Differentially Private Multi-Site Treatment Effect Estimation

TL;DR

This paper introduces a federated learning method with differential privacy for estimating the average treatment effect in healthcare, addressing site heterogeneity and privacy concerns to improve causal inference across multiple hospitals.

Contribution

It presents a novel federated approach for causal inference with differential privacy, specifically targeting ATE estimation across heterogeneous healthcare sites.

Findings

Reliable aggregation of private statistics across sites

Improved privacy-utility tradeoff under site heterogeneity

Effective ATE estimation with differential privacy guarantees

Abstract

Patient privacy is a major barrier to healthcare AI. For confidentiality reasons, most patient data remains in silo in separate hospitals, preventing the design of data-driven healthcare AI systems that need large volumes of patient data to make effective decisions. A solution to this is collective learning across multiple sites through federated learning with differential privacy. However, literature in this space typically focuses on differentially private statistical estimation and machine learning, which is different from the causal inference-related problems that arise in healthcare. In this work, we take a fresh look at federated learning with a focus on causal inference; specifically, we look at estimating the average treatment effect (ATE), an important task in causal inference for healthcare applications, and provide a federated analytics approach to enable ATE estimation across multiple sites along with differential privacy (DP) guarantees at each site. The main challenge comes from site heterogeneity -- different sites have different sample sizes and privacy budgets. We address this through a class of per-site estimation algorithms that reports the ATE estimate and its variance as a quality measure, and an aggregation algorithm on the server side that minimizes the overall variance of the final ATE estimate. Our experiments on real and synthetic data show that our method reliably aggregates private statistics across sites and provides better privacy-utility tradeoff under site heterogeneity than baselines.