Navigating the privacy-accuracy tradeoff: federated survival analysis with binning and differential privacy

Federated Learning (FL) offers a decentralized approach to model training, allowing for data-driven insights while safeguarding patient privacy across institutions. In the Personal Health Train (PHT) paradigm, it is the local model gradients from each institution, aggregated over a sample size of its own patients that are transmitted to a central server to be globally merged, rather than transmitting the patient data itself. However, certain attacks on a PHT infrastructure may risk compromising sensitive data. This study delves into the privacy-accuracy tradeoff in federated Cox Proportional Hazards (CoxPH) models for survival analysis by assessing two Privacy-Enhancing Techniques (PETs) added on top of the PHT approach. In one, we implemented a Discretized Cox model by grouping event times into finite bins to hide individual time-to-event data points. In another, we explored Local Differential Privacy by introducing noise to local model gradients. Our results show that both strategies can reduce these privacy risks without significantly compromising numerical accuracy, reflected in small variations of the hazard ratios and, more noticeably, in the cumulative baseline hazard curves during late follow-up. Our findings highlight the potential for enhancing privacy-preserving survival analysis within a PHT implementation and suggest practical options for multi-institutional research while reducing the exposure that could enable re-identification.

Federated learning (FL) has emerged as a groundbreaking class of privacy-enhancing methods training machine learning models and solving complex mathematical problems, while bypassing the need to share personal data at individual subject level (1). One way of achieving this is to train partial models independently in each data-hosting institution, then synchronously average multiple partial models into a single common global model. Subject privacy protection is thus based on exchanging results in the form of partial model gradients (a.k.a. model coefficients), but not any of the individual-subject level data. This type of approach has garnered significant attention and strong research interest across privacy-aware sectors such as healthcare research, but can extend to other domains (2). As the digital landscape continues to evolve and data privacy regulations become increasingly stringent, FL stands out as a potentially promising solution that is worth examining in deep detail.

The Personal Health Train (PHT) (3–6), a manifesto for ethical and safety guardrails about implementing FL with real world private health data of patients, has recently seen significant traction in recent years (7–10). This integrates several critical components to enable secure and privacy-preserving data analysis, including the technical, legal and governance aspects. Within this manifesto, “Stations” serve as local data repositories where data is securely stored and accessed under predefined rules. “Trains” refer to the algorithms or workflows that visit these stations to conduct data analysis locally at the data location, thereby bypassing the need to transfer individual-level data. The “Track” or handler orchestrates the interactions between trains and stations, ensuring compliance with security protocols and facilitating the aggregation of results. The “Aggregator” combines the local gradients from various stations, integrating distributed data sources while preserving privacy.

While this framework is designed to maintain data within its originating institution, a number of recent studies have pointed out that certain FL methods may become vulnerable to specific attacks resulting in potential patient data leakage (11–16). Kairouz and McMahan (17) have comprehensively analyzed the open challenges in FL and proposed potential solutions. Key threats grouped by the type of adversary involved include:

Curious participants: These are legitimate participants (e.g., institutions inside the FL collaboration network) that attempt to infer sensitive information about their collaboration partners by intercepting partial model updates. This can lead to inference attacks, where the offending partners analyze gradients to determine if specific data subjects were part of the training set (membership inference attacks) or even reconstruct training data (model inversion attacks) of their other consortium partners.

Colluding participants: This is similar to the “curious adversary” attack, but this involves two or more partners inside an FL collaboration network that coordinate their actions jointly, to attempt membership inference or model inversion against the other consortium partners. These colluding partners would intentionally share their partial models with each other, in order to coordinate an attack on the other partners.

Malicious attackers: External entities might exploit security vulnerabilities to penetrate the FL infrastructure of a consortium, where they can intercept communications or inject poisoned updates to manipulate the global model. This includes data poisoning (injecting misleading data) and model poisoning (submitting manipulated local updates to degrade model performance). Note however, that curious and/or colluding participants might also employ data poisoning and model poisoning, in an attempt to forestall the global model from converging and thus buy themselves more time to be able to carry out their inference or inversion attacks against other consortium partners.

