federated analytics pipeline , the method comprising : receiving a client request for an aggregate result , the request comprising at least : one or more parameters defining local pre-processed data or properties of local pre-processed data to be used to generate the aggregate result ; and, one or more parameters defining the form of the aggregate result ; in response to receiving the client request , generating and transmitting a platform query, the platform query defining local pre-processed data required to fulfil the client request and one or more operations to be executed on the identified pre-processed data in order to fulfil the query; receiving the platform query;acquiring local raw data from a data source executing a data harmonisation protocol on the acquired raw data, the data harmonisation protocol configured to transform the local raw data to local pre-processed data according to a common data model , the common data model defining a set of criteria which the local pre-processed data must satisfy, in response to receiving the platform query : generating a local statistical model corresponding to the platform query, using the local pre-processed data; and transmitting the local statistical model to the platform; receiving a plurality of local statistical models ; and, in response to receiving a plurality of local statistical models , aggregating the plurality of local statistical models to generate a global statistical model ; and either : transmitting the aggregate result comprising the global statistical model ; or using the global statistical model to generate the aggregate result fulfilling the client request , and transmitting the aggregate result .

Images