Post on 19-Jun-2020
Genomic Privacy:Limits of Individual Detection
in a PoolSriram Sankararamana, Guillaume Obozinskib, Michael I.
Jordanc, Eran Halperind
a Harvard Medical Schoolb INRIA
c UC Berkeleyd Tel Aviv University
GWAS: Genomewide Association Studies
0 1 1 0 0 0 1 0 0 1 0 10 1 1 1 0 0 0 0 1 0 1 00 1 1 1 0 0 1 0 0 1 0 01 1 0 0 0 0 1 1 0 0 0 1
Cas
es
SNP
0 1 0 0 0 0 1 0 0 1 1 00 1 0 1 0 0 0 0 1 1 0 00 1 0 1 1 1 1 1 0 0 0 10 1 0 0 1 0 1 1 0 0 0 1
Con
trol
s
GWAS factsLooking for common SNPs
Frequency above 1%
Chosen to be correlated to unobserved causal variants.
Most of these SNPs have low effect sizes.
Testing about million SNPs
Bottomline : Need a large number of samples to have sufficient power.
GWAS so far
600 studies covering around 150 traits (Manolio, 2010)
Power can be increased by combining data from multiple studies.
Tens to hundreds of thousands of participants are common.
Rheumatoid Arthritis (5K cases, 17K controls), Alzheimers’ (7K, 14K), lipid levels and cholesterol (~100K).
Has led to setting up of central data-sharing repositories such as dbGap, EGP archive, WTCCCC.
What about individual privacy ?
Some views on privacy and sharing
5
Give up privacy assurances e.g. PGP
Have streamlined procedures to regulate access to data.
The middle ground ?
Separate individual-level and summary data.
Make summary data public.
DTC and genomic privacy
From the 23andMe website:23andMe may collaborate with external parties. Under this informed consent, external parties will only have access to pooled data stripped of identifying information. 23andMe will never release your individual-level data to any third party without asking for and receiving your explicit authorization to do so.
6
Do these measures guarantee privacy of participants ?
7
Individual Detection in a Pool
8
0 1 1 0 0 0 1 0 0 1 0 10 1 1 1 0 0 0 0 1 0 1 00 1 1 1 0 0 1 0 0 1 0 01 1 0 0 0 0 1 1 0 0 0 1
Cas
esSNP
0.25 1 0.75 0.5 0 ................................ 0.5 0.25 0.5
0 1 0 0 0 0 1 0 0 1 1 00 1 0 1 0 0 0 0 1 1 0 00 1 0 1 1 1 1 1 0 0 0 10 1 0 0 1 0 1 1 0 0 0 1
Con
trol
s
0 1 0 0.5 0.5 ................................ 0.5 0.25 0.5
Individual Detection in a Pool
9
0 1 1 0 0 0 1 0 0 1 0 10 1 1 1 0 0 0 0 1 0 1 00 1 1 1 0 0 1 0 0 1 0 01 1 0 0 0 0 1 1 0 0 0 1
Cas
esSNP
0.25 1 0.75 0.5 0 ................................ 0.5 0.25 0.5
0 1 0 0 0 0 1 0 0 1 1 00 1 0 1 0 0 0 0 1 1 0 00 1 0 1 1 1 1 1 0 1 0 10 1 0 0 1 0 1 1 0 0 0 1
Con
trol
s
0 1 0 0.5 0.5 ................................ 0.5 0.25 0.5
0 1 1 1 0 0 0 0 1 0 1 0 : Is this in the case ?
High-density SNP arrays can be used to resolve DNA mixtures
Homer et al, PLoS Genetics,2008
10
Identification in Pools
11
NIH and others removed summary data.
Identification in Pools
12
NIH and others removed summary data.
Need a mathematical model of privacy.
Forensics vs Privacy
Forensics: Given data, choose a procedure to maximize power.
Privacy: Select data to expose such that the maximum power attained by an adversary is small.
13
Forensics vs Privacy
Forensics: Given data, choose a procedure to maximize power.
Privacy: Select data to expose such that the maximum power attained by an adversary is small. Bounds matter.
14
Limits of Individual Detection
Formulate individual detection in a pool as a hypothesis testing problem.
15
Limits of Individual Detection
Formulate individual detection in a pool as a hypothesis testing problem.
Likelihood-Ratio test (LR-test) is optimal for this hypothesis test (Neyman-Pearson lemma)
16
L(x) =Pr(x|H1)Pr(x|H0)
! t(!)
Pr(L(x) ! t(!)|H0) = !
Limits of Individual Detection
Formulate individual detection in a pool as a hypothesis testing problem.
Likelihood-Ratio test (LR-test) is optimal for this hypothesis test.
The power of the LR-test provides an upper bound on the power of any method.
