Sociotechnical safeguards for genomic data privacy.

Recent developments in a variety of sectors, including health care, research and the direct-to-consumer industry, have led to a dramatic increase in the amount of genomic data that are collected, used and shared. This state of affairs raises new and challenging concerns for personal privacy, both legally and technically. This Review appraises existing and emerging threats to genomic data privacy and discusses how well current legal frameworks and technical safeguards mitigate these concerns. It concludes with a discussion of remaining and emerging challenges and illustrates possible solutions that can balance protecting privacy and realizing the benefits that result from the sharing of genetic information.

Robust Transparency Against Model Inversion Attacks.

Transparency has become a critical need in machine learning (ML) applications. Designing transparent ML models helps increase trust, ensure accountability, and scrutinize fairness. Some organizations may opt-out of transparency to protect individuals' privacy. Therefore, there is a great demand for transparency models that consider both privacy and security risks. Such transparency models can motivate organizations to improve their credibility by making the ML-based decision-making process comprehensible to end-users. Differential privacy (DP) provides an important technique to disclose information while protecting individual privacy. However, it has been shown that DP alone cannot prevent certain types of privacy attacks against disclosed ML models. DP with low ϵ values can provide high privacy guarantees, but may result in significantly weaker ML models in terms of accuracy. On the other hand, setting ϵ value too high may lead to successful privacy attacks. This raises the question whether we can disclose accurate transparent ML models while preserving privacy. In this paper we introduce a novel technique that complements DP to ensure model transparency and accuracy while being robust against model inversion attacks. We show that combining the proposed technique with DP provide highly transparent and accurate ML models while preserving privacy against model inversion attacks.

Expanding Access to Large-Scale Genomic Data While Promoting Privacy: A Game Theoretic Approach.

Emerging scientific endeavors are creating big data repositories of data from millions of individuals. Sharing data in a privacy-respecting manner could lead to important discoveries, but high-profile demonstrations show that links between de-identified genomic data and named persons can sometimes be reestablished. Such re-identification attacks have focused on worst-case scenarios and spurred the adoption of data-sharing practices that unnecessarily impede research. To mitigate concerns, organizations have traditionally relied upon legal deterrents, like data use agreements, and are considering suppressing or adding noise to genomic variants. In this report, we use a game theoretic lens to develop more effective, quantifiable protections for genomic data sharing. This is a fundamentally different approach because it accounts for adversarial behavior and capabilities and tailors protections to anticipated recipients with reasonable resources, not adversaries with unlimited means. We demonstrate this approach via a new public resource with genomic summary data from over 8,000 individuals-the Sequence and Phenotype Integration Exchange (SPHINX)-and show that risks can be balanced against utility more effectively than with traditional approaches. We further show the generalizability of this framework by applying it to other genomic data collection and sharing endeavors. Recognizing that such models are dependent on a variety of parameters, we perform extensive sensitivity analyses to show that our findings are robust to their fluctuations.

SecureMA: protecting participant privacy in genetic association meta-analysis.

MOTIVATION: Sharing genomic data is crucial to support scientific investigation such as genome-wide association studies. However, recent investigations suggest the privacy of the individual participants in these studies can be compromised, leading to serious concerns and consequences, such as overly restricted access to data. RESULTS: We introduce a novel cryptographic strategy to securely perform meta-analysis for genetic association studies in large consortia. Our methodology is useful for supporting joint studies among disparate data sites, where privacy or confidentiality is of concern. We validate our method using three multisite association studies. Our research shows that genetic associations can be analyzed efficiently and accurately across substudy sites, without leaking information on individual participants and site-level association summaries. AVAILABILITY AND IMPLEMENTATION: Our software for secure meta-analysis of genetic association studies, SecureMA, is publicly available at http://github.com/XieConnect/SecureMA. Our customized secure computation framework is also publicly available at http://github.com/XieConnect/CircuitService.

A privacy preserving protocol for tracking participants in phase I clinical trials.

