Federated multimodal learning for privacy-preserving blood donor profiling and personalized recall strategy optimization

Abstract

Blood supply shortages remain a persistent challenge for transfusion services, yet effective donor recall is hampered by fragmented data across institutions, limited profiling depth, and increasing privacy regulations. This paper proposes a federated multimodal learning framework that enables distributed blood centers to collaboratively train a shared donor profiling model without exchanging raw records. The framework integrates three modality-specific encoders — for demographic attributes, behavioral donation sequences, and textual feedback — unified through a cross-modal attention mechanism with adaptive gating. Differential privacy is embedded into the federated training pipeline via local gradient clipping and calibrated Gaussian noise injection, with cumulative privacy expenditure tracked through a moments accountant. Building on the fused donor embeddings, a multi-task recall optimization model jointly predicts optimal contact timing and communication channel, while a hierarchical clustering scheme translates predictions into tiered intervention protocols. Experiments on 127,463 donor records partitioned across six simulated blood centers demonstrate that the proposed method achieves a profiling F1 score of 83.7% and a recall conversion rate of 31.2%, approaching centralized performance within approximately 2% points. Ablation analysis confirms that the behavioral sequence modality contributes the strongest discriminative signal, while cross-modal attention yields a 4.3-point F1 improvement over naive concatenation. The privacy-utility tradeoff analysis identifies an operating range of ε ∈ [1.0, 4.0] that preserves over 93% of noise-free model utility, offering practitioners a principled basis for balancing data protection with operational effectiveness.

Supplementary Information

The online version contains supplementary material available at 10.1038/s41598-026-51183-w.

Introduction

Maintaining an adequate and stable blood supply is foundational to modern healthcare, yet the gap between clinical demand and actual availability has proven stubbornly difficult to close. Transfusion services across the globe face this tension in varying degrees, and the situation in China is particularly instructive. Seasonal troughs—most pronounced during winter and summer—tend to overlap with peak surgical caseloads, generating supply-demand mismatches that directly endanger patient outcomes¹. The problem, however, runs deeper than seasonal cycles. Collection infrastructure clusters disproportionately in urban cores, leaving rural and semi-urban communities with chronic shortfalls, and the donor base tilts heavily toward younger age groups whose long-term retention has been discouraging². Faced with these compounding pressures, blood service authorities have begun moving away from passive, broadcast-style recruitment and toward data-driven recall strategies that specifically target lapsed or eligible repeat donors.

Conventional recall approaches, unfortunately, carry well-known weaknesses. Most blood centers function as informationally isolated units; each maintains its own donor database, and jurisdictional or regulatory barriers make merging or cross-referencing these records impractical³. This fragmentation—what practitioners commonly call the “data silo” problem—sharply curtails any institution’s ability to assemble comprehensive donor profiles that capture behavioral patterns across organizational boundaries. Privacy concerns compound the difficulty: pooling sensitive health and behavioral data in a single repository opens donors to non-trivial re-identification risks, a vulnerability that standard anonymization methods only partially address⁴. On top of these structural barriers, most profiling pipelines draw on a narrow slice of available information—mainly demographic fields and donation-history counts—while ignoring richer signals buried in communication logs, survey responses, and spatiotemporal movement records⁵. Profiles built on such a limited feature set inevitably produce recall campaigns that lack the precision needed for genuine personalization.

Several recent developments, viewed collectively, suggest that a more capable paradigm is within reach. Federated learning—conceived originally to let multiple parties train a joint model without sharing raw data—has matured quickly and now sees active deployment in healthcare settings as diverse as electronic health record analytics and medical image segmentation⁶. When differential privacy is layered on top of a federated architecture, the combination provides formal mathematical guarantees against inference attacks on individual contributions, which goes a long way toward building trust among institutional participants⁷. Concurrently, multimodal data fusion has delivered notable performance gains in recommendation systems and user modeling by jointly mining textual, categorical, and sequential data streams⁸. Within blood transfusion research specifically, machine learning has been applied to forecast donation intervals, flag high-risk lapse cohorts, and gauge individual willingness to donate under different contextual conditions⁹. Personalized recommendation engines rooted in collaborative filtering and deep sequential architectures have likewise been repurposed for health behavior nudging, with early results that look promising¹⁰.

Despite this momentum, a conspicuous gap remains at the intersection of privacy-preserving collaboration and multidimensional donor characterization. The majority of federated learning studies in healthcare have concentrated on single-modality clinical data, leaving the heterogeneous and institution-specific feature spaces typical of blood donation ecosystems largely unaddressed¹¹. Multimodal donor profiling efforts, on the other hand, generally presuppose centralized data access and therefore do not translate straightforwardly into federated environments where communication budgets and privacy constraints introduce additional architectural demands¹². The handful of studies that have tried to bridge these two streams have mostly stopped at the conceptual level, offering neither rigorous algorithmic formulations nor empirical evidence grounded in realistic blood service datasets¹³. A clear need exists, then, for research that simultaneously tackles cross-institutional privacy collaboration and expressive, multi-source donor representation within one coherent analytical framework.

The present study addresses this need by putting forward a federated multimodal learning architecture designed expressly for privacy-preserving blood donor profiling and recall optimization. At its core, our work rests on the premise that truly effective recall requires donor portraits capturing not just static demographics but also dynamic behavioral trajectories, psychological engagement cues, and contextual environmental factors—and that building such portraits should never come at the cost of individual privacy. On the theoretical side, we extend federated optimization theory to handle heterogeneous modality alignment across decentralized nodes, yielding fresh insights into convergence behavior when gradient noise varies by modality. On the practical side, the framework offers blood service organizations a concrete path toward collaborative intelligence: participating institutions can tap into a richer shared model while retaining full custody over their local data assets.

The remainder of this paper is organized around four interconnected research components. First, we design a federated multimodal fusion framework that enables distributed blood centers to collaboratively train a shared donor representation model without transmitting raw records. Second, we integrate a differential privacy enhancement mechanism into the federated training pipeline, calibrating noise injection to balance privacy guarantees against model utility in a principled manner. Third, we develop a multi-granularity donor profiling method that fuses demographic, behavioral, and engagement modalities into a unified embedding space, capturing both long-term preference structures and short-term state transitions. Fourth, we formulate a personalized recall strategy optimization model that maps donor profiles to tailored intervention actions — including channel selection, message framing, and timing — via a constrained policy learning approach¹⁴. The principal contributions of this work lie in three areas: the introduction of a modality-aware federated aggregation scheme that respects cross-institutional feature heterogeneity, the co-design of differential privacy budgets with multimodal representation quality, and the end-to-end integration of privacy-preserving profiling with recall policy optimization in a unified system. Together, these contributions advance the state of the art in both federated health analytics and blood service management, offering a replicable template for privacy-conscious, data-rich donor engagement.

