Differentially Private Fisher Randomization Tests for Binary Outcomes

TL;DR

This paper introduces differentially private methods for Fisher randomization tests on binary outcomes, enabling secure and valid causal inference in sensitive data scenarios.

Contribution

It develops novel privacy-preserving Fisher test procedures, including noise injection and Bayesian denoising, with decision rules for causal inference under privacy constraints.

Findings

Methods achieve valid causal inference with differential privacy guarantees.

Simulation studies confirm the effectiveness of the proposed approaches.

Application to clinical trial data demonstrates practical utility.

Abstract

Across many disciplines, causal inference often relies on randomized experiments with binary outcomes. In such experiments, the Fisher randomization test provides exact, assumption-free tests for causal effects. Sometimes the outcomes are sensitive and must be kept confidential, for example, when they comprise physical or mental health measurements. Releasing test statistics or p-values computed with the confidential outcomes can leak information about the individuals in the study. Those responsible for sharing the analysis results may wish to bound this information leakage, which they can do by ensuring the released outputs satisfy differential privacy. In this article, we develop several differentially private versions of the Fisher randomization test for binary outcomes. Specifically, we consider direct perturbation approaches that inject calibrated noise into test statistics or p-values, as well as a mechanism-aware, Bayesian denoising framework that explicitly models the privacy mechanism. We further develop decision-making procedures under privacy constraints, including a Bayes risk-optimal rule and a frequentist-calibrated significance test. Through theoretical results, simulation studies, and an application to the ADAPTABLE clinical trial, we demonstrate that our methods can achieve valid and interpretable causal inference while ensuring the differential privacy guarantee.