Privacy Challenges of Genomic Data-Sharing Beacons and Solutions

抽象的。非常大的基因组数据集的可用性预示着医学的革命。但 已经表明，要确保这些数据集中参与者的匿名性并不简单。 以保护隐私的方式共享数据是医学进步的主要瓶颈。 最近，社区驱动的协议已被广泛采用，用于共享基因组数据。所谓 “基因组数据共享信标协议”旨在提供一个安全，易于实现， 数据共享的标准化接口，只允许对特定的 数据集中的等位基因。以前被认为是强大的隐私威胁，信标协议最近 尽管其严格的策略，但仍然容易受到成员推断攻击。目前， 没有办法系统地评估信标的隐私风险，无论是基因组捐赠者还是 信标操作员。从双方的角度来看，这对信标的可用性产生了怀疑。设置 由于可能的破坏的影响，信标的建立对于信标操作者来说是有风险的。 此外，对于缺乏技术背景无法理解风险的捐助者来说， 选择退出因此，全面了解该系统的缺陷并向基因组捐赠者介绍 和信标操作员对潜在威胁的认识是向前迈进必须克服的重要问题。在 该建议的目的是（i）检测和分析基因组数据共享的漏洞 信标，㈡为捐助者和数据所有者提供风险量化工具， 缔约方对可能的风险，和（三）制定对策，对这些漏洞。我们 就信标系统可能存在的脆弱性和潜在的 对策我们将首次调查信标更新导致的信息泄露， 其将指导信标管理员何时以及如何更新信标的内容。作为第二 为了实现这一目标，我们将设计风险量化算法来评估风险， 捐助者和信标运营商分享数据的可能风险。这将是第一次尝试帮助 信标操作员和参与者作出知情的决定。我们预计，如果这个项目得以实现， 信标系统在隐私风险方面将是透明的，这将恢复 提高系统的可用性。这反过来又会摧毁阻碍和平的边界。 共享基因组数据，使所有下游研究都能从更大的数据量中受益。我们 最终目标是重点研究保护敏感信息的对策。我们观察到 这些方法不能同时保护个人的隐私并提供高的数据效用。我们 将实施新的差分隐私和基于博弈论的技术，以确保隐私- 保持数据共享，数据利用率高。

Abstract. Availability of very large genomic datasets promises a revolution in medicine. However, it has been shown that it is not straightforward to ensure anonymity of the participants in such datasets. Sharing data in a privacy-preserving way stands as a major bottleneck in front of the medical progress. Recently, a community-driven protocol has been widely adopted for sharing genomic data. So called “genomic data-sharing beacon protocol” aims to provide a secure, easy to implement, and standardized interface for data sharing by only allowing yes/no queries on the presence of specific alleles in the dataset. Previously deemed robust against privacy threats, beacon protocol was recently shown to be vulnerable against membership inference attacks despite its stringent policy. Currently, there is no way to systematically assess beacons' privacy risks for neither the genome donors nor the beacon operators. This cast doubts on usability of beacons from both parties' point of views. Setting up a beacon is risky for beacon operators because of repercussions of possible breaches. Furthermore, for the donors who lack technical background to comprehend the risk, it is often safer to opt-out. Thus, a comprehensive understanding of the system's pitfalls and briefing the genome donors and the beacon operators on potential threats are important issues to overcome to move forward. In this proposal, we aim at (i) detecting and analyzing vulnerabilities of the genomic data-sharing beacons, (ii) providing risk quantification tools for both the donors and data owners to inform both parties on possible risks, and (iii) generating countermeasures against these vulnerabilities. We provide extensive preliminary work on possible vulnerabilities of the beacon system and potential countermeasures. For the first time, we will investigate the information leakage due to beacon updates, which will guide beacon admins on when and how to update the content of the beacon. As the second goal, we will design risk quantification algorithms to assess the risk and inform both the genome donors and beacon operators on possible risks of sharing data. This will be the first attempt at helping beacon operators and participants make informed decisions. We project that if this project is realized, beacon system will be transparent in terms of privacy risks, which will reinstate the trustworthiness of the system and increase its usability. This in turn will tear down the borders that stand in the way of sharing genomic data and enable all downstream research that will benefit from larger data sizes. Our final goal is to focus on countermeasures to protect sensitive information. We observe that current approaches fail to protect the privacy of individuals and provide high data utility at the same time. We will implement novel differential privacy and game theory-based techniques to ensure privacy- preserving data sharing with high data utility.