Victoria Bourgeais
email: victoria.bourgeais@univ-evry.fr

Farida Zehraoui

Blaise Hanczar

BIOHAN: A KNOWLEDGE-BASED HETEROGENEOUS GRAPH NEURAL NETWORK FOR PRECISION MEDICINE ON TRANSCRIPTOMIC DATA A PREPRINT

Keywords: Interpretability, Deep learning, Graph neural network, Heterogeneous graph, Domain knowledge, Graph classification, Precision medicine

Deep-learning models promisingly benefit precision medicine in automatically solving phenotype prediction tasks on high-throughout omic data. However, their lack of interpretability limits their development in healthcare. Some studies are leveraging high-level human comprehensible biological concepts to increase the interpretability of these models, but interpretability is still not direct, and managing different knowledge types is limited. We propose BioHAN, a heterogeneous and selfexplaining graph neural network, using a self-attention mechanism. The heterogeneous input graph has a central gene graph and auxiliary graphs that compensate for the sparsity of the central graph. Experiments on a real dataset show that BioHAN has similar accuracy to the non-interpretable state-of-the-art and provides automatic explanations by listing the most relevant genes and identifying the most important concept-based neighbors of these genes. All these features should make BioHAN a functional tool to clinicians.

Introduction

With the rapid improvement of sequencing techniques, the production of patient-specific low-scale characteristics (known as omic profiles) is increasing. The study of these molecular data contributes to the emergence of precision medicine, which proposes solutions at different stages of individual patient care. Among omic data, transcriptomic or gene expression data measure genes' activity through quantifying RNA fragments. These data play a key role in precision medicine as they provide information about the cellular state and allow the study of complex diseases such as cancers. In particular, one of the main applications is the prediction of diagnosis, prognosis, or treatment response from the gene expression profile of a patient. Although the classic shallow models showed interesting results for these supervised classification tasks in the past 20 years ?, there is now an increasing interest in deep learning approaches. The application of deep learning methods on these data shows that healthcare could benefit from the automatic classification and extraction of reliable medical patterns Zhang et al. [2019a]. However, one of the main disadvantages of these models is their lack of interpretability, preventing their development in omics medicine. They do not provide end users (physicians, clinicians, and biologists) with understandable explanations for their predictions. End users need to understand why a phenotype has been predicted to ensure that it is based on reliable medical features rather than on irrelevant artifacts. Regardless of the model's effectiveness, this will have a major effect on their decisions and D R A F T BioHAN A PREPRINT confidence towards the model. Another motivation of interpretability is that the model inspection may contribute to biological discovery by revealing interesting signatures.

The first attempts to interpret neural networks are based on the a posteriori use of scoring methods to evaluate the impact of each input variable on the prediction. The result is a list of important genes for the model [START_REF] Ahn | Deep Learning-based Identification of Cancer or Normal Tissue using Gene Expression Data[END_REF], [START_REF] Hanczar | Biological interpretation of deep neural network for phenotype prediction based on gene expression[END_REF]. Although this may provide interesting information, they are too limited to enlighten the complexity of the model. These interpretations explain neither how the genes are used for the prediction computation nor how genes interact with each other. Moreover, an understandable explanation cannot be based only on genes. Indeed, their role is not always known, or they can be a small part of a larger relevant biological process. An understandable explanation must also include higher-level biological concepts such as biological processes or metabolic pathways. To overcome these limitations, knowledge-based approaches, that integrate high-level biological concepts, have been proposed in the literature. A first approach is based on feed-forward networks, where a knowledge database constrains the model architecture. It means that each neuron is associated with a biological concept and each network connection to a relation between biological concepts. Most models are multilayered perceptrons (MLP) so that one or more hidden layers can integrate knowledge. For example, Kang et al. [START_REF] Kang | A biological network-based regularized artificial neural network model for robust phenotype prediction from gene expression data[END_REF] connect the input genes to a hidden layer whose nodes represent proteins or compounds regulating the genes. In Deep GONet, part of the Gene Ontology hierarchy is represented by several hidden layers of a fully connected MLP [START_REF] Bourgeais | Deep GONet: self-explainable deep neural network based on Gene Ontology for phenotype prediction from gene expression data[END_REF]. These works present some limitations. They can represent only a certain type of graph (i.e., directed acyclic graph in case of a MLP) and cannot fully encapsulate all the knowledge semantics. They also fail to explain how genes and biological concepts interact with each other. The second approach uses graph neural network [START_REF] Wu | A Comprehensive Survey on Graph Neural Networks[END_REF] to integrate gene relations into predictions and interpretations. In these methods, a patient is usually represented by a homogeneous graph based on gene networks such as protein-protein interactions (PPI) or co-expression graphs [START_REF] Rhee | Hybrid approach of relation network and localized graph convolutional filtering for breast cancer subtype classification[END_REF], [START_REF] Ramirez | Classification of cancer types using graph convolutional neural networks[END_REF] and the prediction is a graph classification task. Note that all the patients share the same graph structure; only the omic signal differs. These models can explain which genes are implied in the predictions and how they interact. However, they are limited to the gene level and do not provide high-level biological concepts for interpretation. Regardless of the approach used, most of the models devised require a post-hoc interpretation to identify the most relevant patterns (gene, concept). Few methods, known as self-explaining, have been developed to automatically provide explanations [START_REF] Bourgeais | GraphGONet: a self-explaining neural network encapsulating the Gene Ontology graph for phenotype prediction on gene expression[END_REF].

In this paper, we propose BioHAN (Biological Heterogeneous Attention Network), a novel and self-explaining heterogeneous graph neural network for phenotype prediction. This model makes predictions at least as accurate as the state-of-the-art and provides intelligible interpretation. This interpretation includes multiple-level biological concepts (genes, biological processes, metabolic pathways) and explains how these elements interact for prediction computing. To provide these explanations, our model integrates several biological networks and ontologies (STRING Snel et al. [2000], Gene Ontology Consortium [2004], Reactome [START_REF] Fabregat | The reactome pathway knowledgebase[END_REF]) into its architecture based on a heterogeneous graph neural network with a self-attention mechanism. In addition, BioHAN successfully deals with the sparsity of the integrated knowledge through an original architecture centered on a gene interactions graph and an adapted pooling layer. Unlike classical graph classification approaches, BioHAN considers a fixed heterogeneous graph structure. An input patient is an instantiation of this graph, and the output is a patient-specific subgraph. Experiments on cancer diagnosis demonstrate that BioHAN performs well for cancer-type prediction and automatically produces a subgraph to explain the individual outcome of a sample, which biologists and physicians can easily understand.

Related Work

Our work is closely related to both the interpretation of deep learning models and the graph neural networks.

Interpretation of deep learning-based methods Two main approaches emerge for interpreting deep-learning-based methods: post-hoc and self-explaining models Barredo Arrieta et al. [2020]. In the post-hoc approach, an interpretation method is applied on top of the trained deep learning model. Several post-hoc methods are available, including surrogate models and backpropagation attribution methods. Surrogate models leverage interpretable machine learning models, such as linear models in LIME [START_REF] Tulio Ribeiro | Explaining the predictions of any classifier[END_REF], to approximate the local decision-making process of black box models. Meanwhile, backpropagation attribution methods, such as Layer-wise Relevance Propagation (LRP) [START_REF] Bach | On pixel-wise explanations for non-linear classifier decisions by layer-wise relevance propagation[END_REF] or DeepLIFT [START_REF] Shrikumar | Learning important features through propagating activation differences[END_REF], aim to explain a neural network's prediction by identifying the most influential input variables and neurons for the prediction. They mainly consist in computing a relevance score by backpropagating the output signal to the input layer. As mentioned in the introduction, these methods are not accurate enough to produce a valuable interpretation in the context of gene expression-based models ?. In addition, studies show that surrogate models can produce unfaithful and inconsistent explanations ??, while explanations from backpropagation attribution methods are sensitive to random noises and adversarial attacks ??. Moreover, it is possible to obtain different explanations for the same prediction using various post-hoc methods or by applying the same post-hoc method with D R A F T BioHAN A PREPRINT different parameters Elton [2020]. In contrast, the self-explaining models are inherently interpretable models that automatically provide a form of explanation of their decisions. We can cite as examples the concept bottleneck model, which predicts an intermediate set of human-defined concepts [START_REF] Wei Koh | Concept bottleneck models[END_REF] and attention-based models that can provide a kind of local interpretability through the attention scores Vaswani et al. [2017]. A general opinion is that the black boxes are more accurate than the self-explaining models, with interpretation capacity being seen as a potential constraint that can reduce a model's performance. As a result, there has traditionally been a trade-off between model performance and interpretation. However, a part of the machine learning community now argues that performance and interpretation are not mutually exclusive ?Elton [2020].