Federated learning and privacy protection mechanisms

At its core, federated learning allows multiple data holders to train a shared model collaboratively while each participant keeps its raw data strictly local¹⁵. Three canonical paradigms have crystallized over the past several years: horizontal federated learning, in which participants share the same feature space but hold different sample populations; vertical federated learning, where overlapping users carry complementary feature sets across institutions; and federated transfer learning, which loosens both sample and feature overlap assumptions to handle highly heterogeneous distributions¹⁶. For blood donation networks—regional centers that typically collect similar variables from non-overlapping donor pools—horizontal federation is the most natural fit.

The foundational aggregation method, FedAvg, proceeds in communication rounds during which each client minimizes its local objective and the server averages the resulting parameters weighted by dataset size¹⁵. Formally, the global objective is expressed as:

1

where denotes the local sample count and . FedProx extends this by appending a proximal regularization term to the local loss, yielding:

2

This addition dampens client drift when local data distributions are statistically heterogeneous, a condition common among geographically dispersed blood centers¹⁷.

Privacy guarantees in federated pipelines are most rigorously formalized through differential privacy. A randomized mechanism satisfies -differential privacy if, for any adjacent datasets and differing in one record, and for all measurable output sets :

3

The Laplace mechanism achieves -privacy by adding noise drawn from , whereas the Gaussian mechanism satisfies -privacy with noise where:

4

Here is the global sensitivity of the query function¹⁸. In practice, secure aggregation protocols complement differential privacy by encrypting individual model updates so that the server observes only the aggregate, preventing any single client’s contribution from being reverse-engineered¹⁹. The combination of these two defenses — cryptographic shielding during transmission and statistical obfuscation of individual gradients — forms the privacy backbone upon which our proposed framework is constructed.

Multimodal learning and feature fusion methods

Multimodal learning seeks to build joint representations from heterogeneous information sources — structured tabular records, free-text narratives, and temporal event sequences, among others²⁰. Each modality demands its own encoding strategy: embedding layers and feed-forward networks handle categorical and numerical fields; pre-trained language models transform textual inputs into dense semantic vectors; and recurrent or temporal convolutional architectures capture sequential dependencies in behavioral logs²¹.

Three fusion paradigms dominate the literature. Early fusion concatenates modality-specific features before any shared layers process them, which is straightforward yet prone to noise amplification when modalities differ sharply in dimensionality or informativeness. Late fusion trains independent modality branches and merges their decision-level outputs, preserving modality-specific patterns at the cost of missing fine-grained cross-modal interactions. Hybrid fusion interpolates between these extremes, allowing intermediate representations to interact at selected network depths²².

A particularly effective hybrid mechanism is cross-modal attention, where one modality’s representation queries another to discover semantically aligned features. Given modality representations and , the cross-attention output follows the standard scaled dot-product formulation:

5

where , , are learnable projection matrices and is the key dimension²³. To further regulate information flow, gated fusion networks introduce a modality-wise gate:

6

7

Here denotes the sigmoid function, represents concatenation, and is element-wise multiplication. The gate adaptively controls how much each modality contributes to the fused representation, a property that proves valuable when certain modalities are intermittently missing or noisy²⁴.

In healthcare applications, multimodal fusion has already shown tangible benefits — from combining clinical notes with lab results for patient outcome prediction to integrating wearable sensor streams with electronic health records for chronic disease monitoring²⁵. These precedents suggest that blood donor profiling, which similarly involves structured demographics, textual feedback, and longitudinal donation sequences, stands to gain substantially from a well-designed multimodal architecture.

Donor behavior modeling and recall strategy research

Historically, donor profiling has drawn on three pillars: demographic attributes (age, sex, occupation), behavioral indicators (donation frequency, inter-donation intervals, seasonal patterns), and psychological constructs—altruism, self-efficacy, perceived social norms—that shape underlying motivation²⁶. Early work relied on logistic regression and survival analysis to estimate lapse probability, framing the problem as a binary classification where the dependent variable follows:

8

These models, while interpretable, struggle to capture nonlinear feature interactions that often govern real-world donation decisions²⁷. Gradient-boosted tree ensembles and random forests improved predictive accuracy considerably, yet they still treat each donation event as an independent observation, discarding the temporal structure that characterizes a donor’s evolving engagement trajectory²⁸.

More recent efforts have turned to sequential deep learning architectures. Recurrent networks model the donation history as an ordered sequence , updating a hidden state at each step:

9

where is a nonlinear activation and encodes the -th event features²⁹. Variants based on LSTM and Transformer attention have demonstrated superior performance in capturing long-range dependencies within donation histories³⁰.

Nevertheless, three persistent obstacles limit the practical impact of these methods. First, donor records remain siloed across administratively independent blood centers, preventing any single institution from accessing the full behavioral picture. Second, most existing profiles are coarse-grained — reducing complex motivational and contextual signals to a handful of categorical labels — which limits the personalization depth achievable in recall campaigns. Third, tightening data protection regulations impose strict compliance boundaries that conventional centralized modeling pipelines cannot satisfy without substantial re-engineering³¹. It is precisely at this confluence of challenges — cross-institutional isolation, representational shallowness, and privacy mandates — that the present study positions its contribution, aiming to unify federated collaboration with rich multimodal profiling for recall optimization.

Problem definition and multimodal data description

Consider a federated network comprising blood centers, indexed , each holding a private local dataset where denotes the multimodal feature vector of donor and indicates the recall response label. No center is permitted to share raw records with any other party or with the coordinating server. Under a horizontal federated setting — all participants collect the same feature schema from non-overlapping donor populations — the collective optimization objective can be stated as³²:

10

where is the local empirical loss, is a regularization term, and controls its strength. The goal is to learn a global model parameterized by that produces accurate donor profiles and recall predictions without ever centralizing the underlying data.

Each donor’s multimodal representation consists of three distinct modalities. The first, demographic attributes, is denoted and includes age, sex, blood type, occupation, and residential district, encoded via one-hot or ordinal schemes after standard normalization. The second modality captures historical donation behavior as a temporal sequence , where each event records donation date, volume, collection site, and post-donation adverse reaction flags³³. Irregular time gaps between events are preserved through a positional time-difference encoding. The third modality comprises textual feedback — survey responses, complaint records, and satisfaction comments — represented as a semantic embedding extracted by a pre-trained language encoder. Table 1 summarizes the feature composition across all three modalities.

Table 1.

Multimodal feature specification for blood donor profiling.

Modality	Symbol	Key Feature Fields	Dimensionality	Preprocessing
Demographic attributes		Age, sex, blood type, occupation, district		One-hot encoding, min-max scaling
Behavioral sequence		Donation date, volume, site, adverse flags		Temporal difference encoding, padding
Textual feedback		Surveys, complaints, satisfaction comments		Tokenization, pre-trained embedding

The composite multimodal input for donor is thus written as:

11

A critical preprocessing concern is modality missingness: not every donor has textual feedback on file, and sequence lengths vary considerably across individuals. We address this through masking indicators and modality-aware dropout during training, an approach that has proven robust in analogous healthcare fusion tasks³⁴. With the problem and data formally specified, the subsequent sections detail the federated multimodal architecture designed to operate over these heterogeneous inputs.

