A Multiparty Homomorphic Encryption Approach to Confidential Federated Kaplan Meier Survival Analysis

This paper introduces a privacy-preserving federated framework using threshold CKKS homomorphic encryption to enable multi-institutional Kaplan-Meier survival analysis that achieves high-fidelity results comparable to centralized data while preventing the reconstruction of sensitive individual records through encrypted aggregation and threshold decryption.

The Gist

Imagine a group of doctors from different hospitals who want to answer a crucial question: "How long do patients with a specific type of cancer typically survive?"

To get the most accurate answer, they need to combine data from all their patients. However, there's a major problem: Patient privacy laws (like HIPAA or GDPR) forbid them from sending their raw patient lists to a central server. They can't just "pool" the data because that would expose sensitive medical histories.

This paper presents a clever solution using a technology called Multiparty Homomorphic Encryption (MHE). Here is how it works, explained through simple analogies.

1. The Problem: The "Subtraction Attack"

In previous attempts to solve this, researchers used a "two-round" method:

1. Each hospital sends a summary of their data (e.g., "At month 1, we had 100 patients at risk and 5 died").
2. A central coordinator adds these up and broadcasts the total back to everyone.

The Flaw: This is like a game of "Guess the Number." If Hospital A knows they had 5 deaths, and the coordinator announces the total is 100, Hospital A can simply do the math: $100 - 5 = 95$. They now know exactly how many deaths occurred in all the other hospitals combined. If there are only two hospitals, they know the other hospital's exact data. This is called a subtraction attack.

2. The Solution: The "Locked Box" Analogy

The authors propose a new system where the data never leaves the hospitals in a readable form. They use Homomorphic Encryption, which is like a magical locked box.

• The Magic Box: Imagine every hospital puts their patient counts (how many people are at risk, how many died) into a special, unbreakable locked box.
• Doing Math on Locked Boxes: The magic of this technology is that the central coordinator can add these locked boxes together without ever opening them. It's like stacking two locked boxes on top of each other; the result is a new, larger locked box that contains the sum of the two original boxes inside.
• The Result: The coordinator ends up with one giant locked box containing the total number of patients and deaths from all 500 hospitals combined. But because the box is locked, the coordinator cannot see the individual numbers.

3. The "Secret Committee" (Threshold Decryption)

So, who opens the box? If one person opens it, they see the total, which is fine. But we need to make sure no single person can peek inside the individual contributions.

The authors use a Threshold Committee:

• Imagine a vault with a giant lock that requires 10 keys to open.
• There are 10 different people (a committee) holding these keys.
• To open the final box and see the survival statistics, all 10 people must work together to turn their keys simultaneously.
• If even one person is missing, the box stays locked.
• This ensures that no single hospital or the central coordinator can ever see the raw data. They only see the final, aggregated result.

4. The "Survival Curve" (The Final Output)

Once the committee unlocks the box, they get the total numbers. They then calculate the Kaplan-Meier curve (a standard graph showing survival rates over time).

• What gets released? Only the final graph (e.g., "50% of patients survive 5 years").
• What stays hidden? The specific numbers of how many people died at month 1, month 2, etc., for the entire group.
• Why is this safe? Even if a doctor looks at the final graph, they cannot work backward to figure out how many patients any single hospital contributed. The "subtraction attack" is impossible because the intermediate numbers were never revealed.

5. Packing the Boxes Efficiently

The paper also discusses how to fit these numbers into the "boxes" efficiently.

• Separate Packing: Putting all "at-risk" numbers in one box and all "death" numbers in another.
• Interleaved Packing: Mixing them up (Risk, Death, Risk, Death...) in a single box.
• The Benefit: The authors proved that mixing them up (Interleaved) is like packing a suitcase more tightly. It requires fewer boxes to send, which makes the whole process faster and uses less internet bandwidth, without losing any accuracy.

The Bottom Line

The researchers tested this with a massive simulation involving 60,000 fake patients spread across 500 different hospitals.

• Accuracy: The results were mathematically identical to what you would get if you had stolen all the data and put it in one room (the "Oracle").
• Privacy: The "subtraction attack" was completely blocked.
• Speed: The system was fast enough to be practical for real-world use.

In summary: This paper gives us a way for hospitals to collaborate on life-saving research without ever having to trust each other with their raw patient data. It's like solving a giant puzzle where everyone contributes a piece, but no one ever sees the picture until the very end, and even then, they only see the final image, not who contributed which piece.

Technical Summary

1. Problem Statement

Survival analysis, particularly using the Kaplan–Meier (KM) estimator, is critical for clinical and epidemiological research. However, privacy regulations (e.g., GDPR, HIPAA) prevent the centralization of sensitive patient data across multiple institutions. While Federated Analytics (FA) allows computation without moving data, existing approaches face significant limitations:

• Privacy Gaps in Plaintext Protocols: Traditional two-round federated KM protocols often broadcast aggregated per-time-point counts (at-risk $n_t$ and events $d_t$) to all sites. This allows any single site to subtract its own local counts from the global totals, perfectly reconstructing the contributions of all other participants (the "subtraction attack").
• Estimator-Level Theory Gaps: Existing cryptographic solutions often lack formal guarantees regarding how approximate arithmetic (common in Homomorphic Encryption) affects the statistical properties of the KM estimator.
• Scalability and Efficiency: There is a lack of closed-form scaling laws for communication and computation specific to KM, making it difficult to predict costs for large federations.
• Packing Inefficiency: Standard CKKS (Cheon-Kim-Kim-Song) packing strategies for the two required data streams ($n_t$ and $d_t$) have not been formally optimized for the "add-only" nature of KM aggregation.

