Category: 3. Business

The US high yield bond market is on track for its busiest year since 2021 after posting double-digit gains in year-on-year issuance through the first nine months of 2025.

In comparison, high yield markets in Europe and APAC (excl. Japan) were more muted. European issuance declined marginally through the first three quarters of 2025, while APAC (excl. Japan) recorded only a small year-on-year gain.

The US market has delivered strong issuance performance throughout the year despite a pronounced dip in April, when US tariff announcements caused monthly issuance to drop by more than half compared to March’s figures, according to Debtwire.

The market has recovered steadily since then, with September generating the highest monthly issuance figures in the first three quarters of 2025. For the year, total issuance through the first three quarters stands at US$226.15 billion—14.4% higher than the corresponding period in 2024.

Developments in monetary policy have greatly influenced issuance in key markets. In the US, expectations of interest rate cuts—the Federal Reserve lowered rates by a quarter-point in September; its first cut of 2025—encouraged debt issuers to accelerate maturity extensions, spurring considerable refinancing activity. Meanwhile, in Europe, the European Central Bank has held rates steady since its last cut in June. As a result, conditions have been more stable, contributing to more measured issuance levels overall.

In fact, the European market decelerated after a very active Q2—issuance in Q3 dropped by 40.4% compared to the prior quarter. Overall, this dragged down total issuance for the year to US$110.5 billion, a 2.2% drop compared to Q1 to Q3 2024.

In APAC (excl. Japan), an active Q1 anchored a 5.3% gain in year-on-year issuance—reaching US$11.7 billion through the first nine months of 2025—though Q2 and Q3 were considerably quieter. Nevertheless, the region is on track to at least match the US$14.7 billion of total issuance logged in 2024.

Refinancing drives US activity

Refinancing has been the single biggest driver of issuance activity in the US. Stable pricing is giving borrowers the comfort to come to market, refinance existing facilities, and extend maturities.

US refinancing activity totaled US$154.5 billion through the first three quarters of 2025, accounting for 68.3% of overall issuance so far this year. While yields did spike in April, they have subsequently tightened. The average yield to maturity in Q3 2025 stood at 7.2%, the lowest level recorded since early 2022, according to Debtwire.

However, despite a solid year for US high yield activity so far in 2025, the market could soon feel a shift in investor risk appetite.

Bloomberg reports that the spreads between US investment and non-investment grade bonds widened during the first week of November, while the performance of the lowest-rated triple-C bonds has underperformed compared to the overall market. This points to a more risk-averse position among investors, who are leaning more toward safer, investment-grade notes.

Credit quality shapes European market

As in the US, European high yield issuance has also been led by refinancing activity, reaching US$70.6 billion through the first three quarters of 2025, or almost two-thirds (63.9%) of total issuance for the year. The bulk of this activity arose in Q2, when early-year rate cuts by the ECB provided a favorable window for dealmaking.

Average yields have also followed a pattern of moderate tightening, with overall yields to maturity averaging 5.76% by September 2025—the lowest yields for the past 12 months, according to Debtwire.

However, a pricing delta is opening between higher-rated and lower-rated high yield bonds. Debtwire figures show that the yields on double-B-rated bonds averaged 5.2% in Q3 2025, the tightest in three and a half years, whereas the average yields on lower-rated B high yield notes have increased in each quarter in 2025 to reach 7.59% in Q3 2025.

APAC outperforms

As has been the case elsewhere, refinancing has been the dominant contributor to APAC (excl. Japan) high yield issuance in 2025—even more so than in the US and Europe.

Refinancing in the region totaled US$9.5 billion through the first three quarters of the year, accounting for more than 80% of total high yield issuance in APAC (excl. Japan).

Refinancing figures for the region are already well ahead of the full-year totals recorded in both 2024 (US$8.9 billion) and 2023 (US$3.9 billion), although still far off the figures posted pre-pandemic.

Shifts in US trade policy throughout 2025 have put a dent in investor confidence and inhibited issuer appetite for capital-raising across APAC’s export-focused economies. However, following the US-China trade summit in October, tensions have eased somewhat, which could benefit capital markets activity.

Despite tariff-related challenges and uncertainty, Asian high yield bonds have performed well for investors, with asset manager Invesco noting that the asset class has outperformed its counterparts in Europe and the US on returns.

The market has also continued to show signs of stability following a period of concern in China’s real estate sector, which led to several high-profile defaults of large, repeat high yield issuers. Although the industry is continuing to work through a period of restructuring to establish more stable capital structures, it is now on a firmer footing.

Meanwhile, in the non-real estate space, defaults have been negligible. Issuers are proactively pushing out maturity profiles and deepening their liquidity pools, presenting investors with an attractive risk-reward proposition.

The global high yield market is positioned for a strong end to 2025, due in large part to the remarkable performance of US issuers. Refinancing remains the principal driver across all regions, as attractive yields and stable pricing bring borrowers to the market. With investors focusing even more intently on higher-rated credit quality, the stage seems set for a more predictable 2026, although unexpected rate actions by central banks in the key markets may have significant impacts on the activity levels.

Mario Aguilar covers technology in health care, including artificial intelligence, virtual reality, wearable devices, telehealth, and digital therapeutics. His stories explore how tech is changing the practice of health care and the business and policy challenges to realizing tech’s promise. He’s also the co-author of the free, twice weekly STAT Health Tech newsletter. You can reach Mario on Signal at mariojoze.13.

Mental health chatbot developer Slingshot AI wants the world to believe that its smartphone app, called Ash, will do more good than harm. The evidence that the company offers, though, raises more questions than answers.

Founded in 2022, Slingshot has raised $93 million from investors and last summer launched Ash, touting it as “the first AI designed for therapy.” The company says Ash has been used by more than 150,000 people to help them manage everyday struggles like stress and anxiety. Ash is currently free to use by anyone.

Despite its momentum, Slingshot faces an uphill climb to earn trust: It recently complained to the Food and Drug Administration that high-profile news stories about tragedies allegedly tied to generative artificial intelligence products like ChatGPT have “skewed the public’s perception of risk associated with general wellness apps like Ash.” The company wrote that  “Ash can provide enormous benefit at low risk” by employing basic guardrails and transparency. Slingshot believes its safety systems can identify and appropriately respond to risky prompts. The app’s disclaimers state that Ash is not intended for people facing a mental health crisis.

By Stefanno Sulaiman

JAKARTA (Reuters) -State-owned BPJS Ketenagakerjaan, one of Indonesia’s largest institutional investors, ​is keen to invest in firms that provide infrastructure for the ‌artificial intelligence industry if it gets government approval to invest overseas, a director told ‌Reuters.

The fund is awaiting regulatory approval to invest abroad as it seeks to expand beyond limited domestic opportunities, Edwin Ridwan, the firm’s director of investment development, said on Monday. There is no timeline ⁠for the decision, ‌he said.

The fund is seeking approval to invest up to 5% of its total portfolio overseas, he ‍said. The social security fund has 879 trillion rupiah ($52 billion) of assets under management.

“(AI) supply chain will be a good diversification for ​our investment, and it could be in the U.S.‌, Taiwan, Japan and South Korea,” he said.

The fund sees investment opportunities in companies that support the AI sector such as data centres, energy companies that power the AI industry, and cable firms, Edwin said, adding that core AI firms ⁠like the chipmakers were already “too ​crowded”.

He did not rule out possible investment ​in chipmakers such as Nvidia, but said any decision would depend on the firms’ valuation.

Reuters reported in April ‍that the fund ⁠wants to double its exposure to local equities to up to 20% within three years from around 10%. The largest ⁠portion of its money was invested in bonds, with the remainder in deposits ‌and other instruments.

($1 = 16,700 rupiah)

(Reporting by Stefanno ‌Sulaiman; Editing by John Mair)

Marex joins as day-one clearer for SGX Derivatives’ launch of bitcoin and ethereum perpetual futures, meeting institutional demand for transparent access to regulated crypto derivatives.

 

Marex Group plc (NASDAQ: MRX), a diversified global financial services platform, is proud to announce that the firm will serve as a clearer for SGX Derivative’s SGX Crypto Perpetual Futures product, launching today.

Perpetual futures are futures contracts with no expiration date, commonly used by institutional and professional traders for hedging or as a tool in arbitrage trading. With over $187 billion in global daily volumes, they are the most actively traded crypto derivative product, although much of this trading currently takes place on offshore exchanges. From today, SGX Crypto Perpetual Futures contracts will offer traders continuous exposure to bitcoin or ethereum, with the same transparency, operational standards, and risk management frameworks as traditional listed derivatives.

As a clearer for SGX Crypto Perpetual Futures, Marex is facilitating access to this innovative product under a regulated, exchange-cleared framework. This institution-grade model minimises counterparty risk through central clearing and provides greater operational transparency. To ensure transparency and tight pricing, SGX’s perpetual futures contracts will utilise a funding rate mechanism tied to the iEdge CoinDesk Crypto Indices, aligning with trusted institutional standards for price benchmarks for more efficient trading.

Demand for regulated crypto derivatives has increased dramatically following the launch of crypto ETFs, which provided a regulated means for institutions to gain exposure to this new asset class. The average 30-day volume for IBIT futures/options alone now exceeds 880,000 contracts, but pricing on derivatives tied to ETFs can lag behind real-time market movements and spot pricing.

In addition to providing clearing services for SGX’s crypto derivative products, Marex is a major clearer of crypto derivatives on CME, Cboe, Coinbase Derivatives Exchange, and Bitnomial. Marex Group plans to launch a new service offering cash lending collateralised by stablecoins and select crypto assets through Marex Financial, an FCA regulated entity.

Read our disclaimers

STAMP raises $2 million pre-seed to build AI-powered compliance platform

News

• 24 November, 2025

Edit

Arabic

• Saudi Arabia-based regtech STAMP has raised $2 million in pre-seed funding, backed by unknown investors.
• Founded in 2021 by Muyasser Albar and Mohammed Zarei, STAMP specialises in regulatory licensing, registrations, incorporation, and post-incorporation services for Saudi authorities, integrating these processes into a unified interface.
• With the new funding, STAMP aims to advance its artificial intelligence capabilities and continue building a comprehensive regtech solution.

Press release:

STAMP, a Saudi-based regtech startup, announced that it has raised $2 million in a pre-seed funding round to accelerate the development of its AI-powered compliance and corporate operations platform.

Founded in 2021 by Muyasser Albar and Mohammed Zarei, STAMP specialises in regulatory licensing, registration, incorporation, and post-incorporation corporate services. Its core offerings cover applications for licenses, such as Dealing, Managing, Advising, and Arranging, in addition to corporate filings and regulatory processes before Saudi government authorities.

With the new funding, STAMP aims to advance its artificial intelligence capabilities and continue building a comprehensive regtech solution that helps organisations optimise governance, improve compliance readiness, and stay aligned with Saudi Arabia’s evolving regulatory landscape.

STAMP is developing an integrated technology platform that unifies government processes, registration steps, HR workflows, and compliance tasks into a single intelligent dashboard. The solution enhances oversight, increases operational efficiency, and provides companies with a more transparent and structured way to manage legal and regulatory obligations.

This approach reflects the growing demand for RegTech tools that support Saudi companies in navigating increasingly complex corporate requirements. STAMP aims to set a new benchmark for seamless regulatory management across the Kingdom.

London’s biggest fintech Revolut has been valued at $75 million (£57 billion) after completing a share sale that makes it worth more than high street giants Barclays and Lloyds.

The sale brought in new funding from a range of investors including NVentures, the venture capital arm of AI giant Nvidia, the world’s most valuable company.

