Privacy-Preserving Data Sharing for Genome-Wide Association Studies

By Caroline Uhler, Aleksandra B. Slavkovic, Stephen E. Fienberg. 2012

159 citations recorded by the source corpus.

Genome-wide association studies (GWAS) focus on finding genetic variations associated with traits such as major diseases often by measuring associations between single-nucleotide polymorphisms (SNPs), i.e., DNA sequence variations at single nucleotides, and a particular disease. A typical study compares the DNA of individuals with the disease (cases) and similar individuals without (controls). For a specific trait, the output of such studies often consists of the χ2-statistics or the p-values for the most significant SNPs including their minor allele frequencies (i.e., the lowest allele frequency observed for the cases and the controls). In an article that shocked the genetics community, Homer et al. [13] claimed that, under certain conditions, they could use statistical methods to “accurately and robustly [resolve]” the presence of an individual with known genotype in a mix of DNA samples from which only the minor allele frequencies (MAFs) are known. Their approach compared the MAFs of a specific individual to the distribution of MAFs in a reference population and the distribution of MAFs in a test population; they then used a t-test to assess if the individual was part of the test population. Although proposed specifically for use in a forensic context and only secondarily for breaking privacy, the Homer et al. [13] “attack” appeared to be generally applicable. As a reference population one might use the publicly available SNP data from the HapMap project1 which consists of SNP data from four populations varying in size from 45 to 90 individuals. Note that the HapMap data set does not contain any information regarding the health status of the individuals. For the test population one might use the cases in GWAS, which contain both genotype data and disease status. Before the appearance of the article [13], the averaged MAFs of the cases and the averaged MAFs of the controls in a GWAS were typically publicly available. In response to Homer et al. [13], Braun et al. [3] showed that their proposed test depends heavily on the assumption that the genotypes of the test population, the reference population, and the specific person under consideration are samples from the same underlying population, and that the SNPs used in the study are independent (i.e., that there is no linkage disequilibrium present). These assumptions are usually not met in practice, and as a consequence, the Homer et al. [13] attack lead to a high false-positive rate, see e.g., Braun et al. [3]. Other critiques of Homer et al. suggested alternative formulations of the identification problem, claimed to strengthen the attack, or suggested different ways to protect the data, e.g., see [6, 14, 15, 16, 18, 19, 21, 23, 27]. Despite the apparent limitations of the Homer et al. [13] attack on the privacy of GWAS participants and the controversial and, we believe, exaggerated nature of their statistical claims, NIH immediately removed from open-access databases all aggregate results such as values of averaged MAFs over cases and controls, chi-square (χ2)-statistics, and p-values (see Couzin [7] and Zerhouni and Nabel [26]). The NIH policy remains in effect today.2 Every researcher who wants to gain access to any of these data sets needs to go through an elaborate approval process. This is a particularly difficult obstacle for computer scientists, mathematicians, or statisticians who do not have a credible record in GWAS research. Here we propose methods which allow for the release of aggregate GWAS data without compromising an individual’s privacy, and in many ways totally bystep the debate on the validity of the claims by Homer et al. [13] and others on the vulnerability of GWAS databases. Our GWAS privacy guarantees utilize the concept of differential privacy, recently introduced by the cryptographic community (e.g., Dwork et al. [10]). Differential privacy provides a rigorous definition of privacy with meaningful privacy guarantees in the presence of arbitrary external information. Our contributions are as follows: We propose a method for the release of the averaged MAFs for the cases and for the controls in GWAS without compromising an individual’s privacy. We compute e-differentially private χ2-statistics and p-values and provide a differentially private algorithm for releasing these statistics for the most relevant SNPs. Conditions such as cancer, heart disease, and diabetes are caused by the interaction of various genes and possibly the environment. Detecting such interaction among SNPs related to a specific phenotype (i.e., epistasis) is a main goal of GWAS. Most methods for finding epistasis are based on a two-stage approach: (1) Filtering all SNPs, e.g., using χ2-statistics or a simple logistic regression, to reduce the potentially interacting SNPs to a small number; (2) Further examining the loci achieving some threshold for interactions. For example, Park and Hastie [20] use a form of penalized logistic regression to test for detecting gene-gene interactions on a small number of SNPs. By adapting the work of [1] and [5] to this methodology, we derive a privacy-preserving method for GWAS, where both stages in the two-stage approach satisfy e-differential privacy. Section 2 describes the basic problem and relevant definitions. In Section 3, we present methods for releasing e-differentially private MAFs, χ2-statistics, and p-values, and in Section 4 we evaluate their statistical utility on data based on a simulation study and on a GWAS study of canine hair length involving 685 dogs. In Section 5, we propose a differentially-private method for finding genome-wide associations based on a penalized approach to logistic regression.