Graph neural network A Graph Neural Network (GNN) is a neural network designed specifically for graph-structure data [START_REF] Wu | A Comprehensive Survey on Graph Neural Networks[END_REF]. GNNs can handle various types of graphs, including both directed and undirected ones, and perform a wide range of tasks at the node, edge, or graph level in many domains. Graph-level GNNs comprise graph convolution and pooling layers, followed by fully-connected and output layers. Graph convolution layers update the node features, combining the signal from their neighborhood, whereas the role of pooling layers is to reduce the size of the graph to facilitate the graph classification. Common graph convolution (GCN [START_REF] Kipf | Semi-supervised classification with graph convolutional networks[END_REF], GAT Velickovic et al. [2018], GIN Xu et al. [2019]) and pooling (DiffPool Ying et al. [2018], SAGPool [START_REF] Lee | Self-attention graph pooling[END_REF], GMN ?) generally handle homogeneous graph. Few GNNs have been designed to deal with heterogeneous graphs, and most of them cover node and edge level tasks (RGCN ?, HetGNN Zhang et al. [2019b], HAN Wang et al. [2020], HGT ?). Most GNN models miss interpretation and, as such, require either adaptions of the existing post-hoc methods that do not fit graph-based data (e.g., GNN-LRP ?, GraphLIME ?) or new methods designed specifically for them (e.g., GNNExplainer ? which generate the minimum explanation subgraph while identifying the most influential node features). However, most of these interpretation methods are designed for homogeneous graphs and do not scale to the size of omic graphs. Moreover, all these methods inherit the drawbacks of the post-hoc methods.

3 Biological Heterogeneous Attention Network

Problem Formulation

Let {(X, Y )} N i=1 be a training set containing N samples, where X = [x 1 , . . . , x d ] is the gene expression profile of a patient with d the number of genes and Y = {0, 1} C is the indicator of the class to predict with C the number of classes. y c = 1 when the sample belongs to the class c, and y c = 0 otherwise. Our model integrates the biological information from gene interactions, biological functions, metabolic pathways or other biological concepts within a large heterogeneous graph G = (V, E) described as follows. The interactions between genes are represented by a sparse graph G * = (V * , E * ), where each node represents a gene and each edge a known relation between two genes2 . Biological concepts annotating genes and characterizing their activities (biological functions, pathways. . . ) are each represented by graphs G Ki = (V Ki , E Ki ) I i=1 . For each of this knowledge graph, each node represents a biological concept and each edge a relation between two concepts. The heterogeneous graph G, on which is based our model, integrates the genes graph G * as a central graph, since it receives the gene expression profile of a patient. The I auxiliary graphs G Ki , (1 ≤ i ≤ I), are connected to G * to compensate the sparsity of the central graph through sets of edges E * i , (1 ≤ i ≤ I), between the central graph and the i-th knowledge graph. Therefore, the set of nodes of G is defined as V = {V * , V Ki(1≤i≤I) } and its set of edges as E = {E * , E Ki(1≤i≤I) , E * i(1≤i≤I) }. E * and E Ki are called intra-community edges because they connect two nodes of the same graph and E * i are the inter-community edges since they connect two different graphs. In order to identify the different types of nodes and edges, we introduce two functions t and r. t

(resp. r) assigns a type t(v) ∈ T (resp. relation type r(v, u) ∈ R) to a node v ∈ V (resp. an edge (u, v) ∈ E). The information of each node is embedded into a vector h v ∈ R D t(v)
. In our context, since the gene expression is a scalar, the embedding dimension is one for all types of nodes: h v ∈ R, ∀v ∈ V. A neighborhood of a node v is defined as the set of one-hop nodes that are directly connected to it. We can distinguish several neighborhoods of a node v according to the type of nodes with which it interacts. Depending on its connectivity to other graphs, it may have B (0 ≤ B ≤ I) inter-community neighborhoods, denoted as N j inter (v), where j = 0, . . . , B. However, a node always has at most one intra-community neighborhood N intra (v). Note that the node v can itself be included in its neighborhood; we talk about self-loops (SL).

Model architecture

BioHAN is based on a GNN integrating the four basic modules for graph classification, namely the convolution layer, pooling and readout reduction layers, and finally, the dense layer [START_REF] Wu | A Comprehensive Survey on Graph Neural Networks[END_REF]. The gene expression profile of each patient is inputted into the central graph and is propagated through the knowledge graphs. Note that the structure of the graph is fixed. It is the same one for all the patients, only the data propagated through the model is different. The complete approach is illustrated in Fig. 1. Each layer is described in this subsection.

Convolution layer

The convolution layer (GCONV) is based on a self-attention mechanism to allow nodes to focus only on selected neighbors among the different types of nodes. It is based on the node level attention in HAN Wang et al. [2019]. For each pair of nodes (v, u), an attention score e vu measures the contribution of node v's features to node u. This score depends on the type of node and the type of relationship between two nodes. Note that the score is asymmetric, it means that e vu ̸ = e uv . Node representations are initially projected in a common feature space D ′ by the type-specific weights w

t(v) ∈ R D ′ ×D t(v)
. The nodes from the same graph share the same weight. Computing scores is based on an attention mechanism, a : R

D ′ × R D ′ → R, such as e vu = a(w t(v) h v , w t(u) h u ).
In our experiments, this function refers to a single-layer feed-forward neural network and is parameterized by attention relation-specific weights

w α,r(v,u) ∈ R 2D ′ : e vu = LeakyReLU w T α,r(v,u) [w t(v) h v ∥w t(u) h u ] (1)
where ∥ represents the concatenation operation and . T the transposition.

To facilitate the comparison of the scores across all nodes u targeting the same node v, the attention coefficients are normalized using the softmax function:

α vu = softmax(e vu ) = exp(e vu /τ ) p∈N (v) exp(e vp /τ ) (2)
where τ is the temperature hyperparameter used to control the sparsity of the attention coefficients.

D R A F T BioHAN A PREPRINT
The update of node v ∈ V by the convolution layer l using multi-head attention is the following propagation rule:

(3)

h(l) v = GCONV(h (l-1) v ) = σ 1 (B + 1)K K k u∈N (l) intra (v) α (l,k) vu w (l,k) t(u) h (l-1) u + B j u∈N j(l) inter (v) α (l,k) vu w (l,k) t(u) h (l-1)
u where h

(l-1) u

is the vector representation of node u at layer (l -1), N

•(l) (•) (v) denotes the set of neighboring nodes of node v (inter or intra), α (l,k)
vu and w (l,k) t(u) are respectively the normalized attention coefficient for the pair of nodes (v, u) and type-specific weight at layer (l -1) and head k, σ refers to an activation function (i.e., ReLU function), and K to the number of attention heads. These heads are generally used to stabilize the learning process and obtain various independent coefficients for the same node pair (v, u). The new node representation of a node v is given by adding, without additional cost, a residual connection (RC) h(l) v to the vector representation of node v at the previous layer (l -1):

h (l) v = h(l) v + h (l-1) v . (4)
The residual connections are usually devised to make the network training easier and solve over-smoothing and gradient vanishing problems. All nodes, regardless of their type, are updated in parallel. Note that the same propagation rule applies to all directed or undirected nodes.

Pooling layer

The pooling layer is based on top-r methods [START_REF] Grattarola | Understanding pooling in graph neural networks[END_REF] for homogeneous graphs that attribute an importance score to each node and select only the highest scoring r-nodes. In BioHAN, we adapt top-r strategy to consider multiple types of relations and deal with the sparsity of the central graph G * by not reducing the auxiliary graphs. We reduce the central graph G * by selecting the nodes that concentrate the most information. We look for nodes whose intraand inter-community neighbors are also informative. These nodes will continue to interact with each other even if they belong to different connected components thanks to the auxiliary graphs G Ki . This allows to compensate for the loss of connectivity within the central graph. A score s v for a gene v from the central graph to layer l is calculated as:

s (l) v = γ × h (l) v + (1 -γ) (B + 1) × max u∈G * (l) (h (l) u |u ∈ N (l) intra (v)) + B j max u∈G (l) K j (h (l) u |u ∈ N (j,l) inter (v)) (5)
where γ is a hyperparameter that determines how much information we consider from the node itself and its neighborhoods. The top function then returns the indices of the ⌈|V * (l) |×r (l) ⌉ nodes with the best score s

(l) v , |.
| is the cardinality, r (l) ∈ (0, 1] is the pooling ratio at the layer l indicating the number of nodes to keep.

