Extracted main text — title through conclusion, appendix excluded. This is what our citation measures are computed over, published so the extraction can be checked by eye.
43,751 characters · 18 sections · 39 citation commands
Differentially Private Estimation of Heterogeneous Causal Effects
{\bf Keywords:} causal inference, differential privacy, interpretability, generalized additive models
Understanding how treatment effects may vary across a population is critical for policy evaluations and optimizing treatment decisions. Estimating such treatment effect heterogeneity is common in medicine, marketing, and social science. Existing methods, however, may leak information about specific observations used in estimation. We propose a general way to estimate flexible heterogeneous treatment effect models in a privacy-preserving manner and show empirically how privacy guarantees impact estimation accuracy.
Using the potential outcomes framework neyman1923, rubin1974, we focus on estimating the Conditional Average Treatment Effect (CATE) $\tau(x)=\mathbb{E}[Y(1)-Y(0)|X=x]$ where $Y$ is the outcome of interest, $X$ are observed covariates (features), $T$ is a binary treatment, and $Y(1), Y(0)$ are the potential outcomes under treatment and control. The setting can be experimental, where $T$ is a randomized manipulation, or observational, where $T$ is not explicitly randomized.
Privacy concerns arise when data includes sensitive information, such as healthcare data, finance data, or digital footprint. In these settings, mining population-wide patterns using algorithms without explicit privacy protection can reveal individuals' private information carlini2019, melis2019, shokri2017. The same concern extends to treatment effect estimation, especially CATE estimation, as the flexibly estimated CATE function at fine granularity could potentially reveal individual covariates, treatment status, or potential outcomes, all of which could be highly sensitive.
Differential privacy (DP) has emerged as a standard mathematical definition of privacy and has been widely adopted by U.S. Census Bureau and companies like Apple and Google for data publication and analysis erlingsson2014, abowd2018. DP provides a robust, cryptographically motivated framework for tracking privacy loss and protects against privacy attacks even when an adversary has significant external information dwork2006. In this work, we show how to add DP guarantees to many popular CATE estimation frameworks.
The main contributions of this paper are:
Our work builds on those from CATE estimation and differential privacy.
The modern CATE literature has focused on adapting flexible machine learning models to estimate CATE while utilizing sample-splitting to avoid biases due to overfitting. This includes methods that specify particular ML methods Athey2016, Wager2018) and “meta-learners” that can utilize general ML algorithms nie2021, kunzel2019, kennedy2020, chernozhukov2018, vanderlaan2011. Our paper builds on the latter line of literature and provides a general recipe to make the existing meta-learners differentially private.
Differentially private algorithms have been proposed for many prediction tasks, such as classification, regression, and forecasting. These algorithms typically involve adding differential privacy guarantees to existing machine learning algorithms. For example, DP variants exist for linear models chaudhuri2011, decision tree classifiers jagannathan2009, stochastic gradient descent, and deep neural networks abadi2016. All of these models can be used as base components in our meta-algorithm.
Finally, there has been some initial work on differentially private causal inference methods. lee2019 proposed a privacy-preserving inverse propensity score estimator for estimating average treatment effect (ATE). Their method ties with a specific differentially private prediction method for ATE estimation, which falls into the meta-algorithm framework in this paper. komarova2020 studied the impact of differential privacy on the identification of statistical models and demonstrated identification of causal parameters failed in regression discontinuity design under differential privacy. agarwal2021 studied estimation of a finite-dimensional causal parameter under the local differential privacy framework. Our paper uses the central differential privacy framework, which gives weaker privacy protection and retains much higher data utility.
