Distributed learning optimisation of Cox models can leak patient data: Risks and solutions

TL;DR

This paper reveals that distributed optimization of Cox models can compromise patient privacy through data leakage and proposes a secure, validated method to prevent this while handling missing data.

Contribution

It identifies privacy risks in distributed Cox model training and introduces a novel secure optimization approach with validation methods.

Findings

Distributed Cox model optimization can leak patient data.

Proposed method prevents data leakage during model training.

Feasibility demonstrated with Matlab implementation.

Abstract

Medical data are often highly sensitive, and frequently there are missing data. Due to the data's sensitive nature, there is an interest in creating modelling methods where the data are kept in each local centre to preserve their privacy, but yet the model can be trained on and learn from data across multiple centres. Such an approach might be distributed machine learning (federated learning, collaborative learning) in which a model is iteratively calculated based on aggregated local model information from each centre. However, even though no specific data are leaving the centre, there is a potential risk that the exchanged information is sufficient to reconstruct all or part of the patient data, which would hamper the safety-protecting rationale idea of distributed learning. This paper demonstrates that the optimisation of a Cox survival model can lead to patient data leakage. Following this, we suggest a way to optimise and validate a Cox model that avoids these problems in a secure way. The feasibility of the suggested method is demonstrated in a provided Matlab code that also includes methods for handling missing data.