Abstract
Resource-constrained medical sensing devices are increasingly expected to support local intelligence, privacy-preserving collaboration, and secure communication in Internet of Medical Things (IoMT) environments. However, deploying federated learning in ICU monitoring remains challenging because hospital data are often non-IID, model updates may be adversarially poisoned, and emerging quantum-security threats require stronger communication protection. This paper presents a federated TinyML framework with an edge-hosted patient-state Digital Twin layer for ICU monitoring. The Digital Twin component is implemented as a lightweight patient-state representation rather than a full physiological simulator. It maintains recent physiological observations, temporal risk trends, predicted status labels, and interpretable alert information at the hospital gateway. Patient-specific adaptation is therefore achieved through individualized temporal state tracking and risk-history synchronization, while the predictive model is collaboratively learned across hospitals. The suggested framework employs decision-tree ensembles due to their lightweight nature, efficient inference capabilities, and interpretability inherent to ESP32-class devices. As decision tree structures are not amenable to average aggregation like neural network parameters, the aggregation of local client models is done via the validation-based ensemble fusion. In order to enhance the resistance of the framework to attacks based on poisoning clients, the Performance-Based Filtering (PBF) method analyzes the performance of each local ensemble against a trusted validation set and excludes low-quality local ensembles from the subsequent global ensemble aggregation. The secure model exchange process utilizes ML-KEM-512 key encapsulation scheme in combination with AES-256-GCM authenticated encryption. The extra overhead of the crypto layer is 0.09 ms per update exchange. The framework is evaluated using a clinician-reviewed synthetic ICU monitoring dataset distributed across three non-IID hospital clients and externally benchmarked using a PhysioNet-based critical-care dataset constructed from shared physiological features. The prediction task uses five status categories: normal, mild, moderate, critical, and an outlier/anomaly category; these labels represent synthetic severity-status classes rather than prospectively validated ICU endpoints. Under a targeted label-flipping attack in which one client relabels critical cases as normal, the proposed PBF strategy achieves 86.79% accuracy, 0.782 macro-F1, 0.904 critical-class recall, 0.837 critical-class F1-score, 0.947 macro-AUROC, and 0.799 macro-AUPRC on the synthetic ICU evaluation. External benchmarking at [Formula: see text] achieves 98.04% accuracy, 0.959 macro-F1, 0.977 critical-class recall, 0.987 critical-class F1-score, 0.999 macro-AUROC, and 0.983 macro-AUPRC. Comparative evaluation against FedAvg, Krum, Trimmed Mean, and Coordinate Median shows that PBF provides stronger protection of critical-class recall under adversarial conditions, although full prospective clinical validation remains outside the scope of this study. Overall, the results indicate that a federated TinyML architecture with lightweight patient-state tracking, validation-based ensemble filtering, differential privacy, and post-quantum-secure communication can support privacy-aware and attack-resilient ICU monitoring experiments in resource-constrained IoMT settings. The study should be interpreted as a technical feasibility and robustness evaluation rather than a fully integrated clinical Digital Twin deployment.