Methods for anonymizing genome data

Abstract

Some embodiments are directed to a method for de-identifying a genomic dataset. The method includes receiving (410) a genomic dataset and obtaining (420) a phenotype probability for at least one phenotype-informative single nucleotide polymorphism (SNP) in the genomic dataset and a proportion of a population exhibiting the corresponding phenotypic trait. A re-identification risk score is calculated (430) based on the genomic dataset from the obtained phenotype probability and the obtained proportion of the population exhibiting the phenotypic trait. If the re-identification risk score does not meet a threshold risk criterion, the genomic dataset is de-identified by selecting (450) phenotype-informative SNPs and masking (460) the selected phenotype-informative SNPs, and the re-identification risk score is recalculated. If the re-identification risk score meets the threshold risk criterion, the de-identified genomic dataset is output (470).

Description

Technical Field

[0001] The subject matter disclosed herein relates to methods for anonymizing genomic datasets and corresponding systems for anonymizing genomic datasets. The subject matter disclosed herein further relates to computer-readable media.

Background Art

[0002] Whole genome sequencing has become increasingly inexpensive, and services such as 23andMe and AncestryDNA can sequence hundreds of thousands of SNPs for around $100. However, as more genomic information becomes available, concerns about privacy and security are growing. Attackers are increasingly able to combine genotype and phenotype information in various ways to de-anonymize genomic databases. For example, a specific attack is an attack where an attacker attempts to identify (from a plurality of genotypes) the genotype corresponding to a given phenotype. A further type of de-anonymization attack is an exact match attack, where an attacker attempts to match multiple phenotypes to their corresponding genotypes. Attackers may also use statistical models to predict phenotypic traits based on whole genome sequencing data. With current advances in genomics, the risk of an individual being identified using genomic data is rapidly increasing.

[0003] Quasi-identifiers, also called indirect identifiers, are fields within a dataset that can be used in combination with each other to identify an individual. Examples include gender, postal code, date of birth, occupation, and income. While many people share the same gender, date of birth, or postal code, these combinations can be unique to an individual, especially if they live in a rural area with a small population. Examples of indirect identifiers include phenotypic traits such as hair color and eye color.

[0004] Currently, whole genome sequences can be easily linked to phenotypic traits, making it possible to identify eye color, hair color, skin color, blood type, etc., and subsequently identify the subject. As genome research advances, this problem will only become more serious. Often, users and researchers choose one of two options: retain all genomic information as is, thereby risking privacy violations, or remove all potentially identifiable information from the dataset (thus limiting the usefulness of the data).

[0005] Published U.S. Patent Application No. 2020 / 0035332A1 describes a method and system for anonymizing genetic data. The method and system described herein identifies ancestral identification marker (AIM) regions within genetic data. AIM regions in genetic data contain single nucleotide polymorphism (SNP) alleles associated with a patient population belonging to a specific ancestor. AIM regions that do not contain gene variants associated with a specific disease are masked or removed from the genetic data.

[0006] A problem with prior art is that there is no guarantee that the resulting genetic data is sufficiently anonymized. Simply masking or deleting AIM regions that lack clinically relevant data may still result in genetic datasets that can, in some cases, re-identify the individuals in question. Furthermore, prior art approaches involve deleting data that may contribute to specific diseases in some unknown way, potentially leading to the loss of valuable information.

[0007] Removing more data from a gene dataset increases the risk of losing valuable and relevant information, thereby reducing the data's usefulness. However, leaving more data in a gene dataset increases the risk of individuals being re-identified from that dataset. Therefore, there is an advantage to ensuring that gene datasets are sufficiently anonymized while retaining as much information as possible for research and other uses. Quantifying the risk of re-identification and protecting against the risk of individuals being re-identified from anonymized genome datasets can improve patient privacy, security, and the amount of information available to researchers in anonymized genome datasets. [Overview of the Initiative] [Problems that the invention aims to solve]

[0008] It is advantageous to preserve as much genomic data as possible for researchers to access while protecting the privacy and security of individuals whose data is used. A system and computer implementation for anonymizing genomic datasets are described herein and claimed. This system and computer implementation are intended to address these and other issues.

[0009] Existing genome data preparation methods, for example, remove all genome data related to visible phenotypic traits, regardless of whether that genome data is also related to the disease of interest, thereby deleting important research information from genome datasets. This either reduces the amount of knowledge that can be gained from the analysis, or leaves an excessive amount of personally identifiable information, jeopardizing security and privacy. [Means for solving the problem]

[0010] The subject matter disclosed herein includes computer methods for anonymizing genomic datasets, systems for anonymizing genomic datasets, and computer-readable media. A method for anonymizing a genomic dataset may include the step of receiving a genomic dataset. A genomic dataset may include multiple alleles sequenced in multiple single nucleotide polymorphisms (SNPs), where the multiple SNPs include one or more phenotypic information SNPs. A phenotypic information SNP may be an SNP associated with a phenotypic trait. A genomic dataset may correspond to an individual's genome. The method may further include the step of obtaining a phenotypic probability for at least one phenotypic information SNP. The phenotypic probability may be the probability that a phenotypic trait is expressed as a result of at least one allele corresponding to at least one phenotypic information SNP. For example, if the phenotypic trait is "blue eyes," the phenotypic probability is the probability that the allele occupying a particular phenotypic information SNP associated with eye color results in the presentation of blue eyes. The method may further include the step of obtaining the proportion of a population exhibiting the phenotypic trait. For example, if the phenotypic trait is "blue eyes," the proportion of the population corresponds to the proportion of a population having blue eyes. The above method further includes the step of calculating a re-identification risk score based on the genome dataset. The re-identification risk score indicates the risk of re-identifying an individual associated with the genome dataset from the genome dataset. The re-identification risk score may be calculated from the phenotypic probabilities obtained and the proportion of the population exhibiting the phenotypic trait obtained. The re-identification risk score may be compared to a threshold risk criterion. If the re-identification risk score does not meet the threshold risk criterion, the above method may include the step of anonymizing the genome dataset by selecting phenotypic information SNPs and masking the selected phenotypic information SNPs. If the re-identification risk score meets the threshold risk criterion, the above method may include the step of outputting the anonymized genome dataset.

[0011] The embodiments help improve the privacy and security associated with genomic datasets, while also increasing the amount of information available to researchers, for example. Various examples and embodiments provided herein describe methods for determining re-identification risk scores and anonymizing genomic datasets.

