Author: admin

London’s biggest fintech Revolut has been valued at $75 million (£57 billion) after completing a share sale that makes it worth more than high street giants Barclays and Lloyds.

The sale brought in new funding from a range of investors including NVentures, the venture capital arm of AI giant Nvidia, the world’s most valuable company.

The transaction was led by US investors Coatue, Greenoaks, Dragoneer, and Fidelity Management & Research, with participation from a “broad group” of institutions including Andreessen Horowitz (aka a16z), Franklin Templeton, and T. Rowe Price Associates.

Staff were given the opportunity to sell their shares as part of the transaction.

Revolut, which is headquartered in Canary Wharf and has more than 65 million customers worldwide, including 12 million in the UK, has the stated ambition to “build the world’s first truly global bank.” It aims to have 100 million retail customers by mid 2027.

In September the company committed to £10 billion of investment over five years to drive its expansion, including a £3 billion commitment to the UK supporting over 1,000 new jobs in the market.

Landmarks this year include final banking authorisation and imminent launch in Mexico, winning a banking incorporation licence in Colombia, and upcoming launch in India.

Revolut’s CEO and co-founder Nik Storonsky, said: “This milestone reflects the remarkable progress we have made in the last twelve months towards our vision of building the first truly global bank, serving 100 million customers across 100 countries. I’d like to thank our team for their determination and energy, and for believing that it is possible to build a global financial and technology leader from Europe.”

CFO Victor Stinga said: “The level of investor interest and our new valuation reflect the strength of our business model, which is delivering both rapid growth and strong profitability. We welcome onboard a series of world-class investors and look forward to working with them for the next stage in Revolut’s evolution.”

Last year Revolut’s revenue grew 72% to $4 billion, while pre-tax profit before tax increased 149% to $1.4 billion.

Nik Storonsky co-founded Revolut with Vlad Yetsenko in 2015 in the Canary Wharf tech hub of Level39.

Introduction

Spinal cord injury (SCI) is a catastrophic neurological disorder that results in permanent motor, sensory, and autonomic dysfunction, profoundly impairing patients’ quality of life.¹ Although surgical decompression, spinal stabilization,² and pharmacological agents such as methylprednisolone have been applied,³ and pharmacological agents such as methylprednisolone have been applied. In particular, the use of high-dose methylprednisolone remains controversial due to its marginal benefit and significant side effects, despite FDA approval.⁴ Therefore, the development of safe, effective, and targeted therapies for SCI remains a critical clinical priority.

Following the primary mechanical insult, SCI triggers a complex secondary injury cascade involving ischemia, hypoxia, oxidative stress, and neuroinflammation.^5,6 Among the earliest immune responders, neutrophils infiltrate the injured spinal cord within hours and can remain active for up to 10 days.⁷ Their recruitment is driven by chemokines, complement proteins, leukotriene B4, and extracellular matrix degradation products.⁸ This migration is primarily mediated by cell adhesion molecules such as P-selectin.^9–11 However, in addition to their innate immune functions, neutrophils also release cytotoxic mediators—including reactive oxygen species (ROS), elastase, and matrix metalloproteinases—that exacerbate tissue damage.¹ Notably, the neutrophil membrane retains its injury-homing ability without releasing intracellular pro-inflammatory contents, making it a promising tool for targeted drug delivery in SCI.

As oxidative stress and inflammation are key drivers of secondary injury, strategies that simultaneously address both processes hold significant therapeutic potential.¹² Nanotechnology-based approaches have shown promise in modulating the pathological microenvironment of SCI by scavenging ROS and attenuating inflammatory responses.^13–18 For instance, a rapamycin-loaded hollow mesoporous Prussian blue nanozyme, modified with a cell-penetrating peptide, has demonstrated dual antioxidative and anti-inflammatory functions and led to functional recovery in SCI models.¹² Similarly, Prussian blue nanocubes have been used as imaging and therapeutic agents to facilitate stem cell therapy for SCI.¹⁹

Hederagenin (HED), a naturally occurring pentacyclic triterpenoid saponin extracted from various herbs, exhibits broad biological activities, including anti-inflammatory, anti-lipid peroxidation, anti-cancer, and neuroprotective effects.^20,21 Previous studies have demonstrated that HED can inhibit inflammation-associated signaling pathways, reduce the production of inflammatory cytokines,^22,23 and exert neuroprotective effects in ischemic stroke models.¹³ Notably, HED has been shown to attenuate sepsis-induced lung injury by suppressing NF-κB-mediated inflammation and modulating macrophage polarization.²³ Although its application in SCI has not yet been explored, these findings suggest its potential utility in neural tissue repair.

Based on these insights, we developed a biomimetic nanoplatform composed of mesoporous Prussian blue nanoparticles (MPBNPs) loaded with HED and camouflaged with neutrophil membrane vesicles (NEUm). This study investigates the targeting capability, anti-apoptotic effect, and therapeutic efficacy of this platform—termed NEU@MPBNPs-HED—in both in vitro and in vivo models of SCI (Figure 1).

Figure 1 Schematic diagram of NEU@MPBNPs-HED construction and its application as a targeted and effective therapeutic for attenuating spinal cord injury.

Materials and Methods

Materials

Mesoporous Prussian blue nanoparticles (MPBNPs) were obtained from XFNANO Materials Technology. HED was provided by Nanjing Spring & Autumn Biological Engineering Co., Ltd. Rodamine B (RhB) was from Shanghai Aladdin Biochemical Technology Co., Ltd. Lipopolysaccharides (LPS, from E. coli 0111:B4) and rhodamine 123 (Rh123) were from Shanghai Yuanye Bio-Technology Co., Ltd. Distearoyl phosphatidyl ethanolamine-fluorescein isothiocyanate (DSPE-FITC) was from Xi’an Ruixi Biotechnology Co., Ltd. The mouse peripheral blood neutrophil isolation kit was sourced from Tianjin Haoyang Biotechnology Co., Ltd. Dialysis membranes (2 kDa) was supplied by Shanghai Gifted High Nine Trading Co., Ltd. Cy5 was supplied by Solarbio Life Technology Co., Ltd, and polycarbonate porous membrane syringe filter (200 nm) was from Shanghai Limin Industrial Co., Ltd. Thermo Fisher Technologies Co., Ltd provided trypsin, phosphate buffer solution (PBS), fetal bovine serum (FBS), glucose-free Dulbecco’s modified Eagle medium (DMEM), and high-glucose DMEM were obtained from Thermo Fisher Scientific. The Cell Counting Kit-8 (CCK-8) was from Dojindo Laboratories. Annexin V-FITC/PI Apoptosis Detection and ROS Assay Kits were from Beyotime Biotechnology Co., Ltd. Antioxidant capacity kit (DPPH method) was from Meilian Biotechnology Co., Ltd. Primary antibodies for β-actin, Caspase-9, Caspase-3, Bax, Bcl-2, Cytochrome C, CD86, CD206, Neun, GFAP, NF200, MDA, TNF-α, CD68, Ly6G, iNOS and Arg1 were provided by Cell Signaling Technology Co., Ltd. Hematoxylin and eosin (H&E), horseradish peroxidase (HRP)-conjugated goat anti-rabbit and rabbit anti-mouse secondary antibodies, along with Cy3-linked, 555-linked, and 488-linked goat anti-rabbit secondary antibodies, Hoechst 33342, and DAPI were provided by Servicebio Technology Co., Ltd.

Cells and Mice

Our study exclusively examined female mice. It is unknown whether the findings are relevant for male mice. RAW264.7, HT22, and BV-2 cells from Procell Life Science and Technology Co., Ltd were cultured in high-glucose DMEM supplemented with 10% FBS and 1% penicillin/streptomycin under standard conditions (37 °C, 5% CO₂, humidified atmosphere). All cell lines were authenticated and confirmed to be free of mycoplasma contamination through routine PCR-based testing prior to experimentation.

Female C57 BL/6J mice (8 weeks old) were purchased from Jinan Xingkang Laboratory Animal Technology Co., Ltd. All animal procedures were approved by the Institutional Animal Care and Use Committee (IACUC) of The Second Qilu Hospital of Shandong University (Approval No. KYLL2024550) and conducted in compliance with the animal welfare guidelines as stipulated in the institutional guidelines (Directive 2010/63/EU in Europe) for the care and use of animals.

LPS Treatment

BV-2 cells were seeded in 6-well plates at a density of 1 × 10⁶ cells/well and treated with LPS (1.0 μg/mL) for 24 hours to induce an inflammatory response. After stimulation, cells were treated with PBS, NEUm, MPBNPs, NEU@MPBNPs, HED, MPBNPs-HED, and NEU@MPBNPs-HED. PBS-treated cells served as negative controls, and sham cells (without LPS) served as baseline controls.

Oxygen Glucose Deprivation/Reoxygenation (OGD/R) Treatment

HT22 cells were seeded at 5 × 10⁴ cells/well in 24-well plates and incubated in glucose-free DMEM in a hypoxic chamber (1% O₂, 5% CO₂, 94% N₂) at 37 °Cfor 90 minutes. For reoxygenation, cells were cultured in high-glucose DMEM under normoxic conditions for 24 hours. Subsequently, cells were treated with PBS, NEUm, HED, MPBNPs, NEU@MPBNPs, MPBNPs-HED, or NEU@MPBNPs-HED. PBS-treated cells served as injury controls, and sham cells were cultured in normal conditions throughout.