BioHAN is composed of successive blocks of convolution and pooling layers. At the end of each block, we obtain a central graph of a reduced size such that G * (l) = top-r(s (l) ), |V * (l) |< |V * (l-1) |. Note that the nodes in the central graph G * (0) initially receive the expression of the genes from the expression profile of a sample. The nodes in the auxiliary graphs are zero value as they are annotations and do not have any proper numerical information, but are initialized by a first propagation, such as:

h (0) v =
GCONV( ĥ(0) v ) where ĥ(0

) v = 0 if v ̸ ∈ V * (0) , x v otherwise. ( 6
)
Readout layer The readout layer only transforms the central graph of genes into a vector to perform the graph prediction task. We have chosen to keep only the genes of the central graph, but we can also keep the most important biological concepts. This layer concatenates the information from the last convolution-pooling block L from the remaining nodes in the central graph G * (l) , while keeping track of the original gene indices. A vector

M of dimension D R A F T BioHAN A PREPRINT
equal to the initial number of genes |V * | is created. The entries of this vector, corresponding to the last selected genes, receive their expression from the L th block:

m v = h (L) v if v ∈ top-r(s (L) ), 0 otherwise. ( 7
)
Dense layer A fully connected layer followed by a softmax function is finally applied to complete the classification task.

Model interpretation

Our model is self-explaining, which means that it automatically explains the prediction by selecting the most important genes involved in the prediction. In addition, it performs gene annotation by associating biological concepts with the selected genes. In particular, the readout layer gives the subset of genes directly implied in the final computation of the prediction. For each sample, the model returns a prediction (e.g., cancer/non-cancer) with attached probability and an explanation composed of the subset of genes and their importance score. The importance of a gene g towards a class c is measured through the relevance score3 R c g ∈ R. This score depends on the activation value m g of the neurons in the readout layer (the last hidden layer of the model):

R c g = m g × w g,c (8)
where w g,c is the weight between the gene g from the readout layer and class c from the output layer. Consequently, the genes previously dismissed by the pooling layers have a relevance score equal to zero. Using this score helps to discriminate within the subset the most relevant genes. The size of the subset depends on the pooling ratio. The smaller the subset is, the easier the interpretation will be. Note that it is not the same subset selected for each sample. The attention scores are also explored to enrich the explanations and, notably, to help to generate explanation subgraphs, as shown in Fig. 1. The attention scores from the most reliable genes can be used to identify the most influential neighbors from the different graphs (central and auxiliary) in the heterogeneous graph. Relevance and attention scores can both reveal interesting signatures across patients and models.

Experiments

Dataset

Most of the transcriptomic datasets contain at most 1,000 samples and not necessarily annotations in terms of labels or domain knowledge. Consequently, we apply BioHAN for cancer diagnosis on a unique, well-annotated pan-cancer dataset with around 6,000 samples. This dataset is from the RNA-Seq repository in The Cancer Genome Atlas (TCGA) platform [START_REF] Tomczak | The cancer genome atlas (TCGA): an immeasurable source of knowledge[END_REF]. It contains 56,602 input genes for 5,982 cancer samples from 11 cancer types and 482 non-cancer samples from multiple tissues. We are interested in the multi-classification task where the number of classes C = 12. The dataset is standardized and divided into training (64%), validation (16%) and test sets (20%). The validation set is used for fine-tuning the hyperparameters and early stopping. A thorough description of the dataset is available in Suppl. Table S1.

Knowledge-based graph processing

We choose to base our heterogeneous knowledge graph G on three different biological networks: gene network (G) based on protein-protein interactions (PPI) from STRING database, biological functions (GO) from Gene Ontology, and pathway networks (P) from Reactome database. R = {G -G, G -GO, G -P } and T = {G, GO, P }. PPI is an undirected graph composed of several connected components, and the original nodes represent proteins. They are mapped to their corresponding genes4 and form the central graph G * . This graph is sparse with a connectivity of about 0.096%. There are 86 connected components, including a main one containing more than 97.99% nodes.

GO and Reactome are both directed acyclic graphs (DAG) and annotate the genes biologically. The GO annotations are functions describing the biological activity of the genes. In particular, we are interested in one of the sub-ontology of GO, GO-BP, that gathers biological processes. Reactome is a hierarchy of metabolic pathways (i.e., sequence of chemical reactions) in which the genes are implied. GO and Reactome correspond to the auxiliary graphs in G. Both graphs support the propagation of the gene signal within the parsimonious central graph G * and enrich the explanations

D R A F T BioHAN A PREPRINT
biologically. We preliminarily extract and filter the knowledge relations to retain only the annotations with the genes contained in the dataset. Respectively, 92.63% and 61.78% of the genes are annotated by GO and Reactome graphs. G is described as ({V * = 10, 947, V K1 = 16, 062, V K2 = 2, 502}, {E * = 115, 745, E K1 = 37, 406, E K2 = 2, 521, E * 1 = 73, 580, E * 2 = 29, 305}) with K 1 = GO and K 2 = P . We remind that all the samples share the same heterogeneous graph structure, only the graph signal changes. Each gene in the central graph receives its corresponding signal from TGCA gene profiles. In contrast, the nodes in the auxiliary graphs do not have any value. We apply a first convolution as described by the Eq. ( 6) to initialize them. Regardless of the type of graph to which they belong, all nodes are subject to the same propagation rule. More details about the heterogeneous graph's composition and its connectivity can be found in Suppl. Table S2.

Experimental setup

In the following, we discuss how the optimal hyperparameters are obtained. In Eq. 3, the information from the node itself is not considered explicitly. Solutions are to consider the node in its own neighborhood via self-loops [START_REF] Kipf | Semi-supervised classification with graph convolutional networks[END_REF] or to use residual connections [START_REF] He | Deep residual learning for image recognition[END_REF] as described in Eq. 4. Residual connections could also help to increase the depth of the GNN and avoid gradient vanishing in the backpropagation. In our experiments, BioHAN is more accurate with residual connections than with self-loops or nothing. It costs less compared to increasing the adjacency matrix with self-loops. Concerning the temperature hyperparameter τ , we test values from 0.1 to 1.0.

Experiments show that whatever the value, the models perform the same. In the following experiments, we keep evaluating the model with two different values (τ ∈ {0.1, 1.0}) to analyze the differences in the model interpretation.

The number of attention heads K is set to 1. Experiments show that using one head performs better than with a higher number. Besides, adding more heads has the consequence of increasing the number of parameters to learn. Fine-tuning results of the convolution hyperparameters are available in Suppl. Table S4 and Fig. S5. About the pooling convolution, the hyperparameter γ is fixed to 0.5 to balance the information from the node itself and its neighboring nodes. Meanwhile, isolated nodes are disadvantaged as half of their information is considered. The pooling ratio r depends highly on the number of convolution-pooling blocks used. The objective of having consecutive convolution-pooling blocks is to decrease the size of the central graph and automatically capture the smallest subset of the most important genes, which is used as support of the explanation. Experiments (available in Suppl. Fig. S6) show that a configuration of two blocks with pooling ratios r (1) = 0.5, r (2) = 0.1 achieves the best threshold between interpretation and performances. The reduced size obtained at the pooling layer (L = 2) is 548 on the TCGA dataset. Suppl. Table S3 lists the different hyperparameters with their optimal and tested values.

Models are trained using Adam optimizer with an initial learning rate of 0.001 and a batch size of 16. We use the early stopping strategy on the validation set with a patience of 5 epochs. We perform a multi-classification on the TCGA dataset with the softmax function in the output layer. All the experiments were executed on GPUs RTX 2080Ti and A6000 using PyTorch v1.11.0 and PyTorch Geometric v2.0.4.

Benchmarking

We compare BioHAN with τ = 1 against state-of-the-art machine learning models 5 : decision tree (DT) with the Gini criterion, random forest (RF) with the Gini criterion and a number of trees of 100, support vector machine (SVM) with the linear kernel and C = 1.0, and multi-layered perceptrons with three hidden layers (1000-500-200 neurons). Only the decision tree is an inherently interpretable model among the four models. In this benchmark, we also consider ablations of the heterogeneous graphs to assess the auxiliary knowledge contribution in BioHAN. In a first ablation, we consider only one auxiliary graph such as G = (G * , G K1 ) with K 1 ∈ {GO, P }. They are reported in the results as "BioHAN-ppi-go" and "BioHAN-ppi-reactome". In a second ablation, no auxiliary graphs are considered. Currently, the input graph results in an homogeneous graph of genes such as G = G * . This ablation is refered as "BioHAN-ppi-only".

In that case, BioHAN works similarly as state-of-the-art GNNs composed of GAT convolution [START_REF] Velickovic | Graph Attention Networks[END_REF] with pooling layers. In the related work, there are no comparative heterogeneous GNNs using multiple biological graphs for graph classification task (e.g., phenotype prediction), while MLP are not designed for handling this type of data. We vary the number of training samples N from 25 to 4136 (full size of the training set). For each point size, ten models are learned with a different random seed.