Federated multimodal fusion framework design

Our architecture organizes computation into two distinct tiers: a local multimodal encoding and fusion stage that executes independently at each blood center, and a global aggregation stage managed by a central coordinating server. Figure 1 depicts the end-to-end pipeline spanning both tiers.

Fig. 1.

Overall architecture of the federated multimodal fusion framework for blood donor profiling.

At each client , three parallel encoders transform raw modality inputs into a shared latent space. The demographic encoder maps the attribute vector through a two-layer fully connected network with ReLU activation, producing . For the behavioral sequence , a temporal encoder based on a single-layer Transformer with positional time-difference embeddings compresses variable-length donation histories into a fixed-dimensional summary ³⁵. The textual modality passes through a frozen pre-trained language backbone followed by a trainable projection head, yielding . Unifying all three outputs to the same dimensionality is deliberate — it simplifies the downstream fusion step considerably.

Cross-modal attention then aligns these representations. Taking the behavioral embedding as the query source and the demographic embedding as the key-value source, the attended output is computed as described in Eq. (5). We extend this pairwise mechanism to all modality pairs, producing six directed attention maps whose outputs are averaged per target modality. A gated aggregation unit subsequently fuses the attention-enriched representations into a single donor embedding ³⁶:

12

13

Here is a learnable attention vector for modality , and serves as a soft importance weight — an adaptive mechanism that proves especially useful when certain modalities carry more discriminative power for a given donor³⁷.

After local training over one or more epochs, each client extracts its updated model parameters and transmits them — never raw data — to the coordinating server. The server performs weighted aggregation following the FedAvg principle recalled in Eq. (1), producing a refreshed global model . This global model is then broadcast back to all participants for the next communication round. To mitigate the statistical heterogeneity that inevitably arises from region-specific donor demographics, we incorporate a proximal correction term as formalized in Eq. (2), anchoring local updates to the most recent global state³⁸. The complete round proceeds as:

14

15

where is the local learning rate. As Fig. 1 depicts, this iterative loop — local encoding, fusion, parameter upload, global aggregation, and redistribution — continues until convergence, at which point all participating centers share a jointly optimized donor profiling model while having never exposed a single donor record beyond institutional boundaries.

To facilitate reproducibility, Table 2 presents the complete pseudocode for the federated multimodal training procedure, covering local gradient computation with per-sample clipping, calibrated Gaussian noise injection, proximal-regularized parameter updates, and server-side weighted aggregation with moments-accountant privacy tracking.

Table 2.

Pseudocode of the Federated Multimodal Training Loop.

Differential privacy enhancement and personalized recall strategy optimization model

Before any client transmits gradient updates to the server, a local differential privacy module clips and perturbs each parameter vector. Specifically, the per-sample gradient is first projected onto an -ball of radius :

16

Calibrated Gaussian noise is then injected into the averaged clipped gradient before upload³⁹:

17

where governs the noise magnitude relative to the clipping bound. Over communication rounds, the cumulative privacy expenditure is tracked via the moments accountant, which yields a tighter bound than naive sequential composition. For a given target -guarantee, the required per-round noise scale satisfies , a well-established result from Renyi divergence analysis⁴⁰. In practice, we allocate a total privacy budget uniformly across rounds, monitoring cumulative loss to ensure the training halts before the budget is exhausted.

A matter deserving explicit treatment rather than tacit glossing-over concerns the interaction between local differential privacy and the parameter upload phase itself. In the current implementation, each client transmits its noise-perturbed parameter vector individually, and the server then performs weighted averaging across the K = 6 contributions. Cryptographic secure aggregation—in the sense of Bonawitz et al.¹⁹, where masked updates reveal only the aggregate to the server—has not been integrated at this stage of the system. With only six participants, this design leaves a residual exposure to single-point inference by a curious or compromised coordinator: local DP perturbation attenuates but does not wholly eliminate the attack surface. We flag this openly rather than letting it pass unremarked, and we treat the integration of masking-based secure aggregation as a concrete direction for near-term follow-up work, discussed further among the limitations in Sect. 5.

Figure 2 presents the complete pipeline from privacy-enhanced federated training through to personalized recall decision output.

Fig. 2.

Workflow of the differential privacy enhanced personalized recall strategy optimization.

Building on the fused donor embedding produced by the framework in Sect.  3.2, we formulate recall optimization as a multi-task prediction problem. Two heads branch from the shared embedding: a timing head that predicts the optimal recall window (discretized into weekly intervals), and a channel head that recommends the most effective communication modality (SMS, phone call, mobile app notification, or social media message). The joint loss combines a cross-entropy term for channel classification and a mean squared error term for timing regression:

18

Here balances the two objectives, and denotes the ground-truth channel label derived from historical successful recall records. In all experiments reported below, we set γ = 0.5, assigning equal weight to channel classification and timing regression; a sensitivity analysis of this parameter appears in Sect.  4.3. This multi-task design allows the shared embedding layers to capture representations beneficial to both tasks simultaneously, improving generalization particularly when labeled recall outcomes are sparse.

One practical concern worth confronting head-on is that cross-entropy and mean-squared-error operate on fundamentally incommensurate numerical scales; a naive mixture would let whichever term happens to be larger quietly dominate the gradient signal and starve its counterpart of learning capacity. To keep both heads on comparable footing, we normalize the timing target t_i to the [0,1] interval through min-max scaling computed over the training partition, which bounds the MSE contribution within a controlled range. We then verified empirically: after the first training epoch, the cross-entropy term settles at roughly 1.42 ± 0.08, while the normalized MSE sits at 0.58 ± 0.04, with their respective gradient L2 norms differing by less than a factor of 1.4. Under these conditions, γ = 0.5 functions as an honest equal-weighting rather than a de facto domination of one objective, a reading that Table 3’s stability across γ ∈ [0.3, 0.7] further corroborates. We also explored homoscedastic uncertainty weighting⁴¹ as an alternative, but found it yielded marginally equivalent performance at the cost of two additional learnable parameters, leaving fixed weighting as the more parsimonious choice for this application.

Table 3.

Sensitivity analysis of multi-task balancing parameter γ.

