Beacon Reconstruction Attack: Reconstruction of genomes in genomic data-sharing beacons using summary statistics

Abstract

Motivation: Genomic data-sharing beacon protocol, developed by the Global Alliance for Genomics and Health, offers a privacy-preserving mechanism for querying genomic datasets while restricting direct data access. Despite their design, beacons remain vulnerable to privacy attacks. This study introduces a novel privacy vulnerability of the protocol: one can reconstruct large portions of the genomes of all beacon participants by only using the summary statistics reported by the protocol.

Results: We introduce a novel optimization-based algorithm that leverages beacon responses and SNP correlations for reconstruction. By optimizing for the SNP correlations and allele frequencies, the proposed approach achieves genome reconstruction with a substantially higher F1-score (70%) compared to baseline methods (45%) on beacons generated using individuals from the HapMap and OpenSNP datasets. We show that reconstructed genomes can be used by downstream applications such as in membership inference attacks against other beacons. Our findings reveal that beacons releasing allele frequencies substantially increase the reconstruction risk, underscoring the need for enhanced privacy-preserving mechanisms to protect genomic data.

Availability and implementation: Our implementation is available at https://github.com/ASAP-Bilkent/Beacon-Reconstruction-Attack.

Figure 1.

The system model of our approach. The attacker finds out N and decides on the subset of SNPs $M^{\prime }$ to reconstruct. 1. The attacker takes the snapshot of the beacon for $M^{\prime }$. 2. Beacon can respond with allele frequencies or yes/no for each SNP. In the latter, the attacker estimates allele frequencies from the population. 3. The attacker initializes the matrix using the baseline algorithm, and then 4. updates the assignments such that the SNP correlations are preserved. 5. The attacker optimizes for the original allele frequencies obtained. 6. Steps 4 and 5 are alternated until convergence.

Figure 2.

F1-score comparison for $\left|M^{\prime }\right|$ = 1000 when frequency is unknown. Plot A represents reconstruction from 64 left-out samples of HapMap dataset, Plot B represents reconstruction using Mexican samples.