Recent research has explored implementing Cox Proportional Hazards (CoxPH) models within an FL framework because such models are highly relevant for clinical risk-based decision-making. Existing federated survival work established the feasibility and correctness of the distributed Cox model: Lu et al. showed that a federated fit reproduces the centralized estimates exactly (18), and this model was later also adapted within Vantage6 for distributed survival pipelines (19). Later work drew attention to the residual exposure of such models, namely that the event times and iterative gradient updates that must be shared can leak information about individual patients (20), and discrete-time formulations were proposed partly to reduce this exposure (21). What has not been characterized is how far the standard responses to that exposure—coarsening the shared event times, and adding calibrated noise to the gradients—move the survival estimates away from the exact federated baseline.

Beyond survival analysis, a growing body of work addresses other practical concerns of clinical federated learning. Some studies tackle institutional and demographic heterogeneity together with fairness and personalization; for example, Zhao et al. (22) partition clinical data by demographic group and map the resulting trade-off between predictive accuracy, fairness, and communication cost across several federated strategies. Others focus on securing the exchanged updates through weighted aggregation and encryption, as in the encrypted, weighted federated scheme of Zhao et al. (23) for diabetes classification. These directions are complementary to ours: they concern classification and general risk prediction rather than time-to-event modeling, whereas our focus is the specific leakage channels of federated Cox survival analysis and the effect of mitigating them on the survival estimates themselves.

Our work is therefore to quantify the privacy-accuracy shift that two established Privacy-Enhancing Techniques (PETs) introduced when integrated into a federated Cox workflow, measured on the model coefficients and, on the cumulative baseline hazard. Our proposed method is discretized Cox analysis, where event times are grouped into bins by the participating data stations prior to fitting the local model, in the hope of increasing confidentiality in case of an adversarial attack. For the other, we aim to address the vulnerability of sharing model gradients by incorporating Differential Privacy (DP) (24, 25). This addresses inference risks by adding noise to model updates, ensuring that individual data points remain indistinguishable within the aggregated results (26). The contribution of this work is their integration into a single federated Cox pipeline on a PHT infrastructure and the empirical account of how each one shifts the hazard ratios and the baseline hazard relative to the standard federated Cox model. While the coefficients of a federated Cox fit are known to coincide with those of a centralized fit, the baseline hazard is a separate quantity whose behavior under these techniques has not previously been characterized in this setting.

Data and infrastructure

For this study, three public datasets from The Cancer Imaging Archive (TCIA)—HN1 (27), HEAD–NECK (28), and OPC (29)—were used. These comprise 1,041 patients in total and differ in size and event composition: HN1 (n = 137; 74 events, 54%), HEAD–NECK (n = 298; 56 events, 19%), and OPC (n = 606; 259 events, 43%). Full details of the datasets can be found in the corresponding references. These datasets were reformatted to ensure a consistent nomenclature for compatibility with the federated algorithms used. The study used Vantage6 (30), an open-source federated framework based on the PHT approach. We leveraged the demo-network functionality of Vantage6, which allows users to set up a server along with the necessary data stations on the local machines, thereby simulating a test environment for enabling the execution and evaluation of user-defined tasks and algorithms. A visual representation of this setup is provided in Figure 1. The primary focus of this work is on the partial results (highlighted by red arrows) shared by the data stations for aggregation. The federated Cox algorithm used in this study had been previously adapted for the Vantage6 infrastructure (19). It was further upgraded to be compatible with the latest version of Vantage6 (v4.5) for this work. The complete code for the algorithm can be accessed at https://github.com/MaastrichtU-CDS/v6-coxph/releases/tag/2.0.0.

Discretized cox analysis

Our initial experiment for federated Cox analysis involved implementing a discretized time approach rather than the standard continuous time method, which transmits unique event times from the institution as partial results. In the discretized method, event times are grouped into intervals before being sent to the central server for aggregation. Within this approach, we explored two binning strategies:

Fixed binning: Events are divided into equal-sized bins across all data stations based on optimal bin values determined beforehand.

Quantile binning: Events are categorized based on an optimal number of quantiles identified using the optimal bin values calculated beforehand by the algorithm. Quantile binning ensures that events are evenly distributed across each bin.

To determine the optimal number of bins for both strategies, we applied Sturges’ rule (31), defined as:

Where n represents the total sample size, and ⌈⌉ denotes the ceiling function (rounding up to the next integer).