Sensitivity Analysis

We compare BioHAN with τ = 1 against state-of-the-art machine learning models6 : decision tree (DT) with the Gini criterion, random forest (RF) with the Gini criterion and a number of trees of 100, support vector machine (SVM) with the linear kernel and C = 1.0, and multi-layered perceptrons with three hidden layers (1000-500-200 neurons). Only the decision tree is an inherently interpretable model among the four models. In this benchmark, we also consider ablations of the heterogeneous graphs to assess the auxiliary knowledge contribution in BioHAN. In a first ablation, we consider only one auxiliary graph such as G = (G * , G K1 ) with K 1 ∈ {GO, P }. They are reported in the results as BioHAN-ppi-go and BioHAN-ppi-reactome. In a second ablation, no auxiliary graphs are considered. Currently, the input graph results in an homogeneous graph of genes such as G = G * . This ablation is refered as BioHAN-ppi-only (GAT+pool). In that case, BioHAN works similarly as state-of-the-art GNNs composed of GAT convolution [START_REF] Velickovic | Graph Attention Networks[END_REF] with pooling layers. In the related work, there are no comparative heterogeneous GNNs for graph classification task, while MLP are not designed for handling this type of data. We vary the number of training samples N from 25 to 4136 (full size of the training set). For each point size, ten models are learned with a different random seed.

Biological analysis and interpretation

Sensitivity Analysis

Fig. 2 shows the mean and standard deviation of the accuracy evaluated on TCGA test samples. The models learn globally well in the presence of a sufficient number of training samples (from 1000). The performance of all models gradually deteriorates as the number of training samples decreases. Our approach remains as competitive as the state-of-the-art. With the entire set of training samples at N = 4136, BioHAN, SVM, and RF models have equivalent accuracies. With fewer training samples, the SVM and RF black box models perform slightly better than the deep learning models. The MLP, another black box model, generally has lower accuracy and more parameters than BioHAN (11,551,112 against 131,421). BioHAN is also more competitive than the different ablations conducted, especially the BioHAN-ppi-only variation, which has a similar accuracy trend as the MLP. We can conclude that the more auxiliary knowledge we have in BioHAN, the better they make remote genes communicate and the better the performance. In addition, deep learning is expected to significantly address phenotype prediction problems in the coming years, given the increasing production of transcriptomic data. In particular, a study [START_REF] Hanczar | Assessment of deep learning and transfer learning for cancer prediction based on gene expression data[END_REF] shows that deep learning models outperform standard machine learning models in the presence of larger training sets (> 5000 samples). In all cases, the set of BioHAN variations outperforms the decision tree, the only inherently interpretable method. In Suppl.

Biological analysis and interpretation

In the following, all experiments have been conducted with the maximum number of training samples. BioHAN is trained without performance loss with a temperature τ = 0.1. We choose this value as Suppl. Fig. S8 show that the attention maps produced with τ = 0.1 reveal type-specific biological signatures contrary to the ones produced with τ = 1.0. We first propose to analyze an explanation of a prediction returned by a BioHAN model on a patient. The explanation takes the form of a personalized subgraph centered on gene nodes. For each patient, a different explanation subgraph is generated. The final gene subset contains 548 genes v for which m v ̸ = 0. For a given patient, we rank the genes according to their relevance score. The higher the score towards a class is, the more positive impact the gene has. Our analyses showed that the distribution of these scores follows a Gaussian distribution centered at zero. Assuming that these scores follow a distribution N (0, σ) where σ is the empirical variance, we can apply a two-tailed t-test with a p-value = 0.05 to determine which scores are far from the upper bound and thus identify the most important associated genes. We present in Fig. 3 an example of the explanation of a patient outcome correctly predicted HNSC with a probability of 1.0. An explanation subgraph is designed around the most important gene, ENSG000001771437 . The surrounding nodes represent its intraand inter-community 1-hop neighbors in G (2) . The weights on the edges represent the attention score α (2,1) obtained in the last convolution-pooling block (L = 2). We can leverage the sparsity of the attention coefficients to determine which neighbors are the most influential. This explanation offers a broader view of the different interactions between the biological concepts (gene, biological function, metabolic pathway). It can be easily understood by end users familiar with this knowledge (e.g., biologists and clinicians). According to the explanation, domain-experts can then judge the predicted phenotype's relevancy. The full list of top-relevant genes that passed the two-sided t-test and the corresponding description of all biological concepts are given in Suppl. Tables S6,S5. An explanation subgraph enriched is provided in Suppl. Fig. S9. An interpretation by cancer type can be obtained by averaging the explanations from the same cancer type predictions.

In this last analysis, we evaluate the consistency of the gene signatures to measure the sensibility of the gene subsets across models. Consistency is one evaluation criterion in XAI that expects that different models learned on the same dataset should output similar explanations [START_REF] Robnik | Perturbation-Based Explanations of Prediction Models[END_REF]. To this purpose, we train one hundred BioHAN and BioHAN-ppi-only models with τ = 0.1 and different random seeds. We evaluate the occurrences of the genes across models and test samples. We count how many times a gene v is in the subset (m v ̸ = 0). Then, we sum up each gene's occurrences across models and samples from the same cancer type. We finally compute the maximal The upper bound represents for each cancer type the maximal frequency reachable by any genes across models and samples. frequency among all genes for each cancer type. We compare the results of the two configurations against the upper bound (i.e., the maximal frequency reachable by any genes corresponding to the number of cancer type-specific samples times the number of models). Fig. 4 shows that using auxiliary knowledge and lower attention temperature increases the consistency of the signatures across models. We also notice that consistency occurs on the attention maps (available in Suppl. Fig. S10). By averaging the attention scores across models for one particular node target, this node captures more attention from one single neighbor specific to the cancer type.

Conclusion

We propose BioHAN, a new graph neural network adapted to heterogeneous graphs that combine different biological concepts based on STRING, GO, and Reactome databases. Note that other knowledge graphs can be integrated into BioHAN. Our model performs similarly to state-of-the-art black box machine learning methods. Our experiments show that enriching BioHAN with different knowledge graphs allows it to outperform MLP and ablations of BioHAN. This enrichment compensates for the parsimony of the central gene graph that increases along the model. We guarantee model interpretation through a self-attention mechanism, reduction layers (pooling and readout), and high-level biological concepts. A patient's prediction explanation has been proposed as a graph centered on the most important genes while highlighting the most influential neighbors (gene, biological function, pathway). The auxiliary knowledge has another advantage: making the explanations more intelligible by characterizing gene activity and gaining domain-experts' trust. Statistical tests for biological enrichment are, therefore, no longer necessary. In contrast, in black box methods like SVM, a two-step approach is necessary: firstly, a post-hoc interpretation is required to identify the relevant genes, and secondly, a biological enrichment analysis must be performed on the obtained list to determine overrepresented biological concepts. As discussed in the state-of-the-art, the explanations produced could be unfaithful and inconsistent. In addition, post-hoc methods specific to GNNs, like GNNExplainer, are not adapted to heterogeneous graphs. In future works, we plan to specify the heterogeneous graph depending on the specificities of individual cancer types. We finally wish to estimate the model performance and interpretation on more complicated tasks such as survival. S2: Details about the heterogeneous graph's composition (GO-BP, Reactome, PPI). Column one indicates, depending on the type of graph, either the number of related components (CC), or the graph height (H) corresponding to the maximum distance between a node and the root. Columns two to four give information about the number of nodes, intra-community edges and the associated average degree. Columns five and six describe the number of inter-community edges and the number of genes annotated by auxiliary graphs (the mean and standard deviation per node).

D R A F T BioHAN D R A F T BioHAN D R A F T BioHAN A PREPRINT

D R A F T

B Hyperparameters tuning

Hyperparameter

Optimal values Range of tested values

D ′ 1 - L 2 {1, 2, 3} K 1 [1, 6] ns 0.2 - τ 0.1 [10 -5 , 1.0] RC/SL RC&NO_SL (NO)_RC&(NO)_SL γ 0.5 [0, 1] r 0.5(l = 1) -0.1(l = 2)
[10 -3 , 0.5] Table S3: List of the hyperparameters fine-tuned during the learning step. l) . Depending on the number of blocks tested, the different configurations are named according to the following patterns: r (1) , r (1) -r (2) and r (1) -r (2) -r (3) . Ten models are learned for each configuration. The optimal configuration is a good trade-off between accuracy and interpretability, in that case it corresponds to the configuration in red.

C Sensitivity analysis

D Biological analysis and interpretation

We evaluate the attention maps obtained with one BioHAN model between one node and its neighborhood with two different values of the temperature (i.e., τ ∈ {0.1, 1.0}). The pooling layer can select a different subset of genes across samples. To make the comparison across samples easier, we study the attention maps from the first convolution layer.

