Model Agnostic Differentially Private Causal Inference

Estimating causal effects from observational data is essential in fields such as medicine, economics and social sciences, where privacy concerns are paramount. We propose a general, model-agnostic framework for differentially private estimation of average treatment effects (ATE) that avoids strong structural assumptions on the data-generating process or the models used to estimate propensity scores and conditional outcomes. In contrast to prior work, which enforces differential privacy by directly privatizing these nuisance components, our approach decouples nuisance estimation from privacy protection. This separation allows the use of flexible, state-of-the-art black-box models, while differential privacy is achieved by perturbing only predictions and aggregation steps within a fold-splitting scheme with ensemble techniques. We instantiate the framework for three classical estimators – the G-Formula, inverse propensity weighting (IPW), and augmented IPW (AIPW) – and provide formal utility and privacy guarantees, together with privatized confidence intervals. Empirical results on synthetic and real data show that our methods maintain competitive performance under realistic privacy budgets.

💡 Research Summary

This paper addresses the problem of estimating average treatment effects (ATE) from observational data while providing rigorous differential privacy (DP) guarantees. Existing DP approaches to causal inference either restrict themselves to simple randomized‑trial settings or enforce privacy by privately training the nuisance models (propensity scores and outcome regressions). The latter strategy ties the privacy cost to the complexity of the chosen models, making it infeasible to use modern, high‑dimensional, non‑parametric learners.

The authors propose a model‑agnostic framework that decouples nuisance‑function estimation from privacy protection. The data are split into K folds. For each fold, nuisance models are trained on the remaining K‑1 folds using any off‑the‑shelf black‑box learner (e.g., gradient boosting, neural networks). The trained models are then used to generate predictions on the held‑out fold; only these predictions, not the raw data or model parameters, are later combined to compute the ATE. Because each observation is never used to train the model that predicts its own outcome, the sensitivity of the final aggregation step is dramatically reduced.

Four steps constitute the framework:

1. Randomly partition the dataset into K disjoint folds.
2. Fit propensity‑score and outcome‑regression models on the union of K‑1 folds (any non‑private algorithm).
3. Apply the K‑1 trained models to the held‑out fold to obtain predicted propensity scores (\hat\pi(x_i)) and conditional outcomes (\hat\mu_0(x_i), \hat\mu_1(x_i)).
4. Compute per‑unit scores (\Gamma_i) according to one of three classic estimators—G‑Formula, inverse‑propensity weighting (IPW), or augmented IPW (AIPW)—and release the average (\hat\tau = \frac1n\sum_i \Gamma_i) after adding Gaussian noise calibrated to the (\ell_1) sensitivity (\Delta).

The Gaussian mechanism is employed within the Gaussian Differential Privacy (GDP) framework. Lemma 1 shows that adding noise (Z\sim\mathcal N(0,\Delta^2/\zeta^2)) yields (\zeta)-GDP, which can be translated to the standard ((\varepsilon,\delta)) notion. Because of the cross‑fitting design, (\Delta = O(1/\sqrt n)), so the required noise magnitude shrinks with sample size, unlike prior methods where (\Delta) grows with model dimension.

The paper provides a unified theoretical analysis. It proves that the private estimators retain the same asymptotic variance (V^\star) as their non‑private counterparts (Equations 1‑3). For AIPW, the double‑robust property is preserved: as long as either the propensity‑score or outcome model is consistently estimated (mean‑square error (o(n^{-1}))), the estimator attains the semiparametric efficiency bound even under privacy.

Confidence intervals are constructed in two ways. An analytic variance estimator (\hat V = \frac{1}{n-1}\sum_i (\Gamma_i-\hat\tau)^2) yields a Gaussian CI (\hat\tau \pm z_{\alpha/2}\sqrt{\hat V/n}) after accounting for the added noise. Alternatively, a bootstrap that repeats the entire K‑fold procedure with fresh Gaussian noise provides empirical quantiles, leveraging the post‑processing immunity of DP.

The framework also extends to meta‑analysis: multiple independently privatized ATE estimates can be aggregated with optimal weighting, further reducing variance while preserving the overall privacy budget.

Empirical evaluation includes synthetic experiments and real‑world datasets such as MIMIC‑IV (critical‑care EHR) and UK Biobank (large‑scale health cohort). Under realistic privacy budgets (e.g., (\zeta) corresponding to (\varepsilon) between 1 and 2), the private AIPW estimator achieves mean absolute errors 30‑50 % lower than prior DP‑IPW methods that privatize the propensity model. The approach works equally well with high‑dimensional feature spaces (thousands of covariates) because the privacy cost does not depend on model size. Meta‑analysis across multiple splits further cuts variance by roughly 20 %.

In summary, the authors deliver a practical, flexible, and theoretically sound solution for differentially private causal inference. By isolating privacy protection to the prediction‑aggregation stage and employing cross‑fitting, they enable the use of state‑of‑the‑art machine‑learning models without incurring prohibitive privacy penalties. This work bridges a critical gap between privacy‑preserving data sharing and rigorous causal analysis, opening the door for secure, high‑quality treatment‑effect studies in medicine, economics, and the social sciences. Future directions include extensions to multi‑treatment settings, time‑varying effects, and non‑tabular data such as images or text.