Spinal Cord Injury Model

Female C57 BL/6J mice were anesthetized with isoflurane, and an incision was made in the lower thoracic region of the back to expose the spine, followed by dorsal laminectomy at the T9 level. After fixing the spine, a moderate contusive spinal cord injury (70 kD force) was induced using the Infinite Horizon Impactor (PSI, USA). The muscles and skin were then sutured. Sham mice underwent similar procedures without spinal cord impact.

Preparation of Neutrophil Membrane (NEUm) Nanovesicles

Neutrophils were isolated from the whole blood of female C57 BL/6J mice using the Percoll gradient method. Activated neutrophils were obtained by treating with LPS (0.1 mg/mL) for 4 hours. Plasma membrane was isolated as described by Pilchler et al, weighed and stored at −80°C.

Preparation of MPBNPs-HED

3 mg HED and 3 mg MPBNPs were mixed in 2 mL PBS and stirred for 24 hours. After dialysis using a 2 kDa membrane to remove unloaded HED, the post-dialysis samples were collected to determine HED concentration. Encapsulation efficiency (EE) and loading efficiency (LE) were calculated.

Construction of NEU@MPBNPs-HED

Equal volumes of NEUm nanovesicles and MPBNPs-HED were fused by ultrasound and passed through a syringe filter (200 nm) 20 times. Free NEUm was removed by centrifugation (2500 rpm, 10 minutes) to obtain NEU@MPBNPs-HED.

Characterization of NEU@MPBNPs-HED

Transmission electron microscopy (TEM) was applied to evaluate the size and encapsulation of nanoparticles. Surface charge was determined using a Zetasizer Nano ZS. UV–vis spectrometry (ScanDrop) was used to detect NEU@MPBNPs-HED absorbance.

Release Property of HED in NEU@MPBNPs-HED

To verify the characteristics of pH response release, HED release from NEU@MPBNPs-HED was assessed in PBS at pH 7.4 and pH 5.4. Samples (1 mL) were dialyzed in 20 mL PBS at 37°C. HED release was quantified by measuring absorbance at 405 nm.

NEU@MPBNPs Biocompatibility

To evaluate the biocompatibility, we calculated their hemolysis rate and observed the phagocytosis activity of macrophage. Different concentrations of NEU@MPBNPs or MPBNPs blended with 5% red blood cell (RBC) suspensions were incubated at 37°C for 2 hours, and then centrifuged. Absorbance of supernatants was measured at 545 nm, and hemolysis ratio was calculated.

To evaluate macrophage phagocytosis capacity, RhB-conjugated NEU@MPBNPs or MPBNPs were co-cultured with RAW264.7 cells and then observed by laser confocal fluorescence microscopy (LCFM) after stained with Hoechst 33342.

Evaluation of the Injury Repair Effects of NEU@MPBNPs-HED in vitro

Targeting Property Assessment In Vitro

DSPE-FITC-labeled NEUm were cocultured with OGD/R-pretreated or untreated HT22 cells for 8 hours. And then fluorescence signals were observed under LCFM.

Injury Repair Effects Assessed by CCK-8

OGD/R-pretreated HT22 cells were treated with PBS, NEUm, HED, MPBNPs, NEU@MPBNPs, MPBNPs-HED, or NEU@MPBNPs-HED (HED concentration: 2.0 μg/mL) for 24 hours. The cell viability was assessed based on the protocol of CCK-8.

Apoptosis Assessment

OGD/R-pretreated HT22 cells were treated as above, and then stained with Annexin V-FITC/PI to assess cell apoptosis under LCFM.

Mitochondrial Membrane Potential (MMP) Assessment

HT22 cells were treated as above, stained with Rh123, and observed under LCFM.

Reactive Oxygen Species (ROS) Assessment

HT22 cells were treated as above, and stained according to the protocol of ROS Assay Kit, followed by observation under LCFM.

Free Radical Scavenging Assayed by DPPH Method

HT22 cells were treated as above, and processed in accordance with the instructions of the DPPH kit. The absorbance value (A) at 515 nm was measured, and the clearance rate was calculated according to the formula: Clearance rate (%) = (1-(A_sample-A_blank)/A_control)×100%.

Immunoblot Assay

Protein extracts were quantified, and β-actin, Caspase-3, Caspase-9, Bax, Bcl-2, Cytochrome C, CD86, and CD206 protein levels were analyzed by immunoblotting.

NEU@MPBNPs-HED Distribution Assessment in vivo

After SCI, C57 BL/6J mice were administered Cy5-labeled NEU@MPBNPs or Cy5-conjugated MPBNPs. At 24 hours, spinal cords, brains, and visceral organs were collected, and fluorescence signals were analyzed using Xenogen IVIS Lumina XR imaging system. Spinal cord sections were observed by LCFM.

NEU@MPBNPs-HED Treatment in SCI Mice

After randomization, the mice were treated with PBS, NEUm, HED, MPBNPs, NEU@MPBNPs, MPBNPs-HED, or NEU@MPBNPs-HED. Evaluations were conducted on day 14 using Basso Mouse Scale (BMS) scores, catwalk gait analysis, and electrophysiological analysis. Tissues were collected, fixed, and processed for further analyses.

BMS Score Assessment

Motor function was assessed by two trained researchers on days 1, 7, and 14. Scores ranged from 0 (complete paralysis) to 9 (normal).

Catwalk Gait Assessment

On day 14, Catwalk gait analysis evaluated gait differences, with parameters automatically calculated by the analysis software.

Electrophysiological Analysis

Motor evoked potential (MEP) was recorded on day 14 using an electrophysiological device to assess nerve conduction recovery.

Neun, GFAP, and NF200 Immunofluorescence Assays

Spinal cord sections were stained for Neun, GFAP, NF200, and DAPI, and then observed under LCFM for fluorescence signal analysis. Immunofluorescence staining of spinal cord sections was conducted at 14 days post-injury, a timepoint chosen because it corresponds to the subacute phase of SCI, when neuronal loss, astrocytic activation, and axonal remodeling are clearly detectable.

MDA, TNF-α, Ly6G⁺, CD68⁺, iNOS and Arg1 Immunofluorescence Assays

Spinal cord sections were stained for MDA, TNF-α, Ly6G⁺, CD68⁺, iNOS and Arg1 according to the standard protocol of immunofluorescence staining, and then observed under LCFM for fluorescence signal analysis.

Statistic Analysis

Data were presented as mean ± SD, and SPSS 20.0 (IBM Corp., Armonk, NY, USA) was applied for statistical analysis. Univariate analysis of variance was applied for evaluating the difference between groups, and Tukey posterior tests were conducted (*p < 0.05, **p < 0.01, ***p < 0.001, ****p < 0.0001).

Results

Physicochemical Characterization and Drug Release Properties of NEU@MPBNPs-HED

The NEU@MPBNPs-HED nanocomposite was prepared by first loading HED into mesoporous Prussian blue nanoparticles (MPBNPs) to form MPBNPs-HED, which was then encapsulated into neutrophil membrane (NEUm) nanovesicles (Figure 1). As shown in Figure 2A, transmission electron microscopy (TEM) revealed the characteristic cubic morphology of MPBNPs and the vesicular structure of NEUm, with the final NEU@MPBNPs exhibiting a distinct core–shell configuration. SDS-PAGE analysis further confirmed the retention of membrane proteins after fusion, indicating that the coating process preserved NEUm components (Figure 2B).

Figure 2 Characterization of NEU@MPBNPs-HED. (A) TEM images of (a) MPBNPs, (b) NEUm vesicles, and (c) NEUm-vesicle-camouflaged MPBNPs. Scale bar: 100 nm. (B) SDS-PAGE protein assessment. N, NEUm, NM, NEU@MPBNPs. (C) Particle sizes and (D) zeta potential values of MPBNPs, NEUm vesicles, and NEU@MPBNPs. Data are mean ± SD (n = 3). (E) UV−vis spectra of HED, MPBNPs, NEUm vesicles, and NEU@MPBNPs-HED.

Dynamic light scattering (DLS) and zeta potential measurements showed that the average hydrodynamic diameter of NEU@MPBNPs (~196 nm) was slightly increased compared to MPBNPs, while the surface charge shifted from –20.4 ± 7.6 mV (MPBNPs) to –29.6 ± 4.7 mV, closely matching the NEUm vesicles (–28.9 ± 5.5 mV), as shown in Figure 2C and D. These results suggest successful membrane coating and charge modification consistent with NEUm properties.

UV–vis spectroscopy analysis confirmed the coexistence of characteristic absorption peaks of MPBNPs (710 nm) and HED (405 nm) in the composite. In addition, a strong absorption band was observed near 200 nm, which likely reflects contributions from both MPBNPs and NEUm components. Therefore, while this peak suggests the presence of NEUm in NEU@MPBNPs-HED, we acknowledge that it may also include background absorption from MPBNPs. Taken together with the SDS-PAGE protein profiling results, these findings support the successful construction of the nanocomposite (Figure 2E).

