Federated Bayesian Surveillance of Mechanical Thrombectomy Adverse Events: A Population Risk Layer for Surgical Digital Twins

Federated Bayesian Surveillance of Mechanical Thrombectomy Adverse Events: A Population Risk Layer for Surgical Digital Twins Damini Rijhwani

arXiv:2610.08464v1 [cs.CR] 6 Oct 2026

Automation Core Inc., Cambridge, MA, USA damini@automationcoreinc.com ORCID: 0009-0000-2253-6111 Abstract—Learned surgical simulators and world models can roll out plausible procedural futures, but they carry no grounded estimate of how often interventional devices actually harm patients. We propose treating population-scale adverse-event surveillance as a distinct belief layer of the surgical digital twin, and we evaluate a federated Bayesian protocol for learning it under formal privacy guarantees. Each site holds perclass Gamma-Poisson posteriors over adverse-event rates and exchanges only Rényi-differentially-private natural-parameter updates. We benchmark on the complete FDA MAUDE cohort for thrombus-retrieval catheters (product code NRY): 8,617 reports, of which 6,491 are classified by transparent keyword rules into five thrombectomy complication classes and partitioned across K=8 manufacturer sites. At a matched privacy budget of (ε≈2.09, δ=10−5 ), the conjugate protocol attains a held-out Poisson score of −5.78 per test event versus −26.58 for FedAvg with differential privacy. The non-private federated model also outperforms centralized pooling (+3.19 vs +2.93), evidence that manufacturer-specific complication profiles are real and that federation preserves them. Because MAUDE lacks procedure denominators, outputs are relative rate orderings rather than absolute risks, and we report all privacy-utility operating points. Index Terms—surgical digital twin, adverse-event surveillance, federated learning, differential privacy, mechanical thrombectomy, Bayesian inference

I. I NTRODUCTION Surgical robotics is increasingly adopting world models, using learned simulators to predict action outcomes before execution. World foundation models now evaluate surgical robot policies in silico [1], digital twins are proposed to ground foundation models in operating rooms [2], [3], and surgical digital twin research is developing rapidly [4]. Endovascular intervention, especially mechanical thrombectomy, is a primary target of this effort. These systems share a clear blind spot. A learned simulator can predict that a retriever will deform a vessel, but cannot estimate how often retrievers of that class perforate vessels in clinical practice, since that information resides in fragmented, sensitive post-market records rather than surgical video. Realworld failure statistics for thrombectomy devices exist in scattered form: registry studies of the FDA Manufacturer and User Facility Device Experience (MAUDE) database document device-specific complication patterns in peripheral and pulmonary procedures [5], [6], with reproducibility remaining an active concern [7]. Individual hospitals rarely see enough

events to estimate rates reliably, and procedural records cannot be centralized. We propose that surgical digital twins require a distinct population risk layer: calibrated beliefs over adverse-event rates by device class and complication type, learned across institutions without transferring raw records, to condition perprocedure simulations. This paper introduces this layer and evaluates it on real public data: 1) A federated Bayesian surveillance protocol. Sites maintain per-class Gamma-Poisson posteriors and exchange only Rényi-differentially-private (RDP) naturalparameter updates of dimension 2Z per round. Conjugacy reduces each update to a two-scalar sufficient statistic per class instead of a gradient. 2) A thrombectomy benchmark from complete public data. We provide the recipe for a manufacturer-federated partition of the complete MAUDE cohort for thrombusretrieval catheters: 8,617 reports, with 6,491 classified into five complication classes across major thrombectomy manufacturers. 3) Evidence that federation preserves manufacturer heterogeneity. The federated per-site model outperforms centralized pooling even in the absence of privacy noise, indicating that complication profiles differ across device makers, a structure that pooled models erase. Scope. This paper evaluates population-level rate estimation on public surveillance data. It does not evaluate per-procedure simulation, device control, or clinical decision-making, and its outputs are not evidence of comparative device safety. II. F EDERATED BAYESIAN R ISK P ROTOCOL A. Rate model For complication class z ∈ {1, . . . , Z} at site k, the event count over exposure nz,k is modeled as conditionally Poisson with latent rate θz : yz,k | θz ∼ Poi(nz,k θz ),

θz ∼ Gam(αz,0 , βz,0 ).

