The founding partners of the German-Canadian NephroCAGE consortium are depicted in Figure 1 and their functions in the consortium are outlined in the following:

All methods were carried out in accordance with relevant guidelines and regulations in the participating countries Germany and Canada. The project was approved by the following ethics committees: (1) Charité – Universitätsmedizin Berlin (EA4/104/21) and (2) Research Ethics Board of the McGill University Health Centre and Centre Hospitalier de l’Université de Montréal research center (MP-37-2022-8003). Available data are retrospective data obtained from patients, who gave their informed consent prior to their transplantation for the use of their data for retrospective analyses. All data will be handled in accordance with the corresponding data protection regulations, that is, the European General Data Protection Regulation and the Personal Information Protection and Electronic Documents Act, respectively. Data access was given to clinicians after deidentification only. Prior to the use of data for CPM training, data were in addition pseudonymized to minimize any eventual reidentification risk. There were neither specific compensations nor benefits provided to patients by the NephroCAGE consortium for the use of their data. We use retrospective data, which were gathered during routine care.

Table 1 provides an overview of the NephroCAGE data set, which consists of more than 8000 transplant patient cases across the past 2 decades with an average age of 51.7 years. Approximately two-thirds of the transplanted patients in our data set are male and one-third are female patients, which aligns with the sex distribution known from related studies [25]. Table 2 provides a summary of available categories of transplant data in our NephroCAGE data set.

Data of transplant patients resides in individual hospital information systems (HIS), for example, laboratory information management system, digital pathology system, or patient management system. For example, patient data are collected during dialysis, at transplantation, and for each of the individual follow-up visits after successful transplantation. Before we can use such data for training of CPMs, each clinical site needs to extract relevant data from their internal source systems and transform them into the common NephroCAGE data schema [26]. Some of the clinical transplant centers have already performed extraction of data from internal sources and its harmonization to a common data schema, for example, due to the presence of a local clinical data warehouse. As a result, local efforts for extraction and harmonization of data are reduced at these sites. Extraction and harmonization of data should be automated to establish a reproducible process to allow the continuous integration of new transplant data into the NephroCAGE data set. Thus, the NephroCAGE data set can also be used for answering future research questions in the clinical domain nephrology.

In the NephroCAGE consortium, we have conducted the following steps to make transplant data available for development of CPMs. All clinical sites defined a study protocol and applied for approval by their individual institutional review boards. It involved the detailed description of required data attributes and what kind of algorithm and models will be implemented on the data, for example, the following details were provided: the goal of the project, research hypotheses, patient cohort description, list of variables, incorporated data protection regulations, exclusion criteria, and methods in particular details about the incorporated AI methods and epitope matching algorithms.

Each clinical transplant center has to identify and extract relevant transplant data from their local HIS. Figure 2 depicts the involved process steps per category of data from top to bottom. After data extraction and format harmonization, the quality of retrieved data needs to be assessed by subject-matter experts. For example, selected cases need to be checked for inconsistencies in reported data. We will only address inconsistencies that occurred as part of the data extraction process. If data are confirmed to be inconsistent in the primary system, we have to exclude the patient case from further processing until these inconsistencies are addressed by the clinical transplant centers. Furthermore, outliers will also be removed from further processing.

Figure 3 outlines selected clinical steps in the traditional kidney transplantation process: pre- and posttransplant. If a new organ becomes available via organ donation, its specifics are added to a transplant registry (A1), compatibility checks are conducted (A2), for example, blood group, HLA compatibility, and an allocation decision is taken incorporating donor and recipient specifics (A3). While the organ is retrieved from the donor and transported to the transplant center of the recipient (A4), the recipient is prepared for transplantation (A5). After surgery, the function of the donor organ is closely monitored incorporating common laboratory values (B1) and required medication is set up (B2). After a period of recovery, the patient’s release from the hospital is possible, and rehabilitation can start (B3). Regular follow-up appointments for monitoring of kidney function are required to identify eventual risks for the patient and the graft as early as possible (B4).

