📊 statistics

Differentially private hypothesis testing in survival analysis

This paper establishes a finite-sample theory for differentially private hypothesis testing in survival analysis by developing private tests for Cox regression coefficients and cumulative hazard functions, while providing theoretical guarantees, minimax lower bounds, and numerical validation to characterize the statistical impact of privacy constraints.

Original authors: Elly K. H. Hung, Yi Yu

Published 2026-05-19

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Elly K. H. Hung, Yi Yu

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are a doctor trying to figure out if a new medicine helps patients live longer. You have data on many patients: when they started treatment, when they stopped (either because they got better, passed away, or left the study early), and their personal details like age or weight. This is called survival analysis.

The problem? This data is incredibly sensitive. If you release it, even in a "blinded" way, clever hackers might be able to figure out exactly who is who. To stop this, we use a mathematical shield called Differential Privacy. Think of it like adding a tiny bit of "static" or "noise" to the data before anyone sees it. It's like blurring a photo just enough that you can still see the general scene, but you can't make out the faces of the people in it.

This paper asks a tough question: Can we still run statistical tests to see if the medicine works, even when the data is blurred by this privacy noise?

The authors, Elly Hung and Yi Yu, say: "Yes, but it's harder, and here is exactly how hard." They built a new set of tools to test hypotheses (like "Does this drug work?") on this blurred data without breaking the privacy shield.

Here is a breakdown of their work using simple analogies:

1. The Challenge: The "At-Risk" Puzzle

In survival analysis, patients are linked together. If Patient A is still alive at year 2, they are part of the "at-risk" group for Patient B who might die in year 3. This creates a web of connections.

The Problem: Most privacy tools work by treating data points as independent, like individual coins being flipped. But in survival analysis, the coins are glued together. You can't just blur one coin without affecting the others.
The Solution: The authors invented new ways to blur the data that respect these connections, ensuring the privacy shield holds even when the data is tangled.

2. Tool #1: The "Private Likelihood Ratio" (Testing Two Specific Ideas)

Imagine you want to test two specific theories:

Theory A: The drug has no effect (the coefficient is 0).
Theory B: The drug has a specific effect (the coefficient is 0.2).

Usually, you calculate a "score" to see which theory fits the data better.

The Privacy Twist: The authors take this score and add a special kind of noise (called Laplace noise) to it. It's like weighing a package on a scale that has a slightly wobbly needle.
The Result: They proved that even with the wobbly needle, you can still tell the difference between Theory A and Theory B, provided the difference between them is big enough. If the drug's effect is tiny, the privacy noise might drown it out, and you won't be able to detect it. They calculated exactly how big the effect needs to be to overcome the noise.

3. Tool #2: The "Private Score Test" (Testing One Idea vs. Anything Else)

Sometimes you don't have a specific number in mind. You just want to know: "Is the drug doing anything different from nothing?"

The Challenge: To do this normally, you usually need to calculate a complex "inverse matrix" (a mathematical operation that is very sensitive to noise). If you try to blur this calculation, it breaks.
The Innovation: The authors found a shortcut. Instead of calculating the complex matrix, they just measured the "distance" (Euclidean norm) of the data's signal.
The Calibration: To know if the distance is "too big" to be random chance, they needed a threshold. Instead of guessing, they created a private calibration procedure. It's like having a referee who adds a little bit of noise to the rulebook itself to ensure the game remains fair and private, then sets the winning line based on that.

4. Tool #3: The "Distributed Two-Server Test" (Comparing Two Groups)

Imagine two hospitals. Hospital A has data on patients taking the drug; Hospital B has data on patients taking a placebo. They want to compare them without sharing their raw data.

The Setup: Both hospitals run their own private tests (adding their own noise) and send only the results to a central judge.
The Result: The authors showed that this "distributed" approach works almost as well as if they had combined all the data in one room. They proved that the "separation rate" (how different the two groups need to be to be detected) is nearly the best possible, even with the privacy noise.

What Did They Actually Prove?

The paper doesn't just say "it works." It provides a precise mathematical map of the trade-offs:

When Privacy is Negligible: If you have a massive amount of data, the privacy noise becomes so small compared to the signal that it barely matters. You get almost the same accuracy as if you had no privacy at all.
When Privacy Dominates: If you have a small dataset or very strict privacy rules (very little noise allowed), the privacy noise becomes the main obstacle. The "cost" of privacy is that you need a much stronger drug effect to detect it.
The "Open Gap": They found that for some specific types of tests, they have a "best possible" lower limit (the minimum data needed) and an "upper limit" (what their method achieves), but there is a small gap in the middle. They don't yet know if a perfect method exists to close that gap, or if their current method is already the best we can do.

The Bottom Line

The authors built the first solid theoretical foundation for testing hypotheses on survival data while keeping individual patients anonymous. They showed us:

How to add noise without breaking the statistical test.
When the test will fail (if the effect is too small or the privacy is too strict).
How much data you need to get a reliable answer.

They validated these theories with computer simulations, showing that their "blurred" tests behave exactly as the math predicts: as you get more data or relax the privacy rules slightly, the ability to detect real effects improves.

Technical Summary: Differentially Private Hypothesis Testing in Survival Analysis

Problem Statement

Survival analysis is critical for decision-making in high-stakes domains such as medicine, engineering reliability, and customer retention, yet it frequently involves sensitive individual-level data. While differential privacy (DP) offers a rigorous framework for protecting such data, the development of private hypothesis testing procedures for right-censored data remains significantly underdeveloped compared to private estimation. Existing private testing literature largely relies on the assumption of independent likelihood decompositions, a condition that fails in survival analysis due to the dependence structure induced by at-risk sets. Consequently, standard private testing approaches cannot be directly applied to canonical survival problems like Cox regression and cumulative hazard comparison.