OBJECTIVE: Some phase 1 clinical trials offer strong financial incentives for healthy individuals to participate in their studies. There is evidence that some individuals enroll in multiple trials concurrently. This creates safety risks and introduces data quality problems into the trials. Our objective was to construct a privacy preserving protocol to track phase 1 participants to detect concurrent enrollment. DESIGN: A protocol using secure probabilistic querying against a database of trial participants that allows for screening during telephone interviews and on-site enrollment was developed. The match variables consisted of demographic information. MEASUREMENT: The accuracy (sensitivity, precision, and negative predictive value) of the matching and its computational performance in seconds were measured under simulated environments. Accuracy was also compared to non-secure matching methods. RESULTS: The protocol performance scales linearly with the database size. At the largest database size of 20,000 participants, a query takes under 20s on a 64 cores machine. Sensitivity, precision, and negative predictive value of the queries were consistently at or above 0.9, and were very similar to non-secure versions of the protocol. CONCLUSION: The protocol provides a reasonable solution to the concurrent enrollment problems in phase 1 clinical trials, and is able to ensure that personal information about participants is kept secure.

Composite Bloom Filters for Secure Record Linkage.

The process of record linkage seeks to integrate instances that correspond to the same entity. Record linkage has traditionally been performed through the comparison of identifying field values (e.g., Surname), however, when databases are maintained by disparate organizations, the disclosure of such information can breach the privacy of the corresponding individuals. Various private record linkage (PRL) methods have been developed to obscure such identifiers, but they vary widely in their ability to balance competing goals of accuracy, efficiency and security. The tokenization and hashing of field values into Bloom filters (BF) enables greater linkage accuracy and efficiency than other PRL methods, but the encodings may be compromised through frequency-based cryptanalysis. Our objective is to adapt a BF encoding technique to mitigate such attacks with minimal sacrifices in accuracy and efficiency. To accomplish these goals, we introduce a statistically-informed method to generate BF encodings that integrate bits from multiple fields, the frequencies of which are provably associated with a minimum number of fields. Our method enables a user-specified tradeoff between security and accuracy. We compare our encoding method with other techniques using a public dataset of voter registration records and demonstrate that the increases in security come with only minor losses to accuracy.

A game theoretic approach to balance privacy risks and familial benefits.

As recreational genomics continues to grow in its popularity, many people are afforded the opportunity to share their genomes in exchange for various services, including third-party interpretation (TPI) tools, to understand their predisposition to health problems and, based on genome similarity, to find extended family members. At the same time, these services have increasingly been reused by law enforcement to track down potential criminals through family members who disclose their genomic information. While it has been observed that many potential users shy away from such data sharing when they learn that their privacy cannot be assured, it remains unclear how potential users' valuations of the service will affect a population's behavior. In this paper, we present a game theoretic framework to model interdependent privacy challenges in genomic data sharing online. Through simulations, we find that in addition to the boundary cases when (1) no player and (2) every player joins, there exist pure-strategy Nash equilibria when a relatively small portion of players choose to join the genomic database. The result is consistent under different parametric settings. We further examine the stability of Nash equilibria and illustrate that the only equilibrium that is resistant to a random dropping of players is when all players join the genomic database. Finally, we show that when players consider the impact that their data sharing may have on their relatives, the only pure strategy Nash equilibria are when either no player or every player shares their genomic data.

Coffee-Derived Exosome-Like Nanoparticles: Are They the Secret Heroes?