We will incorporate B cell and T cell epitope matching for donors and recipients as well as our CPMs to provide new insight for clinicians to decide on a donor kidney allocation in steps A2 and A3. If the decision is made for transplantation, the data from surgery and the recipient’s lab data from the hospital stay will be used as input for the CPMs design in steps B1 and B2. Thus, our CPMs can help to provide patient-specific risk scores to clinicians, for example, to adjust immunosuppressant medication accordingly, and improves continuous posttransplant patient monitoring in step B4.

Recently, several algorithms to predict molecular HLA compatibility have been proposed. These algorithms model different immunological pathways of allorecognition. Eplet matching translates HLAs into a set of conformational epitopes, toward which the recipient may form HLA antibodies based on the absence of a corresponding self-epitope [16,17,27,28]. Activation of B cells via conformational epitopes is known to require substantial T cell activation. The model provided by PIRCHE predicts linear T cell epitopes, that may be targeted by the hypervariable T cell receptors. Thus, a combination of specific methods has been shown to further improve histocompatibility prediction [29]. Following this strategy, NephroCAGE aims to combine molecular antibody and T cell epitope matching in a CPM. We aim to implement the molecular matching algorithm as a cloud-based software as a service (SaaS) due to high requirements for storage and computing hardware. The use of a SaaS solution allows flexible control of service quality and user experience. However, submitting genetic data to the SaaS provider may cause conflicts with privacy regulation dependent on local legislation.

Within the NephroCAGE consortium, we aim to develop an open-source command line client for anonymization of HLA data of recipients and donors. For computing the molecular matching scores for donor-recipient pairs, common strategies reducing the resolution of shared information, for example, binning or shuffling, are not applicable given the requirement to obtain exact in silico test results. Therefore, the accurate donor-recipient pair HLA typing will be supplemented by obfuscated HLA data sets. This process considers HLA domain-specific information about haplotype and allele frequencies complicating the identification of individuals in the transmitted data set for the service provider and potential intruders. The molecular matching scores will be correlated to transplant outcome compared to results shown in the literature. Considering these findings as a baseline, we will validate modifications to the prediction pipeline, including a peptide cleavage prediction model.

Various related work showed that AI approaches based on medical input data can result in accurate and robust statistical models to predict patient outcomes [30-34]. For example, supervised tree-based ML algorithms, for example, RF and Extreme Gradient Boosting, have shown promising results for classification tasks for posttransplant risks, for example, for graft failure, patient survival, or graft loss within a certain time period [35-40]. However, most of the existing approaches were research-driven and had only limited access to real-world medical data for their work, for example, using the Scientific Registry of Transplant Recipients data set [41]. Loupy et al [42] developed a risk score for kidney transplant recipients in context of a multicenter study making use of multivariable Cox regression analysis to predict graft loss in patients. Among others, they incorporated the following features: estimated glomerular filtration rate, proteinuria, histology, and HLA antibody [42]. Furthermore, recently advanced approaches based on neural networks making use of large proteomic databases occurred for assessment of immunogenicity and probability to generate antibodies [27,43,44].

From a clinical perspective, NephroCAGE aims to prevent the occurrence of adverse posttransplant end points, for example, loss of function, graft failure, and patient death. Nowadays, regular monitoring is applied to help identifying individual risk factors as early as possible. The use of digital patient records in hospitals for more than a decade provides the data foundation for our work because they form a longitudinal database of historic patient cases, medical decisions, therapies, and disease progression. Today, historical case data are only rarely used for current patient care. Our research hypothesis is that the analysis of historical cases can help to derive prognostic predictions for the individual patient risk to reach severe clinical end points. Based on the analysis of patient-specific parameters, a current patient case will be assigned to a group of similar, historic patient cases.

