Survival Analyses (SAs), a key statistical tool used to predict event occurrence over time, often involve sensitive information, necessitating robust privacy safeguards. This work demonstrates how the Revised Randomized Response (RRR) can be adapted to ensure Diferential Privacy (DP) while performing SAs. This methodology seeks to safeguard the privacy of individuals' data without significantly changing the utility, represented by the statistical properties of the survival rates computed. Our findings show that integrating DP through RRR into SAs is both practical and efective, providing a significant step forward in the privacy-preserving analysis of sensitive time-to-event data. This study contributes to the field by ofering a new comparison method to the current state-of-the-art used for SAs in medical research.
Privacy (DP) provides the patient with “Plausible Deniability”, a condition under which an
individual can deny his participation in a specific research study in a manner that an adversary
cannot disprove with certainty. Applying Diferential Privacy ( DP) have been used over the last
decade [
In this study, we show how to use a revised version of the randomized response, i.e., the
coin-toss mechanism, introduced by Warner [
In Section 2, we describe the related works used to provide privacy in healthcare research, focusing on privacy in SAs. Section 3 explains the theoretical background of the work, and Section 4 illustrates the mechanism used to address the problem of privacy in the SA function computation. Finally, in Section 5, we report our findings and fully discuss the results obtained.
Privacy-preserving technology literature has ofered diferent techniques to adopt DP in medical research studies, such as generative artificial intelligence and statistical models [15, 16].
Solutions for providing privacy using artificial intelligence methods include the implementation of Generative Adversarial Networks (GANs) [17, 18, 19], trained using DP, to create new synthetic data for research purposes rather than operating with the real data. However, GANs have limitations in terms of scalability and eficiency, which include the need for a significant amount of training data and higher demands on power consumption as reported in [20, 21].
On the other hand, the application of statistical models for survival analysis was first explored by Nguyên and Hui [22], Yu et al. [23], which investigated the impact of DP to understand the impact of explanatory variables for discrete-time SAs. In [22] the author proposed an extension of the DP Output Perturbation [24] method originally proposed for the empirical risk minimization problem. However, such an approach is limited for discrete-time SAs and is not applicable in this study. Moreover, Yu et al. [23] proposes to project patients’ data to a space of lower dimension such that the projection preserves good characteristics of the original data. Nevertheless, the method does not rely on any formal definition of privacy.
To the best of our knowledge, it is not present in the literature a model to perform SA privatizing the categories in which patients are grouped. A similar work has been proposed by Gondara and Wang [25]. The authors proposed the Laplacian Noise Time Event (LNTE) mechanism to obfuscate the time-to-event data used by researchers when investigating the survival rates of a patients’ dataset. The LNTE mechanism modifies traditional survival analysis by introducing Laplace noise, in line with a specified privacy budget , to both the subjects at risk and events within a dataset . This process generates a perturbed matrix ′, ensuring DP. Then, the algorithm iteratively adjusts these counts across time points to maintain updated risk and event information, culminating in a diferentially private estimation of the survival probability. However, the mechanism has some limitations, especially when the dataset size is small, leading to truncation and biased estimates in the survival rates.
We split the background into two parts: initially, we briefly describe SA and its main use in healthcare. Then present the DP framework, describing the properties used in our methodology.
Survival Analyses (SAs) are statistical techniques commonly used to analyze time-to-event or time-to-failure data when the event of interest has not yet occurred [26, 27]. Such functions investigate the time between a dichotomous event to occur and are used in diferent fields of research [28, 29]. In SAs, given a certain population of interest, researchers observe the expression of some event at a defined time and want to compute the probability trend of some event, e.g., the occurrence of a certain symptom, the need of a certain treatment, or the death, for the rest of the population at time ′ > . Focusing on the medical research we are presenting, the event of interest is often defined as the death of a patient belonging to a specific population. An intuitive definition of the survival function is that it provides the probability that the event of interest, i.e., the death of a patient, has not yet occurred by time . On the other hand, a censored event refers to a situation where the exact time of the event (such as death, relapse, or recovery) is unknown for an individual within the study. Censoring occurs when the observation period ends before the event occurs or when the individual is lost to follow-up.
