Differentially Private Modeling of Disease Transmission within Human Contact Networks
Authors: Shlomi Hod, Debanuj Nayak, Jason R. Gantenberg, Iden Kalemaj, Thomas A. Trikalinos, Adam Smith
Organizations: Department of Computer Science, Boston University · Department of Health Services, Policy & Practice, School of Public Health, Brown University · Department of Epidemiology, School of Public Health, Brown University · Department of Biostatistics, School of Public Health, Brown University
Epidemiologic studies of infectious diseases often rely on models of contact networks to capture the complex interactions that govern disease spread, and ongoing projects aim to vastly increase the scale at which such data can be collected. However, contact networks may include sensitive information, such as sexual relationships or drug use behavior. Protecting individual privacy while maintaining the scientific usefulness of the data is crucial. We propose a privacy-preserving pipeline for disease spread simulation studies based on a sensitive network that integrates differential privacy (DP) with statistical network models such as stochastic block models (SBMs) and exponential random graph models (ERGMs). Our pipeline comprises three steps: (1) compute network summary statistics using node-level DP (which corresponds to protecting individuals' contributions); (2) fit a statistical model, like an ERGM, using these summaries, which allows generating synthetic networks reflecting the structure of the original network; and (3) simulate disease spread on the synthetic networks using an agent-based model. We evaluate the effectiveness of our approach using a simple Susceptible-Infected-Susceptible (SIS) disease model under multiple configurations. We compare both numerical results, such as simulated disease incidence and prevalence, as well as qualitative conclusions such as intervention effect size, on networks generated with and without differential privacy constraints. Our experiments are based on egocentric sexual network data from the ARTNet study (a survey about HIV-related behaviors). Our results show that the noise added for privacy is small relative to other sources of error (sampling and model misspecification). This suggests that, in principle, curators of such sensitive data can provide valuable epidemiologic insights while protecting privacy.
Figures & tables
Figure 1: An overview of our pipeline for differentially private (DP) simulation of infectious disease transmission. We begin by estimating network statistics using empirical network data. Next, we render these statistics private by adding noise and use them to fit network models (e.g., exponential random graph models). Finally, we run epidemic simulations over networks simulated based on these fitted models. These epidemic simulations inherit the privacy protections of the noised network statistics.
Figure 2: Epidemic dynamics comparing baseline and intervention scenarios under the “high prevalence” condition. The agent-based model simulates transmission over a synthetic network generated from an ERGM fitted to an observed network estimated based on ARTNet data, without differential privacy (refer to Section 3.2 for details). Individual simulations ( n=10 ) shown with transparency; solid lines indicate mean prevalence.
Figure 3: Network representation and its corresponding mixing matrix.
Parameter
Symbol
Value
General Parameters
Time step duration
–
1 week
Initial prevalence
–
0.2
Burn-in period
–
500
Analytic window
–
100
Settings
Table 1: Epidemic simulation parameters.
Figure 4: An illustration of the experimental design to evaluate our pipeline as described in Section 3.2.3 . The reader may find it helpful to contrast this diagram with Figure 1 , which illustrates the pipeline in use.
Figure 5: Edge-level network statistics presented on a relative scale, showing percentage difference from the observed network baseline ( dashed line ). Each point represents the relative deviation of synthetic network statistics compared to the observed network value. Both plots refers to the network used in the low prevalence configuration.
Figure 6: Prevalence ratios comparing intervention effects across different modeling approaches and prevalence conditions.
Figure 7: Granular analysis by age and race for ERGM high prevalence condition across different maximum degree constraints.
Figure 8: Effect of privacy budget ( ε ) on prevalence ratio with maximum degree truncated at 3 across all four modeling scenarios.
Figure 9: Variance analysis at privacy budget ε=1 and truncated degree Δ=3 showing the breakdown of different sources of randomness in the experimental pipeline for ERGM at High Prevalence condition. The plots show the average prevalence of baseline scenario over all synthetic networks and simulations ( solid line ), per differential private release ( dashed line ), per synthetic network ( plus sign ), and the range per simulation ( horizontal line ).
Source
df
SS
MS
Var (%)
Release
4
0.0291
0.0073
26.36
Network : Release
195
0.0532
0.0003
48.13
Simulation : Network : Release
1800
0.0282
0.0000
25.51
Table 2: Analysis of variance for ERGM high prevalence condition showing the breakdown of variance sources in the experimental pipeline. Columns show the source of variance, degrees of freedom (df), sum of squares (SS), mean squares (MS), and percentage of total variance explained (Var %).
Appendix figures & tables13 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 10: Prevalence for the baseline scenario across different modeling approaches and prevalence conditions.
Figure 11: Prevalence for the intervention scenario across different modeling approaches and prevalence conditions.
Figure 12: Incidence rate ratios comparing intervention effects across different modeling approaches and prevalence conditions.