Encapsulation efficiency (EE) and loading efficiency (LE) of HED reached 83.5 ± 4.9% and 70.3 ± 4.8%, respectively (Figure 3A), which are considerably higher than most reported nanoparticle-based systems. Furthermore, pH-responsive drug release was evaluated in PBS at pH 7.4 and 5.4, simulating physiological and acidic inflammatory microenvironments. As shown in Figure 3B, significantly more HED was released at pH 5.4 (90.4% over 48 h), compared to neutral pH (56.2%), indicating enhanced drug release under acidic conditions—a favorable feature for spinal cord injury therapy.

Figure 3 Drug LE of MPBNPs and release rate of NEU@MPBNPs-HED. (A) EE and LE of MPBNPs. (B) Cumulative release rates of HED from NEU@MPBNPs-HED or MPBNPs-HED at different pH values (5.4 and 7.4). Data are mean ± SD (n = 3). Comparison between groups: * p < 0.05.

Biocompatibility of NEU@MPBNPs

Biocompatibility indicators, such as hemolysis and phagocytosis, are key factors that limit the applicability of nanomaterials in clinical settings,²⁴ so we evaluated the biocompatibility of NEU@MPBNPs through hemolysis and phagocytosis assays. To assess hemocompatibility, red blood cells (RBCs) were treated with MPBNPs and NEU@MPBNPs, and hemolysis was measured. Neither MPBNPs nor NEU@MPBNPs led to obvious hemolysis (Figure 4A), with hemolysis ratio for MPBNPs (2.0 mg/mL) being below 2% and hemolysis rate of NEU@MPBNPs being lower (Figure 4B), indicating that NEU@MPBNPs had better hemocompatibility and biosafety.

Figure 4 Biocompatibility of NEU@MPBNPs. (A) Images of RBC suspensions after treatment with different amounts of MPBNPs and NEU@MPBNPs. (B) Hemolytic ratios upon treatment with different amounts of MPBNPs and NEU@MPBNPs. Data are mean ± SD (n = 3). Compared to the MPBNPs group: * p < 0.05. (C) LCFM images of RAW264.7 cells upon culture with MPBNPs-RhB or NEU@MPBNPs-RhB for 24 h. Scale bar: 100 μm. (D) Average fluorescence intensities of RAW264.7 after co-culture with MPBNPs-RhB or NEU@MPBNPs-RhB for 24 h. Data are mean ± SD (n = 3). Compared to the MPBNPs group: **** p < 0.0001.

To evaluate the anti-phagocytosis capability, RhB-labeled MPBNPs or NEU@MPBNPs were co-cultured with RAW264.7 macrophages for 24 hours. As shown in Figure 4C, MPBNPs-RhB treated macrophages showed strong green fluorescence, indicating significant phagocytosis of MPBNPs. Under the same conditions, NEU@MPBNPs-RhB-treated macrophages showed significantly weaker fluorescence, suggesting reduced phagocytosis. The average fluorescence intensity in NEU@MPBNPs-RhB-treated macrophages was significantly lower than that in MPBNPs-RhB-treated cells (Figure 4D). These results indicate that NEUm encapsulation reduced macrophage-mediated clearance. Overall, NEU@MPBNPs demonstrated superior biocompatibility.

Vitro Anti-Injury Effects of NEU@MPBNPs-HED

Targeting Property of NEUm in vitro

To assess the in vitro therapeutic potential of NEU@MPBNPs-HED, HT22 cells subjected to OGD/R insult were used. As shown in Figure 5A, DSPE-FITC-labeled NEUm vesicles exhibited stronger accumulation in OGD/R-treated cells than in untreated cells, confirming enhanced targeting of injured neurons.

Figure 5 In vitro anti-damage efficiency of NEU@MPBNPs-HED. N, NEUm; H, HED; M, MPBNPs; MH, MPBNPs-HED; NM, NEU@MPBNPs; NMH, NEU@MPBNPs-HED; Ctl, control. (A) LCFM image of HT22 cells (a) or OGD/R-treated HT22 cells (b) after coculture with DSPE-FITC-labeled NEUm vesicles for 8 h. Scale bar: 100 μm. (B) OGD/R-treated HT22 cells viability upon administration of PBS, NEUm, HED, MPBNPs, NEU@MPBNPs, MPBNPs-HED, and NEU@MPBNPs-HED for 24 h. Data are mean ± SD (n = 3). Compared to the control group: ns, not significant, **** p < 0.0001; compared to the MPBNPs group: && p < 0.01; compared to the MPBNPs-HED group: # p < 0.05. (C) Apoptosis assessed by fluorescence microscope in OGD/R treated HT22 cells administered with PBS, NEUm, HED, MPBNPs, NEU@MPBNPs, MPBNPs-HED, and NEU@MPBNPs-HED for 24 h. Scale bar: 100 μm. (D) MMP assessment by fluorescence microscope in OGD/R-treated HT22 cells after administered with PBS, NEUm, HED, MPBNPs, NEU@MPBNPs, MPBNPs-HED, and NEU@MPBNPs-HED for 24 h. Scale bar: 100 μm. (E) ROS level evaluation by fluorescence microscope in OGD/R-treated HT22 cells after administered with PBS, NEUm, HED, MPBNPs, NEU@MPBNPs, MPBNPs-HED, and NEU@MPBNPs-HED for 24 h. Scale bar: 100 μm. ((F) Statistical analysis of proportion of dead cells, MMP and ROS. Intergroup comparison: * p < 0.05, *** p < 0.001, and **** p < 0.0001. (G) Free radical clearance rate assessed by DPPH method in OGD/R-treated HT22 cells after administered with PBS, NEUm, HED, MPBNPs, NEU@MPBNPs, MPBNPs-HED, and NEU@MPBNPs-HED for 24 h. Data are mean ± SD (n = 3). Compared to the control group: ## p < 0.01; compared to the MPBNPs group: *** p < 0.001.

Cell viability assays (Figure 5B) revealed that treatment with MPBNPs, NEU@MPBNPs, and NEU@MPBNPs-HED significantly improved cell survival compared to the PBS control, with NEU@MPBNPs-HED showing the highest viability. NEUm alone did not induce a statistically significant effect.

Apoptosis, evaluated by Annexin V-FITC/PI staining (Figure 5C and F), was reduced in the HED, MPBNPs-HED, and NEU@MPBNPs-HED groups, with the latter showing the most pronounced effect.

Mitochondrial membrane potential (MMP), assessed by Rh123 staining (Figure 5D and F), was better preserved in the NEU@MPBNPs-HED group, indicated by decreased fluorescent signal loss.ROS levels, detected using a fluorescent probe (Figure 5E and F), were significantly decreased following treatment with NEU@MPBNPs-HED compared to other treatment groups.

As shown in Figure 5G, MPBNPs perform a good free radical clearance rate (19.84% ±2.795), while NEU@MPBNPs-HED possess the best eliminating rate (51.29%± 1.286), indicating that the nanocomposite demonstrated superior free radical scavenging activity.

Expression Levels of Apoptosis- and Inflammation-Related Proteins

We evaluate the levels of apoptosis-related proteins in HT22 cells and the level of inflammatory markers in BV-2 cells to further elucidate the mechanisms underlying the anti-injury effect of NEU@MPBNPs-HED. Apoptosis is strongly correlated to the activation of caspases, which are classified as promoters (such as Caspase-9) and performers (such as Caspase-3).²⁵ Treatment with NEU@MPBNPs-HED, MPBNPs-HED, or HED led to decreased Caspase-9. As depicted in Figure 6A–C, compared with the control group, the expressions of Caspase-9 and Caspase-3 decreased after treatment with NEU@MPBNPs-HED, MPBNPs-HED or HED, and both of them decreased most significantly in the NEU@MPBNPs-HED group, indicating the strongest anti-apoptosis effect. The discharge of mitochondrial proteins (such as Cytochrome C) is dependent on the MMP, which is highly controlled by the Bcl-2 protein family, such as Bax and Bcl-2.²⁶ Bax can promote apoptosis though oligomerization at the mitochondrial surface to decrease the MMP, while Bcl-2 has the opposite effect.^27,28 The release of Cytochrome C facilitates the formation of apoptosis bodies and caspase activation.²⁹ As shown in Figure 6A–C, Bax and Cytochrome C decreased, and Bcl-2 expression increased after treatment with NEU@MPBNPs-HED, MPBNPs-HED or HED.

Figure 6 Immunoblot analysis of apoptosis-related and inflammatory-associated proteins. Ctl, control; N, NEUm; H, HED; M, MPBNPs; MH, MPBNPs-HED; NM, NEU@MPBNPs; NMH, NEU@MPBNPs-HED. (A) Expression amounts of apoptosis-related proteins in HT22 cells at 24 h after treatment with PBS, NEUm, HED, MPBNPs, NEU@MPBNPs, MPBNPs-HED, and NEU@MPBNPs-HED. (B) Expression amounts of CD86 and CD206 in BV-2 cells at 24 h after treatment with PBS, NEUm, HED, MPBNPs, NEU@MPBNPs, MPBNPs-HED, and NEU@MPBNPs-HED. (C) Relative expression ration of related proteins. Intergroup comparison: * p < 0.05, ** p < 0.01, and *** p < 0.001.