BACKGROUND: Regular coffee consumption has beneficial and preventative effects on liver and chronic neurodegenerative diseases. However, the studies performed with the ingredients found in coffee beverages have not clarified the responsible mechanisms. Exosomes are small, membrane-coated cargo packages secreted by prokaryote and eukaryote cells. Exosomes regulate intercellular communication and affect cellular metabolic activities even among different species. In this study, we aimed to isolate and characterize the edible plant-derived exosome-like nanoparticles from roasted hot coffee beverages, hypothesizing that the edible plant-derived exosome-like nanoparticles were responsible for the beneficial effects of coffee. METHODS: Size exclusion chromatography and commercial kits were used for the isolation process. Efficient coffee edible plant-derived exosome-like nanoparticle fractions were determined by an ultraviolet-visible spectrophotometer. Harvested coffee edible plant-derived exosome-like nanoparticles were characterized by transmission electron microscopy. The quantification procedure was performed using a commercial kit. Coffee edible plant-derived exosome-like nanoparticles' proliferative effects on human hepatic stellate cells and human hepatocellular carcinoma cells were studied using an MTT (3-(4,5-Dimethylthiazol-2-yl)-2,5-Diphenyltetrazolium Bromide) assay. Whole-exosome RNA sequencing was performed. RESULTS: Transmission electron microscopy scanning analysis indicated round-shaped nanoparticles with sizes ranging from 40 to 100 nm. Both size exclusion chromatography and kit-isolated edible plant-derived exosome-like nanoparticle samples showed maximum absorbance at 227.5 nm in ultraviolet-visible spectrophotometer analysis. Regarding the quantitation results, kit isolation was more efficient than the size exclusion chromatography method when the harvested particle numbers were compared. An important MTT assay finding confirmed the observed beneficial effects of coffee beverages: coffee edible plant-derived exosome-like nanoparticles significantly suppressed hepatocellular carcinoma cell proliferation. As a result of sequencing, we identified 15 mature miRNAs. A MapReduce-based MicroRNA Target Prediction Method (The DIANA tools' MR-microT algorithm) highlighted 2 genes specifically associated with the miRNAs that we obtained: KMT2C and ZNF773. CONCLUSION: For the first time in the literature, coffee edible plant-derived exosome-like nanoparticles were identified. These nanoparticles may have therapeutic effects on chronic liver diseases. Experimental studies, therefore, should be performed on disease models to demonstrate their efficacy.

Low efficacy of clarithromycin including sequential regimens for Helicobacter pylori infection.

BACKGROUND: Sequential treatment for Helicobacter pylori (H. pylori) appears to achieve a better eradication rate than triple therapy. However, most of the data have been reported from the Italy, and studies from different population are needed before it is recommended in clinical practice. The present study aimed to assess and compare the efficacy of two separate clarithromycin including sequential regimens in Turkey which is well known with high clarithromycin and metronidazole resistance to H. pylori. METHODS: Consecutive H. pylori -positive patients with non-ulcer dyspepsia were randomly allocated to one of the two sequential regimens; the first group was given lansoprazole 30 mg b.i.d. plus amoxicillin 1 g b.i.d. for the first week, followed by lansoprazole 30 mg b.i.d., clarithromycin 500 mg b.i.d., and metronidazole 500 mg t.i.d. for the second week (LA-CM). The second arm was given the same regimen but tetracycline500 g q.i.d. instead of metronidazole (LA-CT). H. pylori was detected with urea breath test (UBT) and histology before enrollment. UBT was repeated at 6th weeks after treatment. RESULTS: A total of 200 patients were enrolled in groups and 179 of them completed their protocols. The cumulative per protocol ("PP") and intention-to-treat ("ITT") eradication rates were 74.3% and 66.5% in all patients, respectively. Both "PP" (78.2% vs 70.1%) and "ITT" (72% vs 61%) eradication rates were better in LA-CT group than LA-CM group, but the differences were not statistically significant (p > .05). Both regimens were well tolerated, and the incidence of adverse effects was comparable. CONCLUSION: Two weeks clarithromycin including sequential regimens with metronidazole or tetracycline were not achieved acceptable eradication rates in Turkey.

Plasma ghrelin levels in patients with familial Mediterranean fever.

