Addressing Beacon Re-Identification Attacks: Quantification and Mitigation of Privacy Risks

The Global Alliance for Genomics and Health (GA4GH) created the Beacon Project as a means of testing the willingness of data holders to share genetic data in the simplest technical context query for the presence of a specified nucleotide at a given position within a chromosome. Each participating site (or “beacon”) is responsible for assuring that genomic data are exposed through the Beacon service only with the permission of the individual to whom the data pertains, and in accordance with the GA4GH policy and standards. While recognizing the inference risks associated with large-scale data aggregation, and the fact that some beacons contain sensitive phenotypic associations that increase privacy risk, the GA4GH adjudged the risk of re-identification based on the binary yes/no allele-presence query responses as acceptable. However, recent work demonstrated that, given a beacon with specific characteristics (including relatively small sample size, and an adversary who possesses an individual’s whole genome sequence), the individual’s membership in a beacon can be inferred through repeated queries for variants present in the individual’s genome. In this paper, we propose three practical strategies for reducing re-identification risks in beacons. The first two strategies manipulate the beacon such that the presence of rare alleles is obscured; the third strategy budgets the number of accesses per user for each individual genome. Using a beacon containing data from the 1000 Genomes Project, we demonstrate that the proposed strategies can effectively reduce re-identification risk in beacon-like datasets.

Privacy-Enhancing Technologies for Medical and Genomic Data: From Theory to Practice

Jean Louis Raisaro

The impressive technological advances in genomic analysis and the significant drop in the cost of genome sequencing are paving the way to a variety of revolutionary applications in modern healthcare. In particular, the increasing understanding of the human genome, and of its relation to diseases, health and to responses to treatments brings promise of improvements in better preventive and personalized medicine. Unfortunately, the impact on privacy and security is unprecedented. The genome is our ultimate identifier and, if leaked, it can unveil sensitive and personal information such as our genetic diseases, our propensity to develop certain conditions (e.g., cancer or Alzheimer's) or the health issues of our family. Even though legislation, such as the EU General Data Protection Regulation (GDPR) or the US Health Insurance Portability and Accountability Act (HIPAA), aims at mitigating abuses based on genomic and medical data, it is clear that this information also needs to be protected by technical means. In this thesis, we investigate the problem of developing new and practical privacy-enhancing technologies (PETs) for the protection of medical and genomic data. Our goal is to accelerate the adoption of PETs in the medical field in order to address the privacy and security concerns that prevent personalized medicine from reaching its full potential. We focus on two main areas of personalized medicine: clinical care and medical research. For clinical care, we first propose a system for securely storing and selectively retrieving raw genomic data that is indispensable for in-depth diagnoses and treatments of complex genetic diseases such as cancer. Then, we focus on genetic variants and devise a new model based on additively-homomorphic encryption for privacy-preserving genetic testing in clinics. Our model, implemented in the context of HIV treatment, is the first to be tested and evaluated by practitioners in a real operational setting. For medical research, we first propose a method that combines somewhat-homomorphic encryption with differential privacy to enable secure feasibility studies on genetic data stored at an untrusted central repository. Second, we address the problem of sharing genomic and medical data when the data is distributed across multiple mistrustful institutions. We begin by analyzing the risks that threaten patientsâ privacy in systems for the discovery of genetic variants, and we propose practical mitigations to the re-identification risk. Then, for clinical sites to be able to share the data without worrying about the risk of data breaches, we develop a new system based on collective homomorphic encryption: it achieves trust decentralization and enables researchers to securely find eligible patients for clinical studies. Finally, we design a new framework, complementary to the previous ones, for quantifying the risk of unintended disclosure caused by potential inference attacks that are jointly combined by a malicious adversary, when exact genomic data is shared. In summary, in this thesis we demonstrate that PETs, still believed unpractical and immature, can be made practical and can become real enablers for overcoming the privacy and security concerns blocking the advancement of personalized medicine. Addressing privacy issues in healthcare remains a great challenge that will increasingly require long-term collaboration among geneticists, healthcare providers, ethicists, lawmakers, and computer scientists.

EPFL2018

Computational analysis of ultraconserved non-coding DNA elements in vertebrate genomes

Slavica Dimitrieva Janeva

Recent advancements in DNA sequencing technologies, accompanied by parallel development of sophisticated computational methods, offer an unprecedented opportunity to explore and study the genetic material of many organisms. However, despite the tremendous progress in the field of genomics, our understanding of the genetic information encoded by the DNA is far from complete. Whole-genome comparisons of vertebrate species have uncovered the existence of non-coding DNA sequences that exhibit exceptionally high levels of similarity over hundreds of base pairs across distant species, referred to as ultraconserved non-coding elements (UCNEs). The existence of such sequences represents one of the biggest mysteries in current biology. Many UCNEs exhibit even stronger conservation than protein coding regions, but to date no molecular mechanism has been described that would require such a high degree of conservation over such long sequences. This thesis focuses on computational analysis of UCNEs across vertebrate genomes, with an ultimate goal to provide insights into the functioning of these elements and to unravel the reasons for their extreme conservation. Using computational approaches we studied the salient characteristics of UCNEs, and explored their genomic environment and their organization across genomes. Like previous studies, we observed that UCNEs are organized as large clusters around essential developmental genes, forming genomic regulatory blocks. Then we sought to understand the reasons behind this strong clustering of UCNEs. The clustering could reflect functional cooperativity between UCNEs. Alternatively, if each UCNE acts independently, their high concentration near developmental genes could merely reflect the extreme regulatory complexity of these genes. In a special setting of genomic context analysis, we analyzed the fate of UCNEs in teleost fish genomes that were subjected to an additional round of whole-genome duplication. We found that in most cases all UCNEs of a block were retained in one copy only, but together on the same chromosome. Conversely, the corresponding target genes were often retained in two copies, one completely devoid of UCNEs. Our results suggested that UCNEs of a cluster function in a highly cooperative manner. We propose that a multitude of cooperative cis-interactions between UCNEs is the reason for their extreme sequence conservation. Our work presents a novel hypothesis about the reasons for UCNE conservation and their mode of action, which is yet to be confirmed experimentally. The results from our study are made accessible through a new web resource called UCNEbase (http://ccg.vital-it.ch/UCNEbase). UCNEbase provides informa- tion about the genomic organization of UCNEs and their association with developmental regulatory genes, and enables all data to be explored in a genome browser environment. As part of a side project, we developed a new sparsified version of algorithms for computational prediction of RNA secondary structures and introduced a new program sibRNAfold. We performed a thorough analysis of the time complexity of sparsified RNA folding algorithms covering a large parameter space and empirically demonstrated that sparse RNA folding has cubic time complexity rather than quadratic, as claimed previously.

EPFL2013

Patient Privacy in the Genomic Era

Erman Ayday, Jean-Pierre Hubaux, Jean Louis Raisaro

According to many scientists and clinicians, genomics is taking on a key role in the field of medicine. Impressive advances in genome sequencing have opened the way to a variety of revolutionary applications in modern healthcare. In particular, the increasing understanding of the human genome, and of its relation to diseases and response to treatments brings promise of improvements in better preventive and personalized medicine. However, this progress raises important privacy and ethical concerns that need to be addressed. Indeed, each genome is the ultimate identifier of its owner and, due to its nature, it contains highly personal and privacy-sensitive data. In this article, after summarizing recent advances in genomics, we discuss some important privacy issues associated with human genomic information and methods put in place to address them.