For fixed bins, the stations were instructed to locally assign intervals using the “histogram_bin_edges” function from the Python NumPy package, based on the optimal value. These intervals were shared with the server, which computed the global bin edges using the overall minimum and maximum values. For quantile bins, each station calculated the quantile edges for its data based on the optimal value, utilizing the “quantile” function from the NumPy package. These quantile edges were shared with the server to determine the global edges.

The global edges in both scenarios were then sent back to the stations to compute the event counts for their respective bins, which were subsequently aggregated for the Cox analysis. Because several distinct event times fall within each bin, every value that leaves a station is shared by multiple events, so an individual event time can no longer be singled out from the others in its bin. This provides a k-anonymity-style effect that complements the differential-privacy budget described below.

Differential privacy

Differential privacy (DP) limits inference attacks by adding calibrated noise to the data or model updates, making individual data points harder to distinguish in the output. Andreux et al. (21) showed that perturbing the local model gradients alone is enough to prevent reconstruction. We therefore applied Local Differential Privacy (LDP): each station adds Laplacian noise to its local gradients before transmitting them, so the noise is introduced at the data source and the guarantee does not depend on trusting the server or the aggregator. We also tested a variant in which Laplacian noise was additionally applied to the input predictors for 25% of patients at each station, before the gradients were computed.

Formally, this implements ε-local differential privacy through the Laplace mechanism: for a quantity f with L1-sensitivity Δ f (the largest change in f from adding or removing a single patient), releasing f + Lap (Δ f / ε) satisfies ε -differential privacy (24, 25), where f here is the local gradient. The parameter ε is a privacy-loss budget, a smaller ε means more noise and stronger privacy rather than an arbitrary noise level. This calibration to a sensitivity and a budget is what separates LDP from central DP, where a trusted aggregator perturbs the pooled result and usually achieves better utility at the same ε, and from uncalibrated noise, which carries no formal guarantee.

To determine the optimal ε and the corresponding noise scale ((Δ f / ε)), we conducted a series of Cox models using the three public datasets. We applied a combination of noise scales (the parameter ranging from 0.25 to 10) to the local gradients. The results were validated using a private Maastro dataset, HN3 (n = 165; 88 events, 53%). HN3 dataset provided an independent check that the chosen noise scale generalized, by recomputing Harrell’s C-index under that setting. Its endpoint (overall survival) and covariates (age, sex, T/N/M stage, tumor site, HPV status, radiotherapy type) match those of the public datasets. The resulting Harrell’s concordance indices (C-Indices) are plotted in Figure 2.

Ground truth for cumulative baseline hazards

Initially, for the standard federated Cox model, the Breslow estimator (32) was used to calculate the cumulative baseline hazard at each event time, which is defined as follows:

Where d i represents the number of events at each unique time t and Xβ denotes the Linear Predictor (LP) scores.

Cumulative baseline hazard for PETs

Following the derivation of the Cox model results for each PET experiment, we computed the cumulative baseline hazard using the Breslow estimator, either at each event bin edge (for binning) or at each event time (for DP), using the aggregated results from each dataset. Throughout, the standard federated Cox model is used as the reference against which the privacy-enhanced variants are compared. For the regression coefficients this reference is equivalent to a centralized analysis rather than an approximation of it: the Cox partial log-likelihood decomposes additively over the risk sets shared at each event time, so the federated Newton–Raphson procedure converges to the same maximum-likelihood estimates that a pooled fit on the combined data would produce (18). As the three datasets are public (27–29), this equivalence can be reproduced independently. We therefore report every privacy-enhanced result as a deviation from this baseline. The one quantity this equivalence does not cover is the cumulative baseline hazard under each technique, which is why we examine it directly.

Event times binning

The total sample size from the three public datasets consisted of 1,041 patients. The binning process began by requesting each data station to share its sample size. It was then aggregated on the server to compute the optimal bin size using Sturges’ rule, resulting in 12 bins for the datasets used. We subsequently experimented with our binning strategies using this optimal value. Figure 3 compares the hazard ratios (HR) of the clinical predictors and their 95% confidence intervals (CI) for both binning strategies relative to the standard federated Cox model.

Differential privacy on partials

The results of our experiments to determine an optimal ε are presented in Figure 2. The C-Indices (shown in blue) remain relatively stable and comparable to the C-Index of the standard Cox model (shown in red) when the noise scale is low. However, beyond a certain threshold (around 4), the C-Index decreases, indicating a decline in model accuracy due to excessive noise. For our current models, we selected a noise scale of 3.3 (sensitivity = 1, epsilon = 0.3) to balance added noise and model accuracy. This choice rests on an assumed gradient sensitivity of one rather than one enforced by bounding or clipping the gradients. It should therefore be read as the privacy budget under that assumption rather than a guarantee transferable to other data.