[0012] By using threshold risk criteria, acceptable risk levels can be considered, and the genomic dataset can be anonymized accordingly. Furthermore, the amount of information remaining in the genomic dataset can be maximized by avoiding the unnecessary removal of clinical relevance.

[0013] Aspects of the subject matter disclosed herein include corresponding systems for anonymizing genome datasets.

[0014] The executable code for the embodiment of the above method may be stored in a computer program product. Examples of computer program products include memory devices, optical storage devices, integrated circuits, servers, and online software. Preferably, the computer program product includes non-temporary program code stored on a computer-readable medium to execute the embodiment of the above method when the program product is executed on a computer.

[0015] In the embodiment, the computer program includes computer program code that, when executed on a computer, performs all or some of the steps of the embodiment of the method described above. Preferably, the computer program is implemented on a computer-readable medium.

[0016] Another aspect of the subject matter disclosed herein provides a method of making a computer program available for download. This aspect is used when a computer program is uploaded to, for example, Apple's App Store, Google's Play Store, or Microsoft's Windows Store, and the computer program can be downloaded from such a store.

Brief Description of the Drawings

[0017] Further details, aspects, and embodiments are described below by way of example with reference to the drawings. The elements in the figures are shown for simplicity and clarity and are not necessarily drawn to scale. In the figures, elements corresponding to elements already described may sometimes have the same reference numerals.

[0018] [Figure 1] FIG. 1 schematically shows an example embodiment of a system for anonymizing a genomic dataset. [Figure 2] FIG. 2 schematically shows an example of a genomic dataset. [Figure 3] FIG. 3 schematically shows an example embodiment of a method for calculating a re-identification risk score. [Figure 4] FIG. 4 schematically shows an example embodiment of a method for anonymizing a genomic dataset. [[ID=二十二]] [Figure 5] FIG. 5 schematically shows an example of a computer-readable medium having a writable portion including a computer program according to an embodiment. [Figure 6] FIG. 6 schematically shows a processor system according to an embodiment.

Modes for Carrying Out the Invention

[0019] List of reference numerals: 100 System 110 Processor subsystem 120 External network 130 Input / output subsystem 140 Memory 142 genomic dataset 144 instruction 150 data interface 200 genomic dataset 330 database 1000 computer-readable medium 1010 writable portion 1020 computer program 1110 integrated circuit 1120 processing unit 1122 memory 1124 application-specific integrated circuit 1126 communication element 1130 interconnect 1140 processor system 1100 device

[0020] The subject matter disclosed herein is susceptible to many different forms of embodiments, but the present disclosure should be regarded as illustrative of the principles of the subject matter disclosed herein and is not intended to be limited to the specific embodiments shown and described in the drawings. With this understanding, one or more specific embodiments are shown in the drawings and described in detail herein.

[0021] In the following, for the sake of understanding, the elements of the embodiments are described in terms of operations. However, it is clear that each element is configured to perform the functions described as being performed by them.

[0022] Furthermore, the subject matter disclosed herein is not limited to embodiments because the features described herein or recited in different dependent claims can be combined with each other.

[0023] Figure 1 schematically shows an example embodiment of a system 100 for anonymizing genome datasets. System 100 includes a processor subsystem 110 and an input / output subsystem 130. In some embodiments, system 100 further includes memory 140 accessible via a data interface 150. Memory 140 may be local memory or remote memory. In some embodiments, system 100 may be communicatively coupled to an external network or external entity 120.

[0024] In this implementation, the input / output (IO) subsystem 130 includes interfaces for receiving inputs and outputting outputs. For example, the IO subsystem 130 receives a genome dataset corresponding to an individual's genome.

[0025] A genome dataset contains multiple alleles sequenced in multiple single nucleotide polymorphisms (SNPs). SNPs indicate typical locations in the genome where gene mutations occur, and each allele is a given gene, gene sequence, or variant of the SNP. In other words, an SNP indicates a single genomic location where at least a certain proportion of the population has different nucleotides. Therefore, SNP data is considered mutation data, and this mutation data can be used to identify individuals from genome datasets. Most commonly, an SNP corresponds to a pair of alleles, which are nucleic acid bases (adenine (A), cytosine (C), thymine (T), or guanine (G)). For example, on autosomes, one allele is inherited from the mother and one from the father. For each SNP, the wild-type allele and the mutant allele are typically known. The wild-type allele is generally the allele that produces the most frequently observed phenotype in the population, while the mutant allele produces a phenotype other than the wild-type phenotype. The alleles that make up an SNP are called a genotype. Each allele that makes up a SNP has an associated genotype frequency (indicating how often that allele occurs at the location of the SNP in a given population (e.g., a region, country, continent, world, or dataset)) and an associated phenotypic probability (indicating the probability that that allele produces a particular phenotypic trait). Many SNPs contribute to or correspond to one or more phenotypic traits. Such SNPs are sometimes called phenotypic information SNPs. Examples of phenotypic traits include external phenotypic traits such as eye color, skin color, and hair color, and internal phenotypic traits such as blood type, predisposition to disease, and lactose intolerance. While such phenotypic traits may not be identifiable on their own, a combination of many such traits can be considered an indirect identifier because it can reduce the number of potential people to whom the genome corresponding to the genome dataset may belong, ultimately potentially identifying a specific individual. In some embodiments, the genome dataset includes demographic data such as age information and address information. Figure 2 shows an example of a simulation of a snippet from a genome dataset, which is further explained by the corresponding explanation.

[0026] In some embodiments, the IO subsystem 130 receives instructions for a disease to be investigated. Users, such as researchers, may be interested in investigating or researching a particular disease. This disease is known to correspond to the selection of SNPs. For example, a user may be interested in studying prostate cancer. The IO subsystem 130 receives user input indicating interest in prostate cancer and provides the user or another subsystem or process of system 100 with a list of SNPs known to be associated with or contribute to prostate cancer. In some embodiments, the user selects or indicates a particular disease via the IO subsystem 130, and known associated SNPs are retrieved, for example, from an external source or from internal memory such as memory 140. In some embodiments, the disease of interest is predetermined or indicated in a genome dataset, or is obtained from a genome dataset. In some cases, SNPs known to contribute to a particular disease also contribute to phenotypic traits such as eye color or blood type.

