## 4 Securing Artificial Intelligence Accompanying the WBAN
### Collaborative AI between Clinics  
Newer holistic visions, and especially advances in artificial intelligence, suggest that automated diagnosis and therapy selection can be significantly improved when clinics collaborate. Particularly with rare medical conditions, there is a likelihood that a local neural network from a single clinic may not be able to assist in the diagnosis. The situation changes when working with patient data from other clinics. An approach for this scenario is the machine learning method of Federated Learning (FL), which allows the training of a global AI model without the exchange of raw data between local models [40]. Note that this does not fully solve the privacy issue, as even model weights contain sensitive information, therefore allowing privacy attacks [46]. For secure aggregation of the results of the distributed global models into the global model, multiple approaches have been proposed [47; 48]. In its simplest form, such an algorithm computes the average of the model parameters and gradients of the local models [40]. To prevent information about the raw data contained in the training datasets from flowing to other partners in this collaborative network, random noise is added to the model updates in the context of Differential Privacy Average Aggregation before merging [49]. It is important to find the right compromise between the precision of the model and theprivacy of individual models, since in the use case of collaboration between networks responsible for diagnosis and treatment selection, both aspects are crucial. FL introduces unique challenges compared to traditional centralized machine learning approaches. The decentralized nature of FL raises concerns about privacy, robustness, and communication efficiency. Regarding the intention of an attacker on the WBANs data, there are multiple possible targets: (A) Extracting information about the types of vital data acquired at a specific patient or even accessing information about the health state itself. (B) Altering information (network parameters or data) to change the diagnosis output. That way a neural network could be tricked into classifying a terminally ill person as healthy, preventing them from receiving necessary treatment. This could be conducted by entering a contaminated dataset into the network which will hamper the performance of the network. This process is known as data poisoning [41]. Alternatively, in the context of FL, local models could feed malicious gradients or parameters to the main network [50]. State-of-the-art systems employ robust gradient aggregation techniques to mitigate the influence of such 'byzantine' contributions to the main network. Unfortunately, in the specific use case of rare disease treatment, a real dataset might be classified as malicious, as seemingly similar datasets have been classified as healthy so far. The goal of the global model is precisely to accept such rare cases and, considering multiple instances over an extended period, identify new patterns enabling the diagnosis of rare diseases. To address these challenges, there are various approaches that imply specific drawbacks in the discussed context. (A) Differential Privacy: Adding random noise to the shared model parameters increases protection against information leakage and reconstruction attacks. This has to be conducted very carefully as additional noise might impede the accuracy of the final model. Therefore, a suitable tradeoff between security and accuracy needs to be found [51]. (B) Secure Multi-Party Computation (SMPC): Utilizing cryptographic protocols to enable secure aggregation of local model updates without revealing sensitive information. This is achievable in the future, for instance, by using homomorphic encryption, as mentioned in Section 3. (C) Federated Averaging with Robustness: Incorporating techniques such as Byzantine fault tolerance to ensure the integrity of model updates and prevent manipulation by malicious participants.