📊 statistics

Optimal Cox regression under federated differential privacy: coefficients and cumulative hazards

This paper establishes minimax optimal rates for estimating Cox regression coefficients and cumulative baseline hazards under federated differential privacy, revealing phase transitions between private and non-private regimes and introducing a private tree-based Breslow estimator implemented in the R package FDPCox.

Original authors: Elly K. H. Hung, Yi Yu

Published 2026-04-07

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Elly K. H. Hung, Yi Yu

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are a doctor trying to figure out which lifestyle factors (like diet, exercise, or smoking) affect how long patients live. You have data from five different hospitals. However, there's a catch: patient privacy is paramount. You cannot share the raw medical records because that would violate laws and ethics.

This paper is about solving a specific statistical puzzle: How do we learn from this scattered, private data without ever seeing the individual secrets?

Here is the breakdown of the paper's ideas using simple analogies.

1. The Problem: The "Secret Recipe" Dilemma

In statistics, there's a famous tool called the Cox Model. Think of it as a "survival calculator." It takes a list of patient traits and predicts their risk of an event (like a heart attack) over time.

Usually, to make this calculator accurate, you need to dump all the data into one giant pot. But in the real world, data is scattered across many servers (hospitals, banks, research centers), and they can't share the raw ingredients.

The Challenge:

Federated Learning: We want to train the calculator by sending only "updates" (like "the recipe needs more salt") between servers, not the raw data.
Differential Privacy (DP): Even the "updates" might accidentally reveal secrets. So, we add "noise" (static) to the updates to hide the individual contributions.
The Cost: Adding noise makes the calculator less accurate. The paper asks: What is the absolute minimum amount of accuracy we lose just to keep secrets safe?

2. The Solution: Two New Tools

The authors built two specific algorithms to handle this.

Tool A: The "Whispering Gradient Descent" (For Coefficients)

The Goal: Find the numbers (coefficients) that tell us how much each risk factor matters.
The Analogy: Imagine a group of chefs trying to perfect a soup recipe. They can't taste each other's pots. Instead, they send a note saying, "Add a pinch more salt."
The Twist: To protect privacy, they add a little bit of "static" (noise) to their notes.
The Innovation: In survival analysis, the "at-risk" group changes constantly (people leave the study, or the event happens). This makes the math messy. The authors created a special way to add noise that handles this messiness without breaking the recipe.
The Result: They proved mathematically that even with the noise, the recipe converges to the truth, provided you have enough chefs (servers) and enough ingredients (data).

Tool B: The "Tree of Time" (For Cumulative Hazard)

The Goal: Estimate the "Cumulative Hazard," which is basically the total risk accumulated over time.
The Analogy: Imagine you are trying to measure the water level in a river over a year. You can't measure it every second.
The Innovation: Instead of measuring the whole river at once, they chop the timeline into tiny intervals and build a Binary Tree.
- Think of a family tree. At the bottom, you have tiny branches (small time intervals). As you go up the tree, branches merge into larger chunks (weeks, months, years).
- They add noise to the small branches. Because of the tree structure, you can reconstruct the water level for any point in time by combining just a few noisy branches.
The Benefit: This is much more efficient than adding noise to every single day. It keeps the privacy budget (the "allowance" for noise) from running out too fast.

3. The Big Discovery: The "Privacy Tax"

The authors did a deep mathematical analysis to find the Minimax Bounds. In plain English, this is the "Tax on Privacy."

The Non-Private World: If you could see all the data, your error rate would drop quickly as you get more data.
The Private World: Because you are adding noise, your error rate drops slower.
The Phase Transition: The paper reveals a tipping point.
- If your privacy budget is tight (high security), the error is dominated by the noise. It's like trying to hear a whisper in a hurricane.
- If your privacy budget is loose (low security), the error is dominated by the lack of data. It's like trying to hear a whisper in a quiet room; the noise isn't the problem, the volume is.
- Key Finding: They found exactly where this switch happens. They also showed that if you have Public Data (like knowing everyone's age, which isn't secret), you can lower the "Privacy Tax" significantly.

4. Real-World Testing

They didn't just do math on paper. They:

Simulated Data: Created fake patient data to see if their algorithms worked as predicted. They found that the error rates matched their theoretical "Tax" perfectly.
Real Data: Applied their method to a real breast cancer dataset (the Rotterdam dataset). They split the data into fake "hospitals" and showed that their private method could still find the correct risk factors, just with slightly more error than a non-private method.