This paper initiates a finite-sample theory for differentially private hypothesis testing in survival analysis, addressing three canonical problems:

Binary hypothesis testing for Cox regression coefficients.
Identity testing (simple null vs. composite alternative) for Cox regression coefficients.
Two-sample testing for cumulative hazard functions under right censoring in a distributed setting.

Methodology

1. Binary Hypothesis Testing for Cox Coefficients

The authors propose a differentially private version of the partial likelihood ratio test for testing $H_0: \beta^* = \beta_0$ vs. $H_1: \beta^* = \beta_1$ .

Mechanism: The test statistic is constructed by adding Laplace noise to the log partial likelihood ratio. The noise scale is calibrated to the sensitivity of the log partial likelihood ratio, which depends on the boundedness of the covariate process and the distance between $\beta_0$ and $\beta_1$ .
Privacy: The procedure satisfies $(\epsilon, 0)$ -differential privacy.
Detection Guarantee: The paper establishes a sufficient condition for reliable testing, showing that the separation between hypotheses must exceed a rate comprising the standard non-private term ( $d/n$ ) and a privacy-induced term ( $d^2/n^2\epsilon^2$ ).

2. Identity Testing for Cox Coefficients

For the problem of testing $H_0: \beta^* = \beta_0$ vs. $H_1: \|\beta^* - \beta_0\|_2^2 \geq r^2$ , the authors develop a private score-type test.

Statistic: Instead of privatizing the full quadratic form involving the inverse information matrix (which is difficult to estimate privately), the test utilizes the Euclidean norm of the score function, $\|\dot{\ell}_n(\beta_0)/\sqrt{n}\|_2$ .
Calibration: The rejection threshold requires the trace of the population information matrix, $\text{tr}\{G(\beta^*)\}$ . Since this is unknown, the authors propose a private estimator for the trace using a private Hessian computed on a subset of the data.
Implementation: The final test combines the private score statistic with a private trace estimator, avoiding the need to privately invert a $d \times d$ matrix. The procedure maintains the same error guarantees as an oracle test up to constant and logarithmic factors.

3. Distributed Two-Sample Testing for Cumulative Hazards

The authors consider a distributed setting where two servers hold datasets $D_1$ and $D_2$ and wish to test $H_0: \Lambda_1 = \Lambda_2$ vs. $H_1: \|\Lambda_1 - \Lambda_2\|_\infty > r$ .

Approach: The method employs a distributed private Nelson-Aalen estimator (based on a wavelet-like construction) to estimate the cumulative hazard functions $\hat{\Lambda}_1$ and $\hat{\Lambda}_2$ on each server.
Test Statistic: The test rejects $H_0$ if the sup-norm distance between the private estimators exceeds a threshold $\tau$ .
Privacy: Each server applies a private mechanism satisfying $(\epsilon_k, \delta_k)$ -DP. The final test is a function of these private outputs, satisfying the distributed privacy constraints.

Key Contributions and Results

Theoretical Guarantees

Finite-Sample Theory: The paper provides finite-sample detection guarantees and minimax lower bounds, moving beyond the asymptotic perspectives common in prior private testing literature.
Separation Rates:
- For binary Cox coefficient testing, the achievable separation rate is shown to be $O(d/n + d^2/n^2\epsilon^2)$ . A minimax lower bound of $\Omega(d/n + d/n^2\epsilon^2)$ is derived, revealing a gap where the optimality of the proposed partial likelihood ratio test remains open.
- For identity testing, the separation rate is $O(d^{3/2}/n + \text{privacy terms})$ . The non-private component ( $d^{3/2}/n$ ) is shown to be nearly minimax optimal, while the optimal dependence on privacy parameters remains an open problem.
- For distributed two-sample testing of cumulative hazards, the proposed test achieves a separation rate that is minimax optimal up to poly-logarithmic factors. The rate combines the non-private term ( $n^{-1/2}$ ) and the privacy cost term ( $n\epsilon)^{-1}$ .
Privacy vs. Statistical Efficiency: The results identify regimes where privacy is statistically negligible (when $\epsilon \gtrsim \sqrt{d/n}$ ) and regimes where privacy dominates the testing rate.

Numerical Experiments

The authors validate their theoretical findings through simulations:

Cox Coefficients: Empirical power and Type-I error rates for the binary likelihood ratio test and the score-type test were examined. Results show that power increases with sample size $n$ and privacy budget $\epsilon$ , consistent with theoretical predictions.
Two-Sample Testing: Simulations demonstrated that the distributed test correctly controls Type-I error and achieves increasing power as the separation between hazard functions, sample size, or privacy budget increases.

Significance and Claims

The paper claims to be the first to initiate a finite-sample theory for differentially private hypothesis testing in survival analysis. Its significance lies in:

Addressing Dependence: It explicitly handles the non-independence of observations in survival data (via at-risk sets), a structural feature that prevents the direct application of standard private testing methods.
Avoiding Inversion: The identity testing procedure avoids the computationally and statistically challenging task of privately inverting the information matrix, offering a more practical alternative for high-dimensional Cox models.
Optimality: It establishes that for distributed cumulative hazard testing, the proposed method is nearly minimax optimal, providing a benchmark for future work.
Open Problems: The authors modestly note that while their upper bounds for Cox coefficient testing are competitive, the exact minimax separation rate for private binary and identity testing in the Cox model remains an open problem, particularly regarding the tightness of the privacy-dependent terms.

The work does not claim to solve all challenges in private survival analysis but provides a foundational theoretical framework and specific, implementable procedures for key hypothesis testing scenarios, accompanied by rigorous finite-sample analysis.