We will use the existing real-world data from historic patient cases from our clinical partners as a foundation for the definition of specific CPMs per clinical end point of interest [45,46]. Together with our clinical experts, we have defined specific CPMs to predict selected short- and long-term posttransplant events, for example, transplant failure and organ rejection. For example, a CPM trained for prediction of graft failure will cover whether this event will happen (yes or no) within 1 year (short-term) or 5 years (long-term). Such a CPM will predict a floating-point probability p ∈ [0,1], which will be mapped to positive and negative outcome classes. We will minimize the complexity of CPMs by incorporating the principle of data economy, that is, we will only use a minimal set of clinical parameters required to achieve a stable prediction quality. Therefore, we will make us of automatic and manual feature selection approaches to identify most descriptive features for the specific end point from the provided input data set [48-50]. Among others, our CPMs will make use of the following input parameters: recipient and donor data, laboratory values, biopsy results, medication, hospitalization records of the recipient, and HLA compatibility score. Recipient data include sex, weight, height, age at transplantation, end-stage kidney disease, HLA compatibility data, age at graft failure, cause of graft failure, age at death, and many others. Different kinds of follow-up data, for example, weight, and blood pressure, as well as laboratory values, for example, serum creatinine and daily protein-urea. In the case of kidney rejection or failure, a biopsy is performed and analyzed by a pathologist. For interpretation of renal allograft biopsies, Banff classifications are also available in the NephroCAGE data set.

Once a CPM has been trained at a clinical site, it will be shared with other clinical partners in Canada and Germany for validation and continuous training. CPM release versions will be packaged and deployed for execution to individual clinical sites using Docker containers. Thus, comparable small CPMs are exchanged whilst sensitive transplant data do not leave their protected clinical sites.

The current clinical transplantation process outlined in Figure 3 depicts multiple steps where prognostic predictions provided by NephroCAGE CPMs can support clinicians. In the following, we distinguish between pre- and posttransplant use of NephroCAGE CPMs: (1) pretransplant: the use of CPMs prior to transplantation can support more advanced genetic matching of donor and recipients and provide helpful insights for organ allocation; and (2) posttransplant: after transplantation CPMs can also incorporate patient-specific details on the graft function, for example, by including the latest prognosis, which provides a more specific view on the graft. We will focus on binary classifiers predicting short-term (1 year) and long-term (up to 8 years) outcomes post transplantation.

The use of patient-specific risk scores is well known in medicine, for example, Glasgow Coma Scale, acute physiology and chronic health evaluation, and sepsis-related organ failure assessment for intensive care patients [51-53]. Risk scores are often used to stratify patients at risk or to predict selected aspects for patient care. They are often designed to use multiple values, for example, latest observational and laboratory values, and combine them toward a single numeric value for a selected clinical outcome. When a patient has a follow-up appointment or encounters any complication, latest data can be incorporated to update the patient-specific risk score.

We aim to define a patient-specific risk score for selected posttransplant events to provide additional insights for nephrologists during posttransplant care. The risk score is a low-dimensional metric representing the overall risk of developing posttransplant complications and will contribute to steps B1, B2, and B4 of the clinical process outlined in Figure 3. It will be calculated by combining the outcome of multiple CPMs and additional patient-specific parameters into a single clinical parameter. Thus, it can support clinicians in continuously monitoring selected kidney function parameters or initiating adequate action as early as possible. Based on the risk score, we will be able to classify patients into low-, medium-, and high-risk patients comparable to a traffic-light schema. Patients classified as high-risk patients will require increased systematic monitoring to prevent complications as early as possible, whereas patients classified as low-risk patients are not expected to develop severe events in the near future. This helps to use the available clinical workforce more efficiently, especially in times of a shortage of skilled labor.

Figure 4 depicts the building blocks of the NephroCAGE FLI, that is, from bottom to top: local transplant data accessed by local FLI runtimes, a federation layer for exchange of CPMs and data, as well as AI-based model making use of the NephroCAGE FLI to support clinicians in gaining medical insights. Each NephroCAGE clinical partner will join the NephroCAGE FLI by installing and configuring a local NephroCAGE FLI runtime environment on a dedicated host. After transplant data have been extracted from local clinical systems and harmonized, the host running the local FLI runtime environment is granted access to the data. Afterwards, the training of CPMs can be performed on the local data set. Once a stable CPM version becomes available, it will be released for sharing between partners using the NephroCAGE FLI. As a result, pretrained CPMs can be exchanged via the NephroCAGE FLI to facilitate model training even across country borders.