BACKGROUND: Familial Mediterranean fever (FMF) is an auto-inflammatory disorder characterized by febrile attacks. Increased acute-phase reactants are characteristic during febrile attacks. Ghrelin is a natural G-protein that decreases secretion of pro-inflammatory cytokines and acts as anti-inflammatory agent. The aim of this study was to investigate whether there is any change in ghrelin levels and whether increases in ghrelin levels can be used as a marker in these patients. SUBJECTS AND METHODS: Thirty-seven male patients and 30 healthy men as a control group were included in the study. Blood samples were obtained for ghrelin measurements both before the attacks (pre-attack period; ghrelin 1 group) and during the attacks (ghrelin 2 group). Samples were kept at -80°C until the analysis was conducted and plasma ghrelin levels were measured using an immune-sorbent assay method. RESULTS: Mean ghrelin levels measured during the attacks were significantly higher (11.01 ± 4.78 pg/ml) as compared to pre-attack levels (5.78 ± 2.17 pg/ml; p < 0.001). Similarly, mean ghrelin levels measured in FMF patients during an attack were significantly different from that of the control group (6.57 ± 4.13 pg/ml; p < 0.001). CONCLUSIONS: In this study, high ghrelin levels were measured during attacks in FMF patients. This finding is in line with previous results regarding the fact that inflammatory response arising during an FMF attack is an acute inflammatory event. Our findings suggest that ghrelin levels measured during FMF attacks could be used as a biochemical indicator for the FMF attack in FMF patients and that it could be used for support of the diagnosis of the disease.

Quantifying the Correctness, Computational Complexity, and Security of Privacy-Preserving String Comparators for Record Linkage.

Record linkage is the task of identifying records from disparate data sources that refer to the same entity. It is an integral component of data processing in distributed settings, where the integration of information from multiple sources can prevent duplication and enrich overall data quality, thus enabling more detailed and correct analysis. Privacy-preserving record linkage (PPRL) is a variant of the task in which data owners wish to perform linkage without revealing identifiers associated with the records. This task is desirable in various domains, including healthcare, where it may not be possible to reveal patient identity due to confidentiality requirements, and in business, where it could be disadvantageous to divulge customers' identities. To perform PPRL, it is necessary to apply string comparators that function in the privacy-preserving space. A number of privacy-preserving string comparators (PPSCs) have been proposed, but little research has compared them in the context of a real record linkage application. This paper performs a principled and comprehensive evaluation of six PPSCs in terms of three key properties: 1) correctness of record linkage predictions, 2) computational complexity, and 3) security. We utilize a real publicly-available dataset, derived from the North Carolina voter registration database, to evaluate the tradeoffs between the aforementioned properties. Among our results, we find that PPSCs that partition, encode, and compare strings yield highly accurate record linkage results. However, as a tradeoff, we observe that such PPSCs are less secure than those that map and compare strings in a reduced dimensional space.

Blockchain networks: Data structures of Bitcoin, Monero, Zcash, Ethereum, Ripple, and Iota.

Blockchain is an emerging technology that has enabled many applications, from cryptocurrencies to digital asset management and supply chains. Due to this surge of popularity, analyzing the data stored on blockchains poses a new critical challenge in data science. To assist data scientists in various analytic tasks for a blockchain, in this tutorial, we provide a systematic and comprehensive overview of the fundamental elements of blockchain network models. We discuss how we can abstract blockchain data as various types of networks and further use such associated network abstractions to reap important insights on blockchains' structure, organization, and functionality. This article is categorized under:Technologies > Data PreprocessingApplication Areas > Business and IndustryFundamental Concepts of Data and Knowledge > Data ConceptsFundamental Concepts of Data and Knowledge > Knowledge Representation.

A Representativeness-informed Model for Research Record Selection from Electronic Medical Record Systems.

Scientific and clinical studies have a long history of bias in recruitment of underprivileged and minority populations. This underrepresentation leads to inaccurate, inapplicable, and non-generalizable results. Electronic medical record (EMR) systems, which now drive much research, often poorly represent these groups. We introduce a method for quantifying representativeness using information theoretic measures and an algorithmic approach to select a more representative record cohort than random selection when resource limitations preclude researchers from reviewing every record in the database. We apply this method to select cohorts of 2,000-20,000 records from a large (2M+ records) EMR database at the Vanderbilt University Medical Center and assess representativeness based on age, ethnicity, race, and gender. Compared to random selection - which will on average mirror the EMR database demographics - we find that a representativeness-informed approach can compose a cohort of records that is approximately 5.8 times more representative.

