Abstract
Matching patients to clinical trials with large language models is technically feasible, but the prevailing methodology fine-tunes commercial models through external interfaces, transmitting sensitive patient records to third parties, and the resulting screening decisions lack a record that an external auditor can verify. This paper proposes an end-to-end alternative combining privacy-preserving Federated Learning (FL) with a blockchain provenance layer settled on a Layer 2 rollup. On the learning side, we construct an extended benchmark of 3000 patient and trial pairs covering 12 medical conditions and compare FedAvg, FedProx, and FedDyn under simulated clinical heterogeneity with a worst-case label-skew stress client. With all models evaluated on one held-out test set at matched compute, FedDyn reaches an F1 score of 0.885 (0.883 ± 0.008 across five training seeds), matching the early-stopped centralized baseline of 0.878, while an extended 50-epoch centralized run reaches 0.945 (0.944 ± 0.023). Holdout experiments on unseen protocols and unseen conditions quantify the remaining generalization gap. A stratified membership inference evaluation with bootstrap confidence intervals provides preliminary evidence that federated training roughly halves the attacker’s membership advantage. The direction of this reduction is stable across all five seeds, although its confidence interval includes zero and attack area under the curve (AUC) values remain close to the 0.5 random-guessing level throughout. On the provenance side, every decision passes through a deterministic gate. Its evidence is AES-256-GCM-encrypted and stored off-chain on InterPlanetary File System (IPFS), while only cryptographic commitments are anchored by access-controlled smart contracts on the rollup, with a Merkle checkpoint on Ethereum Layer 1. On public test networks, Layer 2 settlement reduces the cost of anchoring each decision by a factor of approximately 53 relative to Layer 1, and the provenance of all 300 test-cohort decisions is independently re-verified end to end. Three Layer 2 hardening mechanisms, an L1 checkpoint, EIP-712 signed consent, and forced inclusion, are demonstrated at feasibility level. The implementation is publicly available on GitHub.