We assume our data consists of iid observations $Z_i=(Y_i, T_i, X_i)$, where $Y \in \mathbb{R}$ is the outcome, $T \in \{0,1\}$ is a binary treatment, and $X \in \mathbb{R}^d$ are the observed covariates, and $i\in \{1,...,n\}$. We define several nuisance functions:
where $e(\cdot)$ is the propensity score, $\mu(\cdot, \cdot)$ is the joint response surface, and $\eta(\cdot)$ is the mean outcome regression. We aim to estimate $\tau(x)=\mu(1, x)-\mu(0, x)$, which is referred to as CATE. We will assume standard causal assumptions such as no unmeasured confounding ( $\{Y_i(0), Y_i(1)\} \protect\mathpalette{\protect\drawindependent}{\perp} T_i|X_i$, i.e. conditional on $X$, treatment is independent of potential outcomes) and overlap of the treated and control propensity score distributions ($0<e(x)<1, \ \ \forall x$). These are trivially satisfied for randomized experiments but typically takes domain knowledge to verify for observational studies.
Differential privacy is a widely adopted privacy definition based on the notion of a randomized algorithm's sensitivity to any single data point dwork2006. It is formally defined as:
Intuitively, differential privacy is a promise to each individual that the output of a DP algorithm will be approximately the same irrespective of its data. The privacy parameters $\varepsilon$ and $\delta$ parameterize the strength of the privacy guarantee -- smaller values of $\varepsilon$ and $\delta$ ensure that the output distributions of $\mathcal{A}(S)$ and $\mathcal{A}(S')$ are closer, thereby ensuring more privacy. Algorithms typically achieve differential privacy guarantees by adding calibrated, symmetric noise to their outputs. Decreasing $\varepsilon$ or $\delta$ necessitates adding more noise to a model, which leads to an implicit trade-off between privacy and accuracy. We explore this trade-off for the CATE setting in Section (ref).
We also leverage a refined notion of differential privacy called $f$-DP, which provides better mathematical tools for the privacy analysis of our algorithms dong2019. $f$-DP conceptualizes the privacy task as providing minimum error rates on statistical tests that would try to determine which of two potential samples were used to generate a statistic. It therefore parameterizes the privacy guarantees with a function, called a “trade-off function,” that relates how Type-I and Type-II error can be traded-off in such a test. $(\varepsilon, \delta)$-DP is a special case of the $f$-DP framework. Our main theorem will be presented in terms of the more general $f$-DP space. Our experimental results will be shown in the more widely used $(\varepsilon, \delta)$-DP space. The following definitions are due to dong2019, which we copy here for completeness.
In this section, we present a meta-algorithm of conditional treatment effect estimation with simple and tight privacy guarantees. The meta-algorithm can be used with leading CATE learners in the literature, including DR-learner, R-learner, and S-learner, among others. Multiple sample splitting, i.e., using different parts of the sample to estimate different components of an estimator, is the key feature of this algorithm and enables the application of the parallel composition property of differential privacy. The privacy guarantee we give is learner-model-agnostic, i.e., it applies for any meta-learner in the literature and sub-algorithm modules as long as each sub-algorithm module is differentially private on its own.
In this subsection, we present our proposed meta-algorithm.
Algorithm (ref) is expressive enough to represent many leading CATE learners. We next show how to map the DR-learner, R-learner, and S-learner to this framework by specifying their $k, \mathcal{A}_1, \ldots, \mathcal{A}_k, \mathcal{T}$, and $\mathcal{B}$. Use $L(Y \sim X)$ to denote a regression estimator, which estimates $x \mapsto \mathbb{E}[Y |X = x]$.
Multiple sample splitting is a key design choice of Algorithm (ref). The practice of using separate samples for estimating the nuisance functions in the first stage and the CATE function in the second stage is popular in the literature chernozhukov2018, kennedy2020, newey2018, nie2021, vanderlaan2011. This is motivated by the fact that sample splitting avoids the bias due to overfitting. kennedy2020 and newey2018 point out that using different parts of the sample to estimate different components of an estimator, called double sample splitting, leads to simpler and sharper risk bound analysis. On top of these, we will see in Section (ref) that multiple sample splitting leads to tight differential privacy guarantees by exploiting parallel composition and post-processing properties of differential privacy.