The transaction was led by US investors Coatue, Greenoaks, Dragoneer, and Fidelity Management & Research, with participation from a “broad group” of institutions including Andreessen Horowitz (aka a16z), Franklin Templeton, and T. Rowe Price Associates.

Staff were given the opportunity to sell their shares as part of the transaction.

Revolut, which is headquartered in Canary Wharf and has more than 65 million customers worldwide, including 12 million in the UK, has the stated ambition to “build the world’s first truly global bank.” It aims to have 100 million retail customers by mid 2027.

In September the company committed to £10 billion of investment over five years to drive its expansion, including a £3 billion commitment to the UK supporting over 1,000 new jobs in the market.

Landmarks this year include final banking authorisation and imminent launch in Mexico, winning a banking incorporation licence in Colombia, and upcoming launch in India.

Revolut’s CEO and co-founder Nik Storonsky, said: “This milestone reflects the remarkable progress we have made in the last twelve months towards our vision of building the first truly global bank, serving 100 million customers across 100 countries. I’d like to thank our team for their determination and energy, and for believing that it is possible to build a global financial and technology leader from Europe.”

CFO Victor Stinga said: “The level of investor interest and our new valuation reflect the strength of our business model, which is delivering both rapid growth and strong profitability. We welcome onboard a series of world-class investors and look forward to working with them for the next stage in Revolut’s evolution.”

Last year Revolut’s revenue grew 72% to $4 billion, while pre-tax profit before tax increased 149% to $1.4 billion.

Nik Storonsky co-founded Revolut with Vlad Yetsenko in 2015 in the Canary Wharf tech hub of Level39.

Introduction

Spinal cord injury (SCI) is a catastrophic neurological disorder that results in permanent motor, sensory, and autonomic dysfunction, profoundly impairing patients’ quality of life.¹ Although surgical decompression, spinal stabilization,² and pharmacological agents such as methylprednisolone have been applied,³ and pharmacological agents such as methylprednisolone have been applied. In particular, the use of high-dose methylprednisolone remains controversial due to its marginal benefit and significant side effects, despite FDA approval.⁴ Therefore, the development of safe, effective, and targeted therapies for SCI remains a critical clinical priority.

Following the primary mechanical insult, SCI triggers a complex secondary injury cascade involving ischemia, hypoxia, oxidative stress, and neuroinflammation.^5,6 Among the earliest immune responders, neutrophils infiltrate the injured spinal cord within hours and can remain active for up to 10 days.⁷ Their recruitment is driven by chemokines, complement proteins, leukotriene B4, and extracellular matrix degradation products.⁸ This migration is primarily mediated by cell adhesion molecules such as P-selectin.^9–11 However, in addition to their innate immune functions, neutrophils also release cytotoxic mediators—including reactive oxygen species (ROS), elastase, and matrix metalloproteinases—that exacerbate tissue damage.¹ Notably, the neutrophil membrane retains its injury-homing ability without releasing intracellular pro-inflammatory contents, making it a promising tool for targeted drug delivery in SCI.

As oxidative stress and inflammation are key drivers of secondary injury, strategies that simultaneously address both processes hold significant therapeutic potential.¹² Nanotechnology-based approaches have shown promise in modulating the pathological microenvironment of SCI by scavenging ROS and attenuating inflammatory responses.^13–18 For instance, a rapamycin-loaded hollow mesoporous Prussian blue nanozyme, modified with a cell-penetrating peptide, has demonstrated dual antioxidative and anti-inflammatory functions and led to functional recovery in SCI models.¹² Similarly, Prussian blue nanocubes have been used as imaging and therapeutic agents to facilitate stem cell therapy for SCI.¹⁹

Hederagenin (HED), a naturally occurring pentacyclic triterpenoid saponin extracted from various herbs, exhibits broad biological activities, including anti-inflammatory, anti-lipid peroxidation, anti-cancer, and neuroprotective effects.^20,21 Previous studies have demonstrated that HED can inhibit inflammation-associated signaling pathways, reduce the production of inflammatory cytokines,^22,23 and exert neuroprotective effects in ischemic stroke models.¹³ Notably, HED has been shown to attenuate sepsis-induced lung injury by suppressing NF-κB-mediated inflammation and modulating macrophage polarization.²³ Although its application in SCI has not yet been explored, these findings suggest its potential utility in neural tissue repair.

Based on these insights, we developed a biomimetic nanoplatform composed of mesoporous Prussian blue nanoparticles (MPBNPs) loaded with HED and camouflaged with neutrophil membrane vesicles (NEUm). This study investigates the targeting capability, anti-apoptotic effect, and therapeutic efficacy of this platform—termed NEU@MPBNPs-HED—in both in vitro and in vivo models of SCI (Figure 1).

Figure 1 Schematic diagram of NEU@MPBNPs-HED construction and its application as a targeted and effective therapeutic for attenuating spinal cord injury.

Materials and Methods

Materials

Mesoporous Prussian blue nanoparticles (MPBNPs) were obtained from XFNANO Materials Technology. HED was provided by Nanjing Spring & Autumn Biological Engineering Co., Ltd. Rodamine B (RhB) was from Shanghai Aladdin Biochemical Technology Co., Ltd. Lipopolysaccharides (LPS, from E. coli 0111:B4) and rhodamine 123 (Rh123) were from Shanghai Yuanye Bio-Technology Co., Ltd. Distearoyl phosphatidyl ethanolamine-fluorescein isothiocyanate (DSPE-FITC) was from Xi’an Ruixi Biotechnology Co., Ltd. The mouse peripheral blood neutrophil isolation kit was sourced from Tianjin Haoyang Biotechnology Co., Ltd. Dialysis membranes (2 kDa) was supplied by Shanghai Gifted High Nine Trading Co., Ltd. Cy5 was supplied by Solarbio Life Technology Co., Ltd, and polycarbonate porous membrane syringe filter (200 nm) was from Shanghai Limin Industrial Co., Ltd. Thermo Fisher Technologies Co., Ltd provided trypsin, phosphate buffer solution (PBS), fetal bovine serum (FBS), glucose-free Dulbecco’s modified Eagle medium (DMEM), and high-glucose DMEM were obtained from Thermo Fisher Scientific. The Cell Counting Kit-8 (CCK-8) was from Dojindo Laboratories. Annexin V-FITC/PI Apoptosis Detection and ROS Assay Kits were from Beyotime Biotechnology Co., Ltd. Antioxidant capacity kit (DPPH method) was from Meilian Biotechnology Co., Ltd. Primary antibodies for β-actin, Caspase-9, Caspase-3, Bax, Bcl-2, Cytochrome C, CD86, CD206, Neun, GFAP, NF200, MDA, TNF-α, CD68, Ly6G, iNOS and Arg1 were provided by Cell Signaling Technology Co., Ltd. Hematoxylin and eosin (H&E), horseradish peroxidase (HRP)-conjugated goat anti-rabbit and rabbit anti-mouse secondary antibodies, along with Cy3-linked, 555-linked, and 488-linked goat anti-rabbit secondary antibodies, Hoechst 33342, and DAPI were provided by Servicebio Technology Co., Ltd.

Cells and Mice

Our study exclusively examined female mice. It is unknown whether the findings are relevant for male mice. RAW264.7, HT22, and BV-2 cells from Procell Life Science and Technology Co., Ltd were cultured in high-glucose DMEM supplemented with 10% FBS and 1% penicillin/streptomycin under standard conditions (37 °C, 5% CO₂, humidified atmosphere). All cell lines were authenticated and confirmed to be free of mycoplasma contamination through routine PCR-based testing prior to experimentation.

Female C57 BL/6J mice (8 weeks old) were purchased from Jinan Xingkang Laboratory Animal Technology Co., Ltd. All animal procedures were approved by the Institutional Animal Care and Use Committee (IACUC) of The Second Qilu Hospital of Shandong University (Approval No. KYLL2024550) and conducted in compliance with the animal welfare guidelines as stipulated in the institutional guidelines (Directive 2010/63/EU in Europe) for the care and use of animals.

LPS Treatment

BV-2 cells were seeded in 6-well plates at a density of 1 × 10⁶ cells/well and treated with LPS (1.0 μg/mL) for 24 hours to induce an inflammatory response. After stimulation, cells were treated with PBS, NEUm, MPBNPs, NEU@MPBNPs, HED, MPBNPs-HED, and NEU@MPBNPs-HED. PBS-treated cells served as negative controls, and sham cells (without LPS) served as baseline controls.

Oxygen Glucose Deprivation/Reoxygenation (OGD/R) Treatment

HT22 cells were seeded at 5 × 10⁴ cells/well in 24-well plates and incubated in glucose-free DMEM in a hypoxic chamber (1% O₂, 5% CO₂, 94% N₂) at 37 °Cfor 90 minutes. For reoxygenation, cells were cultured in high-glucose DMEM under normoxic conditions for 24 hours. Subsequently, cells were treated with PBS, NEUm, HED, MPBNPs, NEU@MPBNPs, MPBNPs-HED, or NEU@MPBNPs-HED. PBS-treated cells served as injury controls, and sham cells were cultured in normal conditions throughout.

Spinal Cord Injury Model

Female C57 BL/6J mice were anesthetized with isoflurane, and an incision was made in the lower thoracic region of the back to expose the spine, followed by dorsal laminectomy at the T9 level. After fixing the spine, a moderate contusive spinal cord injury (70 kD force) was induced using the Infinite Horizon Impactor (PSI, USA). The muscles and skin were then sutured. Sham mice underwent similar procedures without spinal cord impact.

Preparation of Neutrophil Membrane (NEUm) Nanovesicles

Neutrophils were isolated from the whole blood of female C57 BL/6J mice using the Percoll gradient method. Activated neutrophils were obtained by treating with LPS (0.1 mg/mL) for 4 hours. Plasma membrane was isolated as described by Pilchler et al, weighed and stored at −80°C.

Preparation of MPBNPs-HED

3 mg HED and 3 mg MPBNPs were mixed in 2 mL PBS and stirred for 24 hours. After dialysis using a 2 kDa membrane to remove unloaded HED, the post-dialysis samples were collected to determine HED concentration. Encapsulation efficiency (EE) and loading efficiency (LE) were calculated.

Construction of NEU@MPBNPs-HED

Equal volumes of NEUm nanovesicles and MPBNPs-HED were fused by ultrasound and passed through a syringe filter (200 nm) 20 times. Free NEUm was removed by centrifugation (2500 rpm, 10 minutes) to obtain NEU@MPBNPs-HED.

Characterization of NEU@MPBNPs-HED

Transmission electron microscopy (TEM) was applied to evaluate the size and encapsulation of nanoparticles. Surface charge was determined using a Zetasizer Nano ZS. UV–vis spectrometry (ScanDrop) was used to detect NEU@MPBNPs-HED absorbance.

Release Property of HED in NEU@MPBNPs-HED

To verify the characteristics of pH response release, HED release from NEU@MPBNPs-HED was assessed in PBS at pH 7.4 and pH 5.4. Samples (1 mL) were dialyzed in 20 mL PBS at 37°C. HED release was quantified by measuring absorbance at 405 nm.

NEU@MPBNPs Biocompatibility

To evaluate the biocompatibility, we calculated their hemolysis rate and observed the phagocytosis activity of macrophage. Different concentrations of NEU@MPBNPs or MPBNPs blended with 5% red blood cell (RBC) suspensions were incubated at 37°C for 2 hours, and then centrifuged. Absorbance of supernatants was measured at 545 nm, and hemolysis ratio was calculated.