We initially compared the outcomes of the model where noise was introduced to the partial results, specifically the partial gradients, before transmitting them to the server against those of the standard Cox model. In a follow-up analysis, noise was introduced to a 25% subset of input variables (predictors) at the local stations before computing the partial gradients. The HRs are presented alongside the standard Cox model results in Figures 4 and 5. Comprehensive results of the models can be found in the Supplementary Materials.

Cumulative baseline hazards

The cumulative baseline hazard curves for each strategy were individually derived from the Cox model results using the Breslow estimator. Figure 6 shows the total number of patients at risk at each event time. The baseline hazard curves are presented in Figures 7–9, representing event time binning, noise applied to the local gradients, and noise applied to both the predictors (25% subset) and gradients, respectively, for comparative analysis. Figure 10 illustrates the differences in hazard values calculated in each PETs compared to the standard model.

In this study, we explored two potential enhancements to address possible data leakage issues in federated survival analysis when subjected to certain attacks, as was reported by recent research in the field. Our findings demonstrate that enhancing privacy in a federated learning environment is not only feasible but can also be tailored to meet project-specific requirements.

The Vantage6 software used in this work instantiates a PHT-type infrastructure with a client–server network topology, allowing for the analysis of multi-institutional datasets without the need to exchange sensitive patient-level data among collaborating parties. Instead, only aggregated cohort summaries or statistical model coefficients are shared through a mutually trusted third-party server, thus eliminating the need for direct peer-to-peer interactions between institutions. Moreover, Vantage6 supports web-industry-grade End-to-End (E2E) encryption. Even if an attacker were to intercept the transmissions between a local data station and the aggregator, it would remain indecipherable without the appropriate decryption keys, which are securely protected by the system.

Beyond encryption, Vantage6 incorporates access control mechanisms to further enhance security. A role-based access control framework ensures that only authorized users can execute specific tasks. For instance, a data scientist or a researcher may only have permission to submit analysis tasks but not to modify configurations, preventing unauthorized access. Additionally, an inbuilt algorithm store allows independent reviewers to allow list algorithms that are allowed to be executed on a consortium’s data, mitigating risks from untrusted computations.

In addition to these mechanisms, we assessed PETs to establish a multi-layered security framework. We explored two discretization strategies—Fixed and Quantile Bins—and compared them to standard federated Cox models. Our results showed that despite discretization, the predictors’ HRs remained consistent, indicating that the binned models retained predictive power with minimal impact on overall data associations. Furthermore, dynamic binning proved to be promising in handling incremental data in federated settings. Instead of predefining fixed bin edges, dynamic binning can adaptively adjust bin boundaries as new data becomes available, ensuring continuous privacy protection. This adaptability makes it particularly valuable in real-time learning environments where data distributions may evolve over time.

For the cumulative baseline hazard curves, fixed binning shows a steep initial rise, suggesting that while privacy is improved, there is a slight compromise in the hazard estimation. Meanwhile, the baseline curves for quantile binning closely align with those of the standard Cox model during the initial follow-up periods. However, some divergence is observed later, which may indicate increased sensitivity to data sparsity over time, as shown in Figure 6.

Experiments incorporating Differential Privacy (DP) into the Cox model yielded the following insights. Adding noise to the local gradients in the Cox model preserves the model’s utility while enhancing privacy. The HRs for the predictors remain consistent with those of the standard Cox model in our experiments, indicating that the noise added with the chosen epsilon value to the local gradients does not significantly alter the estimated effect sizes. Furthermore, the cumulative baseline hazard curves show minimal deviation between the standard model and the model with noise on local gradients, suggesting that the overall risk estimation remains reliable under this approach.

When additional noise is applied to a 25% subset of the predictors along with the noise on local gradients, the results reveal a more pronounced divergence. This suggests that while the combination further enhances privacy, it may introduce a degree of overestimation in the baseline hazard values, especially over longer follow-up periods. As shown in Figure 6, the number of individuals still at risk falls sharply toward the end of follow-up, and the largest divergences between the privacy-enhanced and standard baseline hazards (Figures 9 and 10) fall in this sparse region, where estimates are inherently unstable. We therefore restrict our interpretation to the period over which the risk set remains adequate and treat the far tail as unreliable rather than as evidence of a systematic effect. Defining a formal evaluation horizon and adding confidence bands around the cumulative hazard are left for future work.