Inflammatory reactions usually lead to a series of secondary insults after SCI, thus inhibition of inflammation at the early stage can provide a good environment for SCI repair.³⁰ CD86 is the cell surface marker of M1-polarized (pro-inflammatory) microglia, and CD206 is the membrane protein of M2-related (anti-inflammatory) microglia.³¹ NEU@MPBNPs-HED inhibited the expression of proinflammatory marker CD86, while increased the expression level of anti-inflammatory marker CD206 (Figure 6B and C), suggesting effective modulation of inflammation.

Vivo Distribution of NEU@MPBNPs

To evaluate the in vivo therapeutic potential and targeting efficiency of NEU@MPBNPs-HED, Cy5-labeled NEU@MPBNPs or MPBNPs were administered to SCI mice. Fluorescence imaging at 24 hours post-injection revealed significantly stronger accumulation of NEU@MPBNPs in the injured spinal cord compared to MPBNPs, with reduced distribution in non-target organs such as the liver, kidney, and brain (Figure 7A–C), indicating enhanced lesion-specific targeting. This result was further validated by fluorescence intensity analysis of DAPI-stained spinal cord sections, which showed significantly higher Cy5 signal in the NEU@MPBNPs group (Figure 7D and E).

Figure 7 In vivo targeting potential of NEU@MPBNPs-HED. (A) Bioluminescence images of mice at 24 h of post-treatment with Cy5-conjugated MPBNPs and Cy5-linked NEU@MPBNPs. (B) Ex vivo bioluminescence images of visceral organs and spinal cords at 24 h of post-treatment with Cy5-conjugated MPBNPs and Cy5-linked NEU@MPBNPs. (C) Semiquantitative assessment of fluorescence signals of spinal cord and other tissue specimens. Data are mean ± SD (n = 3). Compared to the MPBNPs group: *** p < 0.001, and **** p < 0.0001. (D) Fluorescence imaging of spinal cord tissues from mice at 24 h after administration of Cy5-linked MPBNPs and Cy5-conjugated NEU@MPBNPs. Scale bar: 100 μm. (E) Semiquantitative assessment of fluorescence signals of spinal cord sections after DAPI staining. Data are mean ± SD (n = 3). Compared to the MPBNPs group: **** p < 0.0001.

Subsequently, the functional efficacy of NEU@MPBNPs-HED was assessed using Basso Mouse Scale (BMS) scoring, CatWalk gait analysis, motor evoked potentials (MEPs), and immunofluorescence staining of Neun, GFAP, and NF200. These comprehensive evaluations confirmed the neuroprotective and regenerative effects of the treatment in vivo.

BMS Score Analysis

BMS score was used to assess behavioral recovery.³² Compared to the control and NEUm groups, mice treated with HED, MPBNPs, and NEU@MPBNPs-HED showed improved BMS scores, with the NEU@MPBNPs-HED group demonstrating significantly higher scores compared to the MPBNPs-HED group (Figure 8A), indicating enhanced motor recovery.

Figure 8 BMS Score and Catwalk Gait of mice after treatment with NEU@MPBNPs-HED. Ctl, control; N, NEUm; H, HED; M, MPBNPs; NM, NEU@MPBNPs; MH, MPBNPs-HED; NMH, NEU@MPBNPs-HED. (A) BMS Score of the injured mice 14 days after intravenous injection of PBS, NEUm, HED, MPBNPs, NEU@MPBNPs, MPBNPs-HED, and NEU@MPBNPs-HED. Data are mean ± SD (n=3). Comparison between groups: ** p<0.01. (B) Catwalk Gait of the injured mice 14 days after intravenous injection of PBS, NEUm, HED, MPBNPs, NEU@MPBNPs, MPBNPs-HED, and NEU@MPBNPs-HED. (C) Statistic analysis of Regularity index and Max intensity at %. Data are mean ± SD (n=3). Comparison between groups: * p<0.05, ** p<0.01.

Catwalk gait analysis was performed to evaluate hindlimb function recovery.³³ Regularity index describes the exclusive use of normal step sequence patterns during uninterrupted locomotion.³³ Max intensity at % is the time in seconds since the start of a run that the maximum intensity is measured. Max intensity at % is relative to the stand of a paw.³³ As shown in Figure 8B and C, NEU@MPBNPs-treated mice demonstrated better gait parameters compared to MPBNPs-treated mice, and NEU@MPBNPs-HED-treated mice showed significant improvement in gait compared to MPBNPs-HED-treated mice, further supporting the effectiveness of NEUm encapsulation.

Electrophysiological and Histological Assessment of Neural Recovery

MEPs recordings were conducted to assess nerve conduction recovery.³⁴ NEU@MPBNPs-HED-treated mice exhibited larger MEP amplitudes compared to MPBNPs-HED-treated mice (Figure 9A and B), indicating better recovery of nerve conduction function.

Figure 9 MEP analysis of the injured mice 14 days after intravenous injection of PBS, NEUm, HED, MPBNPs, NEU@MPBNPs, MPBNPs-HED, and NEU@MPBNPs-HED. Ctl, control; N, NEUm; H, HED; M, MPBNPs; NM, NEU@MPBNPs; MH, MPBNPs-HED; NMH, NEU@MPBNPs-HED. (A) Recorded MEP of the injured mice. (B) Statistic analysis of the amplitude of MEP. Data are mean ± SD (n=3). Comparison between groups: *** p<0.001.

Neun protein is a well-known neuron marker to investigate neuronal changes.³⁵ Immunofluorescence analysis of spinal cord sections showed increased green fluorescence for Neun in the NEU@MPBNPs-HED group, indicating enhanced neuron recovery (Figure 10A). NF200 is a neurofilament protein involved in axonal sprouting.³⁶ The green fluorescence intensity of NF200 was also strongest in the NEU@MPBNPs-HED group, suggesting better recovery of axonal sprouting (Figure 10B). Additionally, the red fluorescence intensity of GFAP was weakest in the NEU@MPBNPs-HED group, indicating reduced glial scarring and improved neuronal recovery.

Figure 10 Neun, GFAP, and NF200 immunofluorescence staining of the damaged spinal cord tissues. Ctl, control; N, NEUm; H, HED; M, MPBNPs; NM, NEU@MPBNPs; MH, MPBNPs-HED; NMH, NEU@MPBNPs-HED. Neun and GFAP (A), and NF200 and GFAP (B) assays assessing spinal cord injury at 14 days after intravenous injection of PBS, NEUm, HED, MPBNPs, NEU@MPBNPs, MPBNPs-HED, and NEU@MPBNPs-HED. Scale bar: 100 μm.

Antioxidative and Antiinflammation Effect Evaluated by Immunofluorescence Staining

Immunofluorescence staining further confirmed the antioxidative and anti-inflammatory effects of NEU@MPBNPs-HED in spinal cord tissue. MDA (malondialdehyde) is a commonly used indicator of membrane lipid peroxidation, which reflects the degree of intracellular oxidative stress. MDA fluorescence was significantly reduced (Figure 11A), consistent with decreased ROS and enhanced radical scavenging observed in Figure 5E–G. CD68 levels showed no obvious change, while TNF-α expression was markedly decreased (Figure 11B). Moreover, iNOS (M1 marker) showed no significant variation, whereas Arg1 (M2 marker) expression was reduced, and Ly6G fluorescence was also diminished after NEU@MPBNPs-HED treatment (Figure 11C). These results indicate that NEU@MPBNPs-HED effectively attenuates oxidative stress and modulates macrophage-associated inflammatory responses at the tissue level.

Figure 11 (A) MDA, (B) TNF-α and CD68, and (C) Ly6G, iNOS and Arg1 immunofluorescence staining of the damaged spinal cord tissues at 14 days after intravenous injection of PBS, NEUm, HED, MPBNPs, NEU@MPBNPs, MPBNPs-HED, and NEU@MPBNPs-HED. Ctl, control; N, NEUm; H, HED; M, MPBNPs; NM, NEU@MPBNPs; MH, MPBNPs-HED; NMH, NEU@MPBNPs-HED. Scale bar: 100 μm.

Adverse Effect Evaluation by Histological Assay

Histological evaluation based on the H&E-stained sections of major organs, including hearts, livers, spleens, lungs, and kidneys, revealed no abnormalities in any of the treatment groups, including PBS, NEUm, MPBNPs, NEU@MPBNPs, HED, MPBNPs-HED, and NEU@MPBNPs-HED (Figure 12). These results indicate that NEU@MPBNPs-HED and related treatments were safe and did not cause adverse effects.

Figure 12 Histological images of heart, liver, spleen, lung, kidney, and brain samples from mice at 14 days after intravenous injection of PBS, NEUm, HED, MPBNPs, NEU@MPBNPs, MPBNPs-HED, and NEU@MPBNPs-HED. Ctl, control; N, NEUm; H, HED; M, MPBNPs; NM, NEU@MPBNPs; MH, MPBNPs-HED; NMH, NEU@MPBNPs-HED. Scale bar: 100 μm.