Specifically for the medical research field, the Kaplan-Meier ( KM) estimator [30] is the most common method used to compute a patient’s probability rate of survival. The KM nonparametric method is a statistical model that evaluates the survival trend of patients with a common characteristic, finding the relation between the probability of survival over the observation time in the population analyzed. Equation 1, outlines the process for calculating the KM estimator. This method factors in the occurrence of event and the count of patients who have not yet experienced death or have been censored by time ≤ . ̂︀() = ∏︁ (︂ − )︂
:≤ (1)
The gold standard definition of privacy widely accepted in the information security community
research is provided by the notion of Diferential Privacy, introduced in Dwork et al. [
Pr [ℳ() ∈ ] ≤ · Pr [︀ ℳ(′) ∈ ]︀ ∀ ⊂ Im(ℳ)
If a randomized mechanism satisfies -DP, then it ensures that the probability of observing any output is almost equal for any neighboring datasets. When facing two similar yet distinct inputs, we expect the output to be the same within a specific probability range, regulated by the privacy budget provided. Hence, the mechanism protects users’ privacy by ensuring that there is uncertainty about the original data, even if the output is identical for two diferent inputs. As the definition states, it is possible to infer that the lower values are the higher the privacy levels results: if = 0, then Pr [ℳ() ∈ ] = Pr [ℳ(′) ∈ ] ∀ ⊂ Im(ℳ), i.e., the output of the mechanism does not depend on the input.
An important notion when employing the definition of DP for a randomization mechanism ℳ is the characterization of its Privacy Loss (PL) measure. Considering two potential inputs neighbor datasets , ′, the PL of the mechanism is defined as the logarithmic ratio between the probabilities of observing the same output for each input: ℒℳ()||ℳ(′)() = log ︂( Pr [ℳ() = ] )︂
Pr [ℳ(′) = ] (2)
An important and helpful property for our use-case that links the -DP property of a mechanism ℳ with its measure of PL is provided by Dwork and Roth [31]. Formally, stating that a mechanism ℳ adheres to -DP is equivalent to asserting that the absolute value of PL of the mechanism is upper bounded by with probability 1.
This Section shows the Revised Randomized Response (RRR) method and its -DP property.
The Randomize Response mechanism was introduced by Warner [
Figure 1(b) illustrates the revised version of the Randomized Response [14, 32]. Unlike the original method, the RRR mechanism adapts inputs that support categories beyond the binary options of “Yes”or “No”, extending to adapt multiple categories. The algorithm works in the following manner: given a total of > 1 categories and a coin described by a probability ∈ (0, 1) of landing on “heads”, the algorithm takes the input category , and selects the (a) Original Randomize Response mechanism. (b) RRR mechanism. and its Revised version, defined by a coin with bias , selecting a category among available ones. output category through a coin toss process. Similar to the Randomized Response technique, if the coin lands on “heads”, the mechanism outputs the true category . Conversely, if the coin lands on “tails”, RRR uniformly chooses a category from all available options, varying the Randomize Response mechanism and decreasing the probability of leaking the real category.
Equation 2 measures the privacy loss of ℳ, and the aim is to prove it to be less or equal to . As a ifrst step, we evaluate the numerator of that equation. The probability of having the real category denominator, i.e., the probability of getting as the final response upon collecting as output after receiving category as initial input is provided by the following expression: Pr[ = | = ] = + (1 − ) 1 = +1− . On the other hand, to evaluate the as input, is estimated by the expression: Pr[ = | = ] = (1 − )(1 − 1 ) = − 1− + .
Therefore, by computing the logarithm of the ratio between the quantities computed above, we formulate the privacy budget as a function of and , obtaining: (, ) = log ︂(
+ 1 − )︂ − 1 − +
The function (, ) is subject to specific restrictions due to the existential conditions of the logarithmic function. Nonetheless, these limitations can be addressed without significant dificulty. It is crucial to emphasize that the total number of categories should be a positive integer, and the coin’s probability parameter should fall within the real interval (0, 1). Consequentially, by fixing a number of available categories , it holds the condition in 3, which provides the conclusion for the DP property of the mechanism.