We will use DLT such as an Ethereum blockchain network to have decentralized storage for communicating model updates and code between clinical transplant centers without the need for a dedicated central authority [54]. For support of model training, we will implement an institutional incremental learning approach, where members retrain models one after another and compare different collaborative learning mechanisms with each other [23]. The aggregation of model values is well-established for parameter-based approaches like neural networks. However, only limited research investigates the aggregation of tree-based or kernel-based approaches like RFs or support vector machines, which are relevant for the NephroCAGE use cases.

An expert-facing web app will be developed by the consortium as clinical demonstrator. It will be designed using a representation state transfer (REST) API, which allows integration into existing clinical information systems, for example, T-Base at Charité [55]. The NephroCAGE clinical demonstrator will be used by clinicians to gain insights into patient-specific risk scores including additional information for prospective treatment. Therefore, selected data about individual patients will be exchanged with the CPM to calculate the individual probability for posttransplant risks. As a result, we will provide our CPMs in a local deployable way, that is, the CPMs will be executed by the clinical partners, to preserve privacy of any kind of patient data. Furthermore, the clinical demonstrator will serve as an evaluation platform to identify features that can be intervened in to improve outcome.

To facilitate the integration into existing clinical IT infrastructures, we will follow widely adopted internet protocols (HTTP and HTTPs) and well-known software development paradigms for the development of our CPMs and the clinical demonstrator. Therefore, we will develop the NephroCAGE CPMs as modular software components in Python providing an open API to expose their provided functionality for integration into existing software systems. Thanks to the API of the CPMS, the incorporated programming language and software stack remains transparent for the use of the client app. Through the API a stable software interface describing the required in- or output parameters is available, which will facilitate the integration into our clinical demonstrator and other existing clinical software systems. The REST software paradigm guides the development of web app upon established internet protocols [56]. Hence, RESTful APIs could be designed independent of the existing system with which they will be integrated, making them highly decoupled and modular. We will make use of REST API in our CPM design because it will build on well-established communication protocols for exchange of messages and therefore facilitates the integration into existing clinical IT systems. The execution environment for CPMs requires a diverse set of software dependency to function. Virtualization tools, such as Docker (Docker), can support the packaging of CPM software code, automatically install required software dependencies, and improve software deployment reducing maintenance efforts and hospital IT staff [57]. Thus, our CPMs will be packaged using a Docker container, which reduces deployment and maintenance efforts per clinical site.

Transplant data used to form the NephroCAGE data set—as any patient data—are very sensitive and requires dedicated protection measures. However, the accessibility of such data is crucial to enable training of CPMs with high prognostic value. Running a multinational project requiring access to data from different geographic jurisdictions is complex, for example, due to compliance with individual data protection regulations and variety of data formats and semantic meaning. The NephroCAGE consortium develops the privacy-preserving NephroCAGE FLI to comply with the regulations of Canada and Germany. Furthermore, the NephroCAGE data set is unique in its size, details, and longitudinal completeness. As a result, we believe that the NephroCAGE data set can also serve future research as a profound foundation. For example, we plan to use the NephroCAGE data set to analyze the impact of demographics and health care systems on the posttransplant outcomes in Germany and Canada.

The complexity of transplant data stems from its multiple attributes originating from different sources. It contains longitudinal data about clinical events typically occurring years or decades after transplantation and comorbidities related to the underlying disease, for example, creatinine from laboratories and hospitalization data from HISs. Data extraction and harmonization across partners is one of the most challenging parts of our project, because each center has its individual IT infrastructure to store transplant data. Due to our federated setup, we do not make use of a central data warehouse. Therefore, harmonizing transplant data before developing CPMs is more crucial than in a traditional data warehouse setup. Thus, we will perform specific data preprocessing activities, for example, harmonizing categorical variables with the same name and units and checking numerical variables for outliers.

