An AI security architect is implementing a privacy-preserving ML pipeline for a healthcare AI model that must learn from patient data across multiple hospitals without the data leaving each hospital's premises. Which privacy-preserving technique achieves this?

B is correct because federated learning trains a global model by having each hospital train a local model on its own data and share only model weight updates (gradients), not the raw patient data—satisfying the data residency requirement. Adding differential privacy noise to the gradient updates before sharing provides a mathematical privacy guarantee, preventing reconstruction of individual patient records from the aggregated model updates. A is wrong because homomorphic encryption allows computation on encrypted data, but it is computationally prohibitive for training large ML models at scale; federated learning is the practical architecture for distributed training without data sharing. C is wrong because tokenizing patient identifiers in training data is a pseudonymization technique that still requires sharing the data with a central training location; it does not achieve training without data leaving the hospital. D is wrong because synthetic data generation can supplement training data, but training a high-quality healthcare model solely on synthetic data may not achieve the accuracy required; it also does not represent learning from the actual distributed patient data.