Answering Count Queries for Genomic Data with Perfect Privacy

TL;DR

This paper introduces mechanisms for answering count queries on genomic data that guarantee perfect privacy of sensitive genotypes, balancing privacy with minimal error, and providing theoretical bounds and practical evaluations.

Contribution

It proposes novel local and central mechanisms for privacy-preserving count queries on genomic data with perfect privacy guarantees and analyzes their performance relative to theoretical bounds.

Findings

Mechanisms achieve near-optimal error rates close to the theoretical lower bound.

Performance depends on data prior, genotype intersection, and data correlation.

Some mechanisms match the lower bound in specific cases.

Abstract

In this paper, we consider the problem of answering count queries for genomic data subject to perfect privacy constraints. Count queries are often used in applications that collect aggregate (population-wide) information from biomedical Databases (DBs) for analysis, such as Genome-wide association studies. Our goal is to design mechanisms for answering count queries of the following form: \textit{How many users in the database have a specific set of genotypes at certain locations in their genome?} At the same time, we aim to achieve perfect privacy (zero information leakage) of the sensitive genotypes at a pre-specified set of secret locations. The sensitive genotypes could indicate rare diseases and/or other health traits one may want to keep private. We present both local and central count-query mechanisms for the above problem that achieves perfect information-theoretic privacy for sensitive genotypes while minimizing the expected absolute error (or per-user error probability, depending on the setting) of the query answer. We also derived a lower bound of the per-user probability of error for an arbitrary query-answering mechanism that satisfies perfect privacy. We show that our mechanisms achieve error close to the lower bound, and match the lower bound for some special cases. We numerically show that the performance of each mechanism depends on the data prior distribution, the intersection between the queried and sensitive genotypes, and the strength of the correlation in the genomic data sequence.