The epsilon parameter controls the trade-off between privacy and accuracy when incorporating DP. A smaller epsilon provides stronger privacy by introducing more noise but at the cost of compromising model performance. Conversely, a larger epsilon offers less privacy protection but retains more of the original data utility. In practice, choosing epsilon a priori depends on the sensitivity of the data. While the literature does not provide an ideal threshold for selecting epsilon to balance data utility and privacy, we propose the following for a systematic approach:

Initial testing: Beginning with an intermediate epsilon value (e.g., 1.0 or 0.5) based on the project’s privacy requirements.

Sensitivity analysis: Re-running the model with varying values of epsilon. For instance, in the case of survival analysis, if the HRs remain consistent across a range of epsilon (from 0.5 to 1.0), it indicates that model performance is largely unaffected by noise, and any value within this range is acceptable.

Divergence thresholds: If significant deviations are observed in model outputs at lower epsilon values (e.g., ε < 0.5), it suggests that the noise is too disruptive. In such cases, reducing the noise may be necessary while still considering the acceptable level of privacy risk.

A Wald test was conducted to assess whether the models incorporating PETs yielded significantly different estimates for the effects of each predictor compared to the standard Cox model (refer Table 1 for results). The Wald statistics for the predictors in each PET model were relatively low, suggesting a likely non-significant difference. Moreover, the p -values were considerably above the 0.05 significance level, suggesting no statistically significant difference between the coefficients of the PET and standard models. These findings indicate that incorporating PETs in our Cox analysis resulted in comparable outcomes while preserving the overall predictive accuracy of the models. We did not fit a separate centralized Cox model because, for the coefficients, the federated fit returns the same estimates as the centralized one, as established for distributed Cox regression (18). The standard federated model is therefore already our centralized-equivalent baseline.

In this work, we exclusively sampled noise from a Laplacian distribution for differential privacy. Alternatively, depending on the project’s preferences, one could opt to sample noise from a truncated Gaussian distribution. We experimented with adding Laplacian noise to 25% of the predictors and the partial results, increasing the complexity of data reconstruction in the event of a security breach. Applying noise to 100% of the predictors before computing local gradients would mean effectively transforming the data, making the computations resemble those performed on a completely different dataset. This can significantly alter the underlying relationships within the data, potentially resulting in biased estimates and misleading conclusions.

An alternative is synthetic data, which involves generating a new dataset that mimics the statistical properties of the original data. While both these methods aim to enhance privacy, they differ fundamentally in their implementation and implications. Synthetic data preserves the original data structure and relationships, whereas indiscriminately applying differential noise can obscure these relationships and degrade model performance. Researchers may opt for differential noise when strict privacy guarantees are essential (33), but they should be mindful of the potential loss of data utility. Synthetic data may be preferable when the objective is to maintain analytical utility while still protecting sensitive information. However, a synthetic data engine is a machine learning algorithm. Training such an algorithm requires access to the original data, which introduces its own privacy risks and—if learned too “deep”—is not guaranteed to be privacy-preserving (34). Also, the final version must be based on real-world data for trust in prediction models.

Another potential PET is using secure aggregation techniques such as Secure Multi-Party Computation (SMPC) (35), which ensures strong privacy protections by aggregating model updates without disclosing individual contributions. However, SMPC can be computationally demanding. In our study, we experimented with event time binning and differential privacy, which offer a balance between privacy and computational efficiency. These methods provide adequate protection against inference attacks while remaining practical for applications with limited resources and time.

Introducing binning strategies, particularly quantile-based approaches, offers a viable method for enhancing privacy in federated survival analysis. Future research could explore optimizing these binning strategies to minimize any observed trade-offs, such as the variability in cumulative hazard estimation, and to assess their performance across larger datasets. Improvements could also include incorporating outlier detection when calculating bin edges and setting a minimum threshold for the number of data points in each bin. Applying DP highlights the importance of carefully balancing the noise level with the need to maintain model accuracy (privacy vs. utility), particularly in sensitive applications like federated survival analysis.