γ	Profile F1 (%)	Lapse Accuracy (%)	Recall Conv. (%)	Channel Accuracy (%)
0.1	80.2 ± 1.0	84.8 ± 0.9	29.5 ± 1.2	78.4 ± 1.1
0.3	83.1 ± 0.8	87.0 ± 0.7	30.8 ± 0.9	81.6 ± 0.8
0.5	83.7 ± 0.7	87.5 ± 0.6	31.2 ± 0.8	82.3 ± 0.7
0.7	83.3 ± 0.8	87.2 ± 0.7	30.6 ± 1.0	82.8 ± 0.8
0.9	81.4 ± 0.9	85.6 ± 0.8	28.7 ± 1.1	83.1 ± 0.7

To operationalize recall at scale, we further cluster donors into behaviorally coherent groups. Applying -means on the embedding space partitions the donor population into segments; a hierarchical priority score then ranks each segment according to predicted response probability and blood type urgency:

19

20

where is the average predicted positive response rate within cluster , quantifies the current supply urgency for the predominant blood type of that cluster, and are adjustable policy weights⁴². Table 4 summarizes the recall priority tiers and their corresponding intervention protocols.

Table 4.

Hierarchical recall priority tiers and intervention protocols.

Priority Tier	Priority Score Range	Cluster Characteristics	Recommended Action
Tier 1 (Critical)		High response rate, urgent blood type need	Immediate phone call + app notification
Tier 2 (High)		Moderate response rate, general demand	SMS within optimal timing window
Tier 3 (Routine)		Lower engagement, non-urgent type	Periodic app or social media reminder
Tier 4 (Deferred)		High lapse risk, low predicted response	Batch campaign during seasonal drives

As Fig. 2 depicts, the entire flow — from gradient-level privacy protection through embedding-based clustering to tiered recall execution — operates without exposing individual donor records, ensuring that personalization and privacy coexist throughout the decision pipeline.

Experimental setup and profiling performance evaluation

Our experimental dataset consists of 127,463 anonymized donor records drawn from six municipal blood centers and covering the period from January 2018 to December 2023. Each record contains the three modalities defined in Sect. 3.1: demographic attributes, behavioral donation sequences, and textual feedback entries. To simulate a realistic federated environment, we partitioned the dataset across virtual clients corresponding to the originating centers, preserving their natural demographic imbalances. A Dirichlet-based allocation with concentration parameter further controlled the degree of non-IID skew across clients, with smaller values inducing sharper distributional divergence⁴³. Within each client, an 80/10/10 split separated training, validation, and test sets chronologically to prevent temporal leakage.

All models were trained on a single server equipped with four NVIDIA A100 GPUs (40 GB each) under a simulated federated configuration; the six virtual clients ran as isolated processes on co-located hardware rather than on physically separate machines. Some readers may reasonably wonder why four A100s were marshaled for a model carrying only 2.38 million parameters, and the concern is fair enough to address directly. The model itself is modest: peak per-client GPU memory sits around 4.8 GB, and aggregate GPU utilization averaged roughly 31% during federated training rounds, with transient peaks near 58% during hyperparameter sweeps. The abundance of compute served a different purpose entirely—parallelizing six virtual clients running concurrently across five random-seed replicates while sweeping the full hyperparameter grid described later in Table 5. On a single mid-tier GPU, the same experimental volume would have stretched across several weeks of wall-clock time, which proved impractical within our revision schedule. For a genuine multi-center deployment, each blood center would require nothing more than a single workstation-class GPU, and many centers could likely manage with a well-provisioned CPU-only server. The hardware reported here reflects experimental throughput convenience, not operational necessity. We recognize that this design does not reproduce the communication latency, bandwidth limitations, or computational heterogeneity of a genuine multi-center deployment, and we present an explicit communication overhead analysis later in this section. Local training proceeded for 5 epochs per communication round across 100 global rounds. The learning rate was set to with cosine annealing, the embedding dimension , and the proximal coefficient . We selected four baseline methods for comparison: (a) a centralized multimodal model trained on pooled data without federation (Centralized-MM), representing the theoretical performance ceiling; (b) a federated model operating solely on demographic features (Fed-Demo); (c) a federated single-modality behavioral sequence model (Fed-Seq); and (d) a conventional logistic regression with hand-crafted features (LR-Baseline)⁴⁴. Table 6 summarizes the principal results across three evaluation dimensions. All values are reported as mean ± standard deviation over five independent runs with different random seeds, and p-values from paired t-tests against the proposed method are included.

Table 5.

Hyperparameter tuning protocol for all compared methods.

Method	Learning Rate Search	Weight Decay Search	Batch Size Search	Early Stopping
LR-Baseline	{1e-4, 5e-4, 1e-3, 5e-3}	{0, 1e-4, 1e-3}	{64, 128, 256}	Patience = 10
Fed-Demo	{1e-4, 5e-4, 1e-3, 5e-3}	{0, 1e-4, 1e-3}	{64, 128, 256}	Patience = 10
Fed-Seq	{1e-4, 5e-4, 1e-3, 5e-3}	{0, 1e-4, 1e-3}	{64, 128, 256}	Patience = 10
Centralized-MM	{1e-4, 5e-4, 1e-3, 5e-3}	{0, 1e-4, 1e-3}	{64, 128, 256}	Patience = 10
Proposed (FedMM)	{1e-4, 5e-4, 1e-3, 5e-3}	{0, 1e-4, 1e-3}	{64, 128, 256}	Patience = 10

Table 6.

Profiling performance comparison across methods (Mean ± SD, 5 Seeds).

Method	Lapse Accuracy (%)	Profile F1 (%)	Silhouette Score	p-value
LR-Baseline	72.4 ± 1.1	65.8 ± 1.3	0.231 ± 0.018	< 0.001
Fed-Demo	78.1 ± 0.9	71.3 ± 1.0	0.347 ± 0.015	< 0.001
Fed-Seq	80.6 ± 0.8	74.9 ± 0.9	0.389 ± 0.013	< 0.001
Centralized-MM	89.2 ± 0.5	86.1 ± 0.6	0.512 ± 0.010	0.003
Proposed (FedMM)	87.5 ± 0.6	83.7 ± 0.7	0.486 ± 0.012	—

As Table 6 shows, the proposed federated multimodal method achieves a lapse prediction accuracy of 87.5% and an F1 score of 83.7%, narrowing the gap to the centralized upper bound to within roughly 2% points while never exposing raw donor data. The single-modality federated baselines trail by 7–9 points on F1, confirming that multimodal fusion contributes substantial discriminative value even under distributed training constraints. The silhouette score of 0.486 further indicates that the learned embeddings form meaningfully separated clusters aligned with known donor behavioral segments.

To ensure a fair comparison, every baseline received the same level of hyperparameter tuning as FedMM. We conducted grid search over learning rate ({1e-4, 5e-4, 1e-3, 5e-3}), weight decay ({0, 1e-4, 1e-3}), and batch size ({64, 128, 256}) for all methods. Early stopping with patience of 10 rounds on the validation set was applied uniformly. Table 5 summarizes the protocol.

Figure 3 illustrates the accuracy gap more intuitively: the LR-Baseline and single-modality federated variants fall noticeably short, whereas the proposed method closely approaches centralized performance. The advantage is most pronounced for donors with sparse donation histories, where textual and demographic modalities compensate for limited sequential signal.