(1)

The posterior update is conjugate: with natural parameter ηz = (αz − 1, −βz )⊤ , a site’s contribution is the sufficient statistic ∆ηz,k = (yz,k , −nz,k )⊤ , and the global posterior is the prior plus the sum of site contributions: PK ηzglobal = ηzprior + k=1 ∆ηz,k . (2)

TABLE I H ELD - OUT P OISSON SCORE PER TEST EVENT ON THE MAUDE THROMBECTOMY FEDERATION (K=8, Z=5, 10 SEEDS , 95% BOOTSTRAP CI). H IGHER IS BETTER ; ONLY DIFFERENCES ARE INTERPRETABLE .

B. Privacy and communication

Method

Privacy

Score

Centralized (pooled Gamma) FedAvg FedProx SCAFFOLD FedPA FedAvg+DP

none none none none none ε≈2.09

+2.93 [+2.91, +2.94] −26.58 [−26.58, −26.58] −26.58 [−26.58, −26.58] −26.58 [−26.58, −26.58] −26.58 [−26.58, −26.58] −26.58 [−26.58, −26.58]

Federated conjugate, non-private Federated conjugate, σ=6 Federated conjugate, σ=12 Federated conjugate, σ=24 Federated conjugate, σ=48 Federated conjugate, σ=96

none ε≈21.55 ε≈9.39 ε≈4.35 ε≈2.09 ε≈1.02

+3.19 [+3.17, +3.21] +0.47 [−0.14, +1.08] −1.16 [−1.64, −0.69] −2.69 [−3.31, −2.02] −5.78 [−6.72, −4.91] −8.43 [−10.26, −6.68]

Each round, every site clips its update to norm C, adds Gaussian noise N (0, σ 2 I/K), and transmits under pairwisemasking secure aggregation [10], ensuring the server observes only the noised sum. Sensitivity is bounded by the eventlevel neighboring relation: one report perturbs one class count while exposure windows remain fixed, so ∥∆η∥2 ≤ 1 ≤ C. Privacy is tracked in RDP [11] with additive composition over T rounds and conversion to (ε, δ) [12]; sufficient-statistic perturbation for conjugate models follows [13]. Per-round communication requires 2Z scalars per site, independent of cohort size, unlike gradient-based federated methods [14], [15], [16]. In our experiments, each round releases the statistic of an independent Bernoulli-subsampled batch (fraction 1/20) over T =200 rounds. Counts and exposures accumulate together, so posterior means remain unbiased, and the evaluation below depends only on posterior means. Accumulated precision would overstate effective sample size by T /20 and must be renormalized before interpreting posterior widths. The accountant charges every release and claims no subsampling amplification. III. T HE MAUDE T HROMBECTOMY B ENCHMARK A. Cohort and classification We retrieved the complete openFDA MAUDE cohort for product code NRY (catheter, thrombus retriever): 8,617 reports through August 2026, queried by authoritative product code with full pagination and archived query manifests. Report narratives are categorized by transparent, severityordered keyword rules into Z=5 classes: vessel perforation or dissection (1,293), hemorrhage (1,706), distal embolization (307), device fracture or detachment (2,806), and failure to retrieve or track (379), with 6,491 reports matching at least one class. Sites represent the top K−1=7 manufacturers by classified report volume, capturing the major thrombectomy vendors (Penumbra, Micro Therapeutics/ev3, Neuravi, Concentric Medical, Covidien, Stryker Neurovascular), plus an OTHER site (K=8). Exposure nz,k is the site reporting-year span, and 20% of events per site are held out. Estimand. MAUDE is voluntary surveillance lacking procedure denominators. Fitted rates represent events per reportingyear; outputs are relative rate orderings across classes and sites rather than absolute complication probabilities, and reporting propensities vary across manufacturers. B. Baselines and metric We compare against centralized pooled Gamma estimation, FedAvg, FedAvg with DP-SGD-style noise, FedProx, SCAFFOLD, and FedPA, all optimizing the √ same interceptonly Poisson objective, with T =200, C= 2, δ=10−5 , and

