1 of 17

Federated Eligibility Criteria Optimization for Clinical Trial Emulation

Eriberto A. Franchi, Aldo Marzullo, Elena De Momi, Alberto Redaelli

Politecnico di Milano – DEIB – Nearlab | HC@AIxIA 2026 Workshop

2 of 17

Eligibility criteria often exclude too much

Trials use strict eligibility criteria to protect participants and preserve internal validity.

But they exclude most patients who would receive the therapy in routine care.

This often results in:

Slower recruitment
Higher cost
Results that transfer poorly once approved
Many individual criteria contribute little to�the estimated treatment effect.

POLITECNICO DI MILANO

Department of Electronics, Information and Bioengineering

3 of 17

Background: Trial Pathfinder

Re-emulates a completed trial on real-world data (target trial emulation).

Estimates how each criterion changes the treatment hazard ratio (HR).

confounding handled by IPTW + a weighted Cox model

Scores criteria with Shapley values and relaxes those that don't degrade the effect.

POLITECNICO DI MILANO

Department of Electronics, Information and Bioengineering

Trial Pathfinder: Liu et al., Nature 2021.

4 of 17

The gap: assuming a single database

Run at one hospital, recommendations reflect only that site's case-mix.

A single site cannot tell whether a relaxation transports elsewhere.

This situation might lead to a local bias on the very patients a criterion governs can make a harmful relaxation look safe.

Pooling records across hospitals would help, but privacy and governance make it quite difficult, and usually organizing multicenter studies takes time and organization.

POLITECNICO DI MILANO

Department of Electronics, Information and Bioengineering

5 of 17

Our contribution

Trial Pathfinder → the eligibility-optimization logic, that assumes pooled data.

WebDISCO → an exact federated fit for a single Cox model, not influenced by eligibility.

This work → bind them into an exact federated re-emulation & criteria optimization pipeline.

multi-site relax/keep decisions that provably equal centralized pooling,

while sharing no records

POLITECNICO DI MILANO

Department of Electronics, Information and Bioengineering

Trial Pathfinder: Liu et al., Nature 2021. · WebDISCO: Lu et al., JAMIA 22(6):1212–1219, 2015.

6 of 17

Background: WebDISCO (Exact federated Cox)

The Cox partial likelihood is not separable across sites (while risk sets span all sites).

Each site shares only additive risk-set moments per event time (count, covariate sum, outer-product).

Coordinator sums them → reconstructs the exact pooled gradient & Hessian at every step.

federated = centralized pooling to ≈ 10⁻¹⁵ by construction and no record leaves its site

POLITECNICO DI MILANO

Department of Electronics, Information and Bioengineering

WebDISCO: Lu et al., JAMIA 22(6):1212–1219, 2015.

7 of 17

Method: per-criterion relaxation effect

TrialPathfinder original Shapley values exact scoring needs 2ⁿ − 1 cohort fits, causing a federated computational bottleneck.

So we opted for a lighter evaluation approach for each criterion:

emulate under the full protocol and with the criterion relaxed.

Relaxation effect:

Δc = log HR(relaxed) − log HR(full).

Decision:

relax if Δc < ε, otherwise keep.

ε = 0.05 is a decision margin of 5% on the hazard-ratio scale

Only single-criterion (leave-one-out) relaxations are evaluated here.

POLITECNICO DI MILANO

Department of Electronics, Information and Bioengineering

8 of 17

The federated pipeline

Two nested loops: one exact federated fit (FedFit), called per criterion to decide relax vs keep - only aggregate statistics ever leave a site.