Fig. 3.

Profiling accuracy comparison across different methods.

Figure 4 presents the F1 trajectory as the number of participating clients increases from 2 to 10. Performance rises steadily up to , then plateaus — a pattern consistent with diminishing marginal data diversity gains once the federation captures sufficient population heterogeneity⁴⁵. Notably, even with only three participants, the proposed method surpasses the best single-modality federated baseline at , underscoring the outsized contribution of modality richness relative to participant count.

Fig. 4.

F1 Score variation under different numbers of federated participants.

Figure 5 depicts performance degradation as decreases from 1.0 (near-IID) to 0.1 (highly skewed). The proposed method demonstrates stronger resilience than both Fed-Demo and Fed-Seq, losing only 3.8 F1 points across the full non-IID spectrum. We attribute this robustness to the cross-modal attention mechanism, which dynamically reweights modality contributions when certain feature distributions shift across clients — effectively serving as an implicit domain adaptation layer within the federated pipeline.

Fig. 5.

Profiling Performance Under Varying Non-IID Severity ().

Because our experiments run on co-located hardware, we separately quantify the communication overhead a real deployment would face. Table 7 reports per-round parameter payload sizes and estimated transfer times under two bandwidth scenarios. Under a 10 Mbps uplink, one communication round completes in under 8 s; even a constrained 1 Mbps link requires fewer than 80 s per round, suggesting practical viability for municipal blood center networks. We additionally simulated 10%, 20%, and 30% random client dropout. In every scenario, the model converges to within 1.5 F1 points of the full-participation baseline, requiring at most 10 extra communication rounds to reach comparable performance. Because losing two of six heterogeneous clients per round would ordinarily raise serious concerns about gradient variance and client drift—and it is a concern we take seriously—we now report exact variance statistics in Table 8 (presented later in Sect. 4.3 alongside the other robustness diagnostics). Measured across rounds 40–80 (post warm-up, pre-convergence), per-coordinate gradient variance rises from 0.021 under full participation to 0.058 under 30% dropout, roughly a 2.8-fold increase, yet remains comfortably below the 0.15–0.25 regime that typically heralds diverging client drift in standard FedAvg⁴⁶. Three factors, in our reading, account for this measured stability: the FedProx proximal term (µ = 0.01) anchors local updates against the most recent global state; the cross-modal attention gate redistributes representational mass when certain clients’ data distributions shift, acting as an implicit regularizer; and the Dirichlet α = 1.0 setting, while non-IID, does not push heterogeneity into the extreme regime (α < 0.3) where drift effects typically compound. We should be candid, though, that under α = 0.1 combined with 30% dropout, preliminary experiments show the F1 gap widening to roughly 3.5 points—still below catastrophic levels, but a caveat worth naming honestly. Detailed convergence curves and round-by-round F1 values for all three dropout conditions are provided in Supplementary Table S1 and Supplementary Figure S1, which substantiate these robustness claims with granular numerical evidence.

Table 7.

Communication overhead per federated round.

Component	Parameters (M)	Payload (MB)	Time @10Mbps (s)	Time @1Mbps (s)
Demographic Encoder	0.18	0.72	0.6	5.8
Behavioral Encoder	1.24	4.96	4.0	39.7
Text Projection Head	0.33	1.32	1.1	10.6
Attention + Gate	0.54	2.16	1.7	17.3
Recall Heads	0.09	0.36	0.3	2.9
Total	2.38	9.52	7.6	76.2

Table 8.

Gradient variance under varying client dropout rates (rounds 40–80, Mean ± SD).

Dropout Rate	Per-coord. Variance	Gradient L2 Norm	Δ F1 vs. Full (%)	Extra Rounds to Converge
0% (full)	0.021 ± 0.003	2.14 ± 0.19	—	0
10%	0.028 ± 0.004	2.31 ± 0.22	−0.6	3
20%	0.041 ± 0.006	2.67 ± 0.28	−1.1	7
30%	0.058 ± 0.008	3.12 ± 0.35	−1.5	10

V. Discussion.

Since the dataset originates from six actual municipal blood centers, we also evaluated the framework under the natural geographic partition defined by each center’s original donor population. Table 9 contrasts this natural split against two synthetic Dirichlet allocations. Under natural partitioning, the non-IID divergence measured by earth-mover distance reaches 0.41, falling between the two synthetic conditions. FedMM attains a Profile F1 of 82.9 ± 0.8% under the natural split, only 0.8 points below the Dirichlet-0.5 setting. This result confirms that cross-modal attention effectively mitigates real institutional heterogeneity, not merely synthetic partitions.

Table 9.

Performance under natural vs. synthetic data partitioning.

Partition Type	EMD	Profile F1 (%)	Lapse Accuracy (%)	Recall Conversion (%)
Dirichlet (α = 1.0)	0.23	83.7 ± 0.7	87.5 ± 0.6	31.2 ± 0.9
Dirichlet (α = 0.5)	0.52	82.1 ± 0.9	86.3 ± 0.7	30.1 ± 1.0
Natural Geographic	0.41	82.9 ± 0.8	86.8 ± 0.7	30.5 ± 1.1

Recall strategy optimization effectiveness and privacy protection analysis

To gauge the practical value of the proposed personalized recall model, we compared it against three baseline strategies: a fixed-cycle approach that contacts all eligible donors at uniform 90-day intervals (Fixed-Cycle), a rule-based method that triggers recall based on blood type shortage thresholds and last donation date (Rule-Based), and a centralized personalized model trained on pooled data without federated privacy constraints (Central-Personal). Three operational metrics were adopted: recall response rate (proportion of contacted donors who responded positively), recall conversion rate (proportion who actually donated within 30 days of contact), and average cost per successful recall measured in staff time and communication expenses. Table 10 presents the results. Values are reported as mean ± standard deviation across five runs.

Table 10.

Recall strategy performance comparison (Mean ± SD, 5 Seeds).

Strategy	Response Rate (%)	Conversion Rate (%)	Est. Avg. Cost (CNY)¹
Fixed-Cycle	18.3 ± 1.4	11.7 ± 1.2	42.6 ± 2.8
Rule-Based	26.5 ± 1.2	19.2 ± 1.0	31.8 ± 2.1
Central-Personal	41.8 ± 0.8	33.6 ± 0.7	16.4 ± 1.3
Proposed (FedMM-Recall)	39.1 ± 0.9	31.2 ± 0.8	18.1 ± 1.5

¹ Estimated cost per successful recall derived from retrospective simulation. Unit-cost assumptions: SMS at ¥0.08/message (three-operator average, Zhejiang 2023); outbound phone call at ¥0.35/minute with a 3.2-minute average duration; staff time at ¥45/hour prorated across contact and follow-up activities; app or social-network notification at ¥0.02/message. A successful recall is defined as a donation occurring within 30 days of first contact. Unit costs drawn from Huzhou Central Blood Station 2022–2023 operational records; absolute CNY values reflect retrospective simulation only and have not been validated through prospective A/B testing, so they should be read as order-of-magnitude estimates rather than precise operational figures.