To evaluate macrophage phagocytosis capacity, RhB-conjugated NEU@MPBNPs or MPBNPs were co-cultured with RAW264.7 cells and then observed by laser confocal fluorescence microscopy (LCFM) after stained with Hoechst 33342.

Evaluation of the Injury Repair Effects of NEU@MPBNPs-HED in vitro

Targeting Property Assessment In Vitro

DSPE-FITC-labeled NEUm were cocultured with OGD/R-pretreated or untreated HT22 cells for 8 hours. And then fluorescence signals were observed under LCFM.

Injury Repair Effects Assessed by CCK-8

OGD/R-pretreated HT22 cells were treated with PBS, NEUm, HED, MPBNPs, NEU@MPBNPs, MPBNPs-HED, or NEU@MPBNPs-HED (HED concentration: 2.0 μg/mL) for 24 hours. The cell viability was assessed based on the protocol of CCK-8.

Apoptosis Assessment

OGD/R-pretreated HT22 cells were treated as above, and then stained with Annexin V-FITC/PI to assess cell apoptosis under LCFM.

Mitochondrial Membrane Potential (MMP) Assessment

HT22 cells were treated as above, stained with Rh123, and observed under LCFM.

Reactive Oxygen Species (ROS) Assessment

HT22 cells were treated as above, and stained according to the protocol of ROS Assay Kit, followed by observation under LCFM.

Free Radical Scavenging Assayed by DPPH Method

HT22 cells were treated as above, and processed in accordance with the instructions of the DPPH kit. The absorbance value (A) at 515 nm was measured, and the clearance rate was calculated according to the formula: Clearance rate (%) = (1-(A_sample-A_blank)/A_control)×100%.

Immunoblot Assay

Protein extracts were quantified, and β-actin, Caspase-3, Caspase-9, Bax, Bcl-2, Cytochrome C, CD86, and CD206 protein levels were analyzed by immunoblotting.

NEU@MPBNPs-HED Distribution Assessment in vivo

After SCI, C57 BL/6J mice were administered Cy5-labeled NEU@MPBNPs or Cy5-conjugated MPBNPs. At 24 hours, spinal cords, brains, and visceral organs were collected, and fluorescence signals were analyzed using Xenogen IVIS Lumina XR imaging system. Spinal cord sections were observed by LCFM.

NEU@MPBNPs-HED Treatment in SCI Mice

After randomization, the mice were treated with PBS, NEUm, HED, MPBNPs, NEU@MPBNPs, MPBNPs-HED, or NEU@MPBNPs-HED. Evaluations were conducted on day 14 using Basso Mouse Scale (BMS) scores, catwalk gait analysis, and electrophysiological analysis. Tissues were collected, fixed, and processed for further analyses.

BMS Score Assessment

Motor function was assessed by two trained researchers on days 1, 7, and 14. Scores ranged from 0 (complete paralysis) to 9 (normal).

Catwalk Gait Assessment

On day 14, Catwalk gait analysis evaluated gait differences, with parameters automatically calculated by the analysis software.

Electrophysiological Analysis

Motor evoked potential (MEP) was recorded on day 14 using an electrophysiological device to assess nerve conduction recovery.

Neun, GFAP, and NF200 Immunofluorescence Assays

Spinal cord sections were stained for Neun, GFAP, NF200, and DAPI, and then observed under LCFM for fluorescence signal analysis. Immunofluorescence staining of spinal cord sections was conducted at 14 days post-injury, a timepoint chosen because it corresponds to the subacute phase of SCI, when neuronal loss, astrocytic activation, and axonal remodeling are clearly detectable.

MDA, TNF-α, Ly6G⁺, CD68⁺, iNOS and Arg1 Immunofluorescence Assays

Spinal cord sections were stained for MDA, TNF-α, Ly6G⁺, CD68⁺, iNOS and Arg1 according to the standard protocol of immunofluorescence staining, and then observed under LCFM for fluorescence signal analysis.

Statistic Analysis

Data were presented as mean ± SD, and SPSS 20.0 (IBM Corp., Armonk, NY, USA) was applied for statistical analysis. Univariate analysis of variance was applied for evaluating the difference between groups, and Tukey posterior tests were conducted (*p < 0.05, **p < 0.01, ***p < 0.001, ****p < 0.0001).

Results

Physicochemical Characterization and Drug Release Properties of NEU@MPBNPs-HED

The NEU@MPBNPs-HED nanocomposite was prepared by first loading HED into mesoporous Prussian blue nanoparticles (MPBNPs) to form MPBNPs-HED, which was then encapsulated into neutrophil membrane (NEUm) nanovesicles (Figure 1). As shown in Figure 2A, transmission electron microscopy (TEM) revealed the characteristic cubic morphology of MPBNPs and the vesicular structure of NEUm, with the final NEU@MPBNPs exhibiting a distinct core–shell configuration. SDS-PAGE analysis further confirmed the retention of membrane proteins after fusion, indicating that the coating process preserved NEUm components (Figure 2B).

Figure 2 Characterization of NEU@MPBNPs-HED. (A) TEM images of (a) MPBNPs, (b) NEUm vesicles, and (c) NEUm-vesicle-camouflaged MPBNPs. Scale bar: 100 nm. (B) SDS-PAGE protein assessment. N, NEUm, NM, NEU@MPBNPs. (C) Particle sizes and (D) zeta potential values of MPBNPs, NEUm vesicles, and NEU@MPBNPs. Data are mean ± SD (n = 3). (E) UV−vis spectra of HED, MPBNPs, NEUm vesicles, and NEU@MPBNPs-HED.

Dynamic light scattering (DLS) and zeta potential measurements showed that the average hydrodynamic diameter of NEU@MPBNPs (~196 nm) was slightly increased compared to MPBNPs, while the surface charge shifted from –20.4 ± 7.6 mV (MPBNPs) to –29.6 ± 4.7 mV, closely matching the NEUm vesicles (–28.9 ± 5.5 mV), as shown in Figure 2C and D. These results suggest successful membrane coating and charge modification consistent with NEUm properties.

UV–vis spectroscopy analysis confirmed the coexistence of characteristic absorption peaks of MPBNPs (710 nm) and HED (405 nm) in the composite. In addition, a strong absorption band was observed near 200 nm, which likely reflects contributions from both MPBNPs and NEUm components. Therefore, while this peak suggests the presence of NEUm in NEU@MPBNPs-HED, we acknowledge that it may also include background absorption from MPBNPs. Taken together with the SDS-PAGE protein profiling results, these findings support the successful construction of the nanocomposite (Figure 2E).

Encapsulation efficiency (EE) and loading efficiency (LE) of HED reached 83.5 ± 4.9% and 70.3 ± 4.8%, respectively (Figure 3A), which are considerably higher than most reported nanoparticle-based systems. Furthermore, pH-responsive drug release was evaluated in PBS at pH 7.4 and 5.4, simulating physiological and acidic inflammatory microenvironments. As shown in Figure 3B, significantly more HED was released at pH 5.4 (90.4% over 48 h), compared to neutral pH (56.2%), indicating enhanced drug release under acidic conditions—a favorable feature for spinal cord injury therapy.

Figure 3 Drug LE of MPBNPs and release rate of NEU@MPBNPs-HED. (A) EE and LE of MPBNPs. (B) Cumulative release rates of HED from NEU@MPBNPs-HED or MPBNPs-HED at different pH values (5.4 and 7.4). Data are mean ± SD (n = 3). Comparison between groups: * p < 0.05.

Biocompatibility of NEU@MPBNPs

Biocompatibility indicators, such as hemolysis and phagocytosis, are key factors that limit the applicability of nanomaterials in clinical settings,²⁴ so we evaluated the biocompatibility of NEU@MPBNPs through hemolysis and phagocytosis assays. To assess hemocompatibility, red blood cells (RBCs) were treated with MPBNPs and NEU@MPBNPs, and hemolysis was measured. Neither MPBNPs nor NEU@MPBNPs led to obvious hemolysis (Figure 4A), with hemolysis ratio for MPBNPs (2.0 mg/mL) being below 2% and hemolysis rate of NEU@MPBNPs being lower (Figure 4B), indicating that NEU@MPBNPs had better hemocompatibility and biosafety.

Figure 4 Biocompatibility of NEU@MPBNPs. (A) Images of RBC suspensions after treatment with different amounts of MPBNPs and NEU@MPBNPs. (B) Hemolytic ratios upon treatment with different amounts of MPBNPs and NEU@MPBNPs. Data are mean ± SD (n = 3). Compared to the MPBNPs group: * p < 0.05. (C) LCFM images of RAW264.7 cells upon culture with MPBNPs-RhB or NEU@MPBNPs-RhB for 24 h. Scale bar: 100 μm. (D) Average fluorescence intensities of RAW264.7 after co-culture with MPBNPs-RhB or NEU@MPBNPs-RhB for 24 h. Data are mean ± SD (n = 3). Compared to the MPBNPs group: **** p < 0.0001.

To evaluate the anti-phagocytosis capability, RhB-labeled MPBNPs or NEU@MPBNPs were co-cultured with RAW264.7 macrophages for 24 hours. As shown in Figure 4C, MPBNPs-RhB treated macrophages showed strong green fluorescence, indicating significant phagocytosis of MPBNPs. Under the same conditions, NEU@MPBNPs-RhB-treated macrophages showed significantly weaker fluorescence, suggesting reduced phagocytosis. The average fluorescence intensity in NEU@MPBNPs-RhB-treated macrophages was significantly lower than that in MPBNPs-RhB-treated cells (Figure 4D). These results indicate that NEUm encapsulation reduced macrophage-mediated clearance. Overall, NEU@MPBNPs demonstrated superior biocompatibility.

Vitro Anti-Injury Effects of NEU@MPBNPs-HED

Targeting Property of NEUm in vitro

To assess the in vitro therapeutic potential of NEU@MPBNPs-HED, HT22 cells subjected to OGD/R insult were used. As shown in Figure 5A, DSPE-FITC-labeled NEUm vesicles exhibited stronger accumulation in OGD/R-treated cells than in untreated cells, confirming enhanced targeting of injured neurons.

Figure 5 In vitro anti-damage efficiency of NEU@MPBNPs-HED. N, NEUm; H, HED; M, MPBNPs; MH, MPBNPs-HED; NM, NEU@MPBNPs; NMH, NEU@MPBNPs-HED; Ctl, control. (A) LCFM image of HT22 cells (a) or OGD/R-treated HT22 cells (b) after coculture with DSPE-FITC-labeled NEUm vesicles for 8 h. Scale bar: 100 μm. (B) OGD/R-treated HT22 cells viability upon administration of PBS, NEUm, HED, MPBNPs, NEU@MPBNPs, MPBNPs-HED, and NEU@MPBNPs-HED for 24 h. Data are mean ± SD (n = 3). Compared to the control group: ns, not significant, **** p < 0.0001; compared to the MPBNPs group: && p < 0.01; compared to the MPBNPs-HED group: # p < 0.05. (C) Apoptosis assessed by fluorescence microscope in OGD/R treated HT22 cells administered with PBS, NEUm, HED, MPBNPs, NEU@MPBNPs, MPBNPs-HED, and NEU@MPBNPs-HED for 24 h. Scale bar: 100 μm. (D) MMP assessment by fluorescence microscope in OGD/R-treated HT22 cells after administered with PBS, NEUm, HED, MPBNPs, NEU@MPBNPs, MPBNPs-HED, and NEU@MPBNPs-HED for 24 h. Scale bar: 100 μm. (E) ROS level evaluation by fluorescence microscope in OGD/R-treated HT22 cells after administered with PBS, NEUm, HED, MPBNPs, NEU@MPBNPs, MPBNPs-HED, and NEU@MPBNPs-HED for 24 h. Scale bar: 100 μm. ((F) Statistical analysis of proportion of dead cells, MMP and ROS. Intergroup comparison: * p < 0.05, *** p < 0.001, and **** p < 0.0001. (G) Free radical clearance rate assessed by DPPH method in OGD/R-treated HT22 cells after administered with PBS, NEUm, HED, MPBNPs, NEU@MPBNPs, MPBNPs-HED, and NEU@MPBNPs-HED for 24 h. Data are mean ± SD (n = 3). Compared to the control group: ## p < 0.01; compared to the MPBNPs group: *** p < 0.001.