posterior rate (events / reporting-year)

This estimator family extends the Bayesian shrinkage framework of pharmacovigilance signal detection [8], [9] to a multisite setting where no party inspects the pooled table.

102

Penumbra

ev3

Neuravi

Concentric

101

100 perforation/ hemorrhage distal device dissection embolization fracture

failure to retrieve

Fig. 1. Per-class Gamma posterior rate intervals (95%) for the four largest manufacturer sites, non-private fit, flat prior. Rates are events per reportingyear from voluntary reports: relative orderings under differing reporting propensities, not evidence of comparative device safety. Profiles differ markedly across manufacturers, which is the heterogeneity that pooling erases.

σ ∈ {6, 12, 24, 48, 96}. The metric is the unnormalized heldout Poisson log-likelihood per test event (higher is better); only differences across methods are interpretable. Results are reported as means over 10 seeds with 95% bootstrap confidence intervals. IV. R ESULTS AND D ISCUSSION Conjugate updates outperform gradient federation at matched privacy. At (ε≈2.09, δ=10−5 ), the conjugate protocol scores −5.78 versus −26.58 for FedAvg+DP (Table I). Gradient baselines fail to move from their initialization on this objective; all five gradient rows, private and non-private alike, remain at −26.58 with degenerate confidence intervals. Because no learning-rate search was performed, these rows represent an unoptimized floor rather than tuned competitors. The supported claim is that closed-form sufficient-statistic exchange outperforms gradient optimization for this model class on these data, not that it surpasses well-tuned federated systems.

Manufacturer heterogeneity is genuine, and federation preserves it. The non-private federated model outperforms centralized pooling (+3.19 vs +2.93), and Fig. 1 illustrates why. Pooling assumes a single complication profile for all devices; the data contradict this, aligning with the clinical distinction between aspiration and stent-retriever mechanisms and with device-specific MAUDE findings [5], [6]. This inverts the typical framing: federation here is not a privacyconstrained compromise of a centralized ideal, but the betterspecified model. Privacy-utility frontier. Utility decreases monotonically with added noise, from +0.47 at ε≈21.55 to −8.43 at ε≈1.02. We report all operating points so deployments can select target budgets explicitly. Limitations. MAUDE is voluntary and under-reports true incidence; reporting propensities vary by manufacturer and over time, and MAUDE query reproducibility is a recognized challenge [7]. Keyword classification is transparent but coarse: 25% of reports match no class, and narrative quality varies. The privacy guarantee operates at the event level, assuming an honest-but-curious server without collusion. The evaluation scores per-site posteriors; practical deployment would require formal data-use agreements and prospective calibration assessments at the chosen operating budget. V. T OWARD P ROCEDURAL B ELIEF -S TATE T WINS The population layer examined here supplies priors rather than procedural dynamics. A natural extension is coupling this layer with a per-procedure belief-state twin: posterior rate beliefs conditioned on device class initialize the risk state of an intra-operative world model, which updates from sparse observations (such as pulsed fluoroscopy) and evaluates posterior-predictive risk for candidate actions before execution. That direction, aligned with twin-grounded foundation-model control [2], [1], remains future work; this paper provides the underlying population layer learned across institutions under formal privacy guarantees. Code and data. The benchmark recipe, classification rules, and protocol implementation will be released upon publication; all data are public (openFDA MAUDE) [17]. R EFERENCES [1] L. Zbinden, N. Nelson, J.-T. Chen et al., “Cosmos-surg-dvrk: World foundation model-based automated online evaluation of surgical robot policy learning,” arXiv:2510.16240, 2025. [2] Y. Shen, H. Ding, L. Seenivasan et al., “Position: Foundation models need digital twin representations,” arXiv:2505.03798, 2025. [3] H. Ding, L. Seenivasan, H. Shu et al., “Towards robust surgical automation via digital twin representations from foundation models,” arXiv:2409.13107, 2024. [4] A. S. Khan, F. Fan, D. D. Kim et al., “A comprehensive survey on surgical digital twin,” arXiv:2512.00019, 2025. [5] Y. Ahmad, T. Jacobsen, S. Anthony et al., “Adverse events associated with mechanical thrombectomy devices in peripheral interventions,” Journal of Vascular and Interventional Radiology, vol. 35, no. 6, pp. 921–924.e2, 2024. [6] B. E. Warren, K. T. Tan, A. Jaberi et al., “Procedure-related mortality in aspiration thrombectomy for pulmonary embolism: A MAUDE database analysis,” Journal of Endovascular Therapy, vol. 33, no. 3, pp. 1053– 1058, 2026.