17
Limits of Individual Detection
xXi
p
p
n! 1
xXi
p
p
n
Null Alternative
L =m!
j=1
"xj log
pj
pj+ (1! xj) log
1! pj
1! pj
#
18
Likelihood-ratio test
L = x log!
p
p
"+ (1! x) log
!1! p
1! p
"
" (x!p)(p!p)p(1! p)
! 12
(x!p)2(p!p)2
p2(1! p)2
" 1#n
x! p#p(1!p)
Z ! 12n
(x!p)2
p(1!p)Z2.
E0[L] = ! 12n
, V0(L) " 1n
E1[L] " +12n
, V1(L) " 1n
What happens for large pools?
a < p < 1! a, a > 0Need SNPs to be common
19
Main Result
20
z! + z1!" !!
m
n
1-! "
µ0 µ1
Null Alternative
z!#0 z1-"#1
Main Result
21
1-! "
µ0 µ1
Null Alternative
z!#0 z1-"#1
log !, " = 10 ! ! mn
-2.0000 1.0916-3.0000 0.5835-4.0000 0.3954-5.0000 0.2980-6.0000 0.2387-7.0000 0.1988-8.0000 0.1703-9.0000 0.1488-10.0000 0.1322
Can we apply the LR-test in practice?
Use a leave-one out procedure on a dataset to obtain empirical power estimates.
Requires an estimate of the population allele frequencies.
Use an independent reference dataset.
22
L =m!
j=1
"xj log
pj
pj+ (1! xj) log
1! pj
1! pj
#
Can we apply the LR-test in practice?
Requires an estimate of the population allele frequencies.
Use an independent reference dataset.
Drop in power.
Use a leave-one out procedure on a dataset to obtain empirical power estimates.
z! + z1!" !!
mn (1" n
n )
23
Analysis and empirical estimates agree for large pools.
−3 −2 −1 00
0.2
0.4
0.6
0.8
1WTCCC
False positive rate (Log base 10)
Pow
er
−3 −2 −1 00
0.2
0.4
0.6
0.8
1Simulated data
False positive rate (Log base 10)
Pow
er
LRLR theoryHomer et al
m=10000 m=10000
m=1000
m=33138
m=1000
24
Why does our optimal test have lower power than Homer et al?
Alternative hypothesis is the same.Tested individual is present in pool.
Nulls differ.Our null: Tested individual is sampled from the population and is not part of the reference dataset.
Null tested in Homer et al: Tested individual is part of the reference dataset.
25
Does this difference in the nulls matter?
Population has 10 individuals of which 5 are in the pool and rest in the reference.
Easy to detect individual in pool or reference.
Population has 1 million individuals of which 5 are in the pool.
Harder to detect in reference.
Even harder if only 5 out of these 1 million are available in a reference dataset.
26
Does this difference in the nulls matter?
Population has 10 individuals of which 5 are in the pool and rest in the reference.
Easy to detect individual in pool or reference.
Population has 1 million individuals of which 5 are in the pool.
Harder to detect in reference.
Even harder if only 5 out of these 1 million are available in a reference dataset.
Null tested in Homer et al. more appropriate for forensics. Our null more appropriate for privacy.
27
The other null is indeed easier to test.
−3 −2.5 −2 −1.5 −1 −0.5 00
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
0.9
1
False positive rate
Pow
er
Homer et alLRLR theory
−3 −2.5 −2 −1.5 −1 −0.5 00
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
0.9
1
False positive rate
Pow
er
Homer et alLRLR theory
28
Our null requires 4 times more independent SNPs to achieve the same power.
Related questions
Dependent SNPs: Slight decrease in power. Haplotype-based test can be more powerful.
Genotyping errors: Reduces power.
Relatives: Requires more SNPs.
Population-independent.
1!2
29
Xi ! X ,X = {0, 1}n
(X1, . . . , Xm)! f(X1, . . . , Xm)
An alternative framework
30
f = f + !
An alternative framework
31
Release noisy version of fMust still be useful for a non-attacker.An attacker cannot used this sanitized f to learn about X.
Differential Privacy
Relates to the LR test.
Given a test with false positive rate
Power at most
32
Pr(f(X) ! S)Pr(f(Y ) ! S)
" exp!
"(X, Y ) = 1
! exp"!
Dwork et al , 2006
Exponential mechanism
33
!(") ! exp(" #"
S(f))
Exponential mechanism
What is f ? Say the mean frequencies of the allele frequencies.
34
!(") ! exp(" #"
S(f))
S(f) = sup{x,y:!(x,y)=1}||f(x)! f(y)||1
Exponential mechanism
What is f ? Say the mean frequencies of the allele frequencies.
What is S(f) ? O (number of SNPs)
Bad news : The standard deviation of noise is proportional to the number of SNPs.
35
!(") ! exp(" #"
S(f))
S(f) = sup{x,y:!(x,y)=1}||f(x)! f(y)||1
Conclusions
A statistical framework to analyze the limits of genotype detection in pools.
Provides guidelines on data sharing to researchers.
The analytical bound is valid for large pools and common SNPs.
Use in conjunction with the empirical test.
36
Future Directions
37
Identity
PhenotypeGenotype