In this subsection, we formally prove Algorithm (ref) is private under the conditions that each of the sub algorithm modules is private. To give a tight analysis of the privacy guarantee, we adopt the $f$-DP framework proposed by dong2019.
A proof of Theorem (ref) can be found in the appendix.
In this section, we introduce DP-EBMs as the base learner in the meta-algorithm and present the full algorithm of a specific differentially private CATE leaner we call DP-EBM-DR-learner.
DP-EBM is a differentially private and interpretable machine learning algorithm recently introduced by nori2021, which adds differential privacy guarantees to Explainable Boosting Machines (EBM) nori2019, lou2012, lou2013. EBMs and DP-EBMs belong to the family of Generalized Additive Models (GAMs), which are restricted models of the form: \[ g(\eta(x)) = \alpha + f_{1}(x_{1}) + ...+ f_{d}(x_{d}), \] where $\eta(x) = \mathbb{E}[Y|X=x]$ is the regression function, $f_{i}$ is a univariate function that operates on each input feature $x_{i}$, $\alpha$ is an intercept, and $g$ is a link function that provides the relationship between the additively separable function to the regression function and in doing so adapts the model to different settings like classification and regression. GAMs are a relaxation of generalized linear models in which each function $f_{i}$ is restricted to linear. In the GAM setting, the models are allowed to flexibly learn complex functions of each feature, which has been shown to yield more expressive and accurate models chang2021, caruana2015, nori2019. Moreover, the additive structure of the models and inability to learn complex interactions between features (e.g., $f(x_1, x_2, x_3)$) allows GAMs to remain interpretable. At prediction time, the contribution of each feature $i$ is exactly $f_{i}(x_{i})$. These term contributions can be directly compared, sorted, and reasoned about. In addition, each function $f_{i}$ can be visualized as a graph to show how the model's predictions change with varying inputs.
DP-EBMs add privacy guarantees to EBMs by adding calibrated Gaussian noise during each iteration of the training process. This noise has been shown to cause distortion in the learned individual feature functions $\hat{f}_i$, especially under strong privacy guarantees.
We use DP-EBMs to highlight our DP CATE learning algorithm for two main reasons: DP-EBMs have been shown to yield high accuracy under strong privacy guarantees on tabular datasets, and the interpretability of DP-EBMs is useful to showcase how varying privacy guarantees affect CATE estimation nori2021.
Previously, Algorithm (ref) outlined a general recipe to construct DP CATE learners. Now that we have introduced DP-EBM, a concrete prediction algorithm with privacy guarantee, we will present a complete CATE estimator that we call DP-EBM-DR-learner.
DP-EBM-DR-learner is $(\varepsilon, \delta)$-DP by theorem (ref) and remark (ref).
Similarly, we can construct DP-EBM-R-learner and DP-EBM-S-learner following Section (ref) and use DP-EBM for fitting the regression model (or empirical risk minimization).
Our main focus here is DP-EBM-DR-learner due to the favorable theoretical properties of DR-learner, including double robustness kennedy2020, connection to semiparametric efficiency robins1994, and its interpretability. More precisely, DR-learner will always estimate the projection of the true CATE function onto the space of functions over which we optimize in the final regression, even if the true CATE function does not lie in this function space. This fact partially mitigates the problem of model misspecification. We pick DP-EBM prediction algorithm due to its exact model interpretability and high accuracy under privacy constraints.
R-learner shares many of the theoretical properties of DR-learner. DP-EBM-R-learner also has similar empirical performance as DP-EBM-DR-learner in the following experiments.
We treat S-learner as the baseline due to its simplicity. Since the approach is relatively simple and does not use estimated propensity scores, S-learner often has larger bias (integrated squared bias) and smaller variance (integrated variance) for moderate sample sizes. DP-EBM-S-learner reduces to a differentially private average treatment effect (ATE) estimator. This happens because the functional form restriction of DP-EBM enforces the CATE estimate of S-learner to be a constant $\hat{\tau}(x) = \hat{\mu}(1, x) - \hat{\mu}(0, x) = \hat{f}_T(1) - \hat{f}_T(0)$, where $\hat{f}_T$ is the estimated univariate function of the treatment. As a result, DP-EBM-S-learner, an ATE estimator, has a large irreducible bias and a small variance for estimating CATE.
