Federated Survival Analysis

The Cox proportional hazards model is adapted for federated learning by decomposing the partial likelihood function into computable local statistics. Each institution calculates its own risk set sums and event indicators locally, transmitting only aggregated gradient information to the central server. This preserves the model's ability to estimate hazard ratios while ensuring that individual survival times and censoring statuses never leave the originating institution.

Unlike traditional pooled analysis, federated survival models support stratified baseline hazard functions that allow each institution to maintain a distinct underlying risk profile. This is critical when participating hospitals serve demographically different populations with varying baseline disease incidence. The Efron approximation and Breslow estimator are computed locally, enabling the global model to account for site-specific heterogeneity without requiring demographic data centralization.

Federated survival frameworks accommodate time-dependent covariates by structuring local data as counting process intervals. Each client transforms longitudinal patient records into (start, stop, event) format before computing local gradient contributions. This enables modeling of dynamic clinical variables—such as changing lab values or treatment crossovers—while maintaining the privacy guarantee that no individual patient's temporal trajectory is reconstructed centrally.

Model discrimination is assessed using the Harrell's C-index computed in a federated manner. The global concordance statistic is derived by aggregating pairwise comparisons from each site without exchanging the underlying risk scores. Each institution reports only the count of concordant pairs, discordant pairs, and tied risk scores, allowing the central aggregator to compute the overall C-index while keeping individual patient predictions and outcomes private.

The federated framework extends to Fine-Gray subdistribution hazard models and cause-specific hazard models for competing risks analysis. Each institution computes cumulative incidence functions locally for each event type, transmitting only the aggregated score residuals and Hessian matrices. This enables multi-institutional studies where patients may experience different terminal events—such as cancer-specific mortality versus treatment-related mortality—without pooling individual cause-of-death data.

Federated survival analysis integrates with differential privacy mechanisms by tracking cumulative privacy loss across training rounds. Each institution applies calibrated Gaussian noise to its local gradient updates before transmission, with the noise scale determined by the sensitivity of the partial likelihood gradients. A privacy accountant monitors the total epsilon expenditure, enabling researchers to pre-specify a maximum privacy budget and automatically halt training when the bound is reached.

The foundational statistical framework for survival analysis that models the hazard rate as a function of a baseline hazard and a linear combination of covariates. In the federated setting, the partial likelihood function is decomposed across sites, allowing each institution to compute local risk set contributions without sharing individual patient event times or censoring indicators. The central server aggregates these gradient updates to estimate log hazard ratios collaboratively.

An extension of the Cox model that allows different baseline hazard functions for distinct strata while maintaining shared covariate effects. In federated survival analysis, stratification by clinical site naturally accounts for institutional heterogeneity in baseline risk. Each hospital computes stratum-specific contributions to the partial likelihood, enabling the model to handle non-proportional hazards across sites without requiring data centralization.

A non-parametric statistic used to estimate the survival function from time-to-event data. In federated implementations, the Kaplan-Meier curve is constructed by securely aggregating event and censoring counts at each distinct time point across institutions. Techniques like secure aggregation ensure that no single site's individual patient trajectories are revealed, while still producing an accurate population-level survival curve for collaborative research.

A survival analysis framework that handles scenarios where patients are at risk of multiple mutually exclusive events, such as death from cancer versus cardiovascular disease. Federated competing risks models, including the Fine-Gray subdistribution hazard model, partition the cause-specific hazard contributions across sites. Each institution computes local cumulative incidence functions for each event type, which are then securely combined to estimate population-level risk trajectories.

Covariates whose values change over the observation period, such as longitudinal biomarker measurements or treatment dose adjustments. Federated survival models handle these through counting process formulations, where each patient's follow-up is split into intervals. Sites compute local contributions for each time interval, and the central server aggregates these to estimate hazard ratios that reflect dynamic clinical trajectories without ever seeing the raw temporal data.

A distributed implementation of Harrell's C-index, the standard metric for evaluating the discriminative ability of survival models. Each site computes pairwise comparisons between patients with comparable follow-up, determining whether the model correctly ranks predicted risk against observed event order. These local concordance statistics are securely aggregated to produce a global performance measure, enabling model validation without exposing patient-level risk scores or outcomes.