[0027] The IO subsystem 130 further stores the received genome dataset in memory 140. In some embodiments, the IO subsystem 130 receives user input, such as specifying a particular disease under study or selecting data within the genome dataset to prioritize. In some embodiments, the IO subsystem 130 receives a target respecification risk score to indicate a desired level of anonymization. For example, the target respecification risk score is used as a threshold risk criterion.

[0028] In some embodiments, the IO subsystem 130 accesses an external network 120. The external network 120 includes a cloud-based network, servers, an external database, an external device, and so on. In some embodiments, a genome dataset, threshold risk criteria, and / or information about at least one disease are stored on the external network 120 and accessed via the IO subsystem 130.

[0029] In some embodiments, the IO subsystem 130 includes input devices that receive user input, such as a touchscreen, keyboard, mouse, or trackpad, or sensor inputs, such as a camera, microphone, or proximity sensor. In some embodiments, the IO subsystem 130 includes output devices, such as a display or speaker, to provide output to the user. In some embodiments, the IO subsystem 130 handles inputs from and / or outputs to additional components, subsystems, or external entities. For example, the IO subsystem 130 receives inputs from external devices, networks such as cloud-based networks, servers, or components of system 100.

[0030] In the embodiment, memory 140 stores one or more genome datasets in a database for storing genome datasets of multiple individuals, for example. Furthermore, memory 140 may also store instructions or information used in a method for anonymizing genome datasets. Memory 140 also stores threshold risk criteria. Threshold risk criteria are criteria used to ensure that anonymized genome datasets are sufficiently anonymized before being output or distributed, for example, by ensuring that the re-identification risk score of a genome dataset conforms to a specified risk level. The calculation of the re-identification risk score will be described in detail with reference to Figure 3. The threshold risk criterion may be, for example, a percentage indicating the risk of re-identifying an individual from a genome dataset, or an applicable population size indicating the number of people with a phenotypic trait. A larger number of people sharing a phenotypic trait results in a lower risk of re-identification. In some cases, such as when the starting population is small, it is particularly appropriate to use the applicable population size of the threshold as the re-identification risk criterion.

[0031] Memory 140 includes at least one database, such as a genome database 142 and / or an SNP database 144. The genome database 142 stores one or more genome datasets corresponding to multiple individuals. The SNP database 144 stores SNP information associated with one or more diseases, such as a list of SNPs corresponding to a particular disease. Memory 140 is implemented as electronic memory (e.g., flash memory), magnetic memory (e.g., hard disk), or optical memory (e.g., DVD). Memory 140 may include multiple separate memories, which combine to constitute memory 140. Memory 140 may include temporary memory, such as RAM. In the case of temporary memory 140, memory 140 is associated with an acquisition device to store data, such as by acquiring data before use and acquiring data via an optional network connection (not shown).

[0032] In this embodiment, memory 140 includes local memory and / or external (e.g., remote) memory. For example, the genome database 142 is stored in local memory. The SNP database 144 is stored externally and, in some cases, is simply accessed from system 100. In another example, the genome database 142 is stored externally, like a central (government, etc.) database. The genome database 142 and the SNP database 144 may be stored in the same location or in different locations.

[0033] The processor subsystem 110 includes at least one processor and may be referred to as at least one processor circuit. In some embodiments, the processor subsystem 110 determines a re-identification risk score for the genome dataset and anonymizes the genome dataset. In some embodiments, the processor subsystem 110 preprocesses the genome dataset by, for example, masking (e.g., deleting) any direct identifiers in the genome dataset. A direct identifier is a SNP whose data independently identifies an individual without requiring additional information, such as data related to other SNPs. In some embodiments, the processor subsystem 110 preprocesses the genome dataset by obtaining a list of SNPs of interest to the user, for example, a list of SNPs associated with or contributing to a specific designated disease, either directly from the user, from a database in memory 140, or via an external network 120. In some embodiments, the processor subsystem 110 masks (e.g., deletes) SNPs in the genome dataset that are not related to a designated disease by, for example, masking (e.g., deleting) SNPs that are not included in the obtained list of related SNPs. In some embodiments, knowledge of SNPs involved in or associated with a particular disease is incomplete, and researchers may prefer not to restrict genomic datasets based on an incomplete list of SNPs.

[0034] The processor subsystem 110 calculates a respecification risk score from the genome dataset. The calculation of the respecification risk score is based on one or more phenotypic traits. For each specified phenotypic trait, the calculation of the respecification risk score uses the genotype frequency of one or more phenotypic information SNPs associated with that phenotypic trait, the phenotypic probability of the phenotypic information SNPs that produce that phenotypic trait, and the proportion of the population that has that phenotypic trait. These terms are explained in more detail with reference to Figure 2, and the calculation of the respecification risk score is explained in detail with reference to Figure 3.

[0035] The processor subsystem 110 compares the calculated re-identification risk score with a threshold risk criterion. The threshold risk criterion, also called the threshold re-identification risk criterion, may be stored locally, for example in memory 140, received from the user as user input via the IO subsystem 130, or obtained from the external network 120 via the IO subsystem 130. If the calculated re-identification risk score meets the threshold risk criterion, the genome dataset is sufficiently anonymized and output to an external device or user, or stored in local memory. If the calculated re-identification risk score does not meet the threshold risk criterion, the genome dataset is not yet sufficiently anonymized, and the processor subsystem 110 anonymizes the genome dataset by masking (deleting, etc.) data corresponding to one or more SNPs.

[0036] The system 100 further includes a data interface 150. The data interface 150 includes connectors, such as wired connectors, such as Ethernet® connectors, optical connectors, etc., or wireless connectors, such as antennas, such as Wi-Fi, 4G, or 5G antennas. The data interface 150 further provides access to the memory 140.

[0037] Various subsystems of System 100 may be located within a single device or communicate with each other via a computer network. A computer network may include the Internet, an intranet, a LAN, or a WLAN. A computer network may be the Internet. A computer network may be entirely or partially wired, or entirely or partially wireless. For example, a computer network may include Ethernet® connectivity. For example, a computer network may include wireless connectivity such as Wi-Fi or ZigBee. Subsystems may include connection interfaces configured to communicate with other subsystems of System 100 as needed. For example, connection interfaces may include connectors, such as wired connectors, such as Ethernet® connectors or optical connectors, or wireless connectors, such as antennas, such as Wi-Fi, 4G, or 5G antennas. A computer network may include additional elements such as routers and hubs.