In this section, we present experimental results for DP CATE learners using data from a real-world experiment with synthetic treatment effect in addition to five simulated datasets. Imposing privacy constraints necessarily compromises accuracy in estimating CATE. Understanding this privacy-accuracy trade-off is the main goal of our experiments.
We present our analysis to illustrate how DP noise affects the estimated CATE function. We show how different DP CATE learners applied to different sample sizes are affected differently by varying the level of privacy constraints. Further, we elaborate on the privacy-accuracy trade-off by decomposing the increase in mean squared error (MSE) into increases in bias and variance. The code for all experiments in this section is publicly available at \url{https://github.com/FengshiNiu/DP-CATE}.
In our experiments, we evaluate three DP CATE learners: DP-EBM-DR-learner, DP-EBM-R-learner, and DP-EBM-S-learner. For the first two, the sample splitting ratio is set to $(\lambda_{1, 1}, \lambda_{1, 2}, \lambda_2) = (0.25, 0.25, 0.5)$, which means estimating propensity score, outcome regression, and CATE function each uses a quarter, a quarter, and a half of the whole sample, respectively. We use the DP-EBM classifier and regressor implemented in the python package interpret\footnote{\url{https://github.com/interpretml/interpret}} introduced in nori2019 with all hyperparameters set to their default values. Except for propensity scores, which are estimated using a DP-EBM classifier, all other functions in the experiments are fitted using a DP-EBM regressor.
We describe how we generate different datasets $\{(Y_i, T_i, X_i)\}_{i \in \mathcal{S}}$ in all experiments using the following language. We use $P_X$ to denote the covariate distribution, $e(x):= P(T=1|X=x)$ to denote the propensity score, and $b(x) := \mathbb{E}[Y(0)|X=x]$ for the control baseline function.
The main dataset we consider is a real dataset from arceneaux2006, which studies the effect of paid get-out-the-vote calls on voter turnout. We refer to this dataset as the voting data. This data is originally generated from a stratified experiment with varying treatment probability and has previously been used for comparing and evaluating the performance of different causal effect estimators arceneaux2006, nie2021. nie2021 points out that the true treatment effect in this data is close to non-existent, so we can spike the original dataset with a synthetic treatment effect $\tau(\cdot)$ to make the task of estimating heterogeneous treatment effects non-trivial. The modified dataset therefore has the covariate distribution and propensity function from the true data and has a synthetic treatment effect. Because we know the true synthetic treatment effect $\tau(\cdot)$, we can compare the estimated $\hat{\tau}(\cdot)$ to it and evaluate its performance.
Following nie2021, we focus on a subset of 148,160 samples containing 59,264 treated units and 88,896 controls. The covariates have $11$ variables, which include state, county, age, gender, past voting record, etc. The synthetic treatment effect is set to $\tau(X_i) = -\frac{\operatorname{VOTE00}_i}{2+100/\operatorname{AGE}_i}$, where VOTE00i indicates whether the $i$-th unit voted in the year 2000. The synthetic treatment effect is added by strategically flipping the binary outcome. Denote the original outcome in the data by $Y^*$. With probability $1-\tau(X_i)$, we set $Y_i(0) = Y_i(1) = Y^*$. With probability $\tau(X_i)$, we set $Y_i(0) = 1, Y_i(1) = 0$. Finally, we set $Y_i = Y_i(T_i)$. The treatment heterogeneity as measured by $\operatorname{Var}(\tau(X)) = 0.016$ is moderate. This number can also be interpreted as the MSE of using the true ATE as a CATE estimator.
All five other datasets are generated by simulation based on the same recipe:
We specify setups $A$ to $E$ with different $(P_X, b, e, \tau)$ to cover a variety of settings.