We also note that Sturges’ rule sets the number of bins from the total sample size, whereas the information available for survival estimation depends more directly on the number and timing of observed events; where events are sparse, the same bin count carries less information. We used Sturges’ rule as a transparent, data-driven default applied identically across strategies, and a systematic sweep over bin counts, together with rules based on the event count rather than the sample size, is a natural next step.

Selecting the appropriate PET is crucial and should be guided by the specific needs of the users and the data. In most federated modeling, End-to-end encryption (E2E) may provide sufficient privacy protection. However, in more sensitive cases where additional layers of privacy are necessary, both binning and DP offer valid options. For instance, in Cox analysis, researchers could begin with binning event times and then layer DP as required, adjusting the noise based on privacy requirements. Binning raises the difficulty of model-inversion attacks that attempt to reverse-engineer individual data points from the shared values, and DP reduces the information any single update carries about an individual, which is relevant to both model-inversion and membership-inference risks. Dual, which is relevant to both model-inversion and membership-inference risks. This work does not claim that either technique prevents these attacks outright as an attack was not implemented, and our evidence concerns the effect of each technique on the model outputs rather than a measured reduction in attack success. It is also worth noting that, in a healthcare consortium, membership inference is only one component of re-identification risk and is not equivalent to identifying a specific individual: attributing membership to a named person requires additional information that is neither public nor widely available. In practice this risk is also managed at the governance level rather than the algorithmic layer, through federated-learning agreements that constrain who participates and prohibit such attacks (36). Not every risk therefore needs to be solved mathematically, and the claims of this work are limited to the effect of each technique on the model outputs.

While the study demonstrates the feasibility of incorporating PETs into the federated Cox model, we also acknowledge the following limitations. Firstly, the experiments were conducted using public Head & Neck (HNC) datasets, which may not fully represent other datasets, particularly those with higher sensitivity. The equivalency of the privacy protections offered by our approach could be data dependent. Different data distributions or patterns may introduce variations affecting the balance between privacy and utility, potentially leading to unreliable hazard estimates. Therefore, the generalizability of PETs may vary when applied to different types of data, such as lung or prostate cancer datasets. In addition, the three datasets differ in size and in their event and censoring composition, so the federated estimates aggregate a degree of cross-site heterogeneity. Sites with fewer events contribute proportionally less information to the shared risk sets, which is one source of the tail instability noted above.

Secondly, we used the C-index to measure model performance while choosing the optimal epsilon value for the experiments. However, it is crucial to recognize that while the C-index may remain stable, the HRs could still vary, leading to inaccuracies in interpreting the effects of the predictors. Future studies might consider additional performance metrics or sensitivity analyses to ensure that noise introduced by DP does not mask critical shifts in HRs, which could influence clinical interpretations. Future work might also explore using PETs to protect more advanced analysis techniques, such as plotting Schoenfeld residuals to validate Cox model assumptions or constructing Kaplan–Meier curves within a federated framework.

This study evaluated two privacy-enhancing techniques—event-time binning and differential privacy (DP)—for reducing data-leakage risk in federated survival analysis. Using the Vantage6 infrastructure, we performed secure multi-institutional Cox analysis without sharing patient-level data across three head-and-neck cancer datasets arranged in a simulated network. Both fixed and quantile binning preserved the estimated hazard ratios, with fixed binning introducing a slight distortion in the cumulative baseline hazard—a minor trade-off between privacy and accuracy. Adding Laplacian noise to the local gradients likewise maintained model fidelity while reducing privacy risk. As the coefficients of a federated Cox fit coincide with those of a centralized analysis, these estimates depart from a centralized-equivalent baseline only to the extent introduced by the added noise. Extending the perturbation to a subset of predictors was the exception, producing measurable deviations in the cumulative baseline hazard in late follow-up and underlining the need to calibrate the privacy parameters carefully. These findings hold for the datasets, event rates, censoring patterns, and covariate distributions studied here, and for the particular noise scale used, which was selected under an assumed sensitivity of one rather than a formal privacy calculation. There are no claims included of demonstrated resistance to membership-inference or reconstruction attacks. Overall, both techniques can strengthen privacy in federated survival analysis, but the choice and configuration of each should be guided by the sensitivity of the data and the requirements of the specific project. Future work will focus on optimizing these strategies for larger datasets, more institutions, and other clinical applications.