Cell viability assays (Figure 5B) revealed that treatment with MPBNPs, NEU@MPBNPs, and NEU@MPBNPs-HED significantly improved cell survival compared to the PBS control, with NEU@MPBNPs-HED showing the highest viability. NEUm alone did not induce a statistically significant effect.

Apoptosis, evaluated by Annexin V-FITC/PI staining (Figure 5C and F), was reduced in the HED, MPBNPs-HED, and NEU@MPBNPs-HED groups, with the latter showing the most pronounced effect.

Mitochondrial membrane potential (MMP), assessed by Rh123 staining (Figure 5D and F), was better preserved in the NEU@MPBNPs-HED group, indicated by decreased fluorescent signal loss.ROS levels, detected using a fluorescent probe (Figure 5E and F), were significantly decreased following treatment with NEU@MPBNPs-HED compared to other treatment groups.

As shown in Figure 5G, MPBNPs perform a good free radical clearance rate (19.84% ±2.795), while NEU@MPBNPs-HED possess the best eliminating rate (51.29%± 1.286), indicating that the nanocomposite demonstrated superior free radical scavenging activity.

Expression Levels of Apoptosis- and Inflammation-Related Proteins

We evaluate the levels of apoptosis-related proteins in HT22 cells and the level of inflammatory markers in BV-2 cells to further elucidate the mechanisms underlying the anti-injury effect of NEU@MPBNPs-HED. Apoptosis is strongly correlated to the activation of caspases, which are classified as promoters (such as Caspase-9) and performers (such as Caspase-3).²⁵ Treatment with NEU@MPBNPs-HED, MPBNPs-HED, or HED led to decreased Caspase-9. As depicted in Figure 6A–C, compared with the control group, the expressions of Caspase-9 and Caspase-3 decreased after treatment with NEU@MPBNPs-HED, MPBNPs-HED or HED, and both of them decreased most significantly in the NEU@MPBNPs-HED group, indicating the strongest anti-apoptosis effect. The discharge of mitochondrial proteins (such as Cytochrome C) is dependent on the MMP, which is highly controlled by the Bcl-2 protein family, such as Bax and Bcl-2.²⁶ Bax can promote apoptosis though oligomerization at the mitochondrial surface to decrease the MMP, while Bcl-2 has the opposite effect.^27,28 The release of Cytochrome C facilitates the formation of apoptosis bodies and caspase activation.²⁹ As shown in Figure 6A–C, Bax and Cytochrome C decreased, and Bcl-2 expression increased after treatment with NEU@MPBNPs-HED, MPBNPs-HED or HED.

Figure 6 Immunoblot analysis of apoptosis-related and inflammatory-associated proteins. Ctl, control; N, NEUm; H, HED; M, MPBNPs; MH, MPBNPs-HED; NM, NEU@MPBNPs; NMH, NEU@MPBNPs-HED. (A) Expression amounts of apoptosis-related proteins in HT22 cells at 24 h after treatment with PBS, NEUm, HED, MPBNPs, NEU@MPBNPs, MPBNPs-HED, and NEU@MPBNPs-HED. (B) Expression amounts of CD86 and CD206 in BV-2 cells at 24 h after treatment with PBS, NEUm, HED, MPBNPs, NEU@MPBNPs, MPBNPs-HED, and NEU@MPBNPs-HED. (C) Relative expression ration of related proteins. Intergroup comparison: * p < 0.05, ** p < 0.01, and *** p < 0.001.

Inflammatory reactions usually lead to a series of secondary insults after SCI, thus inhibition of inflammation at the early stage can provide a good environment for SCI repair.³⁰ CD86 is the cell surface marker of M1-polarized (pro-inflammatory) microglia, and CD206 is the membrane protein of M2-related (anti-inflammatory) microglia.³¹ NEU@MPBNPs-HED inhibited the expression of proinflammatory marker CD86, while increased the expression level of anti-inflammatory marker CD206 (Figure 6B and C), suggesting effective modulation of inflammation.

Vivo Distribution of NEU@MPBNPs

To evaluate the in vivo therapeutic potential and targeting efficiency of NEU@MPBNPs-HED, Cy5-labeled NEU@MPBNPs or MPBNPs were administered to SCI mice. Fluorescence imaging at 24 hours post-injection revealed significantly stronger accumulation of NEU@MPBNPs in the injured spinal cord compared to MPBNPs, with reduced distribution in non-target organs such as the liver, kidney, and brain (Figure 7A–C), indicating enhanced lesion-specific targeting. This result was further validated by fluorescence intensity analysis of DAPI-stained spinal cord sections, which showed significantly higher Cy5 signal in the NEU@MPBNPs group (Figure 7D and E).

Figure 7 In vivo targeting potential of NEU@MPBNPs-HED. (A) Bioluminescence images of mice at 24 h of post-treatment with Cy5-conjugated MPBNPs and Cy5-linked NEU@MPBNPs. (B) Ex vivo bioluminescence images of visceral organs and spinal cords at 24 h of post-treatment with Cy5-conjugated MPBNPs and Cy5-linked NEU@MPBNPs. (C) Semiquantitative assessment of fluorescence signals of spinal cord and other tissue specimens. Data are mean ± SD (n = 3). Compared to the MPBNPs group: *** p < 0.001, and **** p < 0.0001. (D) Fluorescence imaging of spinal cord tissues from mice at 24 h after administration of Cy5-linked MPBNPs and Cy5-conjugated NEU@MPBNPs. Scale bar: 100 μm. (E) Semiquantitative assessment of fluorescence signals of spinal cord sections after DAPI staining. Data are mean ± SD (n = 3). Compared to the MPBNPs group: **** p < 0.0001.

Subsequently, the functional efficacy of NEU@MPBNPs-HED was assessed using Basso Mouse Scale (BMS) scoring, CatWalk gait analysis, motor evoked potentials (MEPs), and immunofluorescence staining of Neun, GFAP, and NF200. These comprehensive evaluations confirmed the neuroprotective and regenerative effects of the treatment in vivo.

BMS Score Analysis

BMS score was used to assess behavioral recovery.³² Compared to the control and NEUm groups, mice treated with HED, MPBNPs, and NEU@MPBNPs-HED showed improved BMS scores, with the NEU@MPBNPs-HED group demonstrating significantly higher scores compared to the MPBNPs-HED group (Figure 8A), indicating enhanced motor recovery.

Figure 8 BMS Score and Catwalk Gait of mice after treatment with NEU@MPBNPs-HED. Ctl, control; N, NEUm; H, HED; M, MPBNPs; NM, NEU@MPBNPs; MH, MPBNPs-HED; NMH, NEU@MPBNPs-HED. (A) BMS Score of the injured mice 14 days after intravenous injection of PBS, NEUm, HED, MPBNPs, NEU@MPBNPs, MPBNPs-HED, and NEU@MPBNPs-HED. Data are mean ± SD (n=3). Comparison between groups: ** p<0.01. (B) Catwalk Gait of the injured mice 14 days after intravenous injection of PBS, NEUm, HED, MPBNPs, NEU@MPBNPs, MPBNPs-HED, and NEU@MPBNPs-HED. (C) Statistic analysis of Regularity index and Max intensity at %. Data are mean ± SD (n=3). Comparison between groups: * p<0.05, ** p<0.01.

Catwalk gait analysis was performed to evaluate hindlimb function recovery.³³ Regularity index describes the exclusive use of normal step sequence patterns during uninterrupted locomotion.³³ Max intensity at % is the time in seconds since the start of a run that the maximum intensity is measured. Max intensity at % is relative to the stand of a paw.³³ As shown in Figure 8B and C, NEU@MPBNPs-treated mice demonstrated better gait parameters compared to MPBNPs-treated mice, and NEU@MPBNPs-HED-treated mice showed significant improvement in gait compared to MPBNPs-HED-treated mice, further supporting the effectiveness of NEUm encapsulation.

Electrophysiological and Histological Assessment of Neural Recovery

MEPs recordings were conducted to assess nerve conduction recovery.³⁴ NEU@MPBNPs-HED-treated mice exhibited larger MEP amplitudes compared to MPBNPs-HED-treated mice (Figure 9A and B), indicating better recovery of nerve conduction function.

Figure 9 MEP analysis of the injured mice 14 days after intravenous injection of PBS, NEUm, HED, MPBNPs, NEU@MPBNPs, MPBNPs-HED, and NEU@MPBNPs-HED. Ctl, control; N, NEUm; H, HED; M, MPBNPs; NM, NEU@MPBNPs; MH, MPBNPs-HED; NMH, NEU@MPBNPs-HED. (A) Recorded MEP of the injured mice. (B) Statistic analysis of the amplitude of MEP. Data are mean ± SD (n=3). Comparison between groups: *** p<0.001.

Neun protein is a well-known neuron marker to investigate neuronal changes.³⁵ Immunofluorescence analysis of spinal cord sections showed increased green fluorescence for Neun in the NEU@MPBNPs-HED group, indicating enhanced neuron recovery (Figure 10A). NF200 is a neurofilament protein involved in axonal sprouting.³⁶ The green fluorescence intensity of NF200 was also strongest in the NEU@MPBNPs-HED group, suggesting better recovery of axonal sprouting (Figure 10B). Additionally, the red fluorescence intensity of GFAP was weakest in the NEU@MPBNPs-HED group, indicating reduced glial scarring and improved neuronal recovery.

Figure 10 Neun, GFAP, and NF200 immunofluorescence staining of the damaged spinal cord tissues. Ctl, control; N, NEUm; H, HED; M, MPBNPs; NM, NEU@MPBNPs; MH, MPBNPs-HED; NMH, NEU@MPBNPs-HED. Neun and GFAP (A), and NF200 and GFAP (B) assays assessing spinal cord injury at 14 days after intravenous injection of PBS, NEUm, HED, MPBNPs, NEU@MPBNPs, MPBNPs-HED, and NEU@MPBNPs-HED. Scale bar: 100 μm.

Antioxidative and Antiinflammation Effect Evaluated by Immunofluorescence Staining

Immunofluorescence staining further confirmed the antioxidative and anti-inflammatory effects of NEU@MPBNPs-HED in spinal cord tissue. MDA (malondialdehyde) is a commonly used indicator of membrane lipid peroxidation, which reflects the degree of intracellular oxidative stress. MDA fluorescence was significantly reduced (Figure 11A), consistent with decreased ROS and enhanced radical scavenging observed in Figure 5E–G. CD68 levels showed no obvious change, while TNF-α expression was markedly decreased (Figure 11B). Moreover, iNOS (M1 marker) showed no significant variation, whereas Arg1 (M2 marker) expression was reduced, and Ly6G fluorescence was also diminished after NEU@MPBNPs-HED treatment (Figure 11C). These results indicate that NEU@MPBNPs-HED effectively attenuates oxidative stress and modulates macrophage-associated inflammatory responses at the tissue level.