In the central graph, the size of the neighborhood is in [1, 503] (mean = 21.15). We randomly pick a gene v with a neighborhood size close to the mean, i.e., the gene ENSG00000128655 8 where |N intra (v)|= 24. We compare the coefficients α (1,1) across neighbors and samples from the same cancer type. Both results on LGG (Figures SS8a-b) and HNSC (Figures SS8c-d) show that with a lower temperature value, the model can discriminate which neighbors are more informative to a target node. Attention coefficients learned with τ = 0.1 also reveal type-specific biological signatures.

For most patients with the same cancer type, it is generally the same neighbor that is important for the target gene. It is not the same neighbor across the cancer types. For instance, it is the neighbor numbered 19 (ENSG00000198931 9 ) for LGG, whereas it is the neighbor numbered 7 (ENSG00000174233 10 ) for HNSC. These type-specific attentions could further be investigated to understand the biological significance of these differences.

Figure 1 :

 1 Figure 1: Overall framework of BioHAN. In this example, the heterogeneous graph of a sample is composed of a central gene graph G * (colored in red) and two auxiliary graphs GK 1 (in blue) and GK 2 (in green). The set of genes are denoted G. K1 corresponds to a set of biological functions GO and K2 to a set of pathways P . R = {G -G, G -GO, G -P } and T = {G, GO, P }. The convolution and pooling steps are illustrated in the black boxes. An example of an explanation subgraph is given along with the prediction in the output layer.

Figure 2 :

 2 Figure 2: Classification accuracy curves according to the number of training samples N .

Figure 3 :

 3 Fig.2shows the mean and standard deviation of the accuracy evaluated on TCGA test samples. The models learn globally well in the presence of a sufficient number of training samples (from 1000). The performance of all models gradually deteriorates as the number of training samples decreases. Our approach remains as competitive as the state-of-the-art. With the entire set of training samples at N = 4136, BioHAN, SVM, and RF models have equivalent accuracies. With fewer training samples, the SVM and RF black box models perform slightly better than the deep learning models. The MLP, another black box model, generally has lower accuracy and more parameters thanBioHAN (11, 551, 112 against 131, 421). BioHAN is also more competitive than the different ablations conducted, especially the BioHAN-ppi-only variation, which has a similar accuracy trend as the MLP. We can conclude that the more auxiliary knowledge we have in BioHAN, the better they make remote genes communicate and the better the performance. In addition, deep learning is expected to significantly address phenotype prediction problems in the coming years, given the increasing production of transcriptomic data. In particular, a study[START_REF] Hanczar | Assessment of deep learning and transfer learning for cancer prediction based on gene expression data[END_REF] shows that deep learning models outperform standard machine learning models in the presence of larger training sets (> 5000 samples). In all cases, the set of BioHAN variations outperforms the decision tree, the only inherently interpretable method. In Suppl. Fig.S7, F1-score and AUC metrics are displayed.

Figure 4 :

 4 Figure 4: Maximal occurrence (y-axis) obtained across genes for each cancer type (x-axis) for two configurations of BioHAN.

  RC & NO_SL NO_RC & SL RC & SL ACC (avg±std) 0.596 ± 0.389 0.964 ± 0.002 0.609 ± 0.401 0.961 ± 0) 0.964 ± 0.004 0.964 ± 0.002 0.962 ± 0.004 0.960 ± 0.010 0.962 ± 0.009 Table S4: Performance comparison of the different tested values of the convolution layer's hyperparameters: a) combination of residual connections (RC) and self-loops (SL), b) variation of the number of heads K. Ten models are learned for each configuration. The selected value that achieves the best accuracy is in bold.

Figure S5 :Figure S6 :

 S5S6 Figure S5: Evaluation of the model accuracy according to the temperature hyperparameter τ . Ten models are learned for each configuration.

Figure S7 :

 S7 Figure S7: Evaluation of the model performances according to the number of training samples N . Metrics used: (a) F-1 Score (b) AUC.

Figure S8 :

 S8 Figure S8: Attention maps on gene ENSG00000128655 for LGG and HNSC samples.

Figure S9 :

 S9 FigureS9: Example of a larger explanation subgraph based on the top-relevant genes "ENSG00000177143" and "ENSG00000111049" (respectively ranked 1 and 4). A path from gene "ENSG00000177143" to gene "ENSG00000111049" is presented. The intermediate nodes that connect these two genes are within the explanation subset returned by the readout layer. Their rank is indicated in the table on the right of the figure. GO functions and Reactome pathways with the highest attention are also displayed. The weights on the edges represent attention scores between each pair of nodes.

Table S1 :

 S1 Description of the TCGA dataset. # indicates the number of samples in each set {train,validation,test}. Meaning of the abbreviations: BRCA (Breast invasive carcinoma), HNSC (Head and Neck squamous cell carcinoma), KIRC (Kidney renal clear cell carcinoma), LGG (Brain Lower Grade Glioma), LIHC (Liver hepatocellular carcinoma), LUAD (Lung adenocarcinoma), LUSC (Lung squamous cell carcinoma), OV (Ovarian serous cystadenocarcinoma), PRAD (Prostate adenocarcinoma), THCA (Thyroid carcinoma), UCEC (Uterine Corpus Endometrial Carcinoma), NT (Normal samples). The data are pre-normalized with FPKM (fragments per kilobase per million mapped reads) and transformed using log 2 .

	A Dataset
	Class	BRCA	HNSC	KIRC	LGG	LIHC	LUAD	LUSC	OV	PRAD	THCA	UCEC	NT	Total
	#train	705	320	344	327	238	341	321	239	318	321	353	309	4136
	#validation	176	80	86	82	59	85	81	60	80	81	88	77	1035
	#test	221	100	108	102	74	107	100	75	100	100	110	96	1293
	Total	1102	500	538	511	371	533	502	374	498	502	551	482	6464
	Class frequency (%)	17.05	7.74	8.32	7.91	5.74	8.25	7.77	5.79	7.71	7.77	8.53	7.46	100
	Database	Size	|V { * ,Ki} | |E { * ,Ki} |		avg(d intra )	|E * i |	#annotated_genes (avg±std/node)
	GO-BP	H=20	14,685		34,047	4.64 ± 17.51	73,580		10,141 (5.01 ± 15.24)
	Reactome (P)	H=12	2,399		2,416		2.01 ± 5.66	29,305		6,763 (12.22 ± 19.86)
	IPP (G)	CC=86	10,947		115,745 21.15 ± 978.59 102,885	10,199 (10.09 ± 13.29)
	Table

Table S5 :

 S5 Top-15 relevant genes returned by the two-sided t-test (p-value=0.05).

		BioHAN	A PREPRINT
	Gene ID	Relevance score
	ENSG00000177143	0.2713
	ENSG00000105428	0.2662
	ENSG00000197683	0.2486
	ENSG00000111049	0.2323
	ENSG00000178928	0.2204
	ENSG00000134249	0.2174
	ENSG00000105507	0.1981
	ENSG00000178257	0.1978
	ENSG00000111241	0.1808
	ENSG00000167139	0.1733
	ENSG00000183310	0.1651
	ENSG00000063601	0.1644
	ENSG00000204548	0.1624
	ENSG00000213218 ENSG00000233816 ENSG00000278057 ENSG00000160882 F T 0.1614 0.1585 0.1536 0.1499 R A Concept ID Description ENSG00000177143 centrin 1 ENSG00000160299 pericentrin ENSG00000196814 multivesicular body subunit 12B ENSG00000156876 SAS-6 centriolar assembly protein D GO:0000278 mitotic cell cycle
	GO:0006289	nucleotide-excision repair
	GO:0007099	centriole replication
	GO:0034605	cellular response to heat
	GO:0051301		cell division
	R-HSA-9613829	chaperone mediated autophagy
	R-HSA-9615710	late endosomal microautophagy
	R-HSA-9646399		aggrephagy
	8 corresponding to phosphodiesterase 11A
	9 corresponding to adenine phosphoribosyltransferase
	10 corresponding to adenylate cyclase 6

Table S6 :

 S6 Description of the biological concepts in the explanation subgraph.

For example, these relations can be extracted from a gene network based on protein-protein relations.

It is equivalent to the relevance score computed by the backpropagation attribution method Gradients×Inputs ?.

This correspondence is admitted by the bioinformatics community.

The models are learned with the Python package Scikit-learn.

The models are learned with the Python package Scikit-learn.

corresponding to centrin 1


I. INTRODUCTION

Learning thrives on data. The recent renewed popularity of Machine Learning (ML) largely owes to the availability of vast training datasets. However, datasets with the required quality are often not available from a single source, and need to be assembled from subsets owned by different organizations that have a variety of access policies and that often grant no access at all to external entities, thus implementing policies that are far more stringent than required by the GDPR (General Data Protection Regulation).