> 0 ⇐⇒ ∈ ︂( − 2 2 − 2 , 1 ︂) (3)
In conclusion, we would like to make some important remarks. The condition in 3 states that the privacy budget is regulated by how much the coin is set to be fair, i.e., how much the coin is parameterized to respond truthfully during the obfuscation process. We want to stress that with the same amount of privacy guarantees set by the value, the RRR mechanism influences less the computation of the KM estimator when compared to the LNTE [25] even for small size groups. For instance, the RRR mixes the observations of the events, with the consequence that for diferent populations, the number of people at risk is more or less the same; thus, the survival curves will not difer too much from one another. On the other hand, the LNTE provides noisy observation as stated by [25]: when the population reaches zero, the LNTE method needs to be truncated. Otherwise, the researcher must rely on a higher privacy budget .
We discuss the DP approach by simulating a medical research context where we apply the KM estimator, as detailed in Equation 1 to perform SAs. We vary the privacy budget to evaluate the privacy-utility trade-of in SA and conduct statistical analysis to confirm our conclusions.
The datasets1 employed in our experiments represent the typical datasets used in SAs in the medical domain. To ensure a comprehensive evaluation, we used two collections of survival data, commonly used in literature [25, 33] for similar studies, to estimate the SA functions in diferent privacy settings. We utilized the dataset from Bernard et al. [34], referred to as the IPSS-R dataset, to delineate the group populations under consideration for conducting diferent SAs. Similarly, the dataset from McGilchrist and Aisbett [35], known as the Kidney dataset, was employed. Such dataset contains survival data about patients who participated in the original studies [34, 35] categorized into diferent groups based on the diseases or risks.
Figure 2(a) shows the original KM curves for the IPSS-R dataset2. Figures 2(b), 2(c), 2(d) and Figures 2(e), 2(f), 2(g) represents the KM curves obtained using the RRR and LNTE [25] mechanisms, respectively. As done by Gondara and Wang [25], we analyzed the scenarios using three privacy budgets, i.e., = 1, 2, 3, to compare how the mechanisms work in the KM estimation.
Our objective was to show how to process sensitive data for computing SAs in a DP manner. Upon applying the RRR and the LNTE mechanisms, we observe a gradual convergence of the survival curves for diferent values of . Specifically, for lower values of the privacy budget, = 1, the mechanisms alter the trend of the survival rates across time, making the distinction between risk groups less pronounced and creating a convergence through the “Intermediate” risk population. On the other hand, as increases ( = 2, 3), the survival curves for the RRR method appear to approach those of the original IPSS-R data. However, even at higher values, the survival probabilities do not completely align with the original scenario, indicating a residual impact of the privacy-preserving mechanism. Conversely, applying the LNTE, for all , indicates a complete change in the survival trends, reducing the utility of the analysis. 1The datasets were obtained using the Open Source platform cBioPortal https://www.cbioportal.org/datasets and the dataset available on the R survival package https://cran.r-project.org/web/packages/survival/index.html. 2The Kidney Survival Curves, which show similar trends, are omitted due to space limitations but are released along with the code in the GitHub repository at https://github.com/Kekkodf/DP-SurvAnalysis. ity1.0 ilab0.8 rob0.6 lP0.4 a iv0.2 v ru0.0 S ity1.0 i0.9 l b a0.8 b0.7 o rP0.6 l0.5 ivv00..43 a r u0.2
S
We conducted a Pairwise Log-Rank test on all populations in the Kidney dataset to observe statistical diferences in the results obtained. As Table 1 shows, applying the RRR mechanism with = 3 shows comparable findings with the originals. In addition, an important insight is
provided by the -value fetched: we can see that no -value is altered so that the null hypothesis of the distribution can be rejected, replicating the same results of the original scenario.
Moreover, we summed the median survival times and their related confidence intervals, Table 2. The analysis reveals that the Kidney dataset’s low cardinality has an impact on both methods employed. However, the RRR method returns median times more accurately, which closely resembles the real ones, even in cases where there are high privacy guarantees ( = 1). On the other hand, the LNTE mechanism disrupts the survival rates of the subject. As a result, calculating median times becomes impractical as the probabilities do not reach the 0.5 threshold.