[0038] Figure 2 schematically shows an example of a genome dataset 200. A genome dataset 200 includes multiple parameters for each SNP. For example, those shown in Figure 2 include: SNP 210 indicating the location or other identifier of the SNP; genotype 220 indicating the alleles in the SNP; allele frequency 1 230 indicating the frequency of the first allele among the multiple alleles occupying the SNP; allele frequency 2 240 indicating the frequency of the second allele among the multiple alleles occupying the SNP; genotype frequency 250 indicating the frequency of genotypes (e.g., alleles of the SNP) occurring in a population such as a regional or global population, or possibly the population of the dataset; phenotype 260 (also called phenotype probability 260) indicating the probability of a specific phenotypic trait being produced by the genotype of the SNP; and disease correlation 270 indicating whether the SNP has a known correlation with a particular disease of interest. It should be understood that a genome dataset does not necessarily include all of these listed parameters, and may include parameters other than those listed, and that the listed parameters are merely illustrative. For example, the genome dataset contains only SNP210 and genotype 220, and any further information such as genotype frequency, phenotypic probability, and / or disease association is obtained by querying a database or accessing a data source, for example, via an external network 120. For example, based on the entry for SNP210-a (SNP_E1) and the associated genotype (in the table in Figure 2, "AA"), system 100 examines the associated genotype frequency (in this example, the frequency of genotype AA, which accounts for SNP_E1 in the population (64% in this simulation example)), the phenotypic probability (in this example, the probability that genotype AA of SNP_E1 produces blue eyes is 40%), and whether SNP_E1 is known to be associated with prostate cancer (indicated as PCa in the table in Figure 2). For example, genotype frequency, phenotypic probability, and any associated parameters are obtained or accessed from the same data source, such as a single database, or from various data sources.

[0039] The sample of the simulated genome dataset 200 shown in Figure 2 contains data corresponding to multiple phenotypic information SNPs. The genome dataset 200 corresponds to the simulated genome of an individual with blue eyes, brown hair, and light skin tone. For simplicity, this example assumes that these three phenotypes form a set of indirect identifiers on which a respecification risk score is calculated. However, the use of these phenotypic traits is merely illustrative and not limiting. More or fewer phenotypic traits may be used. This example, in which these three phenotypic traits are considered, serves as a model throughout this disclosure to illustrate the methods and devices described herein.

[0040] In this example, the first phenotypic trait is "blue eyes." The SNPs that contribute to or influence eye color are SNP_E1, SNP_E2, SNP_E3, SNP_E4, and SNP_E5. According to a specific individual genome dataset, SNP_E1 is populated with genotype AA (for example, the genotype contains two alleles, each an adenine nucleotide). The frequency of genotype AA at the genomic location corresponding to SNP_E1 in the population is 64% (according to this simulation example). The probability that this genotype AA at this location results in blue eyes is 40%, and SNP_E1 is known to contribute to or be associated with prostate cancer.

[0041] Similarly, ● The AG genotype is populated in SNP_E2, with a genotype frequency of 4.5%. It has an 80% chance of causing blue eyes, and there is no known correlation or contribution to prostate cancer. ●The genotype GT is popular for SNP_E3, with a genotype frequency of 20%, a 95% probability of developing blue eyes, and a known correlation with prostate cancer. ● SNP_E4 is populated with the genotype CC, with a genotype frequency of 81%, a 50% probability of developing blue eyes, and no known correlation with prostate cancer. ●The genotype CT is popular for SNP_E5, with a genotype frequency of 17.5%, a 70% probability of developing blue eyes, and there is no known correlation with prostate cancer.

[0042] Continuing with this example, SNP_H1, SNP_H2, and SNP_H3 are SNPs related to hair color, while SNP_S1, SNP_S2, SNP_S3, and SNP_S4 are SNPs related to skin color. Of particular note are SNP_E1 and SNP_H1, denoted as 210-a, which are the same SNP. That is, they correspond to the same location in the genome and the same allele is populated. This particular SNP contributes to both eye color and skin color, and the genotype AA populated for the above SNP has a 40% chance of having blue eyes and a 55% chance of having light skin.

[0043] The re-identification risk score is calculated based on the parameters shown in the table in Figure 2. This calculation is explained in more detail in Figure 3.

[0044] Once calculated, the re-identification risk score is compared to a threshold risk criterion (such as applicable populations or proportions). Applicable populations correspond to proportions of populations such as regional populations (country, world, etc.) or datasets. For details on the threshold risk criterion, please refer to Figure 4. If the re-identification risk score does not meet the threshold risk criterion, data corresponding to one or more phenotypic information SNPs is masked, and the re-identification risk score is recalculated without the data for these masked phenotypic information SNPs. SNP masking includes deleting data corresponding to the SNPs, replacing data corresponding to the SNPs with null data, or any known masking method. The process of masking one or more SNPs and recalculating the re-identification risk score is repeated until the re-identification risk score meets the threshold risk criterion.

[0045] Figure 3 schematically illustrates an example of a method for calculating a re-identification risk score. A first phenotypic trait PT_current310 is selected. The first, i.e., current phenotypic trait PT_current310 is selected from a list of phenotypic traits to be considered in calculating the re-identification risk score, or from a list of all known phenotypic traits. In some embodiments, the list of phenotypic traits from which the first phenotypic trait PT_current310 is selected includes external phenotypic traits such as eye color and hair color, internal phenotypic traits such as blood type, or a combination of both external and internal phenotypic traits. In some embodiments, the list of phenotypic traits to be considered in calculating the re-identification risk score is received from the user or as input from another subsystem or device. In some embodiments, the list of phenotypic traits to be considered may be obtained from a database or determined based on phenotypic traits indicated by the individual anonymizing the genome dataset. For example, if an individual has blue eyes, brown hair, and light skin tone, these phenotypic traits are included in the list of phenotypic traits that should be considered when calculating the re-identification risk score.

[0046] The first phenotypic trait PT_current310 may correlate with one or more phenotypic information SNPs present in the genome dataset. That is, it is known that one or more locations on the genome contain mutations that cause or contribute to the expression of the first phenotypic trait. For illustrative purposes, these SNPs are shown as SNP_1 320-1, SNP_2 320-2, and SNP-n 320-n, but it should be understood that there may be more or fewer SNPs for a particular phenotypic trait, and the same SNP may contribute to multiple phenotypic traits within the same or different ranges.