As Table 10 shows, the proposed method achieves a response rate of 39.1% and a conversion rate of 31.2%, outperforming the Rule-Based strategy by roughly 12% points on conversion while maintaining cost efficiency. The gap relative to the centralized upper bound remains modest — approximately 2.4 points on conversion — a trade-off that, in our view, is well justified by the privacy guarantees the federated framework provides.

A word of caution is warranted regarding the cost column in Table 10. These figures derive from a retrospective simulation that maps predicted recall actions onto institutional unit-cost assumptions (fully specified in the footnote), rather than from a live prospective trial. In the absence of a controlled A/B test where alternative recall strategies run concurrently on comparable donor cohorts, exact economic figures remain inherently approximate. We report them because the relative ordering across strategies—Fixed-Cycle most expensive, Central-Personal cheapest, our federated method close behind—corresponds to meaningful efficiency differences worth conveying. Readers, however, should interpret the absolute CNY values as estimates rather than established operational costs, and we flag this caveat again among the limitations in Sect.  5.

Figure 6 illustrates these differences visually. The performance lift of the proposed method over Rule-Based is most pronounced among Tier 2 and Tier 3 donor clusters, where personalized timing and channel selection exert the strongest influence on engagement outcomes⁴⁷.

Fig. 6.

Response Rate and Conversion Rate Comparison Across Recall Strategies.

A central question for any privacy-preserving system is how aggressively noise injection degrades downstream utility. We define a normalized utility metric as the harmonic mean of profiling F1 and recall conversion rate, and examine its behavior across a range of privacy budgets . The effective noise scale at each budget level follows from Eq. (4), which we restate here in terms of per-round noise variance:

21

The cumulative privacy loss after rounds, tracked via the moments accountant, satisfies:

22

which provides a standard upper bound under Gaussian mechanism composition⁴⁸.

Figure 7 presents the resulting tradeoff curve. Utility drops modestly when decreases from 8.0 to 2.0 — only a 3.1-point reduction in the composite metric — but the decline accelerates sharply below . This elbow-shaped pattern suggests that operating in the range offers the most favorable balance: privacy guarantees remain meaningfully strong while the model retains over 93% of its noise-free performance. For practical deployment, we recommend as a default, consistent with guidelines adopted in analogous healthcare federated studies⁴⁹.

Fig. 7.

Privacy Budget () versus model utility tradeoff curve.

Figure 8 disaggregates this analysis by examining how different noise intensities affect each recall metric independently. Response rate proves relatively insensitive to noise up to , losing fewer than 2% points from the noise-free baseline. Conversion rate, by contrast, shows greater sensitivity — an expected finding, since conversion depends on finer-grained timing and channel predictions that are more vulnerable to gradient perturbation. Nonetheless, even at the strictest tested budget (), the proposed method still surpasses the Rule-Based baseline on all three metrics, confirming that the federated multimodal architecture retains substantial practical advantage even under conservative privacy regimes.

Fig. 8.

Recall strategy effectiveness under varying noise levels.

Ablation study and key factor analysis

To disentangle the contributions of individual architectural components, we conducted a systematic ablation study in which one module was removed at a time while all other settings remained identical to the full model described in Sect.  4.1. Four ablation variants were tested: (A1) replacing the cross-modal attention fusion with simple concatenation, (A2) disabling the differential privacy module — removing gradient clipping and noise injection entirely, (A3) dropping the behavioral sequence encoder so that only demographic and textual modalities participated, and (A4) excluding the text semantic encoder, leaving demographics and behavioral sequences as the sole inputs. Table 11 presents the results across both profiling and recall dimensions. All values are mean ± standard deviation over five runs.

Table 11.

Ablation study results for key model components (Mean ± SD, 5 Seeds).

Variant	Profile F1 (%)	Lapse Accuracy (%)	Recall Conv. (%)	Δ F1 vs. Full
Full Model	83.7 ± 0.7	87.5 ± 0.6	31.2 ± 0.8	—
A1: w/o Cross-Modal Attention	79.4 ± 0.9	84.1 ± 0.8	27.8 ± 1.1	−4.3
A2: w/o Differential Privacy	84.2 ± 0.6	88.0 ± 0.5	31.9 ± 0.7	+ 0.5
A3: w/o Behavioral Sequence	76.8 ± 1.1	80.3 ± 1.0	25.6 ± 1.3	−6.9
A4: w/o Text Semantics	81.1 ± 0.8	85.4 ± 0.7	29.3 ± 0.9	−2.6

As Table 11 shows, removing the behavioral sequence encoder (A3) inflicts the steepest performance drop — nearly 7 points on F1 — confirming that temporal donation patterns carry the richest discriminative signal for donor profiling. The text semantic modality (A4) contributes a more modest but still meaningful 2.6-point improvement, particularly valuable for donors whose short donation histories limit the sequential encoder’s capacity. Replacing cross-modal attention with naive concatenation (A1) costs 4.3 F1 points, which underscores that the attention mechanism does more than cosmetically blend features; it actively realigns modality-specific representations into a semantically coherent space where interaction effects become visible⁵⁰. Variant A2 — the privacy-free configuration — yields only a marginal 0.5-point gain, a result we find encouraging: the differential privacy mechanism imposes a near-negligible accuracy penalty at the recommended budget of , reinforcing the privacy-utility tradeoff analysis presented in Sect. 4.2.

Beyond module-level ablation, we investigated sensitivity to three operational hyperparameters: the total number of communication rounds , the number of local training epochs per round, and the fusion embedding dimension . Convergence behavior with respect to revealed that the global model stabilizes around round 70, with improvements beyond round 85 falling below 0.1 F1 points per round. Increasing local epochs from 1 to 5 accelerated early-stage convergence substantially, yet pushing to 10 introduced visible client drift effects that degraded final accuracy by 1.2 points despite faster per-round progress — a phenomenon well-documented in heterogeneous federated settings⁵¹. As for the embedding dimension, performance improved steadily from to , plateaued through , and declined marginally at due to overfitting on smaller client datasets. These findings suggest that , , and constitute a robust default configuration, balancing communication efficiency, convergence reliability, and representational capacity for practical blood center deployments.

We examined the sensitivity of the multi-task balancing parameter γ in Eq. (18). Table 3 reports metrics across five γ values. Performance stays stable within γ ∈ [0.3, 0.7], varying by less than 1.0 F1 point. Degradation becomes apparent only at the extremes (γ = 0.1 or 0.9), where one objective dominates the gradient and starves the other. We chose γ = 0.5 on the validation set, and this default proves robust across a reasonably wide operating range.

