## 3 Results  
We compiled the data properties in FL for healthcare applications from 24 published articles, as shown in Figure 3. The data scheme settings consisted of four layers: (i) data partitions such as horizontal federated learning (HFL), vertical federated learning (VFL), and federated transfer learning (FTL) (as discussed in Section 4.2); (ii) data distribution characteristics (non-IID) such as quantity skew, label distribution skew, feature distribution skew, and concept shift skew (as discussed in Section 4.3); (iii) possible data privacy attacks such as model inversion and membership inference attacks (as discussed in Section 4.4.1); (iv) additional data privacy protections such as differential privacy and homomorphic encryption (as discussed in Section 4.4.2). Above the medical data properties is the application task, where the task can be a classification or segmentation (as discussed in Section 4.6). **Numerical description**. The following observations were made based on numerical analysis of the 24 included studies between 2018 and June 2021. Firstly, Figure 4a depicts the number of FL studies published in the medical application by year of publication. Since 2020, the number of articles published on FL has been continuously increasing. The number of papers published in 2021 should continue to increase linearly throughout the year. Secondly, Figure 4b shows the number of studies with data partition characteristics employed in FL  
Figure 3: Medical data properties in federated learning for medical applications, consisting of data partitions, data distribution (i.e., non-IID) characteristics, possible data privacy attacks, and data privacy protections. According to the figure, most published FL studies use horizontal federated learning (HFL) as a medical data partition. Thirdly, Figure 4c shows the number of studies with various defense methods to protect from data privacy attacks. We can see that differential privacy is the most often employed type of data privacy protection. All of the possible data privacy protection methods will be discussed in Section 4.4. Based on Figure 4d, quantity skew is typical when dealing with multi-institutional medical data from FL experiments. Figure 4: Numerical description of published articles in federated learning for medical applications. (**a**) The number of FL studies published in medical application included in the review, 2018–2021; (**b**) number of data partition characteristics employed in FL; (**c**) various data privacy algorithms employed in federated learning for the healthcare area; (**d**) number of non-IID characteristics discussed in FL studies published in the medical domain; (**e**) various machine learning models employed in federated learning for the healthcare area; (**f**) number of FL studies published in medical application included in the systematic review. **Machine learning algorithms**. Additionally, we want to outline the machine learning models employed in the studies and evaluate their proposed FL algorithms. The outlined result of the machine learning model is shown in Figure 4e, where multilayer perceptron (MLP) is the most commonly used model when predicting with tabular medical datasets such as mortality prediction. Meanwhile, convolutional neural network (CNN) is the frequent model architecture used for medical image datasets. Other models include support vector machine (SVM) and autoencoder (AE) models. Additionally, we compile the machine learning task based on the 24 published articles, as shown in Figure 4f. There were 21 studies on classification tasks and three studies on segmentation tasks. Finally, we summarized in Table 1 the strengths and weaknesses of machine learning algorithms performing on federated learning.