Discussion

This study reveals that NEU@MPBNPs-HED, a neutrophil membrane-coated nanoplatform co-delivering HED and MPBNPs, effectively targets the spinal cord lesion and promotes neuroprotection in both in vitro and in vivo SCI models. Compared with previously reported nanotherapies focusing on either anti-inflammatory¹² or antioxidant functions,^13,18 this dual-functional system achieves improved therapeutic outcomes through synergistic suppression of ROS, apoptosis, and neuroinflammation.

Mechanistically, NEU@MPBNPs-HED significantly reduced ROS levels and preserved mitochondrial membrane potential, which corresponded with decreased expression of Caspase-3/9, Bax, and Cytochrome C, and upregulation of Bcl-2. These effects align with earlier findings on HED’s modulation of mitochondrial apoptosis and NF-κB signaling in ischemic models.^18,23 The neutrophil membrane coating further enhanced delivery selectivity to the injured spinal cord, a feature not commonly utilized in prior SCI-targeted nanoplatforms.

Compared to MPBNPs-HED or free HED, the NEU@MPBNPs-HED group achieved better neuronal survival, motor recovery, and reduced glial scarring, as shown by BMS scores, CatWalk gait analysis, MEP amplitude, and immunofluorescence staining. These results underscore the therapeutic advantage of combining biomimetic targeting with responsive drug release for SCI repair.

Despite the promising therapeutic outcomes demonstrated by NEU@MPBNPs-HED, this study has several limitations. First, the in vivo evaluation was limited to a 14-day observation period, which may not fully capture long-term neuroregenerative effects or potential delayed toxicity. Second, while the neutrophil membrane facilitated lesion targeting, the precise molecular mechanisms underlying its homing behavior were not fully elucidated. Furthermore, large-scale extraction and purification of neutrophil membranes, while feasible in laboratory settings, may face hurdles in scalability and cost-effectiveness.And potential differences in immune recognition and response between rodents and humans must be carefully addressed to ensure translational safety and efficacy. Finally, although HED showed strong anti-apoptotic and antioxidant effects, its potential off-target actions and pharmacokinetics in the central nervous system warrant further investigation.

Conclusions

In our study, we developed a nanocomposite composed of neutrophil membrane (NEUm) nanovesicles encapsulating mesoporous Prussian blue nanoparticles (MPBNPs) loaded with Hederagenin (HED), termed as NEU@MPBNPs-HED. This nanocomposite demonstrated improved therapeutic effects compared to free HED and MPBNPs-HED for treating SCI. The NEUm nanovesicles allowed the nanocomposite to target the injury site, mimicking the natural behavior of neutrophils, which are attracted to areas of tissue damage. By camouflaging MPBNPs with NEUm, the nanocomposite evaded immune clearance, enabling it to effectively accumulate at the injury site. Additionally, MPBNPs exhibited efficient drug delivery and safety in vivo. Under the acidic conditions present at the injury site, the degradation of MPBNPs was accelerated, promoting the controlled release of HED and enhancing the therapeutic effect. This study demonstrated that NEU@MPBNPs-HED could improve tissue repair by regulating apoptosis and reducing further damage. The nanocomposite’s safety, targeting ability, and efficacy make it a promising candidate for clinical application as a targeted drug delivery platform for SCI treatment, providing a foundation for future translational research.

Data Sharing Statement

The data are available from the corresponding author on reasonable request.

Ethics Approval

All animal procedures were approved by the Institutional Animal Care and Use Committee (IACUC) of The Second Qilu Hospital of Shandong University (Approval No. KYLL2024550) and conducted in compliance with the animal welfare guidelines as stipulated in the institutional guidelines (Directive 2010/63/EU in Europe) for the care and use of animals.

Acknowledgment

Shandong University Institute of Advanced Medical Research.

Author Contributions

All authors made a significant contribution to the work reported, whether that is in the conception, study design, execution, acquisition of data, analysis and interpretation, or in all these areas; took part in drafting, revising or critically reviewing the article; gave final approval of the version to be published; have agreed on the journal to which the article has been submitted; and agree to be accountable for all aspects of the work.

Funding

This work was supported by National Natural Science Foundation of China (No. 82220108005 and 92468205), Natural Science Foundation of Shandong Province (ZR2023ZD16), Taishan Scholar Program of Shandong Province-Pandeng Taishan Scholars (tspd20210320), and fund for education and training of The Second Qilu Hospital of Shandong University (No. 2023YP34).

Disclosure

The authors declare that there are no conflicts of interest regarding the publication of this paper.

References

1. Dolma S, Kumar H. Neutrophil, extracellular matrix components, and their interlinked action in promoting secondary pathogenesis after spinal cord injury. Mol Neurobiol. 2021;58(9):4652–4665. doi:10.1007/s12035-021-02443-5

2. Bourassa-Moreau É, Mac-Thiong JM, Li A, et al. Do patients with complete spinal cord injury benefit from early surgical decompression? Analysis of neurological improvement in a prospective cohort study. J Neurotrauma. 2016;33(3):301–306. doi:10.1089/neu.2015.3957

3. Kwon BK, Okon E, Hillyer J, et al. A systematic review of non-invasive pharmacologic neuroprotective treatments for acute spinal cord injury. J Neurotrauma. 2011;28(8):1545–1588. doi:10.1089/neu.2009.1149

4. Suberviola B, González-Castro A, Llorca J, Ortiz-Melón F, Miñambres E. Early complications of high-dose methylprednisolone in acute spinal cord injury patients. Injury. 2008;39(7):748–752. doi:10.1016/j.injury.2007.12.005

5. Anjum A, Yazid MD, Fauzi Daud M, et al. Spinal cord injury: pathophysiology, multimolecular interactions, and underlying recovery mechanisms. Int J Mol Sci. 2020;21(20):7533. doi:10.3390/ijms21207533

6. Kobayakawa K, Ohkawa Y, Yoshizaki S, et al. Macrophage centripetal migration drives spontaneous healing process after spinal cord injury. Sci Adv. 2019;5(5):eaav5086. doi:10.1126/sciadv.aav5086

7. Fleming JC, Norenberg MD, Ramsay DA, et al. The cellular inflammatory response in human spinal cords after injury. Brain J Neurol. 2006;129(Pt 12):3249–3269. doi:10.1093/brain/awl296

8. Okada S. The pathophysiological role of acute inflammation after spinal cord injury. Inflamm Regen. 2016;36(1):20. doi:10.1186/s41232-016-0026-1

9. Liou JT, Lee CM, Lin YC, et al. P-selectin is required for neutrophils and macrophage infiltration into injured site and contributes to generation of behavioral hypersensitivity following peripheral nerve injury in mice. Pain. 2013;154(10):2150–2159. doi:10.1016/j.pain.2013.06.042

10. Taoka Y, Okajima K, Uchiba M, et al. Role of neutrophils in spinal cord injury in the rat. Neuroscience. 1997;79(4):1177–1182. doi:10.1016/S0306-4522(97)00011-0

11. Farooque M, Isaksson J, Olsson Y. Improved recovery after spinal cord trauma in ICAM-1 and P-selectin knockout mice. Neuroreport. 1999;10(1):131–134. doi:10.1097/00001756-199901180-00024

12. Shen K, Li X, Huang G, et al. High rapamycin-loaded hollow mesoporous Prussian blue nanozyme targets lesion area of spinal cord injury to recover locomotor function. Biomaterials. 2023;303:122358. doi:10.1016/j.biomaterials.2023.122358

13. Andrabi SS, Yang J, Gao Y, Kuang Y, Labhasetwar V. Nanoparticles with antioxidant enzymes protect injured spinal cord from neuronal cell apoptosis by attenuating mitochondrial dysfunction. J Control Rel. 2020;317:300–311. doi:10.1016/j.jconrel.2019.12.001

14. He J, Qiao Y, Zhang H, et al. Gold-silver nanoshells promote wound healing from drug-resistant bacteria infection and enable monitoring via surface-enhanced Raman scattering imaging. Biomaterials. 2020;234:119763. doi:10.1016/j.biomaterials.2020.119763

15. Yang J, Zhai S, Qin H, Yan H, Xing D, Hu X. Corrigendum to “NIR-controlled morphology transformation and pulsatile drug delivery based on multifunctional phototheranostic nanoparticles for photoacoustic imaging-guided photothermal-chemotherapy” [Biomaterials 176 (2018) 1-12]. Biomaterials. 2019;217(217):119315. doi:10.1016/j.biomaterials.2019.119315

16. Gao A, Liao Q, Xie L, et al. Tuning the surface immunomodulatory functions of polyetheretherketone for enhanced osseointegration. Biomaterials. 2020;230:119642. doi:10.1016/j.biomaterials.2019.119642

17. Li J, Wei J, Wan Y, et al. TAT-modified tetramethylpyrazine-loaded nanoparticles for targeted treatment of spinal cord injury. J Control Rel. 2021;335:103–116. doi:10.1016/j.jconrel.2021.05.016

18. Gao X, Han Z, Huang C, et al. An anti-inflammatory and neuroprotective biomimetic nanoplatform for repairing spinal cord injury. Bioact Mater. 2022;18:569–582. doi:10.1016/j.bioactmat.2022.05.026