[0047] For at least one of the identified SNPs, taking SNP_1 320-1 as an example, the genotype frequency Gfreq_1 340a-1 and phenotypic probability Pprob_1 340b-1 are obtained from, for example, database DB330. Database DB330 is stored in local memory such as memory 140, or in external memory such as cloud storage or on an external device. Database DB330 is accessed via an external network such as external network 120. In some embodiments, database DB330 is a central database accessed by researchers in an organization or collaborative research group. In some embodiments, since the genome dataset contains one or more of the genotype frequencies Gfreq_1 340a-1 and phenotypic probabilities Pprob_1 340b-1, these values ​​are obtained without using separate databases. The genotype frequency Gfreq_1 340a-1 represents the frequency of the alleles shown in the genome dataset for SNP_1 320-1. The phenotypic probability Pprob_1 340b-1 represents the probability that these alleles produce or result in a first phenotypic trait. In some embodiments, the genotype frequency and phenotypic probability are combined to obtain a risk term for each SNP used to calculate a re-specification risk score. The risk term is an intermediate value. For example, the risk term PT_r_1 350-1 for SNP_1 320-1 is determined by combining Gfreq_1 340a-1 and Pprob_1 340b-1. The risk term PT_r_1 350-1 is the product of the genotype frequency Gfreq_1 340a-1 and the phenotypic probability Pprob_1 340b-1, or the sum of the logarithms of Gfreq_1 340a-1 and Pprob_1 340b-1, or includes these.

[0048] In some embodiments, these values ​​are obtained for each phenotypic information SNP. For example, the genotype frequency Gfreq_2 340a-2 and phenotypic probability Pprob_2 340b-2 are obtained for SNP_2 320-2, and the genotype frequency Gfreq_n 340a-n and phenotypic probability Pprob_n 340b-n are obtained for SNP_n 320-n. The risk terms associated with each SNP are calculated from the above, and for example, the risk term PT_r_2 350-2 corresponding to SNP_2 320-2 and the risk term PT_r_n 350-n corresponding to SNP_n 320-n are obtained.

[0049] In some embodiments, the maximum risk term PT_r_max360, indicated by MAX355, is determined. MAX355 returns the maximum risk term PT_r_max360 for the risk terms PT_r_1 350-1 to PT_r_n 350-n corresponding to the SNPs SNP_1 320-1 to SNP_n 320-n. In some embodiments, MAX355 also returns the SNPs corresponding to the maximum risk term PT_r_max360. For example, if a first phenotypic trait has three associated SNPs (SNP_1 320-1, SNP_2 320-2, and SNP-n 320-n), then PT_r_max360 is the largest of PT_r_1 350-1, PT_r_2 350-2, and PT_r_n 350-n. While the above refers to the use of the maximum value, it should be understood that the method is not limited to this. For example, in some embodiments, an average risk term (e.g., the average risk term for all SNP320 associated with a particular phenotypic trait) is determined instead of a maximum risk term. For example, the choice between using an average risk term and a maximum risk term is based, at least in part, on the type of risk or aggressor that the re-identification effort is addressing.

[0050] In some embodiments, the proportion of the population exhibiting a first phenotypic trait, PT_pop340c, is obtained from a database, such as DB330. The proportion of the population exhibiting the first phenotypic trait, PT_pop340c, is combined with the maximum risk term, PT_r_max360, to obtain the contributing term, PT_cont370, corresponding to the first phenotypic trait. For example, the contributing term PT_cont370 is the quotient of PT_pop340c and PT_r_max360, or the difference between the logarithmic terms of PT_pop340c and PT_r_max360. Once the contributing term PT_cont370 is determined, the method repeats the process by selecting the next phenotypic trait, PT_next375, and setting PT_next375 as PT_current310, as shown by the arrows in the flowchart of Figure 3.

[0051] The phenotypic trait sum term PT_tot380 can also be obtained by combining the contributing term PT_cont370 with other contributing terms, such as those corresponding to other phenotypic traits. For example, in the first iteration for a first phenotypic trait, the phenotypic trait sum term PT_tot380 is simply set to the contributing term PT_cont370 corresponding to the first phenotypic trait. In some embodiments, the phenotypic trait sum term PT_tot380 is updated as the contributing terms for each phenotypic trait are determined. For example, the phenotypic trait contributing term PT_cont370 for the first phenotypic trait is multiplied by the contributing terms of other phenotypic traits, or they are logarithmically summed (e.g., summing the logarithms of the contributing terms). In some embodiments, the contributing terms are determined for each phenotypic trait of interest as described above, and after all calculations of these contributing terms are complete, they are combined, for example, by finding the product of these contributing terms or by finding the sum of the logarithms of these contributing terms.

[0052] In some embodiments, the sum of phenotypic traits term PT_tot380 is combined with the population size Pop340d, which is a proportion of a regional or global population, or a population that has already been determined, to obtain the applicable population AP390. For example, if the user is interested in a study of prostate cancer in patients aged 50–75, the population is the number of men aged 50–75 in the region of interest (e.g., Europe, the United States, or worldwide). The population size Pop340d is obtained from a database such as database DB330, as input from the user, from memory, etc. For example, the applicable population AP390 is determined by multiplying the population size Pop340d by the sum of phenotypic traits term PT_tot380, or by summing the logarithms of the population size Pop340d and the sum of phenotypic traits term PT_tot380 equally. The applicable population AP390 may represent the number of people whose genome matches the genome dataset.

[0053] In some embodiments, the applicable population 390 is used as the ReID Risk score 395, for example, when the threshold risk criterion represents a large number of people. In some embodiments, the ReID Risk score 395 is determined from the applicable population. For example, the ReID Risk score 395 is the risk that a particular individual is identified from the genome dataset and is calculated as the reciprocal of the applicable population AP 390 (e.g., 1 / AP). This is suitable when the threshold risk criterion is based on a risk level determined or defined by, for example, ethical or privacy requirements.