K sites

local risk-set moments

S⁰, S¹, S²

Coordinator

Σ moments → exact

gradient g, Hessian H

(Newton–Raphson)

Treatment log HR

FedFit - exact federated Cox (WebDISCO): only aggregate moments cross the network

FedFit is run twice per criterion

For each criterion c:

FedFit(full) and FedFit(c relaxed)

Δc = log HR(relaxed) − log HR(full)

Δc < ε → relax

otherwise → keep

Criterion-optimization loop: n + 1 federated fits instead of Shapley's 2ⁿ − 1

POLITECNICO DI MILANO

Department of Electronics, Information and Bioengineering

9 of 17

Experiments: two settings

Synthetic (known ground truth):

two centers; Center A has an eligibility-specific bias on ECOG=2 (frailty affects treatment only there)
ground truth: keep ECOG=2 and severe comorbidity, relax the three other criteria

MIMIC-IV sepsis (real, no ground truth):

N = 13,305; split by hospital service into medical (12,024) and surgical (1,281) - a ~9:1 imbalance
corticosteroid vs none; 28-day mortality; five severity criteria

POLITECNICO DI MILANO

Department of Electronics, Information and Bioengineering

Data: MIMIC-IV v2.2 — Johnson et al., Scientific Data 10:1, 2023 (PhysioNet).

10 of 17

Synthetic results: relaxation decisions

The biased single center (Local-A) wrongly relaxes ECOG=2; the unbiased center, centralized pooling, and the federated estimator all recover the correct decision (accuracy 1.00, no false relaxation).

POLITECNICO DI MILANO

Department of Electronics, Information and Bioengineering

11 of 17

Synthetic results: hazard ratios

Plotting the ECOG=2 - relaxed HR: Local-A sits at a smaller HR, so its Δ falls below ε and it wrongly relaxes. Paired t-tests: each local differs from federated (p = 0.009 / 0.003), but only the biased center crosses ε - federation corrects it.

POLITECNICO DI MILANO

Department of Electronics, Information and Bioengineering

12 of 17

MIMIC-IV results: relaxation decisions

Same grid as the synthetic case. MED, SURG, and the federated estimator agree on four criteria; the small surgical service alone would keep INR>2.0 - its only disagreement with the federated (= pooled) decision.

POLITECNICO DI MILANO

Department of Electronics, Information and Bioengineering

13 of 17

MIMIC-IV: hazard ratios

SURG alone would keep INR>2.0; federation, adding the medical service, relaxes it (the pooled decision). Relaxing all criteria: +77% eligible (7,520 → 13,305). Single-site differences are not significant (small, underpowered SURG; p = 0.18 / 0.36).

POLITECNICO DI MILANO

Department of Electronics, Information and Bioengineering

14 of 17

Implications

Hospitals bound by privacy rules get the same decisions as pooling, without moving any records.

Biggest gain for small sites: alone they are ~2x wider and can flip a decision.

Representativeness & fairness: broadening criteria enlarges and diversifies the trial population.

Only non-identifying aggregates are exchanged → easier to audit and govern across institutions.

POLITECNICO DI MILANO

Department of Electronics, Information and Bioengineering

15 of 17

Limitations

IPTW adjusts only for measured confounders.

Hazard ratios are covariate-adjusted associations, not automatically causal effects.

Aggregates reduce raw-data exposure but are not a formal privacy measure.

Two federated sites and single-criterion relaxations; more sites and joint relaxation are natural extensions.

POLITECNICO DI MILANO

Department of Electronics, Information and Bioengineering

16 of 17

Conclusion

We achieved a federated formulation of Trial Pathfinder's criterion-optimization step.

It recovers correct relaxation decisions on synthetic data with known ground truth.

It also reproduces centralized pooling on a real critical-care cohort while sharpening a small site.

Future work

Implementing and testing more sites Joint multi-criterion relaxation Implement formal privacy

POLITECNICO DI MILANO

Department of Electronics, Information and Bioengineering

17 of 17

Thank you for your time

Eriberto A. Franchi - eribertoandrea.franchi@polimi.it

Politecnico di Milano – DEIB – Nearlab | HC@AIxIA 2026

Acknowledgments:

This work was supported by the Operational Health Plan funds allocated by the Italian Ministry of Health, “CALabria HUB per Ricerca Innovativa ed Avanzata (CAL.HUB.RIA)” project, T4-AN.09.

This work was also partially funded by Fondazione CARIPLO under the project “Data Science for Health" (grant 2024-0173) and supported by the Google Cloud Research Credits program (award number GCP19980904).