Federated Survival Analysis

The Cox proportional hazards model is adapted for federated computation, allowing multiple medical centers to jointly estimate hazard ratios without sharing individual patient-level survival data. Each institution computes local partial likelihood gradients, which are securely aggregated to update a global model. This preserves the statistical rigor of traditional survival analysis while complying with HIPAA and GDPR requirements. The approach handles right-censored data—patients lost to follow-up or event-free at study end—identically to centralized methods.

Unlike standard federated averaging, survival models often require stratum-specific baseline hazard functions to account for heterogeneous populations across institutions. Each site maintains its own non-parametric Breslow estimator or Nelson-Aalen estimator locally, while the global model shares only the log-hazard ratios for covariates. This stratification prevents confounding from site-specific effects like differing surgical protocols or demographic compositions, ensuring the proportional hazards assumption holds within each stratum.

Federated survival frameworks support time-dependent covariates—variables whose values change during the observation period, such as treatment crossovers or lab values. The counting process formulation partitions each patient's timeline into intervals, with covariate updates transmitted as incremental risk-set modifications. This enables complex analyses like landmark analysis and time-dependent ROC curves without pooling longitudinal data, critical for adaptive clinical trials and real-world evidence studies.

The Fine-Gray subdistribution hazard model and cause-specific hazard models are federated to handle competing risks—scenarios where patients can experience mutually exclusive events, such as cancer-specific mortality versus cardiovascular death. Each institution computes cause-specific cumulative incidence functions locally, while federated aggregation estimates the effect of covariates on each event type. This prevents the biased estimates that occur when competing events are naively treated as independent censoring.

Model discrimination is evaluated using a federated Harrell's C-index or Uno's C-index, which measure the proportion of concordant patient pairs where predicted risk aligns with observed survival order. The computation is decomposed into pairwise comparisons that can be calculated locally and aggregated without revealing individual outcomes. This provides a privacy-compliant metric for comparing prognostic model performance across institutions, essential for regulatory validation of clinical prediction tools.

Survival analysis requires dynamic risk sets—the group of patients still at risk at each event time. Federated protocols use secure multi-party computation or homomorphic encryption to aggregate risk-set statistics across sites without exposing which institution contributed which events. This prevents inference attacks that could reconstruct patient timelines from event-time distributions, a critical vulnerability when modeling rare diseases with small event counts at individual centers.

The foundational statistical framework for survival analysis that models the hazard rate as a function of a baseline hazard and a linear combination of covariates. In a federated setting, the partial likelihood function is decomposed across sites, allowing each institution to compute local risk set contributions without sharing individual patient event times or censoring indicators. The model assumes proportional hazards—that the effect of a covariate is constant over time.

An extension of the Cox model that allows different baseline hazard functions for distinct strata (e.g., study sites, disease subtypes) while estimating common covariate effects. This is particularly well-suited to federated learning because each institution can naturally form a stratum, preserving its unique baseline hazard without sharing it. The stratified partial likelihood is separable, enabling straightforward distributed optimization.

A non-parametric statistic used to estimate the survival function from lifetime data. In federated survival analysis, the Kaplan-Meier curve can be computed in a privacy-preserving manner by securely aggregating event and censoring counts at each distinct time point across institutions. This enables the collaborative generation of survival curves without pooling individual patient-level time-to-event records.

Variables whose values change over the observation period, such as longitudinal lab results or treatment crossovers. Handling these in a federated context requires each site to maintain counting process data structures and compute local contributions to the risk set at each event time. This significantly increases computational complexity and communication overhead compared to models with only baseline covariates.

A survival analysis framework for scenarios where a subject can experience one of several mutually exclusive event types, such as death from cancer versus death from cardiovascular disease. Federated implementations require each institution to compute cause-specific hazards and cumulative incidence functions locally, then securely aggregate these estimates. The Fine-Gray subdistribution hazard model is commonly adapted for decentralized settings.

A decentralized computation of the C-index, the standard metric for evaluating the discriminative power of survival models. It measures the proportion of concordant pairs—where the predicted risk ordering matches the observed event ordering—among all comparable subject pairs. In a federated setting, this requires a secure protocol to compare pairwise orderings across institutional boundaries without revealing individual risk scores.