We compared the RRR method with the state-of-the-art for conducting SAs in a DP manner. Our findings suggest that the RRR method is more efective in balancing privacy and utility, maintaining the distribution properties of real results, and ensuring that researchers can still derive important insights from such SAs. Our work contributes to the evolution of privacypreserving methods in medical research and provides a new comparison for future investigations. As future works, we plan to explore diferent methods for conducting SAs to gain insights into the privacy-utility trade-ofs for such a task. Specifically, we intend to consider Linear and Cox Regression to perform SAs and apply diferent DP mechanisms to protect patients’ privacy. bias, Journal of the American Statistical Association 60 (1965) 63–69. URL: http://www. jstor.org/stable/2283137. [14] B. G. Greenberg, A.-L. A. Abul-Ela, W. R. Simmons, D. G. Horvitz, The unrelated question randomized response model: Theoretical framework, Journal of the American Statistical Association 64 (1969) 520–539. URL: http://www.jstor.org/stable/2283636. [15] T. Ha, T. K. Dang, T. T. Dang, T. A. Truong, M. T. Nguyen, Diferential privacy in deep learning: An overview, in: 2019 International Conference on Advanced Computing and Applications (ACOMP), 2019, pp. 97–102. doi:10.1109/ACOMP.2019.00022. [16] J. Wang, S. Liu, Y. Li, A review of diferential privacy in individual data release, International Journal of Distributed Sensor Networks 11 (2015) 259682. URL: https://doi.org/10.1155/ 2015/259682. doi:10.1155/2015/259682. [17] X. Zhang, S. Ji, T. Wang, Diferentially private releasing via deep generative model, CoRR abs/1801.01594 (2018). URL: http://arxiv.org/abs/1801.01594. arXiv:1801.01594. [18] H. Bae, D. Jung, H. Choi, S. Yoon, Anomigan: Generative adversarial networks for anonymizing private medical data, in: Pacific Symposium on Biocomputing 2020, Fairmont Orchid, Hawaii, USA, January 3-7, 2020, 2020, pp. 563–574. URL: https://psb.stanford.edu/ psb-online/proceedings/psb20/Bae.pdf. [19] B. K. Beaulieu-Jones, Z. S. Wu, C. Williams, R. Lee, S. P. Bhavnani, J. B. Byrd, C. S.
Greene, Privacy-preserving generative deep neural networks support clinical data sharing, Circulation: Cardiovascular Quality and Outcomes 12 (2019) e005122. doi:10.1161/ CIRCOUTCOMES.118.005122. [20] A. Dash, J. Ye, G. Wang, A review of generative adversarial networks (gans) and its applications in a wide variety of disciplines: From medical to remote sensing, IEEE Access 12 (2024) 18330–18357. doi:10.1109/ACCESS.2023.3346273. [21] Z. Cai, Z. Xiong, H. Xu, P. Wang, W. Li, Y. Pan, Generative adversarial networks: A survey toward private and secure applications, ACM Comput. Surv. 54 (2021). URL: https://doi.org/10.1145/3459992. doi:10.1145/3459992. [22] T. T. Nguyên, S. C. Hui, Diferentially private regression for discrete-time survival analysis, in: Proceedings of the 2017 ACM on Conference on Information and Knowledge Management, CIKM ’17, Association for Computing Machinery, New York, NY, USA, 2017, p. 1199–1208. URL: https://doi.org/10.1145/3132847.3132928. doi:10.1145/3132847. 3132928. [23] S. Yu, G. Fung, R. Rosales, S. Krishnan, R. B. Rao, C. Dehing-Oberije, P. Lambin, Privacypreserving cox regression for survival analysis, in: Proceedings of the 14th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, KDD ’08, Association for Computing Machinery, New York, NY, USA, 2008, p. 1034–1042. URL: https://doi.org/ 10.1145/1401890.1402013. doi:10.1145/1401890.1402013. [24] K. Chaudhuri, C. Monteleoni, A. D. Sarwate, Diferentially private empirical risk minimization, J. Mach. Learn. Res. 12 (2011) 1069–1109. URL: https://dl.acm.org/doi/10.5555/ 1953048.2021036. doi:10.5555/1953048.2021036. [25] L. Gondara, K. Wang, Diferentially private survival function estimation, in: F. Doshi-Velez, J. Fackler, K. Jung, D. C. Kale, R. Ranganath, B. C. Wallace, J. Wiens (Eds.), Proceedings of the Machine Learning for Healthcare Conference, MLHC 2020, 7-8 August 2020, Virtual Event, Durham, NC, USA, volume 126 of Proceedings of Machine Learning Research, PMLR, 2020, pp. 271–291. URL: http://proceedings.mlr.press/v126/gondara20a.html. [26] T. G. Clark, M. J. Bradburn, S. B. Love, D. G. Altman, Survival analysis part i: Basic concepts and first analyses, British Journal of Cancer 89 (2003) 232–238. URL: https: //doi.org/10.1038/sj.bjc.6601118. doi:10.1038/sj.bjc.6601118. [27] L. L. Johnson, Chapter 26 - an introduction to survival analysis, in: J. I. Gallin, F. P.