In recent years, Federated Learning (FL) has emerged as a revolutionary privacy-enhancing technology [START_REF] Khan | Federated learning as a privacy solution -an overview[END_REF], apparently able to address the problem of collaborative training. Popularized by Google for privacy-preserving prediction of user keystrokes on smartphones [START_REF] Yang | Applied federated learning: Improving google keyboard query suggestions[END_REF], FL has quickly expanded to other applications [START_REF] Leroy | Federated learning for keyword spotting[END_REF], [START_REF] Ogier Du Terrail | Federated learning for predicting histological response to neoadjuvant chemotherapy in triple-negative breast cancer[END_REF], [START_REF] Kairouz | Advances and open problems in federated learning[END_REF]. Among others, peer-to-peer network-based architectures have been created that eliminate FL's single point of failure by decentralizing AI (Artificial Intelligence) model aggregation [START_REF] Vanhaesebrouck | Decentralized collaborative learning of personalized models over networks[END_REF], [START_REF] Tang | D 2 : Decentralized training over decentralized data[END_REF]; novel algorithms have been developed to ensure convergence of FL's global AI model and to cope with intermittent connectivity of the FL learning nodes in certain applications [START_REF] Woodworth | Graph oracle models, lower bounds, and gaps for parallel stochastic optimization[END_REF].

While FL was originally positioned as a major privacypreserving innovation, further research has cast a shadow of doubt on the strength of privacy protection provided by FL [START_REF] Melis | Exploiting unintended feature leakage in collaborative learning[END_REF]. Potential vulnerabilities and threats pointed out by researchers included a curious aggregator threat [START_REF] Mansouri | Sok: Secure aggregation based on cryptographic schemes for federated learning[END_REF]; susceptibility to man-in-the-middle and insider attacks that disrupt the convergence of global and local models, or cause convergence to fake minima [START_REF] Blanchard | Machine learning with adversaries: Byzantine tolerant gradient descent[END_REF]; and, most importantly, inference attacks that aim to re-identify data subjects from FL's AI model parameter updates [START_REF] Nasr | Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning[END_REF].

In view of the strong privacy protection stance of the European Union, expressed through the CyberSecurity Strategy, the CyberSecurity Act 1 and the GDPR-that stipulates penalties in the amount of 4% of global revenues of noncompliant businesses-these new findings regarding the privacy guarantees provided by FL are worrisome for business managers, and also harmful to the proliferation of FL as a technology that enables GDPR compliance.

A. The TRUMPET project: An Armored FL Framework

The TRUMPET project [START_REF]TRUMPET project[END_REF], [START_REF]CORDIS webpage: TRUMPET project[END_REF] aims at building a multisided, privacy-enhanced, Federated Learning-based platform for the development of dedicated AI applications that will assist (in the use cases selected for the project and described in Section VI) healthcare professionals. Our platform for Armored FL (AFL) will enable AI-powered studies of siloed, multi-site, cross-domain, cross-border European datasets with privacy guarantees that follow the requirements of GDPR.

The key end users are researchers/solution developers (on the demand side), data owners (on the supply side) and healthcare professionals (indirect users of TRUMPET on the application side), as shown in Figure 1.

B. TRUMPET's Main Objectives

The goal of the TRUMPET project is to deliver a highly scalable Federated AI service platform for researchers (see Section II), which will enable AI-powered studies of siloed, multi-site, cross-domain, cross-border European datasets with privacy guarantees that follow the requirements of GDPR.

To this aim, the project will focus on two complementary technical aspects: (1) to research and develop novel privacy enhancement methods tailored for FL (see Section III), and (2) to research, develop and promote with EU data protection authorities a set of novel privacy metrics and a tool for the privacy evaluation of FL implementations (see Section IV).

During the project, we will identify and perform a legal study of the implications of GDPR in FL implementations, which may be applied with further restrictions by different European countries. Our final aim is to identify grey areas, where the use of PET (Privacy Enhancing Technologies) techniques and our novel privacy measurement tool could be applied to help to remove uncertainty on the GDPR compliance of Armored FL (see Section V).

The generic TRUMPET platform will be piloted, demonstrated and validated in the specific use case of European cancer hospitals (see Section VI), allowing researchers and policymakers to extract AI-driven insights from previously inaccessible cross-border, cross-organization cancer data, while ensuring the patients' privacy.

II. THE TRUMPET PLATFORM

High-Level Description: Data Owners (hospitals) keep their datasets private and do not share them directly. Instead, after being given trustworthy privacy guarantees by the TRUMPET platform operator, they install a TRUMPET learning node on their premises and allow it to access the data, so it can be trained and processed on the Data Owner's premises, by a locally executed AI model.

The training of the local model can be performed either continuously or in batches, depending on the application. During training, only the parameters of the resulting model are exchanged with a central node called Federated Model Management (FMM), which is located outside the hospital's premises. The FMM aggregates the local model updates into a global one, and shares it with the TRUMPET nodes, so as to replace the local model updates and continue training if required. This FL process converges to a global model that is constructed from the private datasets of individual Data Owners, but without the data being moved across the boundaries of each Data Owner's premises.

Figure 2 illustrates the flow chain of the TRUMPET platform acting as a privacy-enforcing intermediator. Hospitals keep their data private and do not share them directly. Instead, they install a TRUMPET learning node on their premises and allow it to access the data, so it can be trained and processed on the hospital's premises, by a locally executed AI model. We refer the reader to Section VI for more details on the clinical use cases.

A. Platform Architecture

The TRUMPET platform has a distributed architecture in which: [START_REF]TRUMPET project[END_REF] cloud acts as the facilitator for researchers to build AI models without access to the data. It is worth noting that only descriptive metadata, summary statistics and model updates leave the data owner's premises. Figure 3 details the two main dashboard components of the TRUMPET architecture.

1) Data Owner Dashboard:

The data processing and transformation (ETL; Extract, Transform, Load) service is located at the data owner node. It exposes REST APIs which are used by the hospital's IT team to upload patient datasets privately to the data owner node. Then, each data owner can describe its dataset, define the required privacy level, and also advertise it to external researchers by making use of its data owner control panel. Different versions of the ETL service are envisioned to support several ETL strategies suitable for different healthcare systems. The control panel also provides a dashboard to monitor the different advertised datasets for GDPR transparency, review the model training requests, etc.

Each data owner node will have isolated its user administration and be fully managed by the data owner's IT team. Three user groups are envisioned in the data owner node: (a) Administrator: performs user management, (b) Privacy manager: sets the privacy level of datasets, defines descriptive metadata of datasets, advertises datasets, approves data requests made by external researchers, mainly focusing on aspects related to ethical and data protection, monitors the advertised datasets, and monitors data owner node health, (c) Observer: monitors advertised datasets and monitors data owner node health.

2) Researcher Dashboard: The researcher dashboard will facilitate that researchers can browse advertised datasets, add/remove a dataset to/from favorites, define cohort, get descriptive statistics, train AI models, etc. For example, the model training management service will coordinate model training at data owner nodes, which is done via the agent services acting on behalf of a researcher. First, the researcher will define the code to be executed at the training agent of a data owner node. Afterwards, the code will be reviewed by the data owner and executed on the private dataset. Finally, if the code is approved by the data owner, results of the execution will be returned to the researcher.

We envision to develop a library of pre-approved code that can be executed by the training agent without data owners' intervention. This library of pre-approved code will differ from data owner to data owner, hence reflecting both the data owner's comfort level and dataset requirements. PET methods and privacy budget will be transparently applied to all code execution to prevent data leakage. Finally, the case of descriptive analytics will follow a similar behavior, but without requiring the explicit intervention of the data owner.

B. Data Collection

We will harmonize clinical datasets into a common format and inject them into the TRUMPET private repositories. With the support of technical partners, hospital partners (IRST IRCCS and CHU de Liège) will align their data with a common data model. They will also extract information from databases, data warehouses or other types of data sources that can be shared with the TRUMPET platform to support the three use cases. This data collection will be performed in batch mode (see Figure 4).

There will be no data continuously streamed from the clinical databases to the TRUMPET data owner node. It shall also be understood that only data for those patients matching the inclusion and exclusion criteria of the TRUMPET use cases will be extracted. Moreover, the complete patient record will not be extracted. Only a list of variables needed to support the use cases will be extracted. A detailed description of the three use cases is included in Section VI.

C. Platform Development and Validation

The TRUMPET platform will be validated in three clinical use cases which are detailed in Section VI. In contrast, some more general aspects regarding the development and validation of the TRUMPET platform are included here.