[0054] The following is a formula for calculating the re-identification risk score according to one embodiment:

number

number

number

[0055] As mentioned above, the calculation of the applicable population is done by the maximum term (

number

number

[0056] Furthermore, while the re-identification risk score is presented here as simply the reciprocal of the applicable population, it should be understood that the calculation is not limited to this. For example, additional dimensions may be used in the calculation of the risk score in addition to the applicable population. Such dimensions may include one or more of the following: the attacker's capabilities (e.g., the ability to access various specific databases), the probability of an attack (e.g., internal / external) based on thresholds and / or weights corresponding to existing contexts, phenotypes, and populations, i.e., the likelihood (e.g., the proportion of data subjects with a re-identification risk higher than the threshold mentioned above, the dependencies between phenotypes that divide the applicable population), etc.

[0057] In some embodiments, additional corrective factors are used to account for dependencies between multiple phenotypic traits. These additional corrective factors are based, at least in part, on available statistics, such as statistics showing the association between two traits or conditions. For example, consider the proportion of a population exhibiting both a high BMI (Body Mass Index) and the phenotypic trait of heart disease. Generally, obese individuals (medically defined as having a BMI score above a threshold) make up about 20% of the general population. However, obese individuals make up 40% of the population with heart disease. In this example, it is clear that there is a relationship between the high BMI phenotype and the heart disease phenotype, and this relationship can be used as a corrective factor. The corrective factor is, for example, using a 40% factor instead of a 20% factor when calculating the proportion of a population used in the term PT_Pop.

[0058] Figure 4 schematically shows an example of a computer-based method for anonymizing genome datasets.

[0059] This method includes, in an operation titled “receiving a genome dataset,” receiving a genome dataset from, for example, a user, from a data source such as memory 150, or from an external source such as via an external network 120 (410). In some embodiments, the genome dataset is obtained after data corresponding to direct identifiers has been removed. That is, in some embodiments, the genome dataset includes data corresponding to indirect identifiers.

[0060] The above method includes, in an operation titled “Retrieve Parameters,” obtaining (420) a population proportion (e.g., PT_pop) for at least one phenotypic trait, representing the proportion of the population exhibiting that phenotypic trait, and for at least one phenotypic SNP corresponding to that phenotypic trait, a genotype frequency (e.g., Gfreq) and a phenotypic probability (e.g., Pprob) for at least one phenotypic SNP (420), as illustrated with reference to Figure 3. In some embodiments, obtaining parameters (220) includes obtaining a population size, such as Pop340d. In some embodiments, obtaining parameters (420) includes obtaining a list of phenotypic traits and / or a list of SNPs associated with each of at least one phenotypic trait.

[0061] The above method includes calculating a respecification risk score for a genome dataset (430) in an operation titled “Calculate respecification risk score”. Calculating the respecification risk score (430) is performed as described, for example, with reference to Figure 3.

[0062] The above method includes comparing the calculated respecification risk score to a threshold risk criterion in an operation titled “Compare to Threshold” (440). If the respecification risk score meets the threshold risk criterion, the above method proceeds to an operation titled “Output Anonymized Dataset,” in which the genome dataset is output to a user, another subsystem, function, or device (470). In some embodiments, outputting the anonymized dataset includes, for example, storing the anonymized dataset in memory 140. In some embodiments, the genome dataset is output to a database such as database DB330. Alternatively, the genome dataset may be output to an external device such as a central database or central storage device located in the cloud or on a remote device, for example, via an external network 120. In some embodiments, the genome dataset is encrypted before output, such as when storing or transmitting the genome dataset. In some embodiments, the respecification risk score is output along with the anonymized dataset. Outputting the respecification risk score as well as the anonymized genome dataset allows the anonymized dataset to be used for subsequent research or applications where, for example, the acceptable level of respecification risk differs (e.g., different thresholds for threshold respecification risk). By including a re-identification risk score in anonymized genome datasets, re-anonymization can be avoided or at least mitigated if the re-identification risk score already meets the threshold for subsequent research or applications.

[0063] In some embodiments, the re-identification risk score is calculated as a percentage by taking the reciprocal of the applicable population, as shown in Equation 2, for example. In such embodiments, the threshold risk criterion takes the form of a percentage indicating the risk of re-identifying an individual from the genomic dataset. That is, the threshold risk criterion indicates the likelihood that an individual will be identified from the genomic dataset. For example, a threshold risk criterion of 0.05% indicates that acceptable anonymization has been achieved if the genomic dataset has a 0.05% risk of re-identifying an individual. Therefore, if the calculated re-identification risk score is below the threshold risk criterion, the threshold risk criterion is met; if the calculated re-identification risk score is greater than the threshold re-identification criterion, the threshold risk criterion is not met.

[0064] In some embodiments, the re-identification risk score is calculated as an applicable population, for example, as shown in Equation 1. In such embodiments, the threshold risk criterion takes the form of a raw number, such as the raw population size. That is, the threshold risk criterion represents the number of people in the population that the genome dataset can identify. Thus, the threshold re-identification risk score is met if the calculated re-identification risk score (such as the calculated applicable population) exceeds the threshold risk criterion.

[0065] If comparing the re-identification risk score to a threshold risk criterion (440) indicates that the re-identification risk score does not meet the threshold risk criterion, then phenotypic SNPs present in the genome data are selected (450) and masked (460). Masking selected phenotypic SNPs includes deleting the data corresponding to the selected phenotypic SNPs in the genome dataset, replacing the data corresponding to the selected phenotypic SNPs with dummy data or null data, or obscuring the data corresponding to the selected phenotypic SNPs.

[0066] The phenotypic information SNP is selected by identifying the phenotypic information SNP with the smallest contribution when calculating the applicable population. In other words, it is identified as the phenotypic information SNP with the largest contribution when calculating the respecification risk score. This is because the respecification risk score is calculated using the reciprocal of the applicable population. The contribution term is determined as described with reference to Figure 3. The contribution term corresponds to the phenotypic trait contribution term PT_cont370. In some embodiments, the contribution term for each phenotypic trait is stored, for example, temporarily, along with information identifying which phenotypic information SNP corresponds to that contribution term, and in operation 450, the phenotypic information SNP whose corresponding risk term is the largest risk term PT_r_max360 that contributes to the smallest contribution term PT_count370 is selected.