For all setups, $d=6$. The trim function is specified as $\operatorname{trim}_{0.1}(x) = \min\{\max\{0.1, x\}, 0.9\}$. Setup A, B, C, and D are from Section 6 of nie2021. Setup A has a complicated baseline function. Setup B is a randomized controlled trial with $e = 0.5$. Setup C has a constant treatment effect with $\tau = 1$. Setup D has a nondifferentiable treatment effect function. Setup E has correlated covariates with $\Sigma_d$ generated from a random data generator. Its baseline function is discontinuous and contains an interaction term between variables.
We run all three DP CATE learners on all six datasets with seven levels of training sample size growing exponentially $\{500, 1000, 2000, 4000, 8000, 16000, 32000\}$. For setups A-E, we generate a fixed test sample of size $250000$ using their data generating process and use it throughout the experiments. For the voting data, we construct the training data by random sampling (stratified by treatment) from the whole data and use all data left as the test set. The privacy parameter $\delta$ is fixed as $10^{-5}$ and $\varepsilon$ varies between $\{1, 2, 4, 8, 16\}$. $\varepsilon=16$ is seen as approximately non-private since the privacy guarantee is extremely weak. $\varepsilon=1$ and $\varepsilon=2$ are seen as strong guarantees.
For each specification, we train the algorithm twice on two separate training sets with the specified sample size. We then generate three empirical MSE corresponding to the predicted CATE using each of the two trained algorithms separately and the average of these two algorithms on the test set. These three MSE are denoted as $\widehat{\operatorname{MSE}}_1, \widehat{\operatorname{MSE}}_2, \widehat{\operatorname{MSE}}_{\mathsf{avg}}$. We generate estimated $\widehat{\operatorname{MSE}} = (\widehat{\operatorname{MSE}}_1 + \widehat{\operatorname{MSE}}_2)/2$, $\widehat{\operatorname{Bias}} = 2\widehat{\operatorname{MSE}}_{\mathsf{avg}} - \widehat{\operatorname{MSE}}$, $\widehat{\operatorname{Var}} = 2\widehat{\operatorname{MSE}} - \widehat{\operatorname{Bias}}$. Here $\widehat{\operatorname{Bias}}$ is meant to estimate the integrated squared bias $\int (\mathbb{E}_{\mathcal{S}}[\hat{\tau}_{\mathcal{S}}(x)] - \tau(x))^2 dF(x)$, in which $\mathbb{E}_{\mathcal{S}}[\hat{\tau}_{\mathcal{S}}(x)]$ denotes the expected estimate at point $x$ over the distribution of data $\mathcal{S}$. $\widehat{\operatorname{Var}}$ is meant to estimate the integrated variance $\int \operatorname{Var}(\hat{\tau}_{\mathcal{S}}(x)) dF(x)$. This calculation is motivated by the fact that MSE of the average prediction is the sum of the integrated squared bias plus half of the integrated variance. For each of the specification we run this process five times and report the average $\widehat{\operatorname{MSE}}$, $\widehat{\operatorname{Bias}}$, $\widehat{\operatorname{Var}}$.
Figure (ref) shows the shape function of the conditioning variable “Age” that the DP-EBM-DR-learner learned from the voting data with sample size 16000 at five different levels of $\varepsilon$. The main purpose of this figure is to transparently show the effect of adding differential privacy constraints on the estimated CATE function. Since the true shape function corresponds to the projection of the synthetic CATE function $\tau^*(X_i) = -\frac{\text{VOTE00}_i}{2 + (100/\text{AGE}_i)}$ onto the additive separable function space, it is smooth and monotonically decreasing. DP-EBM-DR-learner learns this well when the algorithm is nonprivate or the privacy is low with $\varepsilon = 128$, $16$, or $8$. When privacy gets stronger with $\varepsilon = 4$ or $2$ or $1$, the estimated shape functions become jumpier and less smooth. Intuitively, this happens because differential privacy is achieved by adding Gaussian noise in the training process. Higher levels of noise under strong privacy lead to less well-behaved nonparametric function estimates. Similar behavior has been observed when DP-EBMs are applied to general prediction tasks nori2021.