1) Two-Round Pilot Approach: The prototyping and piloting in all use cases will follow an interactive and incremental approach to ensure continuous improvement of the TRUMPET platform throughout the project. The pilot will be divided in two rounds associated to two different milestones. In the first round, an initial-basic prototype will be developed and piloted to get preliminary feedback on the platform features. These first indicators will ensure early identification of needs for further adjustments. They will also facilitate the fine-tuning of the initial prototype during the second round, by making appropriate technical improvements according to the results and potential new requirements elicited in the first round.

2) Independent Penetration Testing: With the aim of fostering trust of data owners in the TRUMPET platform, the project will (1) engage external penetration test experts to validate the privacy protection, and (2) provide a PPT (Privacy Penetration Test) facility for data owners to carry out independent privacypentesting via the TRUMPET platform against their own datasets. The external independent expert will launch attacks against a test dataset in one of the hospitals through the TRUMPET platform. To do this, the expert will be given freedom to use the TRUMPET PPT utility and the Researcher dashboard, having the role of a malicious user of TRUMPET.

3) Characterization of Robustness: Privacy is undoubtedly a critical aspect of the TRUMPET platform, as should always be the case when dealing with sensitive information. However, the robustness of ML-based systems is equally important to establish trust and credibility. To this end, several empirical and formal methods and tools can be used for the test and verification of the desired robustness properties. Some federative platforms [START_REF] Girard-Satabin | Caisar: A platform for characterizing artificial intelligence safety and robustness[END_REF] can serve as a unique entry point for such an effort, seamlessly handling the inner encoding to a set of state-of-the-art tools, as well as the aggregation of their results and the generation into summarizing tables and graphs. This allows to have a characterization of the ML-based system through pre-defined metrics [START_REF] Mattioli | An overview of key trustworthiness attributes and kpis for trusted ml-based systems engineering[END_REF] (e.g., the models are robust within a distance of X around the dataset D) which can support an argumentation of safety to stakeholders and certification bodies. Ultimately, a TRUMPET platform that is both privacy-aware and robust is crucial for building trust, which is essential for its success.

III. PRIVACY ENHANCING TECHNOLOGIES FOR AFL

The field of Privacy Enhancing Technologies (PETs) has evolved rapidly in recent years, providing increasingly efficient and feasible solutions to the problem of securely processing and sharing sensitive private data. This has resulted in a diverse set of PET flavors [START_REF]UN Handbook on Privacy-Preserving Computation Techniques[END_REF], where the choice of a specific technique for a particular use case depends on the available resources and the privacy problem to be addressed. Unfortunately, significant obstacles still exist that limit the adoption of PETs in general applications. The obstacles vary from degradation of utility of data, to high computational and communication costs.

The TRUMPET project aims at the application of the most appropiate PET methods for the protection of both exchanged model udpates and the execution of central aggregation. To this end, TRUMPET will study how the performance tradeoffs of baseline PETs improve when tailoring them to the FL setting. This research will take into account several relevant parameters, such as the accuracy/privacy [START_REF] Geyer | Differentially private federated learning: A client level perspective[END_REF] tradeoff, security assumptions [START_REF] Chase | Security of homomorphic encryption[END_REF], computational/communication costs and scalability [START_REF] Cabrero-Holgueras | Sok: Privacy-preserving computation techniques for deep learning[END_REF].

The developed methods will be validated in realistic scenarios, thus demonstrating their advantages and limitations and opening new paths for research. Moreover, while many current approaches assume the honest-but-curious attacker threat model, the semi-honest assumption does not always hold in the real world. Beside the expected progress in FL-tailored PETs, we will also improve security by accounting for stronger dishonest parties (aggregators, learning nodes) taking part in FL settings.

A. PET methods in TRUMPET

As it has been already discussed, FL was originally presented as a privacy-preserving technique enabling the training of models on decentralized data sources without needing to transfer the data to a central server. Unfortunately, it has been proven that FL is vulnerable to several inference attacks related to the exposition of the model updates exchanged during training. To ensure resilience to membership inference and attribute leakage attacks, the TRUMPET platform will deploy the most appropriate combination of PETs depending on a number of factors, such as the selected AI model, FL aggregation algorithm, training dataset and the dataset under analysis, as well as scalability and accuracy/performance requirements of the use cases (see Section VI).

The following provides a short description of the most relevant PETs in the context of the TRUMPET project:

1) Homomorphic Encryption (HE): It allows for computation directly on encrypted data [START_REF] Chase | Security of homomorphic encryption[END_REF]. While it provides input privacy for the model updates, it also presents a higher computational cost than other PET techniques. It requires the use of other primitives (e.g., Zero-Knowledge Proofs or ZKPs) to upgrade the security model against stronger adversaries.

2) Secure Multi-Party Computation (SMPC): It allows a group of parties to jointly compute a function while keeping the parties' inputs secret. In general, many SMPC solutions [START_REF] Evans | A pragmatic introduction to secure multi-party computation[END_REF], like for example those based on the use of Secret Sharing [START_REF] Damgård | Practical covertly secure MPC for dishonest majority -or: Breaking the SPDZ limits[END_REF], present a lower computational cost than HE, but usually require a higher number of communication rounds. There is a wide list of different techniques under the label of SMPC (e.g., Secret Sharing, ZKPs, etc).

3) Differential Privacy (DP): It offers statistical privacy guarantees by adding noise to attributes of individual data records before sharing them. While it provides the lowest computational overhead among all the PETs mentioned here, DP [START_REF] Dwork | Differential privacy[END_REF] entails a tradeoff between privacy level and utility.

4) Coded Distributed Computing (CDC): It is a combination of distributed computing and coding theoretic techniques that enables the distributed computation of a function in the coded domain while keeping the inputs private [START_REF] Ng | A survey of coded distributed computing[END_REF], [START_REF] Ulukus | Private retrieval, computing and learning: Recent progress and future challenges[END_REF].

IV. A TOOL FOR THE VALIDATION OF FL PRIVACY

The TRUMPET project looks at privacy from two complementary points of view. First, we consider statistical privacy as a technological means to avoid information leaking from a computation. Second, we consider privacy from a GDPR point of view. In this last case, we aim at making a connection between the legal GDPR requirements and the statistical requirements, which would help to better fulfill the first type of legal requirements.

A. FL-tailored Privacy Metrics

While Differential Privacy (DP) [START_REF] Dwork | The Algorithmic Foundations of Differential Privacy[END_REF] has become a gold standard notion for statistical privacy in the field of machine learning, it is a brute force notion. Here, by brute force we mean that it requires to hide secrets with so much noise, that it provides protection under the most reasonable threat model. However, in several use cases, such as in medicine, where precision is important and patient data is expensive, it may not provide the best balance between privacy and utility. Moreover, in FL settings where next to privacy there are security risks, the threat models considered by cryptographic approaches often assume a less strong adversary compared to the one of DP. It is usually good to have all components of a system making consistent and equivalent assumptions.

Frameworks such as the one of Pufferfish privacy [START_REF] Kifer | Pufferfish: A framework for mathematical privacy definitions[END_REF] offer more opportunity for fine grained modeling, but task the user with deriving all privacy guarantees by himself.

In the TRUMPET project, we will develop statistical privacy metrics: (1) making more fine-grained assumptions, and not only (2) consistent with the other TRUMPET platform components, but also (3) appropriate for our setting in which a limited number of larger, known entities, that can be kept liable for deviation from the protocol, collaborate to train a statistical model on federated data.

In the learning scenario, the proposed privacy metrics will rely on statistically modeling the prior knowledge (or, rather, the uncertainty) that the adversary has regarding the target training datasets. In particular, these metrics will quantify how much knowledge the adversary may gain upon observing the exchanged data in each interaction. This Bayesian approach deviates from the worst-case adversary considered in DP, and is conceptually more aligned with concepts like distributional privacy [START_REF] Blum | A learning theory approach to non-interactive database privacy[END_REF] and Pufferfish privacy [START_REF] Kifer | Pufferfish: A framework for mathematical privacy definitions[END_REF]. One advantage of these metrics, besides providing higher utility, is the availability of many information-theoretic results that can be almost directly imported. Another advantage is that its formulation is closer to practical attacks that account for the adversary's uncertainty through sampling a dataset that is assumed to be statistically similar to (i.e. partially overlaps) the target dataset [START_REF] Nasr | Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning[END_REF], [START_REF] Carlini | Membership inference attacks from first principles[END_REF].

B. A Tool to Measure TRUMPET Privacy

Having a definition of a privacy metric does not lead easily to being able to actually measure privacy according to that metric. For example, there is a vast literature considering specific algorithms in isolation and studying their privacy guarantees, but far less attention has been paid to the setting where a researcher interacts with a federated data set and decides on the next query after having seen the answer to the previous one. In order to address this issue, TRUMPET will develop a tool that keeps track of the privacy budget a researcher has used so far. By doing so, we aim at not only using the classic composition rules, which have been studied for differential privacy, but also to let the tool look more intelligently at the queries, searching for tighter upper bounds of the actual privacy budget consumed.