Figure 11 (A) MDA, (B) TNF-α and CD68, and (C) Ly6G, iNOS and Arg1 immunofluorescence staining of the damaged spinal cord tissues at 14 days after intravenous injection of PBS, NEUm, HED, MPBNPs, NEU@MPBNPs, MPBNPs-HED, and NEU@MPBNPs-HED. Ctl, control; N, NEUm; H, HED; M, MPBNPs; NM, NEU@MPBNPs; MH, MPBNPs-HED; NMH, NEU@MPBNPs-HED. Scale bar: 100 μm.

Adverse Effect Evaluation by Histological Assay

Histological evaluation based on the H&E-stained sections of major organs, including hearts, livers, spleens, lungs, and kidneys, revealed no abnormalities in any of the treatment groups, including PBS, NEUm, MPBNPs, NEU@MPBNPs, HED, MPBNPs-HED, and NEU@MPBNPs-HED (Figure 12). These results indicate that NEU@MPBNPs-HED and related treatments were safe and did not cause adverse effects.

Figure 12 Histological images of heart, liver, spleen, lung, kidney, and brain samples from mice at 14 days after intravenous injection of PBS, NEUm, HED, MPBNPs, NEU@MPBNPs, MPBNPs-HED, and NEU@MPBNPs-HED. Ctl, control; N, NEUm; H, HED; M, MPBNPs; NM, NEU@MPBNPs; MH, MPBNPs-HED; NMH, NEU@MPBNPs-HED. Scale bar: 100 μm.

Discussion

This study reveals that NEU@MPBNPs-HED, a neutrophil membrane-coated nanoplatform co-delivering HED and MPBNPs, effectively targets the spinal cord lesion and promotes neuroprotection in both in vitro and in vivo SCI models. Compared with previously reported nanotherapies focusing on either anti-inflammatory¹² or antioxidant functions,^13,18 this dual-functional system achieves improved therapeutic outcomes through synergistic suppression of ROS, apoptosis, and neuroinflammation.

Mechanistically, NEU@MPBNPs-HED significantly reduced ROS levels and preserved mitochondrial membrane potential, which corresponded with decreased expression of Caspase-3/9, Bax, and Cytochrome C, and upregulation of Bcl-2. These effects align with earlier findings on HED’s modulation of mitochondrial apoptosis and NF-κB signaling in ischemic models.^18,23 The neutrophil membrane coating further enhanced delivery selectivity to the injured spinal cord, a feature not commonly utilized in prior SCI-targeted nanoplatforms.

Compared to MPBNPs-HED or free HED, the NEU@MPBNPs-HED group achieved better neuronal survival, motor recovery, and reduced glial scarring, as shown by BMS scores, CatWalk gait analysis, MEP amplitude, and immunofluorescence staining. These results underscore the therapeutic advantage of combining biomimetic targeting with responsive drug release for SCI repair.

Despite the promising therapeutic outcomes demonstrated by NEU@MPBNPs-HED, this study has several limitations. First, the in vivo evaluation was limited to a 14-day observation period, which may not fully capture long-term neuroregenerative effects or potential delayed toxicity. Second, while the neutrophil membrane facilitated lesion targeting, the precise molecular mechanisms underlying its homing behavior were not fully elucidated. Furthermore, large-scale extraction and purification of neutrophil membranes, while feasible in laboratory settings, may face hurdles in scalability and cost-effectiveness.And potential differences in immune recognition and response between rodents and humans must be carefully addressed to ensure translational safety and efficacy. Finally, although HED showed strong anti-apoptotic and antioxidant effects, its potential off-target actions and pharmacokinetics in the central nervous system warrant further investigation.

Conclusions

In our study, we developed a nanocomposite composed of neutrophil membrane (NEUm) nanovesicles encapsulating mesoporous Prussian blue nanoparticles (MPBNPs) loaded with Hederagenin (HED), termed as NEU@MPBNPs-HED. This nanocomposite demonstrated improved therapeutic effects compared to free HED and MPBNPs-HED for treating SCI. The NEUm nanovesicles allowed the nanocomposite to target the injury site, mimicking the natural behavior of neutrophils, which are attracted to areas of tissue damage. By camouflaging MPBNPs with NEUm, the nanocomposite evaded immune clearance, enabling it to effectively accumulate at the injury site. Additionally, MPBNPs exhibited efficient drug delivery and safety in vivo. Under the acidic conditions present at the injury site, the degradation of MPBNPs was accelerated, promoting the controlled release of HED and enhancing the therapeutic effect. This study demonstrated that NEU@MPBNPs-HED could improve tissue repair by regulating apoptosis and reducing further damage. The nanocomposite’s safety, targeting ability, and efficacy make it a promising candidate for clinical application as a targeted drug delivery platform for SCI treatment, providing a foundation for future translational research.

Data Sharing Statement

The data are available from the corresponding author on reasonable request.

Ethics Approval

All animal procedures were approved by the Institutional Animal Care and Use Committee (IACUC) of The Second Qilu Hospital of Shandong University (Approval No. KYLL2024550) and conducted in compliance with the animal welfare guidelines as stipulated in the institutional guidelines (Directive 2010/63/EU in Europe) for the care and use of animals.

Acknowledgment

Shandong University Institute of Advanced Medical Research.

Author Contributions

All authors made a significant contribution to the work reported, whether that is in the conception, study design, execution, acquisition of data, analysis and interpretation, or in all these areas; took part in drafting, revising or critically reviewing the article; gave final approval of the version to be published; have agreed on the journal to which the article has been submitted; and agree to be accountable for all aspects of the work.

Funding

This work was supported by National Natural Science Foundation of China (No. 82220108005 and 92468205), Natural Science Foundation of Shandong Province (ZR2023ZD16), Taishan Scholar Program of Shandong Province-Pandeng Taishan Scholars (tspd20210320), and fund for education and training of The Second Qilu Hospital of Shandong University (No. 2023YP34).

Disclosure

The authors declare that there are no conflicts of interest regarding the publication of this paper.

References

1. Dolma S, Kumar H. Neutrophil, extracellular matrix components, and their interlinked action in promoting secondary pathogenesis after spinal cord injury. Mol Neurobiol. 2021;58(9):4652–4665. doi:10.1007/s12035-021-02443-5

2. Bourassa-Moreau É, Mac-Thiong JM, Li A, et al. Do patients with complete spinal cord injury benefit from early surgical decompression? Analysis of neurological improvement in a prospective cohort study. J Neurotrauma. 2016;33(3):301–306. doi:10.1089/neu.2015.3957

3. Kwon BK, Okon E, Hillyer J, et al. A systematic review of non-invasive pharmacologic neuroprotective treatments for acute spinal cord injury. J Neurotrauma. 2011;28(8):1545–1588. doi:10.1089/neu.2009.1149

4. Suberviola B, González-Castro A, Llorca J, Ortiz-Melón F, Miñambres E. Early complications of high-dose methylprednisolone in acute spinal cord injury patients. Injury. 2008;39(7):748–752. doi:10.1016/j.injury.2007.12.005

5. Anjum A, Yazid MD, Fauzi Daud M, et al. Spinal cord injury: pathophysiology, multimolecular interactions, and underlying recovery mechanisms. Int J Mol Sci. 2020;21(20):7533. doi:10.3390/ijms21207533

6. Kobayakawa K, Ohkawa Y, Yoshizaki S, et al. Macrophage centripetal migration drives spontaneous healing process after spinal cord injury. Sci Adv. 2019;5(5):eaav5086. doi:10.1126/sciadv.aav5086

7. Fleming JC, Norenberg MD, Ramsay DA, et al. The cellular inflammatory response in human spinal cords after injury. Brain J Neurol. 2006;129(Pt 12):3249–3269. doi:10.1093/brain/awl296

8. Okada S. The pathophysiological role of acute inflammation after spinal cord injury. Inflamm Regen. 2016;36(1):20. doi:10.1186/s41232-016-0026-1

9. Liou JT, Lee CM, Lin YC, et al. P-selectin is required for neutrophils and macrophage infiltration into injured site and contributes to generation of behavioral hypersensitivity following peripheral nerve injury in mice. Pain. 2013;154(10):2150–2159. doi:10.1016/j.pain.2013.06.042

10. Taoka Y, Okajima K, Uchiba M, et al. Role of neutrophils in spinal cord injury in the rat. Neuroscience. 1997;79(4):1177–1182. doi:10.1016/S0306-4522(97)00011-0

11. Farooque M, Isaksson J, Olsson Y. Improved recovery after spinal cord trauma in ICAM-1 and P-selectin knockout mice. Neuroreport. 1999;10(1):131–134. doi:10.1097/00001756-199901180-00024

12. Shen K, Li X, Huang G, et al. High rapamycin-loaded hollow mesoporous Prussian blue nanozyme targets lesion area of spinal cord injury to recover locomotor function. Biomaterials. 2023;303:122358. doi:10.1016/j.biomaterials.2023.122358

13. Andrabi SS, Yang J, Gao Y, Kuang Y, Labhasetwar V. Nanoparticles with antioxidant enzymes protect injured spinal cord from neuronal cell apoptosis by attenuating mitochondrial dysfunction. J Control Rel. 2020;317:300–311. doi:10.1016/j.jconrel.2019.12.001

14. He J, Qiao Y, Zhang H, et al. Gold-silver nanoshells promote wound healing from drug-resistant bacteria infection and enable monitoring via surface-enhanced Raman scattering imaging. Biomaterials. 2020;234:119763. doi:10.1016/j.biomaterials.2020.119763

15. Yang J, Zhai S, Qin H, Yan H, Xing D, Hu X. Corrigendum to “NIR-controlled morphology transformation and pulsatile drug delivery based on multifunctional phototheranostic nanoparticles for photoacoustic imaging-guided photothermal-chemotherapy” [Biomaterials 176 (2018) 1-12]. Biomaterials. 2019;217(217):119315. doi:10.1016/j.biomaterials.2019.119315

16. Gao A, Liao Q, Xie L, et al. Tuning the surface immunomodulatory functions of polyetheretherketone for enhanced osseointegration. Biomaterials. 2020;230:119642. doi:10.1016/j.biomaterials.2019.119642

17. Li J, Wei J, Wan Y, et al. TAT-modified tetramethylpyrazine-loaded nanoparticles for targeted treatment of spinal cord injury. J Control Rel. 2021;335:103–116. doi:10.1016/j.jconrel.2021.05.016

18. Gao X, Han Z, Huang C, et al. An anti-inflammatory and neuroprotective biomimetic nanoplatform for repairing spinal cord injury. Bioact Mater. 2022;18:569–582. doi:10.1016/j.bioactmat.2022.05.026

19. Kubelick KP, Emelianov SY. Prussian blue nanocubes as a multimodal contrast agent for image-guided stem cell therapy of the spinal cord. Photoacoustics. 2020;18:100166. doi:10.1016/j.pacs.2020.100166

20. Lin R, Liu L, Silva M, et al. Hederagenin protects PC12 cells against corticosterone-induced injury by the activation of the PI3K/AKT pathway. Front Pharmacol. 2021;12:712876. doi:10.3389/fphar.2021.712876

21. Shen Y, Teng L, Qu Y, et al. Hederagenin suppresses inflammation and cartilage degradation to ameliorate the progression of osteoarthritis: an in vivo and in vitro study. Inflammation. 2023;46(2):655–678. doi:10.1007/s10753-022-01763-5

22. Li Y, Dong J, Shang Y, Zhao Q, Li P, Wu B. Anti-inflammatory effects of hederagenin on diabetic cardiomyopathy via inhibiting NF-κB and Smads signaling pathways in a type-2 diabetic mice model. RSC Adv. 2019;9(45):26238–26247. doi:10.1039/C9RA02043H

