Addressing Beacon re-identification attacks: quantification and mitigation of privacy risks.
The Global Alliance for Genomics and Health (GA4GH) created the Beacon Project as a means of testing the willingness of data holders to share genetic data in the simplest technical context-a query for the presence of a specified nucleotide at a given position within a chromosome. Each participating site (or "beacon") is responsible for assuring that genomic data are exposed through the Beacon service only with the permission of the individual to whom the data pertains and in accordance with the GA4GH policy and standards.While recognizing the inference risks associated with large-scale data aggregation, and the fact that some beacons contain sensitive phenotypic associations that increase privacy risk, the GA4GH adjudged the risk of re-identification based on the binary yes/no allele-presence query responses as acceptable. However, recent work demonstrated that, given a beacon with specific characteristics (including relatively small sample size and an adversary who possesses an individual's whole genome sequence), the individual's membership in a beacon can be inferred through repeated queries for variants present in the individual's genome.In this paper, we propose three practical strategies for reducing re-identification risks in beacons. The first two strategies manipulate the beacon such that the presence of rare alleles is obscured; the third strategy budgets the number of accesses per user for each individual genome. Using a beacon containing data from the 1000 Genomes Project, we demonstrate that the proposed strategies can effectively reduce re-identification risk in beacon-like datasets.
School of Computer and Communication Sciences, École Polytechnique Fédérale de Lausanne, Lausanne, Switzerland.
Jean Louis
JL
Raisaro
School of Computer and Communication Sciences, École Polytechnique Fédérale de Lausanne, Lausanne, Switzerland.
Florian
F
Tramèr
Health Science Department of Biomedical Informatics, University of California San Diego, San Diego, CA, USA.
Zhanglong
Z
Ji
School of Informatics and Computing, Indiana University Bloomington, Bloomington, IN, USA.
Diyue
D
Bu
School of Informatics and Computing, Indiana University Bloomington, Bloomington, IN, USA.
Yongan
Y
Zhao
GeneCloud, Intertrust, CA, USA.
Knox
K
Carey
European Molecular Biology Laboratory, European Bioinformatics Institute, Wellcome Trust Genome Campus, Hinxton, Cambridge, CB10 1SD, UK.|Wellcome Trust Sanger Institute, Hinxton, Cambridge, CB10 1SA, UK.
David
D
Lloyd
Division of Genomic Medicine, National Institutes of Health, Bethesda, MD, USA.
Heidi
H
Sofia
Martin, Blanck and Associates, Alexandria, VA, USA.
Dixie
D
Baker
European Molecular Biology Laboratory, European Bioinformatics Institute, Wellcome Trust Genome Campus, Hinxton, Cambridge, CB10 1SD, UK.
Paul
P
Flicek
Department of Genetics, Stanford University, Stanford, CA, USA.
Suyash
S
Shringarpure
Department of Genetics, Stanford University, Stanford, CA, USA.
Carlos
C
Bustamante
Health Science Department of Biomedical Informatics, University of California San Diego, San Diego, CA, USA.
Shuang
S
Wang
Health Science Department of Biomedical Informatics, University of California San Diego, San Diego, CA, USA.
Xiaoqian
X
Jiang
Health Science Department of Biomedical Informatics, University of California San Diego, San Diego, CA, USA.
Lucila
L
Ohno-Machado
School of Informatics and Computing, Indiana University Bloomington, Bloomington, IN, USA.
Haixu
H
Tang
School of Informatics and Computing, Indiana University Bloomington, Bloomington, IN, USA.
XiaoFeng
X
Wang
School of Computer and Communication Sciences, École Polytechnique Fédérale de Lausanne, Lausanne, Switzerland.
Jean-Pierre
JP
Hubaux
D000068240:Data Anonymization; D030661:Genetic Privacy; D023281:Genomics; D006801:Humans; D033181:Information Dissemination
beacon; ga4gh; genomic data sharing; genomic privacy; re-identification