Overview
Pulsecure explores a hard question in applied security: how can a system run useful ML inference over sensitive health features while keeping privacy, model integrity, and auditability visible in the design?
The project is a local web proof of concept. A Rust/Axum API serves a React/Vite interface, stores local screening history in SQLite, loads a signed 15-feature cardiovascular model, and runs the encrypted inference workflow through tfhe-rs.
It is not a medical product and should not be used for clinical decisions. The value of the project is engineering: clear boundaries, explicit contracts, and a working privacy-preserving pipeline.
What It Demonstrates
- A Rust web service with a small, auditable API surface.
- Encrypted inference using
tfhe-rs. - Signed model artifacts with a strict feature contract.
- SQLite persistence for local history and audit events.
- Security-conscious defaults such as sanitized logging and web security headers.
- A Python training/export path for regenerating model artifacts.
Technical Shape
The code is organized around a ports-and-adapters style architecture:
| Layer | Responsibility |
|---|---|
web |
React/Vite user interface |
src/web |
HTTP API, static serving, validation, headers |
src/application |
Inference orchestration and diagnosis history |
src/domain |
Patient features, diagnosis records, key material |
src/adapters |
TFHE, SQLite, privacy helpers, log sanitization |
python |
Model training, evaluation, and export |
The active model contract uses 15 NHANES-derived features. The bundled artifact reports calibrated ROC-AUC 0.9185 and quantized ROC-AUC 0.9186, with a threshold tuned for high screening recall. That design intentionally accepts false positives, which is appropriate for a research screening workflow but not for autonomous diagnosis.
Why It Matters
Pulsecure is a good example of turning a security concept into an end-to-end system. It is not just a cryptography demo and not just an ML notebook: it connects a model contract, encrypted computation, API validation, local persistence, web UX, and operational safeguards into one working prototype.
The project also shows restraint. It does not claim production healthcare compliance or clinical validation. Instead, it focuses on the practical engineering pieces that would matter before any real deployment conversation could happen.
Lessons Learned
FHE changes the shape of a normal ML application. Computation is slower, concurrency needs to be controlled, and model format decisions have direct runtime impact. Keeping the model contract explicit and separating the web, application, domain, and adapter layers made the system easier to test and reason about.