19. Kubelick KP, Emelianov SY. Prussian blue nanocubes as a multimodal contrast agent for image-guided stem cell therapy of the spinal cord. Photoacoustics. 2020;18:100166. doi:10.1016/j.pacs.2020.100166

20. Lin R, Liu L, Silva M, et al. Hederagenin protects PC12 cells against corticosterone-induced injury by the activation of the PI3K/AKT pathway. Front Pharmacol. 2021;12:712876. doi:10.3389/fphar.2021.712876

21. Shen Y, Teng L, Qu Y, et al. Hederagenin suppresses inflammation and cartilage degradation to ameliorate the progression of osteoarthritis: an in vivo and in vitro study. Inflammation. 2023;46(2):655–678. doi:10.1007/s10753-022-01763-5

22. Li Y, Dong J, Shang Y, Zhao Q, Li P, Wu B. Anti-inflammatory effects of hederagenin on diabetic cardiomyopathy via inhibiting NF-κB and Smads signaling pathways in a type-2 diabetic mice model. RSC Adv. 2019;9(45):26238–26247. doi:10.1039/C9RA02043H

23. Wang L, Zhao M. Suppression of NOD-like receptor protein 3 inflammasome activation and macrophage M1 polarization by hederagenin contributes to attenuation of sepsis-induced acute lung injury in rats. Bioengineered. 2022;13(3):7262–7276. doi:10.1080/21655979.2022.2047406

24. Liu J, Chen X, Xu L, et al. Neutrophil membrane-coated nanoparticles exhibit increased antimicrobial activities in an anti-microbial resistant K. pneumonia infection model. Nanomedicine. 2023;48:102640. doi:10.1016/j.nano.2022.102640

25. Baechler BL, Bloemberg D, Quadrilatero J. Mitophagy regulates mitochondrial network signaling, oxidative stress, and apoptosis during myoblast differentiation. Autophagy. 2019;15(9):1606–1619. doi:10.1080/15548627.2019.1591672

26. Youle RJ, Strasser A. The BCL-2 protein family: opposing activities that mediate cell death. Nat Rev Mol Cell Biol. 2008;9(1):47–59. doi:10.1038/nrm2308

27. Westphal D, Kluck RM, Dewson G. Building blocks of the apoptotic pore: how Bax and Bak are activated and oligomerize during apoptosis. Cell Death Differ. 2014;21(2):196–205. doi:10.1038/cdd.2013.139

28. Pistritto G, Trisciuoglio D, Ceci C, Garufi A, D’Orazi G. Apoptosis as anticancer mechanism: function and dysfunction of its modulators and targeted therapeutic strategies. Aging. 2016;8(4):603–619. doi:10.18632/aging.100934

29. Saunders TL, Windley SP, Gervinskas G, et al. Exposure of the inner mitochondrial membrane triggers apoptotic mitophagy. Cell Death Differ. 2024;31(3):335–347. doi:10.1038/s41418-024-01260-2

30. Fan L, Liu C, Chen X, et al. Exosomes-loaded electroconductive hydrogel synergistically promotes tissue repair after spinal cord injury via immunoregulation and enhancement of myelinated axon growth. Adv Sci. 2022;9(13):e2105586. doi:10.1002/advs.202105586

31. Lawrence T, Natoli G. Transcriptional regulation of macrophage polarization: enabling diversity with identity. Nat Rev Immunol. 2011;11(11):750–761. doi:10.1038/nri3088

32. Zhou K, Zheng Z, Li Y, et al. TFE3, a potential therapeutic target for spinal cord injury via augmenting autophagy flux and alleviating ER stress. Theranostics. 2020;10(20):9280–9302. doi:10.7150/thno.46566

33. Zheng G, Zhang H, Tail M, et al. Assessment of hindlimb motor recovery after severe thoracic spinal cord injury in rats: classification of CatWalk XT^® gait analysis parameters. Neural Regen Res. 2023;18(5):1084–1089. doi:10.4103/1673-5374.355763

34. Yuan F, Peng W, Yang Y, et al. Endothelial progenitor cell-derived exosomes promote anti-inflammatory macrophages via SOCS3/JAK2/STAT3 axis and improve the outcome of spinal cord injury. J Neuroinflammation. 2023;20(1):156. doi:10.1186/s12974-023-02833-7

35. Xie L, Wu H, He Q, et al. A slow-releasing donor of hydrogen sulfide inhibits neuronal cell death via anti-PANoptosis in rats with spinal cord ischemia‒reperfusion injury. Cell Commun Signal. 2024;22(1):33. doi:10.1186/s12964-023-01457-x

36. Zhu S, Ying Y, Ye J, et al. AAV2-mediated and hypoxia response element-directed expression of bFGF in neural stem cells showed therapeutic effects on spinal cord injury in rats. Cell Death Dis. 2021;12(3):274. doi:10.1038/s41419-021-03546-6

Problem statement

Despite its privacy-preserving design, the Beacon protocol is vulnerable to membership inference attacks that can reveal whether an individual is part of a dataset, potentially compromising sensitive information. Existing defenses [4, 7, 12, 18], aim to mitigate these risks but often assume static or batch-query environments. Additionally, current game-theoretic approaches [12, 18] model the problem as a Bayesian game which provides a single perturbation-based solution for all users, leading to sub-optimal privacy protection. In reality, attackers can adapt their strategies in sequential-query settings, making these defenses less effective. Hence, we focus on the problem of designing defenses for evolving and more sophisticated attacks.

The system and threat model

The beacon system responds to received queries on the presence of alleles in the connected database(s) and return ’yes’ or ’no’ response for each dataset. Without losing generality, we assume the beacon is connected to a single database. The protocol operates in an authenticated online setting. That is the querier logs in before posing potentially multiple queries. The system has access to previous queries made by the same querier. This continuous access enables the protocol to accumulate information over time, improving its effectiveness in detecting membership inference attacks. In this context, the beacon assigns probabilities to “yes” responses, reflecting the honesty rate of the system. On the other hand, the honesty rate for “no” responses is always set to one, as research has demonstrated that altering “no” responses to “yes” does not enhance privacy protection for individuals within the system [10]. Note that the beacon publicly shares the honesty rate associated with every answer in our setting, which assumes a very strong adversary. If the querier repeats a previously posed query, the same response is returned, ensuring consistency.

We consider a passive adversary who has access to an individual’s genome and seeks to perform a likelihood ratio test (LRT)-based membership inference attack. The adversary aims to conduct a hypothesis test to confidently determine whether the target individual’s genomic data is included in the dataset accessible via the beacon protocol. We assume the adversary can submit multiple queries without any auxiliary information and that the queries and corresponding responses are independent of each other, i.e., not in linkage disequilibrium. Additionally, we assume the adversary has access to the genomes of a control group of individuals with similar genetic backgrounds to individuals in the beacon dataset, denoted as C.

Similar to many membership inference attacks in the literature [3,4,5, 10], we employ a LRT-based attack. The genome of an individual i can be represented as a binary vector, (varvec{d}_{varvec{i}} = {d_{i1}, . . . ,d_{ij}, . . . ,d_{im}}) where (d_{ij}) denotes the presence of SNP j (1 for “yes”, 0 for “no”) and m denotes the number of known SNPs. The beacon, after receiving a query set, Q consisting (k) queries, generates a binary response set (varvec{x}) where (x_j) denotes the presence of the SNP in the beacon for the (j^{th}) query in Q ((Q_j)).

Assuming that the MAFs for the SNPs are public, the optimal attacker constructs a list Q which contains the SNPs of the victim. It is sorted in ascending MAF order. Let the null hypothesis ((H_0)) refer to the case in which the queried genome is not in the Beacon and the alternative ((H_1)) is otherwise.

where (delta) represents the probability of sequencing error, (D_n^i) is the probability that none of the n individuals in the beacon having the allele at position j and (D_{n-1}^j) represents the probability of no individual except for the queried person having the allele at position j. (D_{n-1}^j) and (D_n^j) are defined as follows: (D_{n-1}^j = (1 – f_j)^{2n-2}) and (D_n^i = (1 – f_i)^{2n}), where (f_j) represents the MAF of the SNP at position j. Then, the LRT statistic for person i in the beacon is determined as Eq. 3.

While Raisaro et al. (2017) assume that the beacon is honest with all answers, Venkatesaramani et al. (2023) incorporate the fact that the beacon might be lying in the formulation. They introduce a binary variable (y_j) to indicate if the response for the (j^{th}) query was flipped. They consider (Q_1) as the subset of (Q) with (x_j = 1) and (Q_0) as the subset with (x_j = 0). Let (A_j = log frac{1 – D_n^j}{1 – delta D_{n-1}^j}) and (B_j = log frac{D_n^j}{delta D_{n-1}^j}). Thus, by defining (h_j) as the complement of (y_j), representing honesty, the LRT function can be rewritten as in Eq. 4.

We use Eq. 4 but relax the assumption that (varvec{h}) is a binary vector. We define (varvec{h}) as ({h_jin mathbb {R}:0 le h_j le 1)} where (h_j = 1) indicates an honest response and if (x_j = 0), then (h_j = 1). Thus, the beacon can incorporate uncertainty into the responses and fine-tune the honesty level as desired.

