## 4 Secure Federated Statistical Tests  
### [PERSON]'s \(t\)-Test  
For the secure federated \(t\)-test, we focus on a problem setup where a global dataset is split vertically amongst two clients. One of the clients holds the attributes of all samples in the dataset whereas the other client holds the classes that each sample belongs to. This is a practical setting especially in the healthcare industry where one entity has access to a patient's genotype information (attributes), whereas another entity has access to a patient's phenotype information (classes) and these entities collaborate to analyze their combined data, as can be seen from Figure 2. One example of such an analysis is Polygenic Risk Score Validation [21], which refers to the problem of verifying that genetic risk scores developed on external populations (e.g., Caucasian) remain applicable to local populations (e.g., East Asian). A common statistical test employed to do such testing is the \(t\)-test, which is a test that compares the means of two groups.  
Formally, there are two clients. Client 1 has a vector of values \(\mathbf{v}=[v_{1},\ldots,v_{N}]\) such that \(v_{i}\in[0,1]\) and client 2 has a vector of classes \(\mathbf{c}=[c_{1},\ldots,c_{N}]\) s.t. \(c_{i}\in\{0,1\}\). Even though, mathematically, \(v_{i}\)s do not need to be bounded, in the context of healthcare, these values are usually normalized [22], thus making the assumption practical. If \(c_{i}=0\), then \(v_{i}\) belongs to group 1 and if \(c_{i}=1\), then \(v_{i}\) belongs to group 2. The number of users in group 1 and group 2 are represented as \(n_{1}\) and \(n_{2}\) and are assumed to be publicly known. The task  
Figure 2: Federated setting for [PERSON]’s \(t\)-test. Institution A owns the genomic data, and institution B owns the phenotype data, on the same set of patient IDs. They jointly do the federated \(t\)-test without revealing any private data information to each other.  
is to then calculate the t statistic \(t=\frac{\bar{X}_{1}-\bar{X}_{2}}{s_{\Delta}}\) securely where \(s_{\Delta}=\sqrt{\frac{s_{1}^{2}}{n_{1}}+\frac{s_{2}^{2}}{n_{2}}}\) and \(\bar{X}_{i}\) and \(s_{i}\) are the mean and standard error of samples in group \(i\). Additionally, the degree of freedom \(\frac{(\frac{2}{n_{1}}+\frac{s_{2}^{2}}{n_{2}})^{2}}{\frac{(\frac{2}{n_{1}}+ \frac{s_{2}^{2}}{n_{2}-1})^{2}}{n_{1}-1}+\frac{(\frac{2}{n_{2}}/n_{2})^{2}}{n_ {2}-1}}\) is also calculated securely so that significance testing can be done. In order to avoid having to calculate the square root securely, we instead calculate \(t^{2}=\frac{(\bar{X}_{1}-\bar{X}_{2})^{2}}{s_{\Delta}^{2}}\) and leave the square root calculation to be done in cleartext without any additional leakage of information.  
In our method, we leverage the SIMD packing of MHE schemes to pack \(\mathbf{v}\) and \(\mathbf{c}\) into a single ciphertext and calculate the numerators and denominators of the \(t^{2}\) and degree of freedom values. We then use our secure batch division protocol presented in Section 3 to perform the two divisions simultaneously before decrypting and releasing the results.  
Note that since \(v_{i}\in[0,1]\), \(s_{1}^{2},s_{2}^{2}\in[0,1]\), and the denominator of \(t^{2}\) is bounded in the range \([0,\frac{1}{n_{1}}+\frac{1}{n_{2}}]\). Meanwhile, the denominator of the degree of freedom is bounded in the range \([0,\frac{1}{n_{1}^{2}(n_{1}-1)}+\frac{1}{n_{2}^{2}(n_{2}-1)}]\). This information is used in our secure batch division protocol to obtain the initial approximation to the denominator.