The paper has claimed throughout that the proposed method benefits donors with sparse donation histories. To substantiate this, Table 12 stratifies performance by number of past donations. The advantage of FedMM over Fed-Seq is most pronounced in the 1–2 donations group (a 12.4 F1-point gap), confirming that demographic and textual modalities compensate when behavioral sequences are too short. Beyond six donations, the gap narrows to roughly 3 points as the sequential encoder captures strong temporal patterns on its own.

Table 12.

Profiling Performance Stratified by Donation Sequence Length.

Donations	N	FedMM F1 (%)	Fed-Seq F1 (%)	Fed-Demo F1 (%)	Δ FedMM vs. Seq
1–2	31,842	78.3 ± 1.2	65.9 ± 1.5	70.8 ± 1.3	+ 12.4
3–5	42,715	83.1 ± 0.8	74.6 ± 1.0	71.2 ± 1.1	+ 8.5
6–10	33,489	87.2 ± 0.6	82.1 ± 0.7	71.5 ± 1.0	+ 5.1
> 10	19,417	90.4 ± 0.5	87.5 ± 0.6	72.0 ± 1.0	+ 2.9

A further concern is how the cross-modal attention mechanism behaves when text is entirely absent for most donors. We conducted a stress test, artificially raising the text-missing rate from the observed ~ 60% to 80%, 90%, and 100%. Table 13 reports the results. Even at 100% missingness, Profile F1 drops by only 2.8 points, confirming that masking indicators and modality-aware dropout prevent attention collapse. The learned gate weights show that when text vanishes, the aggregation unit redistributes mass onto behavioral (58%) and demographic (42%) branches rather than producing degenerate outputs.

Table 13.

Stress Test: Performance Under Increasing Text Modality Missingness.

Text Missing Rate	Profile F1 (%)	Lapse Acc. (%)	Gate: Behav.	Gate: Demo.	Gate: Text
≈ 60% (observed)	83.7 ± 0.7	87.5 ± 0.6	0.47	0.31	0.22
80%	82.6 ± 0.8	86.7 ± 0.7	0.51	0.35	0.14
90%	81.8 ± 0.9	86.0 ± 0.8	0.54	0.39	0.07
100%	80.9 ± 1.0	85.3 ± 0.9	0.58	0.42	0.00

To validate that the gated aggregation unit adaptively controls modality contributions, Fig. 9 visualizes learned attention weight distributions across three representative donor archetypes. For frequent donors with rich behavioral sequences (Archetype A), the behavioral modality receives a dominant gate weight of 0.56, while text contributes 0.12. For infrequent donors who provided textual feedback (Archetype B), the text gate weight rises to 0.38 and the behavioral weight drops to 0.27, confirming that the mechanism shifts reliance toward whichever modality carries the strongest signal. For donors lacking both text and long sequences (Archetype C), demographic weight increases to 0.52. These patterns corroborate the aggregate trends in Table 13 and demonstrate that the adaptive gating does not collapse to a fixed weighting scheme.

Fig. 9.

Attention weight distribution across three donor archetypes.

To substantiate the client-dropout robustness claims introduced earlier in Sect. 4.1, Table 8 presents per-coordinate gradient variance and L2-norm statistics measured across communication rounds 40–80 under the four participation scenarios. The variance trajectory tells a coherent story: even at 30% dropout, the observed values stay well short of the 0.15–0.25 band typically associated with diverging client drift in plain FedAvg⁴⁶. The FedProx proximal anchor, combined with the attention gate’s adaptive redistribution of modality weights, appears to dampen perturbations that would otherwise compound.

The experimental results reported in Sect.  4.1 through 4.3 carry implications that extend beyond the numerical metrics themselves, touching on both the theoretical understanding of federated multimodal systems and the operational realities of blood service management.

One may reasonably ask why the federated multimodal design closes so much of the gap to centralized training. In our assessment, the answer hinges on the complementary character of the three modality streams. Demographics supply a stable, low-variance scaffold of donor identity, yet they carry no temporal sensitivity. Behavioral sequences track evolving engagement dynamics but become uninformative when a donor has only one or two visits on record. Textual feedback, sparse as it often is, encodes motivational and attitudinal signals that neither of the other channels can see. What the cross-modal attention mechanism accomplishes when it operates over these three streams jointly goes well beyond simple averaging: it selectively amplifies whichever modality happens to be most diagnostic for a particular donor at a particular moment. The ablation findings confirm this reading—removing any single modality degrades performance, but the magnitude of the damage is context-dependent, and the attention gate compensates by redistributing representational weight to the surviving channels. We contend that this adaptive reweighting is the critical differentiator separating our fusion approach from simpler concatenation or late-fusion alternatives.

Practitioners should interpret the privacy-utility tradeoff with care. Our finding that an operating point around preserves over 93% of noise-free performance is reassuring, but blood center administrators must weigh this against their specific regulatory environment. Institutions subject to stringent personal health information statutes may prefer tighter budgets (), accepting a somewhat coarser recall granularity in exchange for stronger formal guarantees. Conversely, centers operating under cooperative data-sharing agreements with informed donor consent might tolerate or higher, capturing nearly the full performance benefit. The key takeaway is not a single recommended value but rather the shape of the tradeoff curve itself — the elbow region between and — which allows each deployment to make an informed, context-sensitive decision.

We should openly acknowledge several limitations of this work. First, although our dataset encompasses 127,463 records, all six contributing centers belong to a single national blood service system. Whether these findings transfer to transfusion organizations operating under markedly different donation cultures, regulatory frameworks, or demographic compositions has yet to be empirically tested. Second, the communication overhead estimates presented in Table 7 reflect idealized bandwidth assumptions. In a genuine Wide Area Network (WAN) deployment, practical delays are likely to exceed the theoretical values reported here, owing to factors such as latency jitter caused by variable routing paths, the computational cost of cryptographic handshakes (e.g., TLS/SSL negotiations) required for secure parameter transmission, and general network instability including packet loss and congestion events. Our federated experiments, executed on co-located hardware, cannot fully reproduce these effects; physically distributed testbeds remain a priority for future validation. Third, the modality-missingness stress test in Table 13, while informative, relies on random masking. Real-world text availability may correlate with donor engagement levels in ways that synthetic masking fails to capture. Fourth, the attention-weight visualizations in Fig. 9 offer a preliminary window into model behavior, but the architecture largely operates as a black-box predictor. More expressive interpretability mechanisms—concept-based explanation modules, counterfactual reasoning dashboards, or input-attribution maps—would bolster clinical trust and warrant dedicated study. Fifth, the privacy pipeline as currently configured relies exclusively on local differential privacy, without cryptographic secure aggregation on the parameter upload path. In a K = 6 federation this design leaves a residual attack surface against single-client inference by a compromised coordinator—a gap that masking-based secure aggregation protocols, such as Bonawitz et al.¹⁹ or its more recent variants, would close. Integrating such protocols is a priority for subsequent engineering work, and we flag it here rather than burying it. Sixth, the cost figures reported in Table 10 reflect retrospective simulation under institutional unit-cost assumptions rather than prospective A/B validation. While the relative ordering among strategies conveys real efficiency differences, the absolute CNY values should be read as estimates; a live prospective trial remains the proper vehicle for establishing exact operational economics. Seventh, the client-dropout robustness analysis in Sect. 4.1 was conducted primarily under moderate non-IID conditions (Dirichlet α = 1.0). Preliminary runs at α = 0.1 suggest the F1 gap widens to approximately 3.5 points under 30% dropout—still manageable, but a scenario deserving systematic study before deployment in federations exhibiting extreme demographic divergence.