Figure (ref) plots the MSE of DP-EBM-DR-learner, DP-EBM-R-learner, and DP-EBM-S-learner under seven different sample sizes of the voting data at five different levels of privacy. Each curve in the upper row shows how MSE increases as the privacy gets stronger at a given sample size. Each curve in the bottom row shows how MSE decreases as the sample size increases at a given privacy level.
The performance of the less flexible DP-EBM-S-learner stays remarkably stable with MSE equal to about $0.016$ for most designs and is larger than this only at only $n=500$ and $\varepsilon = 1$ where the sample size is the smallest and the privacy is the strongest. This happens because DP-EBM-S-learner outputs a constant scalar estimate of ATE, which is easily estimable with hundreds of samples despite the privacy constraint. In fact, its MSE approximately equals $\operatorname{Var}(\tau^*(X))=0.016$, which is the MSE of the true ATE.
The more flexible DP-EBM-DR-learner and DP-EBM-R-learner are much more sensitive to the privacy parameter $\varepsilon$. This is especially true when the sample size $n$ is small. MSE increases by a factor of $10^3$ going from $\varepsilon=16$ to $\varepsilon=1$ at $n=500$; while it only increases by a factor less than $10$ from $\varepsilon=16$ to $\varepsilon=1$ at $n=32000$. For the intermediate sample size $n=16000$, DR-learner and R-learner are better until privacy is at its strongest at $\varepsilon=1$, as also suggested by Figure (ref).
A researcher interested in exploiting heterogeneity in treatment effects under privacy constraints will need to decide whether to use a flexible CATE estimator or a simple ATE estimator. The lower plot shows that when there is almost no privacy at $\varepsilon=16$, flexible CATE estimators perform better with $3000$ or more samples on this dataset. As the privacy requirements get stronger, it takes more samples for the flexible CATE estimator to perform better. At $\varepsilon=1$ the simple ATE estimator outperforms the CATE estimators until about $20000$ samples on this dataset.
Figure (ref) shows the mean squared error, integrated squared bias, and integrated variance values of the DP-EBM-DR learner on all six datasets. Moving from no privacy to strong privacy, the variance of this learner often increases by about a factor of 10 while the bias changes by at most a factor of 2. This bias-variance decomposition reveals that accuracy loss due to privacy constraints comes mostly from the increase in variance. In other words, the privacy-variance trade-off captures most of the privacy-accuracy trade-off. This finding is in favor of CATE estimation under privacy constraints, because bias is a stronger concern than variance in estimation of causal effects which often deals with critical policy, economic or healthcare issues.
Our main experimental findings can be summarized as:
In this paper, we presented a meta-algorithm for differentially private estimation of the Conditional Average Treatment Effect (CATE). We showed that the meta-algorithm worked with a variety of CATE estimation methods and provided tight privacy guarantees. We pointed out multiple sample splitting, which enabled the usage of the parallel composition property of differential privacy and saved privacy budget, as the key feature of the meta-algorithm. We implemented a fully specified CATE estimator using DP-EBMs as the base learner. DP-EBMs were interpretable, high-accuracy models with privacy guarantees, which allowed us to directly observe the impact of DP noise on the learned causal model. We conducted experiments that varied the size of the training data and the strength of the privacy guarantee to study the trade-off between privacy and CATE estimation accuracy. Our experiments indicated that most of the accuracy loss from differential privacy in the high-privacy, low-to-modest sample size regime was due to an increase in variance rather than bias. The experiments also showed that flexible, multi-stage CATE learners incurred larger accuracy loss from differential privacy than less flexible, single-stage CATE or ATE learners. It would be interesting to complement these empirical findings by characterizing theoretically the trade-off between privacy and accuracy for estimating CATE.