2. Methodology

The authors propose a Multiparty Homomorphic Encryption (MPHE) framework based on the CKKS scheme with threshold decryption. The system operates in three phases:

A. Protocol Phases

1. Phase A (Setup & Alignment):
   • Sites perform Distributed Key Generation (DKG) to create a joint public key and individual secret-key shares.
   • Sites upload their local unique survival times (plaintext). The coordinator computes the global alignment grid ($T_{all}$), the union of all observed times, and broadcasts it.
2. Phase B (Encrypted Aggregation):
   • Sites compute local at-risk ($n^{(k)}_t$) and event ($d^{(k)}_t$) counts aligned to $T_{all}$.
   • These counts are packed into CKKS plaintext vectors and encrypted.
   • Packing Modes: The paper compares Interleaved packing (co-packing $[n_1, d_1, n_2, d_2, \dots]$) vs. Separate packing (distinct streams for $n$ and $d$).
   • The coordinator performs homomorphic addition (ciphertext-only) to aggregate counts from all $K$ sites. No plaintext is revealed here.
3. Phase C (Threshold Decryption & Output Gating):
   • A committee of decryptors (size $R$) generates partial decryption shares for the aggregated ciphertexts.
   • A combiner fuses these shares to recover the aggregated plaintext counts $(N_t, D_t)$.
   • Output Gating: Crucially, the protocol never releases the per-time-point tables $(N_t, D_t)$ to the participating sites. Only the final KM survival curve $\hat{S}(t)$ and optional confidence bands are published.

B. Theoretical Foundations

• Correctness: Proves that the federated KM estimator equals the pooled oracle estimator in both plaintext and exact HE settings.
• Perturbation Bounds: Derives a CKKS-specific perturbation bound showing that the error in the KM product converges uniformly to zero as noise vanishes.
• Identifiability: Proves that publishing only the survival curve $\hat{S}(t)$ reveals hazard ratios but does not uniquely determine the integer counts $(n_t, d_t)$ or per-site splits, effectively closing the subtraction attack vector.
• Packing Optimality: Proves that interleaved packing minimizes the number of ciphertexts required for two streams under add-only aggregation, reducing communication overhead.

3. Key Contributions

1. Privacy-Preserving Framework: A complete MPHE-CKKS framework that eliminates the subtraction-based reconstruction attack by withholding intermediate aggregated counts and releasing only the final survival curve.
2. Estimator-Level Guarantees: Formal proofs establishing that the HE-federated KM is statistically indistinguishable from the pooled oracle, including explicit perturbation bounds for approximate arithmetic.
3. Optimization & Scaling Laws:
   • A proof that interleaved packing is optimal for minimizing ciphertext count.
   • Derivation of closed-form scaling laws showing communication grows linearly with the number of sites ($K$) and stepwise with the number of time points ($|T|$).
4. Empirical Validation: Extensive evaluation on synthetic data (60,000 patients, up to 500 sites) and real-world NCCTG lung cancer data, demonstrating numerical indistinguishability from the oracle.

4. Results

• Privacy: In plaintext baselines, sites could perfectly reconstruct other participants' data via subtraction (100% accuracy). The proposed HE framework completely eliminates this risk; reconstruction is mathematically impossible without the intermediate tables.
• Numerical Fidelity: The HE-federated curves match the pooled oracle to machine precision.
  • Integrated Absolute Error (IAE) on survival: $\approx 10^{-8}$.
  • Relative RMST gaps: $\approx 10^{-12}$ to $10^{-8}$.
  • Confidence interval coverage: $\approx 99.9\%$.
• Performance & Scalability:
  • Runtime: Scales linearly with the number of sites ($K$). For $K=500$, the end-to-end runtime is approximately 9.24 seconds (interleaved) vs. 11.84 seconds (separate).
  • Communication: Interleaved packing reduces uplink bandwidth by up to 2x compared to separate packing (e.g., 1 ciphertext vs. 2 for small grids).
  • Overhead: While HE introduces overhead compared to plaintext, the system remains feasible for large federations (up to 500 sites) with predictable resource usage.

5. Significance

This work bridges the gap between theoretical cryptography and practical clinical survival analysis.

• Clinical Impact: It enables high-fidelity, multi-institutional survival studies (e.g., rare cancer research) without compromising patient privacy, overcoming the "data silo" problem.
• Security Model: It moves beyond simple "honest-but-curious" assumptions by formally proving that even if a site is curious, it cannot infer others' data from the public output, a critical requirement for real-world deployment.
• Practicality: By providing explicit scaling laws and packing optimizations, the paper offers a blueprint for deploying large-scale federated learning systems using Homomorphic Encryption, demonstrating that the computational cost is manageable and predictable.

In summary, the paper presents a robust, mathematically proven, and empirically validated solution for confidential federated survival analysis, effectively neutralizing reconstruction attacks while maintaining statistical accuracy comparable to centralized analysis.