A game theoretic approach to balance privacy risks and familial benefits.

As recreational genomics continues to grow in its popularity, many people are afforded the opportunity to share their genomes in exchange for various services, including third-party interpretation (TPI) tools, to understand their predisposition to health problems and, based on genome similarity, to find extended family members. At the same time, these services have increasingly been reused by law enforcement to track down potential criminals through family members who disclose their genomic information. While it has been observed that many potential users shy away from such data sharing when they learn that their privacy cannot be assured, it remains unclear how potential users' valuations of the service will affect a population's behavior. In this paper, we present a game theoretic framework to model interdependent privacy challenges in genomic data sharing online. Through simulations, we find that in addition to the boundary cases when (1) no player and (2) every player joins, there exist pure-strategy Nash equilibria when a relatively small portion of players choose to join the genomic database. The result is consistent under different parametric settings. We further examine the stability of Nash equilibria and illustrate that the only equilibrium that is resistant to a random dropping of players is when all players join the genomic database. Finally, we show that when players consider the impact that their data sharing may have on their relatives, the only pure strategy Nash equilibria are when either no player or every player shares their genomic data.

Matching Soulmates.

We study iterated matching of soulmates [IMS], a recursive process of forming coalitions that are mutually preferred by members to any other coalition containing individuals as yet unmatched by this process. If all players can be matched this way, preferences are IMS-complete. A mechanism is a soulmate mechanism if it allows the formation of all soulmate coalitions. Our model follows Banerjee, Konishi and Sönmez (2001), except reported preferences are strategic variables. We investigate the incentive and stability properties of soulmate mechanisms. In contrast to prior literature, we do not impose conditions that ensure IMS-completeness. A fundamental result is that, (1) any group of players who could change their reported preferences and mutually benefit does not contain any players who were matched as soulmates and reported their preferences truthfully. As corollaries, (2) for any IMS-complete profile, soulmate mechanisms have a truthful strong Nash equilibrium, and (3) as long as all players matched as soulmates report their preferences truthfully, there is no incentive for any to deviate. Moreover, (4) soulmate coalitions are invariant core coalitions - that is, any soulmate coalition will be a coalition in every outcome in the core. To accompany our theoretical results, we present real-world data analysis and simulations that highlight the prevalence of situations in which many, but not all, players can be matched as soulmates. In an Appendix we relate IMS to other well-known coalition formation processes.

Using game theory to thwart multistage privacy intrusions when sharing data.

Person-specific biomedical data are now widely collected, but its sharing raises privacy concerns, specifically about the re-identification of seemingly anonymous records. Formal re-identification risk assessment frameworks can inform decisions about whether and how to share data; current techniques, however, focus on scenarios where the data recipients use only one resource for re-identification purposes. This is a concern because recent attacks show that adversaries can access multiple resources, combining them in a stage-wise manner, to enhance the chance of an attack's success. In this work, we represent a re-identification game using a two-player Stackelberg game of perfect information, which can be applied to assess risk, and suggest an optimal data sharing strategy based on a privacy-utility tradeoff. We report on experiments with large-scale genomic datasets to show that, using game theoretic models accounting for adversarial capabilities to launch multistage attacks, most data can be effectively shared with low re-identification risk.