Subfields: Artificial Intelligence, Molecular Biology, Public Health, Environmental and Occupational Health

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Molecular Biology

In Public Health, Environmental and Occupational Health

Citations in the corpus

The structure of optimal private tests for simple hypotheses (2018, background): “Early work on differentially private hypothesis testing began in the Statistics community with [VS09, USF13].”
Differential Privacy: An Economic Method for Choosing Epsilon (2014, background): “This is evident in the literature [32, 7, 30, 24, 5, 31, 6, 28, 38, 8, 2, 41, 43, 27, 9, 12, 40, etc.], where algorithms have been evaluated with e ranging from as little as 0.01 to as much as 7, often with no explanation or justiﬁcation.”
Private selection from private candidates (2018, background): “Some examples include private PAC learning [21], private frequent itemset mining [4], private PCA [8, 20] and private multiple hypothesis testing [15, 34].”
Differentially private model selection with penalized and constrained likelihood (2016, methodology): “, 2014; Karwa & Slavković, 2016), non-parametric density estimation (Wasserman & Zhou, 2010), hypothesis testing (Fienberg et al., 2011; Johnson & Shmatikov, 2013; Uhler et al., 2013; Yu et al., 2014; Karwa et al., 2014; Solea, 2014; Dwork et al., 2015; Sheffet, 2015; Wang et al., 2015; Gaboardi et ”
Differentially Private Uniformly Most Powerful Tests for Binomial Data (2018, methodology): “Uhler et al. (2013) develop DP chi-squared tests and p -values for GWAS data, and derive the exact sampling distribution of their noisy statistic.”
Differentially Private Nonparametric Hypothesis Testing (2019, background): “Several other papers, though they make asymptotic arguments on the uniformity of their p-values, have developed frameworks for private chi-squared tests specifically for the intent of genomewide association study (GWAS) data [13, 18, 34].”
Differentially Private Chi-squared Test by Unit Circle Mechanism (2017, methodology): “The input perturbation method ensures differential privacy by randomizing each count in the contingency table (Uhler et al., 2013; Johnson & Shmatikov, 2013; Wang et al., 2015; Gaboardi et al., 2016).”
A New Class of Private Chi-Square Tests (2016, methodology): “In practice, asymptotic distributions derived under this regime result in unreliable hypothesis tests because privacy noise is significant [21].”
Revisiting Differentially Private Hypothesis Tests for Categorical Data (2015, methodology): “…of the algorithm proposed by Johnson and Shmatikov (2013) was noticed by Uhler et al. (2013), they proposed an output perturbation method (Uhler et al., 2013; Yu et al., 2014): compute the chi-squared statistic on the original data (here it is 2.916), determine a quantity called the…”
Differentially Private Chi-Squared Hypothesis Testing: Goodness of Fit and Independence Testing (2016, background): “Additionally, Uhler et al. (2013) look at 3 × 2 contingency tables that are evenly split between the two columns, and study releasing differentially private χ 2 -statistics of the most relevant SNPs for certain diseases by perturbing the table of counts, the χ 2 - statistic itself, and the p…”
Locally Private Mean Estimation: Z-test and Tight Confidence Intervals (2018, background): “Johnson and Shmatikov (2013), Uhler et al. (2013) and Yu et al. (2014) focused on the Pearson χ2-test, showing that the noise added by differential privacy vanishes asymptotically as the number of datapoints goes to infinity, and propose a private χ2-based test which they study empirically.”
Improved Differentially Private Analysis of Variance (2019, background): “Many private chi-squared tests have been specifically motivated by genome-wide association studies (GWAS) [9, 20, 11].”
Towards practical privacy-preserving genome-wide association study (2018, result): “For example, previous works by Uhlerop et al. [USF13], and by Simmons and Berger [SB16] have focused on computing a diﬀerentially private χ 2 test.”
Statistical Approximating Distributions Under Differential Privacy (2018, methodology): “In the privacy-preserving case, differential privacy can be achieved by adding noise directly to the table T [Gaboardi et al., 2016, Rogers and Kifer, 2017, Johnson and Shmatikov, 2013] or to the test statistic itself [Uhler et al., 2013, Yu et al., 2014].”
INSPECTRE: Privately Estimating the Unseen (2018, methodology): “This realization has motivated a surge of interest in developing data sharing techniques with an explicit focus on maintaining privacy of the data (Johnson & Shmatikov, 2013; Uhler et al., 2013; Yu et al., 2014; Simmons et al., 2016).”
The Large Margin Mechanism for Differentially Private Maximization (2014, methodology): “This is a very general algorithmic problem that arises in many applications, include private PAC learning [25] (choosing the most accurate classifier), private decision tree induction [21] (choosing the most informative split), private frequent itemset mining [5] (choosing the most frequent itemset)”
Realizing privacy preserving genome-wide association studies (2016, methodology): “These privacy concerns have led some to suggest using statistical tests that are differentially private (Jiang et al. , 2014; Johnson and Shmatikov, 2013; Tramer et al. , 2015; Uhler et al. , 2013; Wang et al. , 2014; Yu and Ji, 2014; Yu et al. , 2014).”
Membership Privacy in MicroRNA-based Studies (2016, methodology): “In [33], they present methods for privately disclosing allele frequencies, chi-square statistics, and p -values.”