Privacy-Preserving, Decentralised Inference of Epidemic Transmission Dynamics from Digital Exposure Histories

@misc{kim2026privacypreserving,
  title = {{Privacy-Preserving, Decentralised Inference of Epidemic Transmission Dynamics from Digital Exposure Histories}},
  author = {Y. Kim and B. Lambert and L. Ferretti and M. Kendall and R. Hinch and J. Webb and T. Rawson and L. Abeler-Doerner and P. Horby and M. Parker and M. C. Mills and C. Fraser and M. U. G. Kraemer and C. A. Donnelly},
  howpublished = {medRxiv},
  year = {2026},
  month = oct,
  doi = {10.64898/2026.10.05.26364757},
  url = {https://www.medrxiv.org/content/10.64898/2026.10.05.26364757v1},
  note = {CC BY},
}

TY  - UNPB
TI  - Privacy-Preserving, Decentralised Inference of Epidemic Transmission Dynamics from Digital Exposure Histories
AU  - Y. Kim
AU  - B. Lambert
AU  - L. Ferretti
AU  - M. Kendall
AU  - R. Hinch
AU  - J. Webb
AU  - T. Rawson
AU  - L. Abeler-Doerner
AU  - P. Horby
AU  - M. Parker
AU  - M. C. Mills
AU  - C. Fraser
AU  - M. U. G. Kraemer
AU  - C. A. Donnelly
PY  - 2026
DA  - 2026/10/05
PB  - medRxiv
DO  - 10.64898/2026.10.05.26364757
UR  - https://www.medrxiv.org/content/10.64898/2026.10.05.26364757v1
AB  - BackgroundExposure-history data collected during epidemics or pandemics within digital contact-tracing applications hold immense potential for rapid, scalable epidemiological inference. The sensitivity of these data makes privacy-preserving designs essential to secure public trust and app uptake. However, during the COVID-19 pandemic, such approaches were not yet available at the scale or maturity required for deployment. We present a Bayesian decentralised framework to infer transmission dynamics from exposure-history data while protecting user privacy.  MethodsOur approach is based on iterative communication between user devices and a central server, computing log-likelihood gradients on device from exposure-history data and centrally updating parameter values using only aggregated gradients. Applying this framework to synthetic exposure-history data from a hypothetical respiratory pathogen epidemic simulated on dynamic contact networks, we assessed its ability to estimate the underlying transmission parameters, perform infector attribution, and reconstruct serial-interval (SI) distributions. We systematically explored how inference was affected by incomplete exposure-history data arising from partial app adoption, case under-ascertainment, and incomplete exposure logging, and by transmission scenarios.  FindingsOur decentralised framework accurately recovered transmission parameters, closely matching estimates derived from centralised data with no systematic bias in posterior means. Parameter recovery remained robust when hazards from unobserved exposures were known as a daily average across the population. Although incomplete exposure-history data and specific transmission scenarios introduced compensatory parameter biases, the inferred host infectiousness profile retained sufficient accuracy, and the weekly SI distributions reconstructed from infector attributions closely resembled the ground-truth distributions.  InterpretationOur findings highlight that, beyond its primary role as a control measure, digital contact tracing could help characterise transmission dynamics almost in real time and inform public health interventions while preserving user privacy.  FundingOxford Martin School Programme on Digital Pandemic Preparedness; National Institute for Health and Care Research (NIHR) Health Protection Research Unit in Emerging and Zoonotic Infections.  Evidence before this studyWe searched PubMed for studies published from database inception to Sept 30, 2026, using the keywords ("digital contact tracing" OR "exposure notification" OR "contact tracing app") AND ("federated learning" OR "decentralised" OR "privacy-preserving" OR "statistical inference" OR "Bayesian inference") AND ("transmission" OR "serial interval" OR "infectiousness"). During the COVID-19 pandemic, digital contact-tracing (DCT) apps were deployed at an unprecedented scale: 224 COVID-19 apps were launched across 127 countries, 128 of which supported exposure notification. In England and Wales, the NHS COVID-19 app had 16.5 million regular users (28% of the total population) and averted an estimated 1 million cases and 9,600 deaths in its first year. To protect privacy, however, most apps used decentralised architectures that kept exposure-history data on users devices. This privacy-preserving principle has largely prevented these data from being used for epidemiological inference to understand transmission dynamics, such as estimating the serial-interval (SI) distribution and host infectiousness profile over time. While existing decentralised algorithms estimate each users infection risk, we found no study that developed and evaluated a framework for estimating population-level epidemiological parameters from exposure-history data that remain on users devices.  Added value of this studyTo our knowledge, this is the first such framework. It estimates key quantities required for understanding transmission dynamics, including how an infected individuals infectiousness changes over time relative to their symptom onset date, how much close contacts increase the risk of transmission, and the SI distribution. The framework learns an exposure hazard function from data that never leave users devices, then attributes infections to likely infectors, and reconstructs the SI distribution. We applied the framework to synthetic exposure-history data from epidemics simulated on dynamic contact networks of 166,034 individuals, matching the 2024 population of Oxford, UK. It produced estimates comparable to those from centralised analysis, identified the timing of peak host infectiousness relative to symptom onset to within one day, and reconstructed SI distributions that closely tracked the ground truth. We also systematically assessed how participation levels (app adoption and case ascertainment), technical limitations (incomplete exposure logging), and surveillance (knowledge of the background hazard from unobserved exposures) affected inference, and showed that daily population-level knowledge of the background hazard was sufficient for reliable inference.  Implications of all the available evidenceBeyond their role as a control measure, DCT apps could provide timely, population-representative estimates of key transmission parameters, such as the host infectiousness profile and SI distribution. Our findings show that such inference is feasible within the privacy-preserving architectures likely to underpin future DCT systems. Greater app adoption, case ascertainment, and exposure logging would improve inference accuracy. To realise this potential, the framework will need to be embedded in DCT systems, supported by concurrent epidemiological research, real-world validation, and early collaboration with public health authorities and platform providers.
ER  -