23. Wang L, Zhao M. Suppression of NOD-like receptor protein 3 inflammasome activation and macrophage M1 polarization by hederagenin contributes to attenuation of sepsis-induced acute lung injury in rats. Bioengineered. 2022;13(3):7262–7276. doi:10.1080/21655979.2022.2047406

24. Liu J, Chen X, Xu L, et al. Neutrophil membrane-coated nanoparticles exhibit increased antimicrobial activities in an anti-microbial resistant K. pneumonia infection model. Nanomedicine. 2023;48:102640. doi:10.1016/j.nano.2022.102640

25. Baechler BL, Bloemberg D, Quadrilatero J. Mitophagy regulates mitochondrial network signaling, oxidative stress, and apoptosis during myoblast differentiation. Autophagy. 2019;15(9):1606–1619. doi:10.1080/15548627.2019.1591672

26. Youle RJ, Strasser A. The BCL-2 protein family: opposing activities that mediate cell death. Nat Rev Mol Cell Biol. 2008;9(1):47–59. doi:10.1038/nrm2308

27. Westphal D, Kluck RM, Dewson G. Building blocks of the apoptotic pore: how Bax and Bak are activated and oligomerize during apoptosis. Cell Death Differ. 2014;21(2):196–205. doi:10.1038/cdd.2013.139

28. Pistritto G, Trisciuoglio D, Ceci C, Garufi A, D’Orazi G. Apoptosis as anticancer mechanism: function and dysfunction of its modulators and targeted therapeutic strategies. Aging. 2016;8(4):603–619. doi:10.18632/aging.100934

29. Saunders TL, Windley SP, Gervinskas G, et al. Exposure of the inner mitochondrial membrane triggers apoptotic mitophagy. Cell Death Differ. 2024;31(3):335–347. doi:10.1038/s41418-024-01260-2

30. Fan L, Liu C, Chen X, et al. Exosomes-loaded electroconductive hydrogel synergistically promotes tissue repair after spinal cord injury via immunoregulation and enhancement of myelinated axon growth. Adv Sci. 2022;9(13):e2105586. doi:10.1002/advs.202105586

31. Lawrence T, Natoli G. Transcriptional regulation of macrophage polarization: enabling diversity with identity. Nat Rev Immunol. 2011;11(11):750–761. doi:10.1038/nri3088

32. Zhou K, Zheng Z, Li Y, et al. TFE3, a potential therapeutic target for spinal cord injury via augmenting autophagy flux and alleviating ER stress. Theranostics. 2020;10(20):9280–9302. doi:10.7150/thno.46566

33. Zheng G, Zhang H, Tail M, et al. Assessment of hindlimb motor recovery after severe thoracic spinal cord injury in rats: classification of CatWalk XT^® gait analysis parameters. Neural Regen Res. 2023;18(5):1084–1089. doi:10.4103/1673-5374.355763

34. Yuan F, Peng W, Yang Y, et al. Endothelial progenitor cell-derived exosomes promote anti-inflammatory macrophages via SOCS3/JAK2/STAT3 axis and improve the outcome of spinal cord injury. J Neuroinflammation. 2023;20(1):156. doi:10.1186/s12974-023-02833-7

35. Xie L, Wu H, He Q, et al. A slow-releasing donor of hydrogen sulfide inhibits neuronal cell death via anti-PANoptosis in rats with spinal cord ischemia‒reperfusion injury. Cell Commun Signal. 2024;22(1):33. doi:10.1186/s12964-023-01457-x

36. Zhu S, Ying Y, Ye J, et al. AAV2-mediated and hypoxia response element-directed expression of bFGF in neural stem cells showed therapeutic effects on spinal cord injury in rats. Cell Death Dis. 2021;12(3):274. doi:10.1038/s41419-021-03546-6

Problem statement

Despite its privacy-preserving design, the Beacon protocol is vulnerable to membership inference attacks that can reveal whether an individual is part of a dataset, potentially compromising sensitive information. Existing defenses [4, 7, 12, 18], aim to mitigate these risks but often assume static or batch-query environments. Additionally, current game-theoretic approaches [12, 18] model the problem as a Bayesian game which provides a single perturbation-based solution for all users, leading to sub-optimal privacy protection. In reality, attackers can adapt their strategies in sequential-query settings, making these defenses less effective. Hence, we focus on the problem of designing defenses for evolving and more sophisticated attacks.

The system and threat model

The beacon system responds to received queries on the presence of alleles in the connected database(s) and return ’yes’ or ’no’ response for each dataset. Without losing generality, we assume the beacon is connected to a single database. The protocol operates in an authenticated online setting. That is the querier logs in before posing potentially multiple queries. The system has access to previous queries made by the same querier. This continuous access enables the protocol to accumulate information over time, improving its effectiveness in detecting membership inference attacks. In this context, the beacon assigns probabilities to “yes” responses, reflecting the honesty rate of the system. On the other hand, the honesty rate for “no” responses is always set to one, as research has demonstrated that altering “no” responses to “yes” does not enhance privacy protection for individuals within the system [10]. Note that the beacon publicly shares the honesty rate associated with every answer in our setting, which assumes a very strong adversary. If the querier repeats a previously posed query, the same response is returned, ensuring consistency.

We consider a passive adversary who has access to an individual’s genome and seeks to perform a likelihood ratio test (LRT)-based membership inference attack. The adversary aims to conduct a hypothesis test to confidently determine whether the target individual’s genomic data is included in the dataset accessible via the beacon protocol. We assume the adversary can submit multiple queries without any auxiliary information and that the queries and corresponding responses are independent of each other, i.e., not in linkage disequilibrium. Additionally, we assume the adversary has access to the genomes of a control group of individuals with similar genetic backgrounds to individuals in the beacon dataset, denoted as C.

Similar to many membership inference attacks in the literature [3,4,5, 10], we employ a LRT-based attack. The genome of an individual i can be represented as a binary vector, (varvec{d}_{varvec{i}} = {d_{i1}, . . . ,d_{ij}, . . . ,d_{im}}) where (d_{ij}) denotes the presence of SNP j (1 for “yes”, 0 for “no”) and m denotes the number of known SNPs. The beacon, after receiving a query set, Q consisting (k) queries, generates a binary response set (varvec{x}) where (x_j) denotes the presence of the SNP in the beacon for the (j^{th}) query in Q ((Q_j)).

Assuming that the MAFs for the SNPs are public, the optimal attacker constructs a list Q which contains the SNPs of the victim. It is sorted in ascending MAF order. Let the null hypothesis ((H_0)) refer to the case in which the queried genome is not in the Beacon and the alternative ((H_1)) is otherwise.

where (delta) represents the probability of sequencing error, (D_n^i) is the probability that none of the n individuals in the beacon having the allele at position j and (D_{n-1}^j) represents the probability of no individual except for the queried person having the allele at position j. (D_{n-1}^j) and (D_n^j) are defined as follows: (D_{n-1}^j = (1 – f_j)^{2n-2}) and (D_n^i = (1 – f_i)^{2n}), where (f_j) represents the MAF of the SNP at position j. Then, the LRT statistic for person i in the beacon is determined as Eq. 3.

While Raisaro et al. (2017) assume that the beacon is honest with all answers, Venkatesaramani et al. (2023) incorporate the fact that the beacon might be lying in the formulation. They introduce a binary variable (y_j) to indicate if the response for the (j^{th}) query was flipped. They consider (Q_1) as the subset of (Q) with (x_j = 1) and (Q_0) as the subset with (x_j = 0). Let (A_j = log frac{1 – D_n^j}{1 – delta D_{n-1}^j}) and (B_j = log frac{D_n^j}{delta D_{n-1}^j}). Thus, by defining (h_j) as the complement of (y_j), representing honesty, the LRT function can be rewritten as in Eq. 4.

We use Eq. 4 but relax the assumption that (varvec{h}) is a binary vector. We define (varvec{h}) as ({h_jin mathbb {R}:0 le h_j le 1)} where (h_j = 1) indicates an honest response and if (x_j = 0), then (h_j = 1). Thus, the beacon can incorporate uncertainty into the responses and fine-tune the honesty level as desired.

The adversary can decide if the individual (i) is a member of the dataset when (L_i(Q, varvec{x}, varvec{h})) falls below a predefined fixed threshold (theta) [7, 19]. The attacker simulates the attack on the control group C and picks the one that balances precision and recall. However, fixed thresholding can be bypassed using various defense mechanisms [10]. We rather adopt adaptive thresholding, which is a more effective and realistic technique that can work in an online setting and can adjust the threshold (theta) based on the response set (varvec{x}) to the queries Q: (theta (Q,varvec{x})). It ensures the false positive rate for an attack does not exceed a predefined rate [10].

Background on game theory and reinforcement learning (RL)

A Bayesian game is a game with simultaneous moves/actions where players have incomplete information about each other. An (alpha)-Bayesian game is an extension where instead of having precise probabilistic beliefs, players work with a set of possible probability distributions. The parameter (alpha) reflects the players’ level of ambiguity aversion. Stackelberg games, on the other hand, involve a leader-follower structure, where the leader moves first and the follower responds. The leader’s strategy accounts for the fact that the follower will optimize their response after observing the leader’s move. RL has been used to model Stackelberg games in various domains [20,21,22]. RL enables both the leader and follower to learn and adjust their strategies dynamically in real time. It is very effective in games with large actions or state spaces because it can approximate optimal strategies without exhaustively exploring all possibilities.

RL techniques rely on Markov Decision Processes (MDPs), including the following fundamental components: State s represents the state of the world; Action space A is the set of all valid actions available to a player in a given environment; Reward R function computes the reward for a specific state and action, and sometimes it also depends on the next state; Policy (pi) is a rule used by an agent to decide what actions to take by mapping the states of the environment to actions. The environment conveys the current state to the agent and changes with respect to the agent’s actions by transitioning to a new state. It provides a reward or penalty; Value Function V estimates how good a state is, and (Q^{pi }) estimates how good a state-action pair is in terms of long-term rewards. The difference is the advantage (hat{A}); Discount Factor (gamma in [0,1]) weighs how much future rewards are valued compared to immediate rewards.

Privacy and utility definitions

We define the function (p_i) to measure the privacy risk of an individual (i). This function compares the log-likelihood ratio test (LRT) value of individual (i) with the LRT values of all individuals in a control group. It then calculates the percentage of control group members whose LRT values are greater than that of individual (i). It is defined as (p_i(Q, varvec{x}, varvec{h}, C) = [ sum nolimits _{t in C} textbf{1}_{L_i(Q, varvec{x}, varvec{h}) le L_t(Q, varvec{x}, varvec{h})} ] / |C|) where (L) represents the LRT, computed based on the attacker’s set of queries (Q) and sharer’s responses (varvec{x}) as previously described. This function allows us to quantify the risk of re-identification over time as more queries are posed: A lower, rapidly decreasing value is interpreted as high risk, indicating that the probability of correctly re-identifying an individual is increasing.

We quantify the utility of the beacon service using function (u(Q,varvec{h}) = [sum nolimits _{j in Q} (h_j)] / |Q|). The function returns the average honesty level of the responses provided by the system which is captured by the variable (varvec{h}) in the (LRT) function defined in Eq. 4 where (h_j) represents the honesty level for the (j^{th}) query in query set (Q).

Our novel defense strategies

Here, we present a novel game theory-based defense mechanism against LRT-based attacks which can handle a few queries due to the large strategy space. Then, we present the first reinforcement learning (RL)-based solutions.

