To Release or Not to Release: Evaluating Information Leaks in Aggregate Human-Genome Data

Zhou, Xiaoyong; Peng, Bo; Li, Yong Fuga; Chen, Yangyi; Tang, Haixu; Wang, Xiaofeng

doi:10.1007/978-3-642-23822-2_33

Cited by 57 publications

(73 citation statements)

References 40 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Like the attacks in previous tracing work for the genomic setting [1], [2], [28]- [30] and in the fingerprinting setting [17], [20], our attack uses a simple scoring function to make its decision. The scoring function works incrementally, with each marginal (SNP) making a separate contribution.…”

Section: Description Of the Attackmentioning

confidence: 99%

Robust Traceability from Trace Amounts

Dwork

Smith

Steinke

et al. 2015

2015 IEEE 56th Annual Symposium on Foundations of Computer Science

106

View full text Add to dashboard Cite

The privacy risks inherent in the release of a large number of summary statistics were illustrated by Homer et al. (PLoS Genetics, 2008), who considered the case of 1-way marginals of SNP allele frequencies obtained in a genome-wide association study: Given a large number of minor allele frequencies from a case group of individuals diagnosed with a particular disease, together with the genomic data of a single target individual and statistics from a sizable reference dataset independently drawn from the same population, an attacker can determine with high confidence whether or not the target is in the case group.In this work we describe and analyze a simple attack that succeeds even if the summary statistics are significantly distorted, whether due to measurement error or noise intentionally introduced to protect privacy. Our attack only requires that the vector of distorted summary statistics is close to the vector of true marginals in 1 norm. Moreover, the reference pool required by previous attacks can be replaced by a single sample drawn from the underlying population.The new attack, which is not specific to genomics and which handles Gaussian as well as Bernouilli data, significantly generalizes recent lower bounds on the noise needed to ensure differential privacy (Bun, Ullman, and Vadhan, STOC 2014; Steinke and Ullman, 2015), obviating the need for the attacker to control the exact distribution of the data.

show abstract

Section: Description Of the Attackmentioning

confidence: 99%

Robust Traceability from Trace Amounts

Dwork

Smith

Steinke

et al. 2015

2015 IEEE 56th Annual Symposium on Foundations of Computer Science

106

View full text Add to dashboard Cite

show abstract

“…Homer et al [30] prove that de-identification is an ineffective way to protect the privacy of genomic data, which is also supported by other works [27,50,52]. Most recently, Gymrek et al [29] show how they identified DNAs of several individuals who participated in scientific studies.…”

Section: Related Workmentioning

confidence: 79%

Addressing the concerns of the lacks family

Humbert

Ayday

Hubaux

et al. 2013

Proceedings of the 2013 ACM SIGSAC Conference on Computer &Amp; Communications Security - CCS '13

103

View full text Add to dashboard Cite

The rapid progress in human-genome sequencing is leading to a high availability of genomic data. This data is notoriously very sensitive and stable in time. It is also highly correlated among relatives. A growing number of genomes are becoming accessible online (e.g., because of leakage, or after their posting on genome-sharing websites). What are then the implications for kin genomic privacy? We formalize the problem and detail an efficient reconstruction attack based on graphical models and belief propagation. With this approach, an attacker can infer the genomes of the relatives of an individual whose genome is observed, relying notably on Mendel's Laws and statistical relationships between the nucleotides (on the DNA sequence). Then, to quantify the level of genomic privacy as a result of the proposed inference attack, we discuss possible definitions of genomic privacy metrics. Genomic data reveals Mendelian diseases and the likelihood of developing degenerative diseases such as Alzheimer's. We also introduce the quantification of health privacy, specifically the measure of how well the predisposition to a disease is concealed from an attacker. We evaluate our approach on actual genomic data from a pedigree and show the threat extent by combining data gathered from a genome-sharing website and from an online social network.

show abstract

“…Thus, releasing (aggregate) genomic data is currently banned by many institutions due to this privacy risk. In [40], Zhou et al study the privacy risks of releasing aggregate genomic data. They propose a riskscale system for classifying aggregate data and a guide for the release of such data.…”

Section: Related Workmentioning

confidence: 99%

De-anonymizing Genomic Databases Using Phenotypic Traits

Humbert

Huguenin

Hugonot

et al. 2015

Proceedings on Privacy Enhancing Technologies

View full text Add to dashboard Cite

People increasingly have their genomes sequenced and some of them share their genomic data online. They do so for various purposes, including to find relatives and to help advance genomic research. An individual's genome carries very sensitive, private information such as its owner's susceptibility to diseases, which could be used for discrimination. Therefore, genomic databases are often anonymized. However, an individual's genotype is also linked to visible phenotypic traits, such as eye or hair color, which can be used to re-identify users in anonymized public genomic databases, thus raising severe privacy issues. For instance, an adversary can identify a target's genome using known her phenotypic traits and subsequently infer her susceptibility to Alzheimer's disease. In this paper, we quantify, based on various phenotypic traits, the extent of this threat in several scenarios by implementing de-anonymization attacks on a genomic database of OpenSNP users sequenced by 23andMe. Our experimental results show that the proportion of correct matches reaches 23% with a supervised approach in a database of 50 participants. Our approach outperforms the baseline by a factor of four, in terms of the proportion of correct matches, in most scenarios. We also evaluate the adversary's ability to predict individuals' predisposition to Alzheimer's disease, and we observe that the inference error can be halved compared to the baseline. We also analyze the effect of the number of known phenotypic traits on the success rate of the attack. As progress is made in genomic research, especially for genotype-phenotype associations, the threat presented in this paper will become more serious.

show abstract

To Release or Not to Release: Evaluating Information Leaks in Aggregate Human-Genome Data

Cited by 57 publications

References 40 publications

Robust Traceability from Trace Amounts

Robust Traceability from Trace Amounts

Addressing the concerns of the lacks family

De-anonymizing Genomic Databases Using Phenotypic Traits

Contact Info

Product

Resources

About