The adversary can decide if the individual (i) is a member of the dataset when (L_i(Q, varvec{x}, varvec{h})) falls below a predefined fixed threshold (theta) [7, 19]. The attacker simulates the attack on the control group C and picks the one that balances precision and recall. However, fixed thresholding can be bypassed using various defense mechanisms [10]. We rather adopt adaptive thresholding, which is a more effective and realistic technique that can work in an online setting and can adjust the threshold (theta) based on the response set (varvec{x}) to the queries Q: (theta (Q,varvec{x})). It ensures the false positive rate for an attack does not exceed a predefined rate [10].

Background on game theory and reinforcement learning (RL)

A Bayesian game is a game with simultaneous moves/actions where players have incomplete information about each other. An (alpha)-Bayesian game is an extension where instead of having precise probabilistic beliefs, players work with a set of possible probability distributions. The parameter (alpha) reflects the players’ level of ambiguity aversion. Stackelberg games, on the other hand, involve a leader-follower structure, where the leader moves first and the follower responds. The leader’s strategy accounts for the fact that the follower will optimize their response after observing the leader’s move. RL has been used to model Stackelberg games in various domains [20,21,22]. RL enables both the leader and follower to learn and adjust their strategies dynamically in real time. It is very effective in games with large actions or state spaces because it can approximate optimal strategies without exhaustively exploring all possibilities.

RL techniques rely on Markov Decision Processes (MDPs), including the following fundamental components: State s represents the state of the world; Action space A is the set of all valid actions available to a player in a given environment; Reward R function computes the reward for a specific state and action, and sometimes it also depends on the next state; Policy (pi) is a rule used by an agent to decide what actions to take by mapping the states of the environment to actions. The environment conveys the current state to the agent and changes with respect to the agent’s actions by transitioning to a new state. It provides a reward or penalty; Value Function V estimates how good a state is, and (Q^{pi }) estimates how good a state-action pair is in terms of long-term rewards. The difference is the advantage (hat{A}); Discount Factor (gamma in [0,1]) weighs how much future rewards are valued compared to immediate rewards.

Privacy and utility definitions

We define the function (p_i) to measure the privacy risk of an individual (i). This function compares the log-likelihood ratio test (LRT) value of individual (i) with the LRT values of all individuals in a control group. It then calculates the percentage of control group members whose LRT values are greater than that of individual (i). It is defined as (p_i(Q, varvec{x}, varvec{h}, C) = [ sum nolimits _{t in C} textbf{1}_{L_i(Q, varvec{x}, varvec{h}) le L_t(Q, varvec{x}, varvec{h})} ] / |C|) where (L) represents the LRT, computed based on the attacker’s set of queries (Q) and sharer’s responses (varvec{x}) as previously described. This function allows us to quantify the risk of re-identification over time as more queries are posed: A lower, rapidly decreasing value is interpreted as high risk, indicating that the probability of correctly re-identifying an individual is increasing.

We quantify the utility of the beacon service using function (u(Q,varvec{h}) = [sum nolimits _{j in Q} (h_j)] / |Q|). The function returns the average honesty level of the responses provided by the system which is captured by the variable (varvec{h}) in the (LRT) function defined in Eq. 4 where (h_j) represents the honesty level for the (j^{th}) query in query set (Q).

Our novel defense strategies

Here, we present a novel game theory-based defense mechanism against LRT-based attacks which can handle a few queries due to the large strategy space. Then, we present the first reinforcement learning (RL)-based solutions.

Stackelberg defender

The interaction between the beacon and the attacker is modeled as a Stackelberg game in which the leader moves first (attacker), and the other player (the beacon) moves subsequently, making decisions based on the leader’s query. The attacker’s strategy in our game is represented by Q where (Q_j) represents the index of (j^{th}) queried SNP where (1 le j le kle m). Unlike in the previous attacks, the attacker can query SNPs not carried by the victim to confuse the beacon service. (varvec{Q} = [Q_1, Q_2, dots , Q_{k}], quad Q_j in {1, 2, dots , m}, quad 1 le j le kle m).

The beacon’s strategy in the game is represented by the vector (varvec{h}) where ({h}_j in [0,1]) for the query j which indicates the honesty rate. We discretize (varvec{h}) for this game and let the beacon choose from four available strategies. The granularity can be increased at the cost of computational time. (varvec{h} = [h_1, h_2, dots , h_{k}], quad h_j in {0.25, 0.5, 0.75, 1}, quad 1 le j le kle m).

To formulate the problem as a Stackelberg game, we use representations of the attacker and defender utility function, naming payoff function. We define the payoff function of the Stackelberg attacker as (1 – p_{victim}(Q, {textbf {x}}, {textbf {h}}, C)) which is the complement of the victim’s privacy. The payoff function of the Stackelberg defender consists of two parts: (i) a privacy term and (ii) a honesty term. The privacy term first computes the LRT values of the individuals in the control group C for the (i^{th}) query using strategy (h_i). Then, we compute the variance in the first quartile of these values to quantify the risk of privacy violation. High variance indicates that an incoming query is posing a re-identification risk. The honesty term is simply (h_i). The final term is the weighted sum of these two terms, where the weights are hyperparameters to the algorithm. Please see Additional file 1: Supplementary Note S1 for the details about the Stackelberg defender’s payoff calculation.

Reinforcement learning-based attackers and defenders

In this section, we discuss our Reinforcement Learning (RL) approach designed to protect individuals’ privacy in the beacon database while preserving system utility. The environment has two main players: the user (regular or attacker) and the beacon service.

States

The beacon agent’s state space (S_b) consists of the user’s (t^{th}) query (Q_t) and the beacon service’s statistical data at time t. We define (varvec{s}_{varvec{b}}) as the beacon state, where (varvec{s}_{varvec{b}} in S_b). Specifically, each state includes (i) the MAF of the queried SNP j, (ii) the minimum and mean LRT (L_i(Q,varvec{x,h})) values among the individuals in each of beacon database and control group before responding the current query, (iii) potential LRT change by lying or not for SNP j, (iv) the minimum (p_i(Q,varvec{x,h},C)) among beacon participants after lying or not, and finally, (v) the beacon’s utility (u(Q,varvec{h})) up to the current query (Q_t). Importantly, the agent only observes summary statistics rather than individual genomes which reduces state complexity and enhances privacy, especially in decentralized or outsourced training scenarios.

The attacker’s state space (S_a) contains information about the victim. The state (varvec{s}_{varvec{a}} in S_a) categorizes the victim’s SNPs into g groups: (g-1) groups based on their MAF values and another group for SNPs that she does not have. Let (s_{min}) and (s_{max}) be the SNPs with the lowest and the highest MAFs in the group, respectively, For each group, (varvec{s}_{varvec{a}}) includes: (i) (L_{victim}(Q_{s_{min}}, x={0}, h={1})), (ii) (L_{victim}(Q_{s_{min}}, x={1}, h={1})), (iii) (L_{victim}(Q_{s_{max}}, x={0}, h={1})), and (iv) (L_{victim}(Q_{s_{max}}, x={1}, h={1})). The attacker assumes the beacon is honest and calculates the LRT ranges for the rarest and most common SNP in each group as if those were the only queried SNPs. (varvec{s}_{varvec{a}}) also contains (i) the number of SNPs, (ii) the minimum and mean LRT values obtained on the control group C at time t, and (iii) (p_{victim}(Q,varvec{x,h},C)) at time t.

Actions

The beacon agent’s continuous action space (A_b) is an honesty rate to choose for the query j. That is, (A_b = left{ varvec{h} in mathbb {R}^k mid 0 le h_t le 1, , forall t in {1, 2, dots , m} right}). The attacker’s action space (A_a) is a SNP group to choose from: (A_a = left{ varvec{a} in mathbb {Z}^k mid 1 le a_t le g, , forall t in {1, 2, dots , m} right}). From the chosen group, a specific query is then randomly selected for querying.

Rewards

We use both intermediate and final rewards to train our agents. The intermediate reward (r_t) is computed as a function R of a given state-action pair at time t: (r_t = R(varvec{s}_t, h_t)). The function (R_b) assesses the trade-off between privacy and utility for the beacon agent for each query: (R_b = p_{victim}(Q, varvec{x}, h, C) + h_t). As articulated, (p_{victim}) represents the privacy of the victim component, and (h_t) represents the utility of the system for (t^{th}) query. This ensures that each action taken by the beacon considers privacy and utility. For the attacker agent, the intermediate reward function (R_a) is defined based on the beacon’s honesty rate for the (t^{th}) query: (R_a = h_t). Here, the attacker’s goal is to maximize the honesty rate from the beacon’s answers to improve the chances of reidentifying the victim.

In the real-world scenario, the beacon does not know which individual the attacker is targeting, and the attacker is unaware of the honesty level of the responses. However, during training, information about the victim’s identity is provided to the beacon agent, and the honesty rate is provided to the attacker agent for the models to converge faster. This information is removed during inference for the system to be realistic. Additionally, the agent’s objective is to maximize a cumulative reward: The sum of all rewards that will be collected after the end of the current episode, discounted by a factor (0<gamma <1) based on the time t: (R = sum nolimits _{t=0}^{infty } gamma ^t r_t). Finally, a final constant reward is given at the episode’s end based on the success of the agent: Beacon receives it if the victim is not reidentified, or the attacker earns it for reidentifying the victim.