Supporting COVID-19 Disparity Investigations with Dynamically Adjusting Case Reporting Policies.

Data access limitations have stifled COVID-19 disparity investigations in the United States. Though federal and state legislation permits publicly disseminating de-identified data, methods for de-identification, including a recently proposed dynamic policy approach to pandemic data sharing, remain unproved in their ability to support pandemic disparity studies. Thus, in this paper, we evaluate how such an approach enables timely, accurate, and fair disparity detection, with respect to potential adversaries with varying prior knowledge about the population. We show that, when considering reasonably enabled adversaries, dynamic policies support up to three times earlier disparity detection in partially synthetic data than data sharing policies derived from two current, public datasets. Using real-world COVID-19 data, we also show how granular date information, which dynamic policies were designed to share, improves disparity characterization. Our results highlight the potential of the dynamic policy approach to publish data that supports disparity investigations in current and future pandemics.

Dynamically adjusting case reporting policy to maximize privacy and public health utility in the face of a pandemic.

OBJECTIVE: Supporting public health research and the public's situational awareness during a pandemic requires continuous dissemination of infectious disease surveillance data. Legislation, such as the Health Insurance Portability and Accountability Act of 1996 and recent state-level regulations, permits sharing deidentified person-level data; however, current deidentification approaches are limited. Namely, they are inefficient, relying on retrospective disclosure risk assessments, and do not flex with changes in infection rates or population demographics over time. In this paper, we introduce a framework to dynamically adapt deidentification for near-real time sharing of person-level surveillance data. MATERIALS AND METHODS: The framework leverages a simulation mechanism, capable of application at any geographic level, to forecast the reidentification risk of sharing the data under a wide range of generalization policies. The estimates inform weekly, prospective policy selection to maintain the proportion of records corresponding to a group size less than 11 (PK11) at or below 0.1. Fixing the policy at the start of each week facilitates timely dataset updates and supports sharing granular date information. We use August 2020 through October 2021 case data from Johns Hopkins University and the Centers for Disease Control and Prevention to demonstrate the framework's effectiveness in maintaining the PK11 threshold of 0.01. RESULTS: When sharing COVID-19 county-level case data across all US counties, the framework's approach meets the threshold for 96.2% of daily data releases, while a policy based on current deidentification techniques meets the threshold for 32.3%. CONCLUSION: Periodically adapting the data publication policies preserves privacy while enhancing public health utility through timely updates and sharing epidemiologically critical features.

Implicit Incentives Among Reddit Users to Prioritize Attention Over Privacy and Reveal Their Faces When Discussing Direct-to-Consumer Genetic Test Results: Topic and Attention Analysis.

Background: As direct-to-consumer genetic testing services have grown in popularity, the public has increasingly relied upon online forums to discuss and share their test results. Initially, users did so anonymously, but more recently, they have included face images when discussing their results. Various studies have shown that sharing images on social media tends to elicit more replies. However, users who do this forgo their privacy. When these images truthfully represent a user, they have the potential to disclose that user's identity. Objective: This study investigates the face image sharing behavior of direct-to-consumer genetic testing users in an online environment to determine if there exists an association between face image sharing and the attention received from other users. Methods: This study focused on r/23andme, a subreddit dedicated to discussing direct-to-consumer genetic testing results and their implications. We applied natural language processing to infer the themes associated with posts that included a face image. We applied a regression analysis to characterize the association between the attention that a post received, in terms of the number of comments, the karma score (defined as the number of upvotes minus the number of downvotes), and whether the post contained a face image. Results: We collected over 15,000 posts from the r/23andme subreddit, published between 2012 and 2020. Face image posting began in late 2019 and grew rapidly, with over 800 individuals revealing their faces by early 2020. The topics in posts including a face were primarily about sharing, discussing ancestry composition, or sharing family reunion photos with relatives discovered via direct-to-consumer genetic testing. On average, posts including a face image received 60% (5/8) more comments and had karma scores 2.4 times higher than other posts. Conclusions: Direct-to-consumer genetic testing consumers in the r/23andme subreddit are increasingly posting face images and testing reports on social platforms. The association between face image posting and a greater level of attention suggests that people are forgoing their privacy in exchange for attention from others. To mitigate this risk, platform organizers and moderators could inform users about the risk of posting face images in a direct, explicit manner to make it clear that their privacy may be compromised if personal images are shared.

