Privacy-preserving federated tensor decomposition of single-cell immune data: recovering multicellular programs across institutions

Tensor decomposition of donor \times cell-type \times gene single-cell data recovers multicellular programs: coordinated axes of inter-individual transcriptional variation that span cell types and stratify disease. Yet immune single-cell atlases are increasingly multi-institution, multi-ancestry, and governed, so patient cells often cannot be pooled. We present a federated estimator: each site computes a local program subspace, and a coordinator merges these by stacked SVD under federated global-mean centering, provably equivalent (up to truncation) to the centralised decomposition. This centering makes the merge robust to site-label confounding (program AUC 0.957 vs.\ 0.861 for naive per-site centering). Only program subspaces leave a site, and aggregation is compatible with secure aggregation. On a 261-donor systemic lupus erythematosus atlas it recovers the canonical interferon program (ISG enrichment AUC 0.998; case--control separation 0.958; bootstrap ΔAUC=-0.000, 95% CI [-0.004,+0.012] vs.\ centralised), across institution-scale and multi-ancestry partitions, and across three real COVID-19 sites (subspace correlation 0.989). It recovers the program when no site observes all cell types (correlation 1.000, exact by construction), which fixed-feature federated PCA cannot. On an interstitial-lung-disease atlas the recovered program predicts disease better than the best single cell type (AUC 0.96 vs.\ 0.91; gap 95% CI excludes zero) and the advantage survives federation; a liver cohort is consistent (p=0.005). Membership-inference shows secure aggregation cuts attack AUC from 0.91 to 0.61. The method enables cross-institution, cross-ancestry recovery of multicellular immune programs without sharing cells.