Policies

The outputs of our policies are designed as computable functions that depend on a set of trainable parameters (varvec{theta }). These parameters determine the behavior of the policy by mapping the current state of the environment to optimal actions. The beacon and the attacker are trained using different methods. The beacon uses the Twin Delayed Deep Deterministic Policy Gradient (TD3) [23] algorithm which is suitable for continuous action spaces like the beacon’s. TD3 consists of two components: A policy network (actor) (mu _{theta }(varvec{s}_b)) which selects actions (y_t in {A_b}) and two networks (critics): (Q_{phi 1}^{mu }(varvec{s}_b, h_t)) and (Q_{phi 2}^{mu }(varvec{s}_b, h_t)), which estimate the expected cumulative reward for taking action (h_t). The two critics, (phi _1) and (phi _2), are used to mitigate overestimation bias in Q-value estimates by taking the minimum of their outputs during updates. The critic evaluates the Q-value ((Q^{mu }(varvec{s}_b, h_t))) based on the Bellman equation:

where (varvec{s}_{varvec{b}}^{prime }) is the next state sampled from the environment’s transition model (P(varvec{s}_{varvec{b}}^{prime }|varvec{s}_{varvec{b}}, h_t)). The actor is optimized to deterministically select actions that maximize the value predicted by the critic, following the objective function J: (max J(varvec{theta }_{mu }) = mathbb {E}_{varvec{s}_b} left[ V_{phi 1}(varvec{s}_b, mu _{varvec{theta }}(varvec{s}_b)) right]). The policy (mu _{theta }) is then updated to maximize the expected return as estimated by the critics. This update is performed by adjusting the policy parameters (varvec{theta }_mu) using gradient ascent, (varvec{theta }_{mu } leftarrow varvec{theta }_{mu } + alpha _mu nabla _{varvec{theta }_{mu }} J(varvec{theta }_{mu })), for the policy learning rate (alpha _mu).

The attacker operates in a stochastic and discrete action space which requires a different approach for policy optimization: Proximal Policy Optimization (PPO) [24]. PPO also uses actor and critic networks but in contrast to TD3, (i) it uses a single critic to estimate the value function and (ii) the actor chooses actions probabilistically. We define the attacker’s policy (pi _{theta }) given parameters (theta) and the objective function of PPO to be maximized as follows:

where (varvec{theta }_{old}) is the vector of policy parameters before the policy update, (epsilon) is the clipping term to control the learning rate, and (hat{A}_t) is an estimator of the advantage function at timestep t which quantifies the benefit of choosing (a_t) over others in a given state.

We train the agents using two approaches: (1) training against predefined static strategies and (2) training against adaptive agents who can dynamically change strategies. Using approach 1, we train the Optimal Beacon Defender (OBD). This agent was trained against both the optimal attacker and a set of regular users. Thus, it learns to detect the optimal attack. However, an optimal attacker may adapt its strategy by querying SNPs outside the MAF order or targeting SNPs that the victim does not carry. OBD cannot defend against this. To model this attacker, we train the Tactical Beacon Attacker TBA using approach 1, against predefined defense strategies from literature (see Compared methods section). To ensure variability and prevent overfitting, in each episode, and randomly switched the opponent’s strategy during training.

Using approach 2, we train the Generic Beacon Defender (GBD) and the Generic Beacon Attacker (GBA) against each other in a two-player setup. The OBD and TBA are used as the starting point to initialize training. To address inherent challenges in multi-agent reinforcement learning (MARL) within adversarial environments, we implemented a structured training framework with a centralized environment and a shared control group accessible to both agents only during training, e.g., publicly available HapMap samples. Please see Discussion section for a discussion on these design choices.

Datasets

We evaluate of our defense techniques using the 164 individuals in the CEU population of the HapMap dataset [25]. We randomly select (i) 40 individuals as the beacon participants; (ii) 50 individuals for the control group of the beacon; and (iii) 50 individuals for the control group of the attacker. This beacon size is the size considered commonly in the literature [3, 4, 6, 15]. In addition, the beacon size has no effect on the attacker’s behavior as it depends on MAF values extracted from the population. For model building, we assume an attack on 10 randomly selected beacon participants. In each episode, the RL-based defense methods select one individual from this group for training, with control groups shared between the attacker and the beacon only during training. The remaining 30 beacon participants are reserved for system testing.

Experimental setup

We trained OBD and TBA over 100,000 episodes, followed by a 25,000 episode fine-tuning phase for the GBD and GBA. We allowed a maximum of 100 queries per episode and performed training cycles every 10 episodes. For the beacon agent, using the TD3 algorithm, training began after 100 episodes of exploration. The agent was trained with a learning rate of (10^{-4}) for both the actor and critic networks, a discount factor (gamma) of 0.99, and a batch size of 256. The replay buffer size was set to (10^4), with policy noise at 20 percent of the maximum action value and noise clipping set at 50 percent to prevent excessive exploration. The TD3 agent was trained for 50 epochs per update cycle. The attacker agent, on the other hand, was trained for 300 epochs per update cycle using a cyclic learning rate scheduler, with a base learning rate of (10^{-5}) and a maximum learning rate of (10^{-3}). We set the discount factor to 0.99 and applied an epsilon clipping threshold (epsilon) of 0.2 to limit policy updates. We defined the g=6 MAF range groups as follows: [0–0.03.03], (0.03,0.1], (0.1,0.2], (0.2,0.3], (0.3,0.4], and (0.4,0.5]. Training took 29 hours for single-agent sessions. Multi-agent fine-tuning took 34 hours. The only set of hyper-parameters in the Stackelberg game is the weights for the privacy and utility terms in the defender’s reward, which we set to 0.85 and 0.15, respectively.

To assess defenses against biased random queries, we model query behavior that deviates from random. We introduce a tunable risk parameter, (l in [0, 1]), to control the querier’s tendency to select rare variants. The probability of selecting a specific SNP j, denoted P(j), is weighted by its MAF such that (P(j)~=~frac{text {MAF}_j^{(1-l)}}{sum nolimits _{k=1}^{m} text {MAF}_k^{(1-l)}}). In this model, the highest risk level ((l=1)) surpasses the MAF bias, resulting in a uniform query distribution where rare SNPs are just as likely to be selected as common ones. On the other hand, decreasing l models more conservative queriers who are less likely to select rare SNPs. We evaluate our defenses against a spectrum of these query behaviors using l values of 0.2 (low-risk), 0.6 (medium-risk), and 1 (high-risk).

We evaluated all reinforcement learning models on a SuperMicro SuperServer 4029GP-TRT with 2 Intel Xeon Gold 6140 Processors (2.3GHz, 24.75M cache) and 256GB RAM. The RL agents were trained using a single NVIDIA GeForce RTX 2080 Ti GPU. The game theory approach was simulated on a SuperMicro SuperServer with 40 cores in parallel (Intel Xeon CPU E5-2650 v3 2.30 GHz).

Compared methods

We compare our methods with the following baselines and state-of-the-art methods the literature. Honest Beacon: The defender responds truthfully to all queries, setting the lower bound for privacy and the upper bound for utility. Baseline Method: The defender flips (k_b) percent of SNVs with the lowest MAF, establishing a lower bound for effectiveness. Random Flips: Proposed by [4], this method randomly flips (epsilon) percent of unique SNVs, enhancing privacy by adding randomness to responses. Query Budget: Also from [4], this method assigns a privacy budget to each individual, limiting their exposure by reducing their contribution to responses after multiple queries. This budget decreases with each query involving the individual, especially for rare alleles, which pose a higher re-identification risk. Once the budget is exhausted, the individual is removed from future queries to preserve their privacy. Strategic Flipping: The Strategic Flipping [7] approach flips (k_s) percent of SNVs in decreasing order of their differential discriminative power, targeting the most informative variants first. Online Greedy (OG) Adaptive: The OG adaptive method, introduced by [10], is an adaptive thresholding based defense method. Here, the beacon has access to a control group. Based on K lowest LRTs on the control group, the beacon calculates a threshold LRT for every new query, and flips the response whenever any individual’s LRT in the beacon falls below this threshold. Simple Recurrent Neural Network (RNN): As a baseline neural network-based solution, we employ a simple RNN to capture the sequential nature of the attacker’s queries. The model uses a 3-layer GRU with an input dimension of 18 and a hidden dimension of 64. It receives the same input as the state of the corresponding RL attacker agent and predicts the degree of honesty through a sigmoid-activated linear classifier. This RNN-based defense model trains against both Optimal and Random attackers for 200 epochs, with a maximum of 300 queries per individual. At the end of each epoch, we switch the victim to ensure generalization across different users.

The parameters for these approaches were selected to balance privacy and utility effectively. Based on the sensitivity analysis conducted by [7], the following parameter values were identified as optimal for achieving this balance: (k_s) = 5, (k_b) = 10, (epsilon) = 0.25, and (beta) = 0.9. The game-theoretic approach of [12] is not directly comparable to our work as it is using a non-LRT-based formulation of risk and it aims at modifying the summary statistics within the system (e.g., allele frequencies) instead of directly altering the beacon responses like we do. The code and the model were also not available.