Differentially Private Modeling of Disease Transmission within Human Contact Networks
Authors: Shlomi Hod, Debanuj Nayak, Jason R. Gantenberg, Iden Kalemaj, Thomas A. Trikalinos, Adam Smith
Organizations: Department of Computer Science, Boston University · Department of Health Services, Policy & Practice, School of Public Health, Brown University · Department of Epidemiology, School of Public Health, Brown University · Department of Biostatistics, School of Public Health, Brown University
Epidemiologic studies of infectious diseases often rely on models of contact networks to capture the complex interactions that govern disease spread, and ongoing projects aim to vastly increase the scale at which such data can be collected. However, contact networks may include sensitive information, such as sexual relationships or drug use behavior. Protecting individual privacy while maintaining the scientific usefulness of the data is crucial. We propose a privacy-preserving pipeline for disease spread simulation studies based on a sensitive network that integrates differential privacy (DP) with statistical network models such as stochastic block models (SBMs) and exponential random graph models (ERGMs). Our pipeline comprises three steps: (1) compute network summary statistics using node-level DP (which corresponds to protecting individuals' contributions); (2) fit a statistical model, like an ERGM, using these summaries, which allows generating synthetic networks reflecting the structure of the original network; and (3) simulate disease spread on the synthetic networks using an agent-based model. We evaluate the effectiveness of our approach using a simple Susceptible-Infected-Susceptible (SIS) disease model under multiple configurations. We compare both numerical results, such as simulated disease incidence and prevalence, as well as qualitative conclusions such as intervention effect size, on networks generated with and without differential privacy constraints. Our experiments are based on egocentric sexual network data from the ARTNet study (a survey about HIV-related behaviors). Our results show that the noise added for privacy is small relative to other sources of error (sampling and model misspecification). This suggests that, in principle, curators of such sensitive data can provide valuable epidemiologic insights while protecting privacy.
Figures & tables
Figure 1: An overview of our pipeline for differentially private (DP) simulation of infectious disease transmission. We begin by estimating network statistics using empirical network data. Next, we render these statistics private by adding noise and use them to fit network models (e.g., exponential random graph models). Finally, we run epidemic simulations over networks simulated based on these fitted models. These epidemic simulations inherit the privacy protections of the noised network statistics.
Figure 2: Epidemic dynamics comparing baseline and intervention scenarios under the “high prevalence” condition. The agent-based model simulates transmission over a synthetic network generated from an ERGM fitted to an observed network estimated based on ARTNet data, without differential privacy (refer to Section 3.2 for details). Individual simulations ( n=10 ) shown with transparency; solid lines indicate mean prevalence.
Figure 3: Network representation and its corresponding mixing matrix.
Parameter
Symbol
Value
General Parameters
Time step duration
–
1 week
Initial prevalence
–
0.2
Burn-in period
–
500
Analytic window
–
100
Settings
Table 1: Epidemic simulation parameters.
Figure 4: An illustration of the experimental design to evaluate our pipeline as described in Section 3.2.3 . The reader may find it helpful to contrast this diagram with Figure 1 , which illustrates the pipeline in use.
Figure 5: Edge-level network statistics presented on a relative scale, showing percentage difference from the observed network baseline ( dashed line ). Each point represents the relative deviation of synthetic network statistics compared to the observed network value. Both plots refers to the network used in the low prevalence configuration.
Figure 6: Prevalence ratios comparing intervention effects across different modeling approaches and prevalence conditions.
Figure 7: Granular analysis by age and race for ERGM high prevalence condition across different maximum degree constraints.
Figure 8: Effect of privacy budget ( ε ) on prevalence ratio with maximum degree truncated at 3 across all four modeling scenarios.
Figure 9: Variance analysis at privacy budget ε=1 and truncated degree Δ=3 showing the breakdown of different sources of randomness in the experimental pipeline for ERGM at High Prevalence condition. The plots show the average prevalence of baseline scenario over all synthetic networks and simulations ( solid line ), per differential private release ( dashed line ), per synthetic network ( plus sign ), and the range per simulation ( horizontal line ).
Source
df
SS
MS
Var (%)
Release
4
0.0291
0.0073
26.36
Network : Release
195
0.0532
0.0003
48.13
Simulation : Network : Release
1800
0.0282
0.0000
25.51
Table 2: Analysis of variance for ERGM high prevalence condition showing the breakdown of variance sources in the experimental pipeline. Columns show the source of variance, degrees of freedom (df), sum of squares (SS), mean squares (MS), and percentage of total variance explained (Var %).
Appendix figures & tables13 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 10: Prevalence for the baseline scenario across different modeling approaches and prevalence conditions.
Figure 11: Prevalence for the intervention scenario across different modeling approaches and prevalence conditions.
Figure 12: Incidence rate ratios comparing intervention effects across different modeling approaches and prevalence conditions.
Figure 13: Granular analysis by age and race for ERGM low prevalence condition across different maximum degree constraints.
Figure 14: Granular analysis by age and race for BM high prevalence condition across different maximum degree constraints.
Figure 15: Granular analysis by age and race for BM low prevalence condition across different maximum degree constraints.
Source
df
SS
MS
Var (%)
Release
4
0.0506
0.0127
54.14
Network : Release
195
0.0257
0.0001
27.47
Simulation : Network : Release
1800
0.0172
0.0000
18.39
Appendix
Table 3: Analysis of variance for ERGM low prevalence condition showing the breakdown of variance sources in the experimental pipeline.
Source
df
SS
MS
Var (%)
Release
4
0.0282
0.0070
24.86
Network : Release
195
0.0642
0.0003
56.66
Simulation : Network : Release
1800
0.0209
0.0000
18.47
Appendix
Table 4: Analysis of variance for SBM high prevalence condition showing the breakdown of variance sources in the experimental pipeline.
Source
df
SS
MS
Var (%)
Release
4
0.0024
0.0006
9.46
Network : Release
195
0.0129
0.0001
51.13
Simulation : Network : Release
1800
0.0099
0.0000
39.41
Appendix
Table 5: Analysis of variance for SBM low prevalence condition showing the breakdown of variance sources in the experimental pipeline.
Figure 16: Variance analysis at privacy budget ε=1 and truncated degree Δ=3 showing the breakdown of different sources of randomness in the experimental pipeline across different modeling approaches and prevalence conditions. The plots show the average prevalence of baseline scenario over all synthetic networks and simulations ( solid line ), per differential private release ( dashed line ), per synthetic network ( plus sign ), and the range per simulation ( horizontal line ).
Figure 17: Degree-level network statistics across different modeling approaches. The x-axis represents the proportion of nodes with each degree value as a percentage of the total network (10,000 nodes).
Figure 18: Prevalence ratio across different maximum degree thresholds for age group 25-34 across all four modeling scenarios.
Figure 19: Prevalence ratio across different maximum degree thresholds for Black population across all four modeling scenarios.