Circulating vaspin and its relationship with insulin sensitivity, adiponectin, and liver histology in subjects with non-alcoholic steatohepatitis.

OBJECTIVE: Non-alcoholic steatohepatitis (NASH) is closely associated with components of metabolic syndrome. Vaspin is a novel adipocytokine that may link obesity, insulin resistance (IR), and type 2 diabetes mellitus. We aimed to investigate circulating vaspin levels in subjects with NASH and also to search for the association of vaspin with IR, adiponectin, and histological findings. MATERIAL AND METHODS: A total of 50 male patients with NASH and 30 healthy male controls were enrolled. Vaspin and adiponectin were measured with ELISA method. Insulin sensitivity determined by homeostasis model assessment (HOMA-IR) index. RESULTS: Plasma vaspin levels were higher and adiponectin levels were lower in NASH group compared with controls (p < 0.01 and p < 0.001, respectively). However, in multivariate analysis adjusted for glucose and lipid parameters, and HOMA-IR indexes, the difference in vaspin concentrations was disappeared. Nonetheless, the difference regarding the adiponectin levels remained significant between groups (p = 0.03). Vaspin was negatively correlated with low-density lipoprotein cholesterol (r = -0.32, p = 0.03) in subjects with NASH. CONCLUSIONS: This study indicates that circulating vaspin levels are not altered in male subjects with NASH. These results suggest that in the absence of metabolic risk factors, vaspin per se may not be involved in the pathogenesis of NASH.

De-identifying Socioeconomic Data at the Census Tract Level for Medical Research Through Constraint-based Clustering.

Numerous studies have shown that a person's health status is closely related to their socioeconomic status. It is evident that incorporating socioeconomic data associated with a patient's geographic area of residence into clinical datasets will promote medical research. However, most socioeconomic variables are unique in combination and are affiliated with small geographical regions (e.g., census tracts) that are often associated with less than 20,000 people. Thus, sharing such tract-level data can violate the Safe Harbor implementation of de-identification under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). In this paper, we introduce a constraint-based k-means clustering approach to generate census tract-level socioeconomic data that is de-identification compliant. Our experimental analysis with data from the American Community Survey illustrates that the approach generates a protected dataset with high similarity to the unaltered values, and achieves a substantially better data utility than the HIPAA Safe Harbor recommendation of 3-digit ZIP code.

Using game theory to thwart multistage privacy intrusions when sharing data.

Person-specific biomedical data are now widely collected, but its sharing raises privacy concerns, specifically about the re-identification of seemingly anonymous records. Formal re-identification risk assessment frameworks can inform decisions about whether and how to share data; current techniques, however, focus on scenarios where the data recipients use only one resource for re-identification purposes. This is a concern because recent attacks show that adversaries can access multiple resources, combining them in a stage-wise manner, to enhance the chance of an attack's success. In this work, we represent a re-identification game using a two-player Stackelberg game of perfect information, which can be applied to assess risk, and suggest an optimal data sharing strategy based on a privacy-utility tradeoff. We report on experiments with large-scale genomic datasets to show that, using game theoretic models accounting for adversarial capabilities to launch multistage attacks, most data can be effectively shared with low re-identification risk.