Figure 13: Granular analysis by age and race for ERGM low prevalence condition across different maximum degree constraints.
Figure 14: Granular analysis by age and race for BM high prevalence condition across different maximum degree constraints.
Figure 15: Granular analysis by age and race for BM low prevalence condition across different maximum degree constraints.
Source
df
SS
MS
Var (%)
Release
4
0.0506
0.0127
54.14
Network : Release
195
0.0257
0.0001
27.47
Simulation : Network : Release
1800
0.0172
0.0000
18.39
Appendix
Table 3: Analysis of variance for ERGM low prevalence condition showing the breakdown of variance sources in the experimental pipeline.
Source
df
SS
MS
Var (%)
Release
4
0.0282
0.0070
24.86
Network : Release
195
0.0642
0.0003
56.66
Simulation : Network : Release
1800
0.0209
0.0000
18.47
Appendix
Table 4: Analysis of variance for SBM high prevalence condition showing the breakdown of variance sources in the experimental pipeline.
Source
df
SS
MS
Var (%)
Release
4
0.0024
0.0006
9.46
Network : Release
195
0.0129
0.0001
51.13
Simulation : Network : Release
1800
0.0099
0.0000
39.41
Appendix
Table 5: Analysis of variance for SBM low prevalence condition showing the breakdown of variance sources in the experimental pipeline.
Figure 16: Variance analysis at privacy budget ε=1 and truncated degree Δ=3 showing the breakdown of different sources of randomness in the experimental pipeline across different modeling approaches and prevalence conditions. The plots show the average prevalence of baseline scenario over all synthetic networks and simulations ( solid line ), per differential private release ( dashed line ), per synthetic network ( plus sign ), and the range per simulation ( horizontal line ).
Figure 17: Degree-level network statistics across different modeling approaches. The x-axis represents the proportion of nodes with each degree value as a percentage of the total network (10,000 nodes).
Figure 18: Prevalence ratio across different maximum degree thresholds for age group 25-34 across all four modeling scenarios.
Figure 19: Prevalence ratio across different maximum degree thresholds for Black population across all four modeling scenarios.
The pandemic in 2020 and 2021 had enormous economic and societal consequences, and studies show that contact tracing algorithms can be key in the early containment of the virus. While large strides have been made towards more effective contact tracing algorithms, we argue that privacy concerns currently hold deployment back. The essence of a contact tracing algorithm constitutes the communication of a risk score. Yet, it is precisely the communication and release of this score to a user that an adversary can leverage to gauge the private health status of an individual. We pinpoint a realistic attack scenario and propose a contact tracing algorithm with differential privacy guarantees against this attack. The algorithm is tested on the two most widely used agent-based COVID19 simulators and demonstrates superior performance in a wide range of settings. Especially for realistic test scenarios and while releasing each risk score with epsilon=1 differential privacy, we achieve a two to ten-fold reduction in the infection rate of the virus. To the best of our knowledge, this presents the first contact tracing algorithm with differential privacy guarantees when revealing risk scores for COVID19.
Rob Romijnders, Christos Louizos, Yuki M. Asano +1
The COVID19 pandemic had enormous economic and societal consequences. Contact tracing is an effective way to reduce infection rates by detecting potential virus carriers early. However, this was not generally adopted in the recent pandemic, and privacy concerns are cited as the most important reason. We substantially improve the privacy guarantees of the current state of the art in decentralized contact tracing. Whereas previous work was based on statistical inference only, we augment the inference with a learned neural network and ensure that this neural augmentation satisfies differential privacy. In a simulator for COVID19, even at epsilon=1 per message, this can significantly improve the detection of potentially infected individuals and, as a result of targeted testing, reduce infection rates. This work marks an important first step in integrating deep learning into contact tracing while maintaining essential privacy guarantees.
Rob Romijnders, Christos Louizos, Yuki M. Asano +1
Traditional network models from network science, such as the Erdos-Renyi and configuration models, generate random networks that reproduce few selected topological properties observed in real-world networks. Deep graph generative models emerge as a data-driven approach, leveraging deep neural network architectures to learn complex structural distributions directly from real-world networks to generate more realistic synthetic networks. Because real social contact networks cannot be shared due to privacy risks, synthetic networks serve as an alternative for developing and evaluating epidemic mitigation strategies. In this work, we evaluate deep graph generative models as well as the configuration from a network science perspective by assessing both the topological similarity between generated and real-world networks and their utility in identifying effective node immunization strategies to sup- press epidemic/misinformation spreading. It is found that two deep graph generative models produce synthetic networks that closely resemble the structural properties of real-world networks, enabling them to identify effective immunization strategies.
Tianrui Mao, Abele Malan, Megha Khosla +2
Delft University of Technology, the Netherlands · University of Neuchâtel, Switzerland