Ognibene, L. L. Johnson (Eds.), Principles and Practice of Clinical Research (Fourth Edition), fourth edition ed., Academic Press, Boston, 2018, pp. 373–381. URL: https: //www.sciencedirect.com/science/article/pii/B9780128499054000265. doi:https://doi. org/10.1016/B978-0-12-849905-4.00026-5. [28] B. Bieszk-Stolorz, Application of the survival analysis methods in contemporary economics on the example of unemployment, in: K. Nermend, M. Łatuszyńska (Eds.), Experimental and Quantitative Methods in Contemporary Economics, Springer International Publishing, Cham, 2020, pp. 115–131. [29] N. R. Latimer, Survival analysis for economic evaluations alongside clinical trials— extrapolation with patient-level data, Med. Decis. Making 33 (2013) 743–754. [30] E. L. Kaplan, P. Meier, Nonparametric estimation from incomplete observations, Journal of the American Statistical Association 53 (1958) 457–481. URL: https://www.tandfonline.com/ doi/abs/10.1080/01621459.1958.10501452. doi:10.1080/01621459.1958.10501452. [31] C. Dwork, A. Roth, The algorithmic foundations of diferential privacy, Foundations and Trends® in Theoretical Computer Science 9 (2014) 211–407. URL: http://dx.doi.org/10.1561/ 0400000042. doi:10.1561/0400000042. [32] T. Wang, J. Blocki, N. Li, S. Jha, Locally diferentially private protocols for frequency estimation, in: E. Kirda, T. Ristenpart (Eds.), 26th USENIX Security Symposium, USENIX Security 2017, Vancouver, BC, Canada, August 16-18, 2017, USENIX Association, 2017, pp. 729–745. URL: https://www.usenix.org/conference/usenixsecurity17/technical-sessions/ presentation/wang-tianhao. [33] P.-C. Bürkner, brms: An R Package for Bayesian Multilevel Models Using Stan, Journal of Statistical Software 80 (2017) 1–28. URL: https://www.jstatsoft.org/index.php/jss/article/ view/v080i01. doi:10.18637/jss.v080.i01. [34] E. Bernard, H. Tuechler, P. L. Greenberg, R. P. Hasserjian, J. E. A. Ossa, Y. Nannya, S. M. Devlin, M. Creignou, P. Pinel, L. Monnier, G. Gundem, J. S. Medina-Martinez, D. Domenico, M. Jädersten, U. Germing, G. Sanz, A. A. van de Loosdrecht, O. Kosmider, M. Y. Follo, F. Thol, L. Zamora, R. F. Pinheiro, A. Pellagatti, H. K. Elias, D. Haase, C. Ganster, L. Ades, M. Tobiasson, L. Palomo, M. G. D. Porta, A. Takaori-Kondo, T. Ishikawa, S. Chiba, S. Kasahara, Y. Miyazaki, A. Viale, K. Huberman, P. Fenaux, M. Belickova, M. R. Savona, V. M. Klimek, F. P. S. Santos, J. Boultwood, I. Kotsianidis, V. Santini, F. Solé, U. Platzbecker, M. Heuser, P. Valent, K. Ohyashiki, C. Finelli, M. T. Voso, L.-Y. Shih, M. Fontenay, J. H. Jansen, J. Cervera, N. Gattermann, B. L. Ebert, R. Bejar, L. Malcovati, M. Cazzola, S. Ogawa, E. Hellström-Lindberg, E. Papaemmanuil, Molecular international prognostic scoring system for myelodysplastic syndromes, NEJM Evidence 1 (2022) EVIDoa2200008. URL: https://evidence.nejm.org/doi/abs/10.1056/EVIDoa2200008. doi:10.1056/EVIDoa2200008. [35] C. A. McGilchrist, C. W. Aisbett, Regression with frailty in survival analysis, Biometrics 47 (1991) 461–466. URL: http://www.jstor.org/stable/2532138.