5. Why This Matters

This paper is a "first" in the field. Before this, we didn't have a solid mathematical map for how privacy affects survival analysis in a distributed world.

For Hospitals: It gives them a blueprint on how to collaborate on cancer research without breaking patient privacy laws.
For Statisticians: It tells them exactly how much data they need to collect to overcome the "noise" of privacy.
For the Public: It proves that we can do advanced medical research on sensitive data without sacrificing individual privacy.

Summary Metaphor

Imagine trying to solve a jigsaw puzzle where the pieces are locked in separate safes.

Old Way: You couldn't solve it because you couldn't open the safes.
New Way (This Paper): You send a blurry photo of the piece's edge to a central hub. The hub tries to fit it.
The Paper's Contribution: It calculated exactly how blurry the photos can be before the puzzle becomes unsolvable, and it built a special "blurry-photo machine" (the algorithms) that makes the best possible puzzle even with the blur.

1. Problem Formulation

The paper addresses the challenge of performing survival analysis on distributed data while preserving strict privacy guarantees. Specifically, it focuses on the Cox Proportional Hazards Model, a standard tool for analyzing time-to-event data with censoring.

Setting: A Federated Learning environment where data is distributed across $S$ servers. Each server $s$ holds $n_s$ independent and identically distributed (i.i.d.) triples of $(T_{s,i}, \Delta_{s,i}, Z_{s,i}(\cdot))$ , representing event time, censoring indicator, and covariate processes.
Goal: Estimate two fundamental quantities:
1. The regression coefficient vector $\beta_0 \in \mathbb{R}^d$ .
2. The cumulative baseline hazard function $\Lambda_0(t) = \int_0^t \lambda_0(s) ds$ .
Constraint: The system must satisfy Federated Differential Privacy (FDP). In this model, each server $s$ holds a local privacy budget $(\epsilon_s, \delta_s)$ . Data is processed locally, and only privatized messages (gradients or statistics) are communicated to a central aggregator. The privacy constraint applies to the data within each server, and the interaction protocol must ensure that the aggregate output satisfies the federated constraints.
Key Challenge: The Cox partial likelihood involves a complex normalization term (the risk set sum) that depends on the entire dataset at a given time point. This creates dependencies between data points, making the calculation of sensitivity (required for adding noise) and the design of efficient private algorithms significantly more difficult than in standard linear regression.

2. Methodology

The authors propose a comprehensive framework involving minimax analysis and specific algorithms for both parameter estimation and function estimation.

A. Estimation of Regression Coefficients ( $\beta_0$ )

Algorithm: FDP-Cox (Algorithm 1).
- This is a Private Stochastic Gradient Descent (SGD) algorithm.
- Mechanism: At each iteration $k$ , each server $s$ computes the gradient of the partial likelihood on a local batch of data. To satisfy $(\epsilon_s, \delta_s)$ -CDP locally, the server adds Gaussian noise to the gradient.
- Sensitivity Handling: The paper derives a tight bound on the $\ell_2$ -sensitivity of the Cox score function. Unlike standard settings, the sensitivity here scales as $O(\log(n)/n)$ due to the time-dependent risk set normalization.
- Aggregation: The central server aggregates the noisy gradients using weights proportional to the "effective sample size" of each server, defined as $\min(n_s, n_s^2 \epsilon_s^2 / d)$ .
Label DP Extension: The authors also study a relaxed setting where covariates $Z$ are public, and only the time/censoring indicators are private (Label FDP). They derive minimax bounds for this scenario, showing that while the dimensionality cost is reduced in some regimes, the fundamental privacy cost remains significant in the central/federated settings.

B. Estimation of Cumulative Baseline Hazard ( $\Lambda_0$ )

Algorithm: FDP-Breslow (Algorithm 2).
- This is a distributed version of the Breslow estimator.
- Mechanism: The time horizon $[0, 1]$ is partitioned into intervals. The algorithm constructs a binary tree of cumulative hazard estimates.
- Privacy Mechanism: Instead of releasing the cumulative hazard at every time point (which would accumulate noise linearly), the servers release privatized estimates for the nodes of a binary tree. This allows any cumulative hazard $\Lambda(t)$ to be reconstructed by summing only $O(\log(1/\text{interval}))$ noisy terms, keeping the noise accumulation logarithmic.
- Truncation: To handle the risk of small risk sets (which would explode the sensitivity), the algorithm truncates the denominator of the Breslow estimator using a private estimate of the at-risk probability.