[0067] In some embodiments, one or more phenotypic information SNPs have associated priority directives. In some embodiments, data corresponding to phenotypic information SNPs with associated priority directives are retained in a genome dataset so that these data are not selected and masked in operations 450 and 460, respectively. For example, selecting a phenotypic information SNP (450) includes determining the smallest contributing term associated with a phenotypic information SNP without a priority directive (e.g., determining the contribution of the phenotypic information SNP that contributes most to the respecification risk score). To illustrate this, consider the following example where, for a particular phenotypic trait, the risk term PT_r_1 350-1 of SNP_1 320-1 in Figure 3 is the maximum risk term for that phenotypic trait (e.g., PT_r_1 350-1 = PT_r_max 355), and the resulting contributing term PT_cont 370 is the smallest contributing term that contributes to a respecification risk score that does not meet the threshold risk criterion. If SNP_1 320-1 has a priority instruction associated with it, the data corresponding to SNP_1 320-1 is not selected or masked, even though it corresponds to the least contributing term. Instead, the next least contributing term and its associated phenotypic information SNP are determined. If the phenotypic information SNP associated with this next least contributing term does not have a priority instruction, this phenotypic information SNP is selected in operation 450, and the corresponding data is masked in operation 460.

[0068] Priority directives are obtained by user input. In some embodiments, the user may have particular interest in a subset of phenotypic information SNPs and want to ensure that this subset is present in an anonymized dataset. In such cases, the user enters a list of SNPs of interest individually or as an additional field or flag in the genomic dataset to be anonymized. In some embodiments, priority directives are automatically assigned based on proximity to SNPs known to be associated with a particular disease of interest. The proximity of one SNP to another is determined by any known method using a genomic pathway network, for example, described in patent application EP3479272A1, which is incorporated herein by reference in its entirety, particularly on pages 4, line 28 to 5, line 3 and pages 6, line 18 to 7, line 9. SNPs that are at a predefined distance or proximity to, for example, SNPs of interest or SNPs known to contribute to a particular disease are prioritized by assigning priority directives to such SNPs.

[0069] For example, a user might indicate SNPs of particular interest. The distance between each phenotypic information SNP in the genome dataset and the indicated SNP is determined, for example, using a genome pathway network. For a given SNP, if the distance between that SNP and the indicated SNP is below a threshold distance, that SNP is added to a subset of phenotypic information SNPs to which priority indications are applied.

[0070] If phenotypic SNPs are masked in operation 460, a new re-identification risk score is calculated in operation 430 without using the data corresponding to the masked phenotypic SNPs. In other words, the phenotypic SNPs selected in operation 450 are effectively removed from the genome dataset. Data corresponding to such phenotypic SNPs is not used in subsequent calculations of the re-identification risk score.

[0071] Phenotypic SNPs are removed from the genome dataset, for example, by masking them, until the resulting re-identification risk score meets the threshold risk criterion. For example, if the threshold risk criterion indicates an acceptable risk level, the selection and masking of phenotypic SNPs and the recalculation of the re-identification risk score are repeated until the genome dataset is sufficiently anonymized.

[0072] Figure 5 schematically illustrates an example of a computer-readable medium having a writable portion containing a computer program 1020 that includes instructions for causing a processor system to perform the method shown in Figure 4. The computer program 1020 is embodied on the computer-readable medium 1000 as a physical mark or by magnetization of the computer-readable medium 1000. However, any other suitable embodiment is equally conceivable. Furthermore, although the computer-readable medium 1000 is shown here as an optical disc, it will be understood that the computer-readable medium 1000 may be any suitable computer-readable medium such as a hard disk, solid-state memory, or flash memory, and may be non-recordable or recordable. The computer program 1020 includes instructions for causing a processor system to perform the above method which provides diagnostic assistance to a user.

[0073] Figure 6 schematically shows a processor system 1140 according to an embodiment of system 100 for anonymizing genome datasets. The processor system includes one or more integrated circuits 1110. Figure 6 schematically shows the architecture of one or more integrated circuits 1110. Circuit 1110 includes a processing unit 1120, such as a CPU, for executing computer program components that perform the method according to the embodiment or implement the module or unit thereof. Circuit 1110 includes a memory 1122 for storing programming code, data, etc. Part of the memory 1122 may be read-only. Circuit 1110 may include a communication element 1126, such as an antenna, a connector, or both. Circuit 1110 may include a dedicated integrated circuit 1124 for performing some or all of the processing defined by the method described above. The processor 1120, memory 1122, dedicated IC 1124, and communication element 1126 are interconnected via an interconnect 1130, which is a bus. The processor system 1110 may be configured for contact and / or contactless communication using antennas and / or connectors.

[0074] For example, in one embodiment, a processor system 1140, such as a system for anonymizing a genome dataset, includes a processor circuit and a memory circuit, where the processor executes software stored in the memory circuit. For example, the processor circuit may be an Intel Core i7 processor, an ARM Cortex-R8, etc. In an embodiment, the processor circuit may be an ARM Cortex-M0. The memory circuit may be a ROM circuit or a non-volatile memory such as flash memory. The memory circuit may also be a volatile memory such as SRAM memory. In the latter case, the system may include a non-volatile software interface (such as a hard drive or network interface) configured to provide the software.

[0075] The system 100 for anonymizing genome datasets is shown as including one of the components described, but various components may overlap in various embodiments. For example, the processor 1120 may include multiple microprocessors that independently perform the method described herein, or perform steps or subroutines of the method described herein, so that multiple processors cooperate to achieve the functions described herein. Furthermore, if the system 100 is implemented in a cloud computing system, various hardware components may belong to separate physical systems. For example, the processor 1120 may include a first processor in a first server and a second processor in a second server.

[0076] The embodiments described above are illustrative, not limiting, to the subject matter disclosed herein, and it should be noted that those skilled in the art can design many alternative embodiments.

[0077] In the claims, any reference numerals in parentheses should not be construed as limiting the claims. The use of the verb “includes” and its conjugations does not exclude the existence of elements or steps other than those enumerated in the claims. Singular elements do not exclude the existence of multiple elements. Expressions such as “at least one” when preceding a list of elements represent a selection of all or a subset of the elements in the list. For example, the expression “at least one of A, B, and C” should be understood to include A only, B only, C only, both A and B, both A and C, both B and C, or all of A, B, and C. The subject matter disclosed herein is realized by hardware comprising several different elements and by a appropriately programmed computer. In a device claim enumerating several components, some of these components may be embodied by the exact same hardware item. The mere fact that certain means are described in mutually different dependent claims does not mean that combinations of these means cannot be used advantageously.

[0078] In the claims, reference numerals in parentheses refer to reference numerals or formulas of embodiments in the drawings illustrating embodiments, and are therefore intended to enhance the understanding of the claims. These reference numerals shall not be construed as limiting the claims.