Stackelberg defender

The interaction between the beacon and the attacker is modeled as a Stackelberg game in which the leader moves first (attacker), and the other player (the beacon) moves subsequently, making decisions based on the leader’s query. The attacker’s strategy in our game is represented by Q where (Q_j) represents the index of (j^{th}) queried SNP where (1 le j le kle m). Unlike in the previous attacks, the attacker can query SNPs not carried by the victim to confuse the beacon service. (varvec{Q} = [Q_1, Q_2, dots , Q_{k}], quad Q_j in {1, 2, dots , m}, quad 1 le j le kle m).

The beacon’s strategy in the game is represented by the vector (varvec{h}) where ({h}_j in [0,1]) for the query j which indicates the honesty rate. We discretize (varvec{h}) for this game and let the beacon choose from four available strategies. The granularity can be increased at the cost of computational time. (varvec{h} = [h_1, h_2, dots , h_{k}], quad h_j in {0.25, 0.5, 0.75, 1}, quad 1 le j le kle m).

To formulate the problem as a Stackelberg game, we use representations of the attacker and defender utility function, naming payoff function. We define the payoff function of the Stackelberg attacker as (1 – p_{victim}(Q, {textbf {x}}, {textbf {h}}, C)) which is the complement of the victim’s privacy. The payoff function of the Stackelberg defender consists of two parts: (i) a privacy term and (ii) a honesty term. The privacy term first computes the LRT values of the individuals in the control group C for the (i^{th}) query using strategy (h_i). Then, we compute the variance in the first quartile of these values to quantify the risk of privacy violation. High variance indicates that an incoming query is posing a re-identification risk. The honesty term is simply (h_i). The final term is the weighted sum of these two terms, where the weights are hyperparameters to the algorithm. Please see Additional file 1: Supplementary Note S1 for the details about the Stackelberg defender’s payoff calculation.

Reinforcement learning-based attackers and defenders

In this section, we discuss our Reinforcement Learning (RL) approach designed to protect individuals’ privacy in the beacon database while preserving system utility. The environment has two main players: the user (regular or attacker) and the beacon service.

States

The beacon agent’s state space (S_b) consists of the user’s (t^{th}) query (Q_t) and the beacon service’s statistical data at time t. We define (varvec{s}_{varvec{b}}) as the beacon state, where (varvec{s}_{varvec{b}} in S_b). Specifically, each state includes (i) the MAF of the queried SNP j, (ii) the minimum and mean LRT (L_i(Q,varvec{x,h})) values among the individuals in each of beacon database and control group before responding the current query, (iii) potential LRT change by lying or not for SNP j, (iv) the minimum (p_i(Q,varvec{x,h},C)) among beacon participants after lying or not, and finally, (v) the beacon’s utility (u(Q,varvec{h})) up to the current query (Q_t). Importantly, the agent only observes summary statistics rather than individual genomes which reduces state complexity and enhances privacy, especially in decentralized or outsourced training scenarios.

The attacker’s state space (S_a) contains information about the victim. The state (varvec{s}_{varvec{a}} in S_a) categorizes the victim’s SNPs into g groups: (g-1) groups based on their MAF values and another group for SNPs that she does not have. Let (s_{min}) and (s_{max}) be the SNPs with the lowest and the highest MAFs in the group, respectively, For each group, (varvec{s}_{varvec{a}}) includes: (i) (L_{victim}(Q_{s_{min}}, x={0}, h={1})), (ii) (L_{victim}(Q_{s_{min}}, x={1}, h={1})), (iii) (L_{victim}(Q_{s_{max}}, x={0}, h={1})), and (iv) (L_{victim}(Q_{s_{max}}, x={1}, h={1})). The attacker assumes the beacon is honest and calculates the LRT ranges for the rarest and most common SNP in each group as if those were the only queried SNPs. (varvec{s}_{varvec{a}}) also contains (i) the number of SNPs, (ii) the minimum and mean LRT values obtained on the control group C at time t, and (iii) (p_{victim}(Q,varvec{x,h},C)) at time t.

Actions

The beacon agent’s continuous action space (A_b) is an honesty rate to choose for the query j. That is, (A_b = left{ varvec{h} in mathbb {R}^k mid 0 le h_t le 1, , forall t in {1, 2, dots , m} right}). The attacker’s action space (A_a) is a SNP group to choose from: (A_a = left{ varvec{a} in mathbb {Z}^k mid 1 le a_t le g, , forall t in {1, 2, dots , m} right}). From the chosen group, a specific query is then randomly selected for querying.

Rewards

We use both intermediate and final rewards to train our agents. The intermediate reward (r_t) is computed as a function R of a given state-action pair at time t: (r_t = R(varvec{s}_t, h_t)). The function (R_b) assesses the trade-off between privacy and utility for the beacon agent for each query: (R_b = p_{victim}(Q, varvec{x}, h, C) + h_t). As articulated, (p_{victim}) represents the privacy of the victim component, and (h_t) represents the utility of the system for (t^{th}) query. This ensures that each action taken by the beacon considers privacy and utility. For the attacker agent, the intermediate reward function (R_a) is defined based on the beacon’s honesty rate for the (t^{th}) query: (R_a = h_t). Here, the attacker’s goal is to maximize the honesty rate from the beacon’s answers to improve the chances of reidentifying the victim.

In the real-world scenario, the beacon does not know which individual the attacker is targeting, and the attacker is unaware of the honesty level of the responses. However, during training, information about the victim’s identity is provided to the beacon agent, and the honesty rate is provided to the attacker agent for the models to converge faster. This information is removed during inference for the system to be realistic. Additionally, the agent’s objective is to maximize a cumulative reward: The sum of all rewards that will be collected after the end of the current episode, discounted by a factor (0<gamma <1) based on the time t: (R = sum nolimits _{t=0}^{infty } gamma ^t r_t). Finally, a final constant reward is given at the episode’s end based on the success of the agent: Beacon receives it if the victim is not reidentified, or the attacker earns it for reidentifying the victim.

Policies

The outputs of our policies are designed as computable functions that depend on a set of trainable parameters (varvec{theta }). These parameters determine the behavior of the policy by mapping the current state of the environment to optimal actions. The beacon and the attacker are trained using different methods. The beacon uses the Twin Delayed Deep Deterministic Policy Gradient (TD3) [23] algorithm which is suitable for continuous action spaces like the beacon’s. TD3 consists of two components: A policy network (actor) (mu _{theta }(varvec{s}_b)) which selects actions (y_t in {A_b}) and two networks (critics): (Q_{phi 1}^{mu }(varvec{s}_b, h_t)) and (Q_{phi 2}^{mu }(varvec{s}_b, h_t)), which estimate the expected cumulative reward for taking action (h_t). The two critics, (phi _1) and (phi _2), are used to mitigate overestimation bias in Q-value estimates by taking the minimum of their outputs during updates. The critic evaluates the Q-value ((Q^{mu }(varvec{s}_b, h_t))) based on the Bellman equation:

where (varvec{s}_{varvec{b}}^{prime }) is the next state sampled from the environment’s transition model (P(varvec{s}_{varvec{b}}^{prime }|varvec{s}_{varvec{b}}, h_t)). The actor is optimized to deterministically select actions that maximize the value predicted by the critic, following the objective function J: (max J(varvec{theta }_{mu }) = mathbb {E}_{varvec{s}_b} left[ V_{phi 1}(varvec{s}_b, mu _{varvec{theta }}(varvec{s}_b)) right]). The policy (mu _{theta }) is then updated to maximize the expected return as estimated by the critics. This update is performed by adjusting the policy parameters (varvec{theta }_mu) using gradient ascent, (varvec{theta }_{mu } leftarrow varvec{theta }_{mu } + alpha _mu nabla _{varvec{theta }_{mu }} J(varvec{theta }_{mu })), for the policy learning rate (alpha _mu).

The attacker operates in a stochastic and discrete action space which requires a different approach for policy optimization: Proximal Policy Optimization (PPO) [24]. PPO also uses actor and critic networks but in contrast to TD3, (i) it uses a single critic to estimate the value function and (ii) the actor chooses actions probabilistically. We define the attacker’s policy (pi _{theta }) given parameters (theta) and the objective function of PPO to be maximized as follows:

where (varvec{theta }_{old}) is the vector of policy parameters before the policy update, (epsilon) is the clipping term to control the learning rate, and (hat{A}_t) is an estimator of the advantage function at timestep t which quantifies the benefit of choosing (a_t) over others in a given state.

We train the agents using two approaches: (1) training against predefined static strategies and (2) training against adaptive agents who can dynamically change strategies. Using approach 1, we train the Optimal Beacon Defender (OBD). This agent was trained against both the optimal attacker and a set of regular users. Thus, it learns to detect the optimal attack. However, an optimal attacker may adapt its strategy by querying SNPs outside the MAF order or targeting SNPs that the victim does not carry. OBD cannot defend against this. To model this attacker, we train the Tactical Beacon Attacker TBA using approach 1, against predefined defense strategies from literature (see Compared methods section). To ensure variability and prevent overfitting, in each episode, and randomly switched the opponent’s strategy during training.

Using approach 2, we train the Generic Beacon Defender (GBD) and the Generic Beacon Attacker (GBA) against each other in a two-player setup. The OBD and TBA are used as the starting point to initialize training. To address inherent challenges in multi-agent reinforcement learning (MARL) within adversarial environments, we implemented a structured training framework with a centralized environment and a shared control group accessible to both agents only during training, e.g., publicly available HapMap samples. Please see Discussion section for a discussion on these design choices.

Datasets

We evaluate of our defense techniques using the 164 individuals in the CEU population of the HapMap dataset [25]. We randomly select (i) 40 individuals as the beacon participants; (ii) 50 individuals for the control group of the beacon; and (iii) 50 individuals for the control group of the attacker. This beacon size is the size considered commonly in the literature [3, 4, 6, 15]. In addition, the beacon size has no effect on the attacker’s behavior as it depends on MAF values extracted from the population. For model building, we assume an attack on 10 randomly selected beacon participants. In each episode, the RL-based defense methods select one individual from this group for training, with control groups shared between the attacker and the beacon only during training. The remaining 30 beacon participants are reserved for system testing.

Experimental setup

We trained OBD and TBA over 100,000 episodes, followed by a 25,000 episode fine-tuning phase for the GBD and GBA. We allowed a maximum of 100 queries per episode and performed training cycles every 10 episodes. For the beacon agent, using the TD3 algorithm, training began after 100 episodes of exploration. The agent was trained with a learning rate of (10^{-4}) for both the actor and critic networks, a discount factor (gamma) of 0.99, and a batch size of 256. The replay buffer size was set to (10^4), with policy noise at 20 percent of the maximum action value and noise clipping set at 50 percent to prevent excessive exploration. The TD3 agent was trained for 50 epochs per update cycle. The attacker agent, on the other hand, was trained for 300 epochs per update cycle using a cyclic learning rate scheduler, with a base learning rate of (10^{-5}) and a maximum learning rate of (10^{-3}). We set the discount factor to 0.99 and applied an epsilon clipping threshold (epsilon) of 0.2 to limit policy updates. We defined the g=6 MAF range groups as follows: [0–0.03.03], (0.03,0.1], (0.1,0.2], (0.2,0.3], (0.3,0.4], and (0.4,0.5]. Training took 29 hours for single-agent sessions. Multi-agent fine-tuning took 34 hours. The only set of hyper-parameters in the Stackelberg game is the weights for the privacy and utility terms in the defender’s reward, which we set to 0.85 and 0.15, respectively.

