Patient Identity Persists in Federated Intracranial EEG: An Identifiability–Utility Analysis Under Subject-Disjoint Evaluation

Abstract

Federated learning is increasingly adopted for clinical EEG because raw recordings remain at their originating institutions, creating the perception that resulting models are inherently privacy-preserving. Using the SWEC intracranial EEG (iEEG) cohort, we investigate whether representations supporting seizure detection also encode patient identity and whether these properties can be separated. Treating each of 12 patients as a federated client, we evaluate seizure detection, patient reidentification, patient verification, and membership inference under strict subject-disjoint cross-validation. A federated classifier built on frozen ResNet18 spectrographic features achieves seizure ROC-AUC of 0.772 and PR-AUC of 0.785, while the same representation supports 12-way patient identification at 0.757 accuracy, approximately nine times chance. Compared with sampleweighted FedAvg, FedAvgM improves balanced accuracy by 0.025 and ROC-AUC by 0.009; compared with uniform FedAvg, it improves ROC-AUC by 0.026. Random-window cross-validation inflates apparent seizure performance by 0.210 ROC-AUC relative to subject-disjoint evaluation, indicating patient-specific leakage. We evaluate three interventions: linear bottlenecks, gradient-reversal adversaries trained against patient labels, and pairwise verification adversaries. None preserves high seizure utility while patient identity approaches chance. A class-level adversary reduces membership-inference AUC from 0.784 to 0.618, an absolute reduction of 0.166, while increasing patient re-identification accuracy from 0.601 to 0.807, an absolute increase of 0.206. Thus, membership privacy and identity privacy can move in opposite directions. Commonly reported privacy metrics may not adequately characterize privacy risk in federated EEG. We recommend reporting patient verification and re-identification alongside membership-inference attacks as independent privacy endpoints in federated neurophysiological systems.