Federated training runs at the hospital Node. Local access controls and privacy-budget checks protect that boundary, while transport, storage and operational security also depend on deployment configuration.
Evidence from the pinned source
This 2.0.1 guide uses the Hub snapshot f09bb753 and the companion Node snapshot 5e52ac5, merged on 7 July 2026. The Node repository has no independently named 2.0.1 tag; these instructions pin the reviewed commits. See the version comparison for scope and sources.
“Implemented” means the control exists in the reviewed code; it does not certify a deployed system or assert that every security test has passed. Historical README summaries and planned-feature lists can lag behind implementation.
Training uses hospital-hosted datasets and exchanges model updates and metrics.
The hospital grants dataset access and controls allowed operations.
The Node validates proposed jobs and records privacy spend.
Review user, dataset, API and training activity in the Node.
Source controls, configured protections and remaining gaps
Model updates and metrics also need protection
A genuine experimental-subset job can bypass epsilon-budget gating and recording only when the Node validates the experiment permission and subset. This is a budget-accounting exception, not authorization to expose a production dataset or a privacy guarantee for experimental data.
The companion Node implements FedSVM with random Fourier features and DP-SGD weight sharing, plus a DP Random Forest algorithm. Older documentation describing exported SVM support vectors is superseded by this code. Check algorithm-specific bounds and parameters rather than transferring a deep-learning privacy statement to every model.
The Node checks estimated costs before admission and records the measured costs from completed rounds. Estimates and actual costs can differ; the recorded spend can exceed the configured budget and prevent the next job. A budget reset changes accounting state and does not undo earlier information disclosure.
Federated learning does not by itself provide cryptographic secure aggregation, remove re-identification risk or establish lawful use of a dataset. The reviewed code is not evidence of an end-to-end encrypted or certified clinical system.
Review this before using sensitive data
Disable debug flags in both Compose files; configure explicit allowed hosts and Node FLOWER_ALLOW_INSECURE=false. Provide HTTPS at the web/API boundary, and configure TRUSTED_PROXIES when a trusted reverse proxy supplies client-IP headers.
Protect the Hub credential-encryption keys, Node configuration, databases, dataset files and backups. Persisted secrets must survive application updates. Restrict Flower access, review audit logs and test restoration procedures. Automatic secret rotation and a clinical-deployment certification are not established by these snapshots.
See the installation guide for the exact Docker defaults and roadmap for documented future work.