Claims

1. A computer-based method for anonymizing a genome dataset, wherein the genome dataset comprises multiple alleles sequenced in multiple single nucleotide polymorphisms (SNPs), each of the multiple SNPs comprises one or more phenotypic information SNPs, each of the phenotypic information SNPs is an SNP associated with a phenotypic trait, the genome dataset corresponds to an individual's genome, and the method is: The steps include receiving the aforementioned genome dataset, A step of obtaining the phenotypic probability of at least one phenotypic information SNP corresponding to a certain phenotypic trait, the genotype frequency of the allele occupying the phenotypic information SNP, and the proportion of a population exhibiting the certain phenotypic trait, wherein the phenotypic probability is the probability that the phenotypic trait is expressed as a result of at least one allele corresponding to the at least one phenotypic information SNP; A step of calculating a re-identification risk score based on the genome dataset, wherein the re-identification risk score represents the risk of re-identifying the individual associated with the genome dataset from the genome dataset, and the re-identification risk score is calculated by calculating the product or logarithmic sum of the obtained phenotypic probability and the obtained genotype frequency, calculating a contributing term corresponding to a certain phenotypic trait from the quotient of the obtained proportion and the product or the logarithmic difference of the proportion and the logarithmic sum, and the re-identification risk score is calculated as the contributing term itself or its reciprocal. The steps include comparing the aforementioned re-identification risk score with a threshold risk criterion, If the aforementioned re-identification risk score does not meet the threshold risk criteria, Select the phenotypic information SNP corresponding to the phenotypic trait considered in the calculation of the aforementioned re-identification risk score, The genome dataset is anonymized by masking the selected phenotypic information SNPs. The aforementioned re-identification risk score is recalculated, If the aforementioned re-identification risk score meets the threshold risk criteria, The steps include outputting the anonymized genome dataset, A computer implementation method, including

2. A step of comparing the re-identification risk score with the threshold risk criterion, The steps of anonymizing the genome dataset and The step of recalculating the aforementioned re-identification risk score is: The computer implementation method according to claim 1, wherein the re-identification risk score is repeated until the threshold risk criterion is met.

3. The computer implementation method according to claim 1 or 2, further comprising the step of encrypting the anonymized genome dataset.

4. The step of calculating the aforementioned re-identification risk score is: For multiple phenotypic SNPs related to a certain phenotypic trait, calculate a plurality of the aforementioned products or logarithmic sums. The quotient or logarithmic difference is calculated using the largest of the aforementioned products or logarithmic sums. A computer implementation method according to claim 1, including the following:

5. The step of calculating the aforementioned re-identification risk score is: For multiple phenotypic SNPs related to a certain phenotypic trait, calculate a plurality of the aforementioned products or logarithmic sums. The quotient or logarithmic difference is calculated using the average of the plurality of products or logarithmic sums. A computer implementation method according to claim 1, including the following:

6. The computer implementation method according to any one of claims 1 to 5, wherein the one or more phenotypic information SNPs include a subset of SNPs having priority indicators, and the step of selecting the phenotypic information SNPs includes the step of selecting phenotypic information SNPs that do not have priority indicators.

7. The subset of SNPs having the priority indication is: For each of the one or more phenotypic information SNPs, The distance between the aforementioned SNP and a pre-specified SNP of interest is determined. The computer implementation of claim 6, wherein if the determined distance is within a threshold distance, the SNP is identified by adding it to the subset of SNPs having the priority indication.

8. The computer implementation method according to any one of claims 1 to 7, wherein the step of masking the selected phenotypic information SNPs includes the step of deleting data entries representing the selected phenotypic information SNPs in the genome dataset.

9. The computer implementation method according to any one of claims 1 to 8, further comprising the step of outputting the re-identification risk score.

10. The computer implementation method according to any one of claims 1 to 9, wherein the step of calculating the re-specification risk score includes the steps of obtaining statistical information relating to the dependencies between a plurality of phenotypic traits from a database, and applying a correction factor derived from the statistical information.

11. Identifying at least one direct identifier, wherein the direct identifier is an SNP that independently identifies the individual; The steps include masking the at least one direct identifier identified in the genome dataset, A computer implementation method according to any one of claims 1 to 10, further comprising:

12. The computer implementation method according to any one of claims 1 to 11, wherein the phenotypic trait includes an external phenotypic trait.

13. A computer program that, when executed by a processor system, causes the processor system to execute the computer implementation method described in any one of claims 1 to 12.

14. A system for anonymizing a genome dataset, wherein the genome dataset includes multiple alleles sequenced in multiple single nucleotide polymorphisms (SNPs), each of the multiple SNPs includes one or more phenotypic information SNPs, each of the phenotypic information SNPs is an SNP associated with a phenotypic trait, the genome dataset corresponds to an individual's genome, and the system is Receiving the aforementioned genome dataset, Obtaining the phenotypic probability of at least one phenotypic information SNP corresponding to a certain phenotypic trait, the genotype frequency of the allele occupying the phenotypic information SNP, and the proportion of a population exhibiting the certain phenotypic trait, wherein the phenotypic probability is the probability that the phenotypic trait is expressed as a result of at least one allele corresponding to the at least one phenotypic information SNP; The input / output subsystem that executes, The calculation of a re-identification risk score based on the genome dataset, wherein the re-identification risk score indicates the risk of re-identifying the individual associated with the genome dataset from the genome dataset, and the re-identification risk score is calculated by calculating the product or logarithmic sum of the obtained phenotypic probability and the obtained genotype frequency, calculating a contributing term corresponding to a certain phenotypic trait from the quotient of the obtained proportion and the product or the logarithmic difference of the proportion and the logarithmic sum, and the calculation is performed as the contributing term itself or its reciprocal. The aforementioned re-identification risk score is compared with the threshold risk criteria, If the aforementioned re-identification risk score does not meet the threshold risk criteria, Select a phenotypic information SNP corresponding to the phenotypic trait considered in the calculation of the aforementioned re-identification risk score, By masking the selected phenotypic information SNP, Anonymizing the aforementioned genome dataset, Recalculating the aforementioned re-identification risk score, Execute, If the aforementioned re-identification risk score meets the threshold risk criteria, A processor subsystem that performs the output of the anonymized genome dataset via the input / output subsystem, A system that includes this.

Images