These caveats notwithstanding, the practical outlook for the framework is encouraging. Its modular design—local encoding separated cleanly from global aggregation—allows individual centers to join the federation incrementally, without overhauling existing data infrastructure. The tiered recall prioritization maps onto operational workflows that blood service staff already understand, which lowers the adoption barrier considerably. Privacy guarantees anchored in formal differential privacy theory, rather than ad hoc anonymization heuristics, provide a defensible compliance posture as regulatory scrutiny of health data analytics continues to tighten. Looking forward, incorporating real-time donor feedback loops and dynamic privacy budget adjustment could further sharpen both the responsiveness and the trustworthiness of federated donor management systems.

Conclusion

This paper tackled the intertwined challenges of building accurate blood donor profiles and optimizing personalized recall strategies under stringent privacy constraints. We proposed a federated multimodal learning framework that enables cross-institutional collaboration while keeping individual donor records strictly local. Four tightly coupled components—federated architecture design, differential privacy integration, multimodal donor profiling, and multi-task recall optimization—were each validated through systematic experiments on a dataset exceeding 127,000 donor records distributed across six simulated blood centers.

Three principal findings stand out. First, the federated multimodal fusion framework—built around cross-modal attention and adaptive modality gating—reaches profiling accuracy within 2% points of a centralized upper bound, all while preserving strict data isolation across participating institutions. Behavioral sequences emerged as the single most discriminative modality, yet the attention mechanism’s capacity to dynamically offset modality-level sparsity—drawing on textual and demographic cues for donors with thin donation histories—proved indispensable for maintaining consistent performance across varied donor subpopulations. Second, the differential privacy enhancement, which pairs local gradient clipping with calibrated Gaussian noise injection, incurs only marginal utility loss at a privacy budget of . The elbow-shaped tradeoff curve that our experiments revealed gives practitioners a concrete basis for calibrating protection strength against institutional risk tolerance. Third, formulating personalized recall optimization as a multi-task learning problem over timing and channel selection lifts conversion rates by roughly 12% points relative to rule-based approaches, and the hierarchical priority clustering converts model outputs into operationally actionable recall schedules.

In terms of originality, this study offers three contributions: a modality-aware federated aggregation scheme designed for heterogeneous feature distributions across decentralized nodes; a co-designed privacy-utility balancing mechanism that formally bounds cumulative privacy loss without catastrophic accuracy degradation; and a complete end-to-end pipeline linking privacy-preserving profiling to multi-task recall decision-making inside a single trainable system. Taken together, these advances push forward the methodological frontier of federated health analytics and provide blood service organizations with a replicable blueprint for privacy-conscious, data-rich donor engagement. More broadly, the framework shows that meaningful collaborative intelligence is attainable even in health domains where data sensitivity and institutional fragmentation have long obstructed joint modeling.

Several promising avenues remain open for future work. Integrating cryptographic secure aggregation on top of the current DP scheme would close the residual single-point inference risk in small-K federations and strengthen the privacy guarantees to a more defensible operational posture. Incorporating additional modalities—geospatial mobility traces, wearable physiological indicators, social network interaction patterns—could enrich donor representations further, though it would also demand solutions to considerably greater modality alignment complexity. Exploring personalized federated aggregation, in which the global model adapts its weighting scheme to each client’s local distribution, may unlock additional robustness gains under non-IID conditions, particularly in the α ≤ 0.3 regime where gradient variance effects start to compound visibly. A prospective A/B validation of the recall strategy—replacing our retrospective cost simulation with actual operational deployment across a multi-center pilot—would convert our economic projections into established figures and, equally valuable, expose edge cases not readily visible in retrospective data. Strengthening model interpretability through attention visualization dashboards or concept-based explanation modules would deepen clinical trust and smooth regulatory review. Perhaps most critically, transitioning from simulated federation to genuine multi-center deployment—complete with real network latency, asynchronous update schedules, and institutional governance negotiations—represents the indispensable next step toward confirming the practical viability of this system in operational blood management environments.

Electronic Supplementary Material

Below is the link to the electronic supplementary material.

Abbreviations

FedMM

Federated Multimodal Model

FedAvg

Federated Averaging

DP

Differential Privacy

LSTM

Long Short-Term Memory

ReLU

Rectified Linear Unit

SMS

Short Message Service

CNY

Chinese Yuan

IID

Independent and Identically Distributed

Non-IID

Non-Independent and Identically Distributed

LR

Logistic Regression

F1

F1 Score

CE

Cross-Entropy

GPU

Graphics Processing Unit

IRB

Institutional Review Board

Author contributions

Li Li conceptualized the study, designed the federated multimodal fusion framework, implemented the experiments, and drafted the manuscript. Jiaojiao Li supervised the research, contributed to the formulation of the recall strategy optimization model, performed data curation and validation, and critically revised the manuscript for important intellectual content. Both authors read and approved the final manuscript.

Funding

No funding was received for this research.

Data availability

All data generated and analyzed during the current study are available from the corresponding author upon reasonable request.

Code availability

All raw code developed for this study—covering the modality-specific encoders, cross-modal attention and gated fusion units, FedAvg/FedProx aggregation with client-dropout simulation, local differential privacy with moments-accountant tracking, and the multi-task recall heads—has been organized into a single, directly runnable archive (fedmm-blood-donor.zip) that we have uploaded to the Related files section of this submission. The archive ships with requirements.txt, YAML configuration files aligned with the hyperparameter grid reported in Table 5, and per-experiment entry scripts (run_federated.py, run_privacy_sweep.py, run_dropout_analysis.py, run_recall_evaluation.py). Readers can rerun any headline experiment end-to-end on the packaged sample data without additional engineering work, and all procedural details needed for verification are documented in the accompanying README.md and docs/IRB_terms.md⁵².

Declarations

Competing interests

The authors declare no competing interests.

Ethics approval and consent to participate

This study was approved by the Research Ethics Committee of Huzhou Central Blood Station (Reference Number: IRB-2024-00376). All participants provided written informed consent prior to enrollment. The study was conducted in accordance with the Declaration of Helsinki and relevant national regulations.

Consent for publication

All authors have reviewed the manuscript and consent to its publication. No identifiable information regarding participants has been included.