Privacy in Pharmacogenetics: An End-to-End Case Study of Personalized Warfarin Dosing

By Matt Fredrikson, Eric Lantz, Somesh Jha, Simon M. Lin, David Page, Thomas Ristenpart. 2014

908 citations recorded by the source corpus.

We initiate the study of privacy in pharmacogenetics, wherein machine learning models are used to guide medical treatments based on a patient’s genotype and background. Performing an in-depth case study on privacy in personalized warfarin dosing, we show that suggested models carry privacy risks, in particular because attackers can perform what we call model inversion: an attacker, given the model and some demographic information about a patient, can predict the patient’s genetic markers. As differential privacy (DP) is an oft-proposed solution for medical settings such as this, we evaluate its effectiveness for building private versions of pharmacogenetic models. We show that DP mechanisms prevent our model inversion attacks when the privacy budget is carefully selected. We go on to analyze the impact on utility by performing simulated clinical trials with DP dosing models. We find that for privacy budgets effective at preventing attacks, patients would be exposed to increased risk of stroke, bleeding events, and mortality. We conclude that current DP mechanisms do not simultaneously improve genomic privacy while retaining desirable clinical efficacy, highlighting the need for new mechanisms that should be evaluated in situ using the general methodology introduced by our work.

Subfields: Privacy & Security, Medical & Health AI

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Privacy & Security

In Medical & Health AI

Matt Fredrikson

Citations in the corpus

Privacy-Preserving Generative Deep Neural Networks Support Clinical Data Sharing (2017, neutral): “Numerous linkage and membership inference attacks on both biomedical datasets [6-13] and from machine learning models [14-16] have demonstrated the ability to re-identify participants or reveal participation in a study.”
The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networks (2018, neutral): “Model inversion [19, 20] is an attack that learns aggregate statistics of the training data, potentially revealing private information.”
Towards the Science of Security and Privacy in Machine Learning (2016, neutral): “Privacy [59].”
Membership Inference Attacks Against Machine Learning Models (2016, neutral): “Inferring information about the model’s training dataset should not be confused with techniques such as model inversion that use a model’s output on a hidden input to infer something about this input [17] or to extract features that characterize one of the model’s classes [16].”
Model Inversion Attacks that Exploit Confidence Information and Basic Countermeasures (2015, neutral): “(See also the discussion of differential privacy in [13].”
Local Model Poisoning Attacks to Byzantine-Robust Federated Learning (2019, neutral): “Specifically, an attacker could compromise the confidentiality of users’ private training or testing data via various attacks such as model inversion attacks [21, 22], membership inference attacks [40, 49, 53], and property inference attacks [1, 24].”
Deep Models Under the GAN: Information Leakage from Collaborative Deep Learning (2017, positive): “But the model inversion attack [26, 27] has proven that we can recover inputs (e.”
Privacy in Deep Learning: A Survey (2020, neutral): “This poses serious privacy concerns, as neural networks are used in different aspects of our lives [5, 3, 6, 7, 8, 9, 10].”
Secure Federated Submodel Learning (2019, neutral): “In addition to the fact that the real index reveals a client’s private data, the client’s individual submodel update can still memorize or even allow reconstruction of her private data, namely “model inversion” attack [1], [42]–[45].”
Privacy Risks of Securing Machine Learning Models against Adversarial Examples (2019, neutral): “arget model with membership inference attacks [38, 42, 59], learning global properties of training data with property inference attacks [12], reconstructing training data with model inversion attacks [10, 11] or colluding model training attacks [47, 59]. Attacks targeting model privacy include: the ”
Exploiting Unintended Feature Leakage in Collaborative Learning (2018, neutral): “Several techniques infer class features and/or construct class representatives if the adversary has black-box [16, 17] or whitebox [2] access to a classifier model.”
Stealing Machine Learning Models via Prediction APIs (2016, neutral): “Prior attacks such as model inversion [4, 23, 24] have shown that access to a model can be abused to infer information about training set points.”
Bypassing Backdoor Detection Algorithms in Deep Learning (2019, neutral): “The model predictions can also be exploited to reconstruct the model parameters [24], or its input [9].”
Machine Learning Models that Remember Too Much (2017, neutral): “[26] explore model inversion: given a model fθ that makes a prediction y given some hidden feature vector x1, .”
Attacking Graph-based Classification via Manipulating the Graph Structure (2019, neutral): “rated that machine learning is vulnerable to adversarial examples [7,12,27,30,37,40,43,46,51,53,56, 68], poisoning attacks [8,18,31,38,67,70], privacy attacks for users (e.g., model inversion attacks [19,20], membership inference attacks [49,52], property inference attacks [3,21]), as well as model ”
Property Inference Attacks on Fully Connected Neural Networks using Permutation Invariant Representations (2018, neutral): “[16] invert a linear regression model to infer patients’ genomic markers given their corresponding output from the model and auxiliary demographic information about them.”
Stealing Hyperparameters in Machine Learning (2018, neutral): “In these attacks [15], [14], an attacker aims to leverage model predictions to compromise user privacy.”
Zero-shot Knowledge Transfer via Adversarial Belief Matching (2019, neutral): “In model inversion (Fredrikson et al., 2014, 2015) we have white-box access to a pretrained model, and we wish to recreate training images from the weights alone.”