A local node for updating detection models while maintaining data privacy has a sharing module configured to receive instructions for calculating at least one general feature from data stored at the first local node, a retraining module configured to retrain the detection model to include a detection component that uses the instructions, a data collection module configured to collect data comprising customer data and transaction data stored at the first local node, and a performance module. The performance module is configured to determine a value for the at least one general feature from the collected data using the instructions, and trigger a suspicious activity alert based on the determined value and the instructions. The customer data and transaction data are indeterminable from the at least one general feature and the determined value.