Privacy-Preserving AI Learns Personalized Treatment Rules Without Exposing Patient Data

Medicine is increasingly personal. Two patients with the same diagnosis can respond in strikingly different ways to the same drug, and the promise of precision medicine rests on learning which treatment works best for whom. But the data needed to make those calls — clinical trials, electronic health records, genomic profiles — are among the most sensitive information that exists. A new study published in the journal Machine Learning tackles this tension head-on, presenting a differentially private version of a popular machine learning method for tailoring treatments, complete with mathematical guarantees that patient privacy survives the learning process.

The method at the heart of the work is called outcome weighted learning, or OWL, first proposed by Zhao and colleagues in 2012. Unlike ordinary classification, where an algorithm learns to predict a known label from features, OWL works with a fundamentally different kind of data: a triple of patient characteristics, the treatment actually given, and the reward — the clinical outcome — observed only for the treatment that was administered. The outcomes of the treatments a patient did not receive are never observed. OWL converts the search for an optimal individualized treatment rule into a weighted classification problem, where patients who benefited greatly from their assigned treatment carry more weight in shaping the decision rule. The goal is a function that, given a patient’s characteristics, recommends the treatment expected to maximize their clinical benefit.

The challenge is that learning such rules from medical data risks leaking the very information patients entrusted to researchers. Differential privacy, introduced by Cynthia Dwork and collaborators in 2006, offers a rigorous answer. A randomized algorithm is differentially private if its outputs are, up to a controlled slack governed by a privacy budget epsilon, essentially indistinguishable whether or not any single individual’s record is in the dataset. The standard trick is to inject carefully calibrated noise — often Gaussian — so that no one person’s contribution can be reverse-engineered from the results. Smaller epsilon means stronger privacy, but typically at the cost of accuracy, creating the field’s central trade-off between privacy and utility.

Previous attempts to privatize treatment-rule learning, such as the batch differentially private OWL algorithm of Giddens and colleagues from 2023, relied on full-batch gradient descent with output perturbation. That approach becomes computationally expensive and memory-hungry on the massive datasets typical of modern medicine, such as electronic health records and genomic data. The new paper, authored by Aoli Yang, Jun Fan, Yunwen Lei, and Dao-Hong Xiang, instead builds its privacy-preserving learner on stochastic gradient descent, or SGD, which estimates gradients from small random mini-batches and updates the model far more frequently. Their algorithm adds Gaussian noise to the gradient at every iteration, a technique known as gradient perturbation, making it well suited to large-scale and even streaming clinical data.

A subtle but crucial technical point distinguishes this work from classical differentially private SGD analyses. In standard supervised learning, the sensitivity of a gradient — how much one changed record can shift it — is bounded by the Lipschitz constant of the loss function alone. In the OWL setting, each stochastic gradient is multiplied by a weight involving the observed reward and the probability of the treatment assignment. Because both the reward and the treatment are random variables, the sensitivity analysis must account for the magnitude of that weighting term, bounded by the maximum reward divided by the minimum treatment probability. The privacy proof therefore had to be rebuilt from the ground up for this weighted gradient structure, and the resulting noise calibration reflects it.

On the utility side, the authors prove convergence rates for the excess value function — the gap between the expected clinical benefit of the best possible treatment rule and that of the learned one. For a broad class of convex loss functions satisfying Lipschitz continuity and a smoothness condition known as Hölder smoothness, the excess error scales as one over the square root of the sample size plus a privacy term that shrinks with the dataset size and the privacy budget. Under a statistical assumption called the Tsybakov noise condition, which describes how many ambiguous patients sit near the decision boundary, these surrogate-error rates translate into rates for the excess value function itself. When the data are clean near the margin, the rate approaches the optimal order; when many samples crowd the boundary, learning slows.

The choice of loss function turns out to matter enormously under privacy constraints. The hinge loss, the classic margin-based surrogate used in support vector machines, is non-smooth, and non-smoothness is poison for private optimization: the theory shows it demands a tiny step size on the order of n to the power minus three-halves and roughly n squared iterations to converge. The authors’ elegant fix is the Moreau envelope, a smoothing technique from convex analysis that produces a differentiable approximation of the hinge loss while preserving its convexity and margin-based character. With the smoothed hinge loss, the same convergence rate is achieved with a step size of order n to the minus one-half and only about n iterations — a dramatic efficiency gain. The logistic loss, by contrast, suffers from vanishing gradients far from the decision boundary and degrades when noise from tight privacy budgets disrupts optimization near the margin.

Simulations designed to mimic a phase II clinical trial confirmed the theory. Across sample sizes from one thousand to seven thousand and privacy budgets ranging from nearly airtight to fully relaxed, misclassification rates fell and empirical treatment values rose as privacy constraints loosened, gradually approaching the non-private baseline. Larger datasets absorbed the privacy noise more gracefully, reaching the same performance with smaller privacy budgets — a finding with real implications, since it suggests that pooling more clinical data can buy stronger privacy protection without sacrificing model quality. In every setting, the Moreau-smoothed hinge loss delivered the lowest misclassification rates and the highest treatment values, vindicating the smoothing strategy.

The team also validated the approach on real data from the AIDS Clinical Trials Group Study 175, a landmark HIV trial available through the UCI Machine Learning Repository. Using ten prognostic variables — including age, body weight, Karnofsky score, and several binary clinical indicators — and the change in CD4 cell count as the reward, they compared treatment strategies across four binary decision scenarios. With five-fold cross-validation repeated two hundred times, the pattern held: treatment values climbed as epsilon increased, and the smoothed hinge loss consistently produced the best rules across all privacy levels and scenarios.

The work closes a gap that earlier privacy-preserving treatment-rule methods left open, providing complete excess generalization bounds with explicit privacy costs rather than privacy guarantees alone. The authors point toward two natural next steps: extending the framework to nonlinear treatment effects using kernel methods in reproducing kernel Hilbert spaces, and embedding the algorithm in federated learning so that multiple hospitals could jointly train treatment rules without ever sharing raw patient records. As artificial intelligence seeps deeper into clinical decision-making, results like these sketch a future in which the algorithms that choose our treatments can learn from everyone’s data while provably revealing no one’s.

Subject of Research: Differentially private stochastic gradient descent for estimating optimal individualized treatment rules via outcome weighted learning in precision medicine

Article Title: Differentially Private Stochastic Gradient Descent for Outcome Weighted Learning

Article References: Yang, A., Fan, J., Lei, Y., & Xiang, D.-H. (2026). Differentially Private Stochastic Gradient Descent for Outcome Weighted Learning. Machine Learning, 115(10), Article 232. https://doi.org/10.1007/s10994-026-07168-x

Image Credits: AI Generated

DOI: 10.1007/s10994-026-07168-x

Keywords: differential privacy, outcome weighted learning, stochastic gradient descent, precision medicine, individualized treatment rules, machine learning, Gaussian mechanism, Moreau envelope, hinge loss, excess value function, electronic health records, clinical trials