Federated Survival Analysis with Node-Level Differential Privacy: Private Kaplan-Meier Curves

TL;DR

This paper presents a method for calculating privacy-preserving Kaplan-Meier survival curves across multiple healthcare sites using node-level differential privacy, ensuring data privacy while maintaining statistical utility.

Contribution

It introduces a one-shot privacy-preserving approach for survival analysis that avoids iterative training and heavy cryptography, with benchmarking of four smoothing techniques under various privacy levels.

Findings

Total-Variation smoothing yields highest accuracy.

Frequency-domain smoothers offer better worst-case robustness.

Curves maintain acceptable log-rank error at privacy budgets of 0.5 and above.

Abstract

We investigate how to calculate Kaplan-Meier survival curves across multiple health-care jurisdictions while protecting patient privacy with node-level differential privacy. Each site discloses its curve only once, adding Laplace noise whose scale is determined by the length of the common time grid; the server then averages the noisy curves, so the overall privacy budget remains unchanged. We benchmark four one-shot smoothing techniques: Discrete Cosine Transform, Haar Wavelet shrinkage, adaptive Total-Variation denoising, and a parametric Weibull fit on the NCCTG lung-cancer cohort under five privacy levels and three partition scenarios (uniform, moderately skewed, highly imbalanced). Total-Variation gives the best mean accuracy, whereas the frequency-domain smoothers offer stronger worst-case robustness and the Weibull model shows the most stable behaviour at the strictest privacy setting. Across all methods the released curves keep the empirical log-rank type-I error below fifteen percent for privacy budgets of 0.5 and higher, demonstrating that clinically useful survival information can be shared without iterative training or heavy cryptography.