To assess defenses against biased random queries, we model query behavior that deviates from random. We introduce a tunable risk parameter, (l in [0, 1]), to control the querier’s tendency to select rare variants. The probability of selecting a specific SNP j, denoted P(j), is weighted by its MAF such that (P(j)~=~frac{text {MAF}_j^{(1-l)}}{sum nolimits _{k=1}^{m} text {MAF}_k^{(1-l)}}). In this model, the highest risk level ((l=1)) surpasses the MAF bias, resulting in a uniform query distribution where rare SNPs are just as likely to be selected as common ones. On the other hand, decreasing l models more conservative queriers who are less likely to select rare SNPs. We evaluate our defenses against a spectrum of these query behaviors using l values of 0.2 (low-risk), 0.6 (medium-risk), and 1 (high-risk).

We evaluated all reinforcement learning models on a SuperMicro SuperServer 4029GP-TRT with 2 Intel Xeon Gold 6140 Processors (2.3GHz, 24.75M cache) and 256GB RAM. The RL agents were trained using a single NVIDIA GeForce RTX 2080 Ti GPU. The game theory approach was simulated on a SuperMicro SuperServer with 40 cores in parallel (Intel Xeon CPU E5-2650 v3 2.30 GHz).

Compared methods

We compare our methods with the following baselines and state-of-the-art methods the literature. Honest Beacon: The defender responds truthfully to all queries, setting the lower bound for privacy and the upper bound for utility. Baseline Method: The defender flips (k_b) percent of SNVs with the lowest MAF, establishing a lower bound for effectiveness. Random Flips: Proposed by [4], this method randomly flips (epsilon) percent of unique SNVs, enhancing privacy by adding randomness to responses. Query Budget: Also from [4], this method assigns a privacy budget to each individual, limiting their exposure by reducing their contribution to responses after multiple queries. This budget decreases with each query involving the individual, especially for rare alleles, which pose a higher re-identification risk. Once the budget is exhausted, the individual is removed from future queries to preserve their privacy. Strategic Flipping: The Strategic Flipping [7] approach flips (k_s) percent of SNVs in decreasing order of their differential discriminative power, targeting the most informative variants first. Online Greedy (OG) Adaptive: The OG adaptive method, introduced by [10], is an adaptive thresholding based defense method. Here, the beacon has access to a control group. Based on K lowest LRTs on the control group, the beacon calculates a threshold LRT for every new query, and flips the response whenever any individual’s LRT in the beacon falls below this threshold. Simple Recurrent Neural Network (RNN): As a baseline neural network-based solution, we employ a simple RNN to capture the sequential nature of the attacker’s queries. The model uses a 3-layer GRU with an input dimension of 18 and a hidden dimension of 64. It receives the same input as the state of the corresponding RL attacker agent and predicts the degree of honesty through a sigmoid-activated linear classifier. This RNN-based defense model trains against both Optimal and Random attackers for 200 epochs, with a maximum of 300 queries per individual. At the end of each epoch, we switch the victim to ensure generalization across different users.

The parameters for these approaches were selected to balance privacy and utility effectively. Based on the sensitivity analysis conducted by [7], the following parameter values were identified as optimal for achieving this balance: (k_s) = 5, (k_b) = 10, (epsilon) = 0.25, and (beta) = 0.9. The game-theoretic approach of [12] is not directly comparable to our work as it is using a non-LRT-based formulation of risk and it aims at modifying the summary statistics within the system (e.g., allele frequencies) instead of directly altering the beacon responses like we do. The code and the model were also not available.

The first generation of Cayenne has achieved cult status over the years. First unveiled in 2002, the SUV represented Porsche’s bold move into a new segment and has built up a loyal fan base over the years. There are dedicated communities around the world where fans and collectors share their enthusiasm, exchange experiences and present their cars. One such modern classic recently visited Porsche’s Sonderwunsch department; Phillip Sarofim, entrepreneur and dedicated car collector, had his 2009 Cayenne GTS completely refurbished to new-car condition and extensively individualised.

This first ‘Factory Re-Commission’ project involving a Cayenne attracted a great deal of attention at Icons of Porsche. The successful combination of historic character, striking off-road looks and modern customisation was a hit. The Paint to Sample colour Black Olive created the desired retro look of the exterior. The lower sections of the body, as well as the alloy wheels, are finished in matt black. In the interior, extensive leather upholstery in English Green (Leather to Sample) meets the iconic Pasha fabric pattern in Black/Olive. The seat centres, and even the inside of the glove compartment, are trimmed in this iconic Porsche textile.

Unique Sonderwunsch Cayenne

With 70s vibes in the desert.

More customisation options than ever before with the Cayenne Electric

Right next to the reimagined classic, Porsche presented the new Cayenne Electric – for the first time in public, just days after its digital world premiere.

The technologically pioneering electric SUV, which produces up to 1,156 PS, also attracted many visitors. Its new Porsche Driver Experience display and control concept with its elegantly curved Flow Display garnered just as much attention as its impressive performance figures and progressive design did.

Another area of focus was the significantly expanded possibilities for individualisation. Never before has a Cayenne been so extensively customisable from the factory in such a wide range of ways as the new all-electric model. Customers will soon be able to choose from 13 exterior colours, 12 interior combinations and up to five interior packages and five accent packages. The new leather colours Magnesium Grey, Lavender and Sage Grey, plus leather-free Race-Tex interiors with a Pepita textile option, bring iconic Porsche designs into the present. Trim strips and accent colours can be fine-tuned to precisely match the interior and exterior.

The Cayenne goes electric

The Cayenne Electric marks the beginning of a new era for Porsche.

Together with the upgraded first-generation Cayenne in Dubai, the Cayenne Electric showcased the possibilities for individualising a Porsche using cars from more than two decades apart. The classic model demonstrates how first-generation vehicles can be transformed into bespoke one-offs through the Sonderwunsch programme. The Cayenne Electric, too, as well as offering the widest range of customisation options of any generation of Cayenne to date, can also be tailored to become a one-of-a-kind example through Porsche Exclusive Manufaktur.

Other highlights from the fifth Icons of Porsche festival

In addition to the two generations of Cayenne, Porsche also showcased other innovations and highlights at Icons of Porsche.

---

911 Turbo S

After its premiere at IAA Mobility in Munich, the new top-of-the-range model in the 911 series was also in the spotlight in Dubai. An innovative twin-turbo powertrain with T-Hybrid technology makes the new 911 Turbo S the most powerful production 911 of all time, with a system output of 523 kW (711 PS).

Macan GTS

The Macan GTS is a particularly sporty addition to Porsche’s range of all-electric SUVs. Its overboost power output of up to 420 kW (571 PS), the optional rear differential lock and the lowered sports air suspension noticeably take the agility of the model to a new level. Visually, including in the interior, the fifth variant of the Macan Electric features the characteristic GTS look with striking contrast details.

Panamera Turbo E-Hybrid Sonderwunsch

With the interior of the Panamera Turbo E-Hybrid Sonderwunsch, Porsche showcases how an individual customer dream can become a reality. Fade effects and contrasting colours that correspond to the exterior, as well as perfect craftsmanship, make the interior of this Panamera truly unique. The car’s humidor and Champagne cooler are examples of how exceptionally luxurious ideas can also be realised in a car’s interior as part of the Sonderwunsch programme.

911 GT3 with Manthey Kit

The Manthey Kit, which was previously reserved for the 911 GT3 RS, is now also available for the 911 GT3 and brings even greater performance on the racetrack. With enhanced aerodynamics offering significantly increased downforce, modified suspension, and upgraded brake components, it is designed for intensive track days. Equipped with the kit, the 911 GT3 lapped the Nürburgring-Nordschleife in 6:52.981 minutes – around 2.8 seconds faster than its predecessor fitted with the Manthey Kit.

911 Targa 4 GTS Art Car

Labubu is the most well-known character in the ‘The Monsters’ series. Together with the artist Kasing Lung, Porsche presented a strictly limited collector’s edition of the ‘King Mon’ character in Dubai as well as an art car with Labubu behind the wheel. In doing so, the collaborators celebrated 10 years of ‘The Monsters’ and 60 years of the Porsche 911 Targa at the same time. The 25th anniversary of the Carrera GT super sports car also received special attention at this year’s festival.

---

Info

Published figures should only be used for the purpose of comparison between vehicles. Information provided may relate to models, performance characteristics, optional extras and features only available in overseas models of the vehicle and must not be relied upon as they may be unavailable in Australia. Please note, product changes may have been made since the production of any content. Please contact an Official Porsche Centre for specific information on current data, vehicles, performance characteristics, optional extras and features available in Australian delivered vehicles.

^PS (PferdeStärke, German for horsepower) is the standard unit used in the European Union to measure the power output of a motor in ‘metric horsepower’.

Global asset manager Schroders has teamed up with Thai company Krungthai Asset Management to launch catastrophe bond fund strategies specifically for the Thai ultra-high net worth investor marketplace.

The new KTAM Catastrophe Bond Funds will act as feeder funds into an established cat bond fund managed by the Schroders Capital insurance-linked securities (ILS) team.

The two new cat bond feeder strategies are called the KTAM Catastrophe Bond Fund Not for Retail Investors and the KTAM Catastrophe Bond Fund Unhedged Not for Retail Investors.

They are designed to help open-up access to the diversifying and relatively uncorrelated catastrophe bond asset class to ultra-high net worth investors in Thailand, bringing them a simple and localised way to access an investment strategy from a leading and established ILS market investment manager.

The two KTAM cat bond funds are open-ended and available now for ongoing subscription to investors.

They provide access to the Schroder IF Flexible Cat Bond Fund, which is the master fund to the KTAM strategies.

As of September 30th 2025, the Schroder IF Flexible Cat Bond Fund had more that US $877 million in cat bond assets under management, sitting as part of Schroders Capital’s Private Debt and Credit Alternatives (PDCA) platform that manages more than US $30 billion globally.

Schroders noted that the launch of these strategies serves to further open-up access to insurance-linked securities (ILS) to Asian investors.

“Thai investors will benefit from institutional oversight and a Luxembourg vehicle, ensuring robust governance and industry-leading standards,” the asset manager explained.

The new strategies will be offered to Thai HNW investors by Krungthai Asset Management, while the 37 strong Schroders Capital ILS team with its near 15 year track record will manage the master cat bond fund that assets ultimately feed to.

Katherine Cox, Head of Client Group, South Asia and Global Official Institutions, Schroders, commented, “We are delighted to partner with Krungthai Asset Management to offer our Cat Bond strategy for Thailand’s ultra-high net worth investors. The strategy’s performance over the past three years underscores the appeal of insurance-linked securities as a source of diversification and resilient income for investors.

“The momentum in the catastrophe bond market remains strong, supported by sustained investor demand and disciplined pricing. As monetary conditions ease and private wealth investors seek stability and returns, we are strategically positioned to capture these market dynamics while delivering institutional-grade solutions that strengthen portfolio resilience for investors.”

Chavinda Hanratanakool, Chief Executive Officer, Krungthai Asset Management, added, “Natural disasters are growing more severe, with significant impacts on lives, property and economies. However, they also present unique investment opportunities through risk transfer via Catastrophe Bonds.

“We are pleased to partner with Schroders, a specialist in this field, to bring Catastrophe Bond funds to Thai investors – offering diversification benefits and attractive return especially as these assets have low correlation with mainstream investments during periods of market volatility.”

This new partnership between Schroders and Krungthai Asset Management is not the first to target the Thailand investor base with a fund designed to make accessing catastrophe bonds simpler.

Recall that ILS manager Twelve Securis had partnered with Kiatnakin Phatra Asset Management (KKP Asset Management), part of the Kiatnakin Phatra Financial Group, to launch two catastrophe bond strategies for the Thai domestic market, with both serving as feeders to the Twelve Cat Bond Fund.