[7] X. Li, Y. Feng, Y. Gong, and Y. Chen, “Assessing the reproducibility of research based on the FDA manufacturer and user facility device experience data,” Journal of Patient Safety, vol. 20, no. 5, pp. e45–e58, 2024. [8] W. DuMouchel, “Bayesian data mining in large frequency tables, with an application to the FDA spontaneous reporting system,” The American Statistician, vol. 53, no. 3, pp. 177–190, 1999. [9] A. Bate, M. Lindquist, I. R. Edwards et al., “A Bayesian neural network method for adverse drug reaction signal generation,” European Journal of Clinical Pharmacology, vol. 54, no. 4, pp. 315–321, 1998. [10] K. Bonawitz, V. Ivanov, B. Kreuter et al., “Practical secure aggregation for privacy-preserving machine learning,” in Proc. ACM CCS, 2017. [11] I. Mironov, “Rényi differential privacy,” in Proc. IEEE CSF, 2017, pp. 263–275. [12] C. Dwork and A. Roth, “The algorithmic foundations of differential privacy,” Foundations and Trends in Theoretical Computer Science, vol. 9, no. 3-4, pp. 211–407, 2014. [13] M. A. Heikkilä, E. Lagerspetz, S. Kaski, K. Shimizu, S. Tarkoma, and A. Honkela, “Differentially private Bayesian learning on distributed data,” in Advances in Neural Information Processing Systems (NeurIPS), 2017. [14] H. B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” in Proc. AISTATS, 2017, pp. 1273–1282. [15] M. Abadi, A. Chu, I. Goodfellow et al., “Deep learning with differential privacy,” in Proc. ACM CCS, 2016, pp. 308–318. [16] P. Kairouz, H. B. McMahan, B. Avent et al., “Advances and open problems in federated learning,” Foundations and Trends in Machine Learning, vol. 14, no. 1-2, pp. 1–210, 2021. [17] U.S. Food and Drug Administration, “Manufacturer and user facility device experience (MAUDE) database,” Product codes LMH and LZN (dermal filler), 2015–2024, https://www.accessdata.fda.gov/scripts/cdrh/ cfdocs/cfmaude/, 2024.

Related documents

• Federated Bayesian Surveillance of Mechanical Thrombectomy Adverse Events: A Population Risk Layer for Surgical Digital Twins#1218199
• From digital control to digital twins in medicine: A brief review and future perspectives#460986
• Mitigating fraud in a fully decentralized clinical trial of a digital health intervention.#305169
• The Potential of Digital Twins for Pediatric Rare Diseases.#156924
• Design for a Digital Twin in Clinical Patient Care#131318