C. Theoretical Framework

Minimax Lower Bounds: The authors derive fundamental lower bounds for the estimation error using the van Trees inequality and score attack arguments. These bounds establish the "cost of privacy" by comparing private rates to non-private rates.
Upper Bounds: They prove that their proposed algorithms achieve rates that match the lower bounds up to poly-logarithmic factors.

3. Key Contributions

First Systematic Minimax Analysis: This is the first work to provide a rigorous minimax analysis for the Cox model under Federated Differential Privacy. It quantifies the fundamental statistical cost of privacy in survival analysis.
Phase Transitions: The analysis reveals "server-level phase transitions." Depending on the local sample size $n_s$ and privacy budget $\epsilon_s$ , a server's contribution switches between a non-private regime (dominated by $1/n_s$ ) and a private regime (dominated by $d/(n_s^2 \epsilon_s^2)$ ).
Novel Algorithms:
- FDP-Cox: Handles the unique dependence structure of the Cox partial likelihood via private SGD with carefully bounded sensitivity.
- FDP-Breslow: Adapts binary tree mechanisms to the distributed setting for nonparametric integral estimation, achieving nearly minimax optimal rates for the cumulative hazard.
Label DP Results: The paper provides the first minimax bounds for Cox regression under Label Differential Privacy (where covariates are public), showing that the privacy cost structure differs significantly from full DP but remains non-trivial.
Implementation: The authors released an R package, FDPCox, implementing these methods.

4. Main Results

A. Regression Coefficients ( $\beta_0$ )

The minimax rate for the squared $\ell_2$ error is:
$\mathbb{E}\|\hat{\beta} - \beta_0\|_2^2 \asymp \frac{d^2}{\sum_{s=1}^S \min(n_s, \frac{n_s^2 \epsilon_s^2}{d})} \cdot \text{polylog}(\dots)$

Interpretation: The effective sample size is the sum of the minimum of the local sample size and the "private effective sample size" ( $n_s^2 \epsilon_s^2 / d$ ).
Phase Transition: If $n_s \epsilon_s^2 \ll d$ , the server operates in the private regime where the error scales with $1/(n_s^2 \epsilon_s^2)$ . If $n_s \epsilon_s^2 \gg d$ , it operates in the non-private regime ( $1/n_s$ ).

B. Cumulative Hazard ( $\Lambda_0$ )

The minimax rate for the supremum norm error is:
$\mathbb{E}\left[\sup_{t} |\hat{\Lambda}(t) - \Lambda_0(t)|\right] \asymp \frac{1}{\sqrt{\sum_{s=1}^S \min(n_s, n_s^2 \epsilon_s^2)}} + \text{terms involving } \|\hat{\beta} - \beta_0\|$

The rate for $\Lambda_0$ depends on the square root of the effective sample size, similar to non-parametric density estimation, but with the privacy penalty incorporated.
The error also depends on the accuracy of the plug-in estimator $\hat{\beta}$ .

C. Label DP

Under Label FDP (public covariates), the lower bound for $\beta_0$ estimation is:
$\frac{d^2}{\sum \min(n_s, n_s^2 \epsilon_s^2)} + \frac{d^3}{(\sum n_s)^2 (\max \epsilon_s)^2}$
This highlights that while the dimensionality penalty ( $d^2$ vs $d^3$ ) is reduced in the non-private term, the private term still incurs a significant cost, particularly in the federated setting.

5. Significance and Impact

Bridging Theory and Practice: The paper moves beyond theoretical bounds to provide computationally efficient algorithms that are implemented in a real software package, making private survival analysis accessible.
Healthcare and Finance Applications: By addressing the specific challenges of censored data in a federated setting, this work enables secure collaboration in high-stakes domains like multi-center clinical trials and financial risk management, where data sharing is legally restricted.
Fundamental Limits: The derived minimax bounds serve as a benchmark for future research, defining the theoretical limits of what is achievable under federated privacy constraints.
Handling Complexity: The work successfully tackles the non-trivial mathematical difficulty of the Cox model's risk-set normalization under privacy constraints, a problem that had remained largely unexplored in the rigorous statistical literature.

In summary, Hung and Yu provide a foundational study that establishes the statistical limits of private survival analysis and offers practical, optimal algorithms for estimating both the regression coefficients and the baseline hazard in a federated environment.