In the FL scenario, it is often the case that the Data Owners also interact with the Aggregator through the exchange of updates of the model that is being learned. Each of these updates potentially leaks information regarding the contents of the training dataset available at each Data Owner. The availability of a privacy budget and, more importantly, a practical way of measuring how much information has been leaked becomes crucial in such an interactive scenario: on the one hand, it may serve to establish to which extent the exchanged data must be protected/obfuscated by PET methods; on the other hand, it may lead to hard rules on the federation, for example, by preventing a Data Owner from submitting further updates whenever the budget limit has been reached.

V. GDPR COMPLIANCE OF AFL

Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) applies to any processing of personal data, including the training of machine learning (ML) algorithms on data relating to identifiable individuals. Federated learning (FL) has gained recent popularity as a privacy-preserving technology that can help ML solutions achieve GDPR compliance due to its capability to train algorithms on various datasets without the transfer of any personal data. As data never leaves its source and is not collected in a central location, FL solutions can be used to ensure better security for personal data. This was recently highlighted by ENISA, which confirmed that FL can help preserve the privacy of data and protect against the unauthorized disclosure of sensitive data [START_REF] Enisa | Securing Machine Learning Algorithms[END_REF]. In addition, FL architectures are considered to facilitate compliance by design with the data protection principles of data minimization and storage limitation [START_REF] Rossello | Data Protection by design in AI?[END_REF], [START_REF]Report on Artificial intelligence and privacy[END_REF]. In other words, they can help ensure that only relevant, adequate and necessary personal data is processed, and kept for as little time as possible.

FL can therefore be used as a technical measure to achieve compliance with the principles of data security and data minimization. The use of FL alone, however, is not sufficient to ensure that the data processing is GDPR compliant. First of all, FL can be susceptible to a number of privacy and security challenges, including man-in-the-middle and insider attacks, and most importantly, inference attacks that aim to re-identify data subjects from FL's AI model parameter updates. The AFL methods TRUMPET will develop combining FL with other PETs are therefore crucial for reducing the risk of reidentification of data subjects (see Sections III and IV).

Second, while AFL methods are essential for ensuring data privacy and security, data controllers using the TRUMPET AFL platform remain responsible for ensuring compliance with all GDPR principles. In particular, they should implement measures to prevent any unfair or arbitrary treatment of data subjects, including by performing Data Protection Impact Assessments (DPIAs) to assess any risks for the data subjects. Data owners should ensure that in cases where previously collected personal data are re-used for training ML models, the new purpose for which they are processing those data is compatible with the original one. Additionally, they are responsible for determining the lawful basis for secondary data processing and demonstrating compliance with all GDPR principles and requirements.

VI. RESEARCH WITH DISTRIBUTED CLINICAL DATA

The AFL-based TRUMPET platform will give the possibility for researchers to develop statistical AI models from distributed clinical datasets, while providing strong privacy guarantees and without transferring data out of each hospital's infrastructure. We will consider three different clinical use cases to demonstrate the capability of the TRUMPET platform in the field of cancer treatment and diagnosis.

A. Use Cases' Description 1) Non-small Cell Lung Cancer (NSCLC) Use Case: It is the primary cause of cancer-related death worldwide. Patients with advanced non-oncogene addicted disease usually benefit from treatment with immune checkpoint inhibitors (ICIs), which are able to reactivate the repressed immune response against tumor cells. However, only a portion of patients achieves durable clinical benefit from these treatment approaches [START_REF] Vanguri | Multimodal integration of radiology, pathology and genomics for prediction of response to PD-(L)1 blockade in patients with non-small cell lung cancer[END_REF].

2) Stereotactic Body Radiation Therapy (SBRT) Use Case: For some cancers, surgery remains a mainstay in the treatment of solitary metastases. However, for patients with metastasis unresectable by surgery, SBRT is increasingly used as an ablative treatment option. Although at present there are several studies investigating the utility of SBRT in the treatment of metastatic disease, currently, limited guidelines allow to determine which patients could really benefit from it [START_REF] Ramadan | Impact of stereotactic body radiotherapy (sbrt) in oligoprogressive metastatic disease[END_REF].

3) Head and Neck Cancer (HNC) Use Case: Despite the therapeutic goals of RT (Radiation Therapy) as a potentially curative treatment in HNC, toxicity is commonly seen. Patients undergoing radiation therapy for HNC can experience significant early and long-term side effects. We hypothesize that a systemic assessment of late side effects against planned dosevolume histograms and RT fractions regimen could generate new knowledge to further optimize treatment planning in HNC [START_REF] Siddiqui | Management of radiation toxicity in head and neck cancers[END_REF].

B. Secondary TRUMPET objectives

In particular, several secondary TRUMPET objectives have been established in relation to each of these use cases:

• Non-small cell lung cancer (NSCLC) use case: We intend to integrate clinical, biological and radiological data of NSCLC patients treated with immunotherapy to find an algorithm predictive of patient's prognosis. • Stereotactic body radiotherapy (SBRT) use case: We intend to develop a classifier predicting the survival probability over 6 months, hence obtaining one criteria for the eligibility to SBRT treatment. Specifically, the model should answer the two following questions:

-What is the probability for a patient X to survive more than 4 or 6 months? -What is the estimated survival period of patient X?

• Head and neck cancer (HNC) use case: We intend to identify causality relationships between the radiotherapy treatment plan and its delivery towards late side effects in Head and Neck cancer.

C. Ethical Aspects of the Clinical Use Cases

The main ethical aspects of the TRUMPET project relate to the use of retrospective patient health data for the three TRUMPET platform use cases. The required ethical approval actions for the use of patient health data are being prepared and performed by IRST IRCCS and CHU de Liège before starting work on any of the above described use cases. In order to address and mitigate potential risks for data subjects stemming from the secondary use of data within TRUMPET, a Data Protection Impact Assessment (DPIA) will be performed, and the necessary technical and organisational measures (such as de-identification and encryption of personal data) will be implemented throughout the project to ensure the security of patient data and compliance with data protection requirements. See Section V for more details on the compliance of the TRUMPET platform with GDPR principles.

VII. SOME CONCLUSIONS AND EXPECTED RESULTS

This work has given an overview of the scope and main technical aspects of the EU-funded project TRUMPET:

• The main objective is to provide a highly scalable FLbased service platform for researchers. • The TRUMPET platform will allow to perform collaborative studies with cross-border European datasets and with privacy guarantees that follow GDPR requirements. • Two concrete technical objectives: (1) research and development of FL-tailored PET methods, and (2) research and development of a set of novel privacy metrics and a tool for the privacy evaluation of FL implementations. • Identify and perform a legal study of the implications of GDPR in FL implementations. Moreover, even if the GDPR is an European regulation, different European countries may apply further restrictions. TRUMPET will necessarily take this into account in the legal study. • The project will engage external penetration test experts to validate the privacy protection, and provide a facility for data owners to do independent privacy-pentesting. • The use cases cover major unmet clinical needs in treatment and diagnosis of cancer. They emphasize different points of view over the cohorts, either from a disease perspective or from a treatment modality perspective.

Thanks to the federated nature of the platform and its privacy metric, the pilots will demonstrate the benefits of Armored FL to streamlining clinical and epidemiological research processes across the EU, while ensuring compliance to the GDPR and national data privacy laws.

Fig. 1 .

 1 Fig. 1. TRUMPET and its direct and indirect users.

Fig. 2 .

 2 Fig. 2. High-level description of the TRUMPET flow chain.

Fig. 3 .

 3 Fig. 3. High-level view of the TRUMPET platform architecture.

Fig. 4 .

 4 Fig. 4. Process to harmonize clinical data under a common format.

  patient data resides in a data owner node located inside the hospital's premises, and (2) the central TRUMPET figure has been made using images from www.flaticon.com and www.stockio.com.

		Federated Model Management (FMM)
			Aggregated Model
	Aggregated	Aggregation		Aggregated
	Models	Model Updates		Model Updates	Models
		Model Updates	Aggregated Models
	Data Owner node	Data Owner node	Data Owner node
		Data Owners	Data Owners	Data Owners
		(Hospitals)	(Hospitals)	(Hospitals)
	Model Update	Model Update		Model Update
	Private Data	Private Data		Private Data

This

https://digital-strategy.ec.europa.eu/en/policies/cybersecurity-act.

ACKNOWLEDGMENT

Trumpet project was funded by the European Union with grant agreement Nr.101070038.

Views and opinions expressed are however those of the authors only and do not necessarily reflect those of the European Union. Neither the European Union nor the granting authority can be held responsible for them.