We will work together with nephrologists and clinical experts to identify clinical end points of interest as basis for CPM development. We will start to investigate the applicability of tree-based models and artificial neural networks as ML methods based on our literature review, because tree-based methods perform better on imbalanced tabular data than neural networks. Furthermore, tree-based methods show better explainability by providing explicit feature importance. Finally, an imbalance of data in kidney transplantation might lead to over-fitting for the majority classes. Consequently, we will apply resampling methods to reduce this effect [58-60].

Genomic data for the HLA compatibility algorithm are among the most sensitive transplant data. Therefore, we aim to implement an anonymization client so that the HLA is not susceptible to various privacy threats. Today, only 5 genetic loci from HLA-A, -B, and -DR are used by Eurotransplant’s graft allocation algorithm despite a total of 11 clinically relevant HLA loci being associated with immunologic risk [15]. Molecular matching, such as PIRCHE, has been shown to provide additional value to serologic HLA matching in assessing risk of developing donor-specific HLA antibodies, thus having the potential to improve long-term transplant outcomes. Furthermore, donor-specific antibodies are a major factor for rejection that deteriorate organ function and result in graft loss. Although we will use the NephroCAGE FLI to share CPMs between partners, still concerns remain about the privacy of patient data in the case of backtracking the ML model coefficient into individual patient outcomes. Therefore, we will incorporate only deidentified data as basis for CPM training, that is, anonymization of sensitive attributes such as follow-up visit dates, surgery date, and birth date.

Furthermore, the prediction results of CPMs alone are not sufficient to fully explore the reasons. Therefore, we will add additional information to the results, which will enable clinicians to perform informed decision-making, for example, most important features used by the model or details about the specific subtree the individual is assigned to. Thus, clinicians will be enabled to assess the provided prediction and also provide feedback about their final decision, which might be different from the prediction. Thus, we trust that clinicians can incorporate additional insights provided by CPMs into their decision-making process, but still remain the final and human decision maker responsible for clinical treatment decision.

We use observational retrospective data over different time periods and different centers. For example, the majority of transplant data contributed to the NephroCAGE data set is provided by 1 center as outlined in Table 1. Furthermore, transplant data from individual centers was collected across different time periods, thus they might differ due to advances in medical practice. This limits data integration from all centers, including preprocessing and modeling of the data in a similar fashion. Different times and eras of transplantation may infer time bias in the model. Different center practices and demographics may be challenging to interpret and might influence the prediction of CPMs. Therefore, CPMs will show the differential importance of features on the desired clinical outcome. However, clinically actionable features must be determined as certain features cannot be changed, for example, the donor’s age. For some clinically relevant factors, interventions must be found, and randomized controlled trials must be established to find appropriate therapy. By diminishing worse outcomes, training and improvement of the CPM may change over time, resulting in inferior model performance, thus deteriorating identifying patients at risk. All the hospitals represent independent cohort in our federated learning setup and hence a particular attention needs to be given in the order of learning to be done on these data set [61].

We have introduced the overall goals of our German-Canadian NephroCAGE consortium, addressing multiple challenges in implementing latest federated learning methods to enable privacy-preserving training of CPMs using real-world transplant data from transplant centers in Germany and Canada. We have highlighted the need to perform data harmonization and develop automated data extraction pipelines per transplant center to ensure reproducibility and scalability of the developed CPMs. Our NephroCAGE FLI will be used for privacy-preserved training and exchange of CPMs, which incorporate data from various hospitals. By including molecular epitope matching into our CPM, we aim to gain insights on donor and recipient HLA-matching beyond the current standard of care. The goal of our CPMs is to support clinicians by identifying severe posttransplant risks as early as possible for individual transplant patients. We aim to develop a clinical demonstrator, which will be used for evaluation of CPMs in a clinical setting. The CPM needs to be verified in randomized clinical studies and evaluated to assess factors that can be used for treatment and modification to improve outcomes. This will especially be achieved if more transplant centers join the consortium and share their transplant data via the NephroCAGE FLI.