Differential Privacy Budget

Epsilon is a non-negative real number that defines the privacy loss parameter. A smaller epsilon (e.g., ε = 0.1) provides a stronger privacy guarantee by ensuring that the output distribution of an algorithm is nearly identical whether or not any single individual's genomic record is included in the dataset.

• ε = 0: Perfect privacy, but zero utility (output is pure noise).
• ε = 0.1–1.0: Strong privacy, typical for high-sensitivity genomic studies.
• ε = 10+: Weak privacy, approaching non-private analysis.

The guarantee is formally expressed as: for any two neighboring datasets differing by one record, the probability ratio of any output is bounded by e^ε.

When multiple differentially private queries are performed on the same genomic dataset, the total privacy budget is the sum of the individual epsilons. This is the fundamental accounting rule of differential privacy.

• If you run query A with ε = 0.3 and query B with ε = 0.4, the total privacy cost is ε = 0.7.
• This forces a global budget constraint on the entire analysis pipeline.
• Genomic researchers must plan queries carefully to avoid exhausting the budget before all necessary analyses are complete.
• Tools like privacy odometers track cumulative spend in real-time.

When differentially private queries operate on disjoint, non-overlapping subsets of a genomic database, the total privacy cost is the maximum of the individual epsilons, not the sum.

• If a dataset is partitioned by chromosome and a query with ε = 0.5 runs independently on each partition, the total cost remains ε = 0.5.
• This property is critical for scalable genomic analysis, allowing parallel computation across cohorts without multiplying the privacy loss.
• Enables efficient distributed processing in federated learning architectures where data is naturally partitioned across institutions.

Any computation applied to the output of a differentially private mechanism cannot weaken the privacy guarantee. Once noise has been calibrated to satisfy ε-differential privacy, no downstream analysis—no matter how sophisticated—can reverse-engineer the protected individual contributions.

• A genomic model trained on DP-sanitized summary statistics inherits the same privacy guarantee.
• This property enables safe release of privatized genomic data to third-party researchers.
• It is a one-way property: post-processing can degrade utility but never privacy.
• Critical for open-science initiatives sharing variant frequency databases.

Pure ε-differential privacy can be too restrictive for many genomic applications. (ε, δ)-differential privacy introduces a small failure probability delta, allowing the privacy guarantee to be violated with probability at most δ.

• δ is typically chosen to be cryptographically small, e.g., 10⁻⁶ or smaller than the inverse of the dataset size.
• Enables practical mechanisms like the Gaussian mechanism, which is essential for high-dimensional genomic data.
• The Gaussian mechanism adds noise calibrated to the L2-sensitivity of a query, scaled by ε and δ.
• Most real-world genomic DP deployments use this relaxed definition.

The global sensitivity of a query measures the maximum change in its output when a single individual's genomic record is added or removed. This value directly determines how much noise must be added to achieve a given ε.

• L1-sensitivity: Maximum absolute difference in query output (used for Laplace mechanism).
• L2-sensitivity: Maximum Euclidean distance (used for Gaussian mechanism).
• A query counting variants in a cohort has sensitivity = 1; a sum of allele frequencies has higher sensitivity.
• Clipping and bounding are preprocessing steps that limit sensitivity, trading some accuracy for reduced noise requirements.

The privacy loss parameter that quantifies the maximum divergence between outputs of a randomized algorithm on neighboring datasets differing by one record. A smaller epsilon (e.g., ε = 0.1) provides stronger privacy but adds more noise, while larger values (e.g., ε = 10) yield higher accuracy at the cost of weaker guarantees. In genomic contexts, epsilon values between 1 and 8 are commonly explored for GWAS analyses, balancing variant discovery power against re-identification risk.

The primary method for achieving (ε, δ)-differential privacy by adding calibrated Gaussian noise to query outputs. The noise scale is proportional to the L2 sensitivity of the query divided by epsilon. For genomic applications like allele frequency queries, the sensitivity is typically 1/n where n is the cohort size, allowing tighter noise calibration for larger populations. This mechanism is preferred over the Laplace mechanism when composing multiple queries due to its tighter composition properties under advanced composition theorems.

The fundamental property that epsilon values accumulate across multiple queries on the same dataset. Key composition theorems include:

• Basic Composition: k queries each with ε_i consume a total budget of Σ ε_i
• Advanced Composition: Allows a tighter bound of O(√k) growth for (ε, δ)-DP mechanisms
• Rényi DP Composition: Provides exact composition using Rényi divergence, enabling more precise budget tracking for genomic pipelines with hundreds of iterative queries

The measurement of a query's maximum output change when a single record is added or removed from the dataset. Global sensitivity (worst-case over all possible neighboring datasets) determines the noise magnitude required. In genomic contexts, queries like minor allele frequency have sensitivity of 1/(2n) for L1 distance, while more complex queries like PCA loadings require careful sensitivity bounding through clipping norms or smooth sensitivity frameworks to avoid excessive noise injection.

A complementary cryptographic technique that enables computation directly on encrypted genomic data without decryption. Unlike differential privacy, which adds statistical noise, homomorphic encryption provides exact results on ciphertexts. Modern schemes like CKKS support approximate arithmetic on real numbers, making them suitable for genomic model inference. Often combined with differential privacy in hybrid approaches where HE protects data in transit and DP guards against inference-time leakage.

The probability that an adversary can link anonymized genomic records to specific individuals using auxiliary information. Key attack vectors include:

• Quasi-identifier linkage: Matching rare variant combinations against public databases
• Allele frequency matching: Correlating aggregate statistics with known genotypes
• Beacon attacks: Repeatedly querying genomic beacons to infer membership The privacy budget directly bounds this risk, with ε = ln(1/(1-δ)) providing a formal guarantee against membership inference.