GoKawiilMost genomic studies begin by asking participants to upload one of the most identifying and irrevocable pieces of data they own, their DNA. I continue to investigate whether multi-party computation can offer a different model, one in which a study can produce useful results without anyone collecting the participants’ genomes in the first place.
That question has now led me to build a proof of concept with Stoffel MPC. One hundred simulated participants successfully computed aggregate allele counts without any party seeing the complete dataset. This post explains what I built, how it performed and what I learned.
Stoffel MPC has launched
Stoffel recently launched version 0.1.0 of its multi-party computation (MPC) platform with the ambitious goal of making privacy-preserving applications accessible to ordinary developers and not just to teams of cryptography boffins.
MPC lets several computers perform calculations on private data without any one of the computers receiving the complete inputs. Although MPC systems have traditionally been difficult to build with Stoffel presents the technology as an approachable developer platform. Applications are written in its Python-like StoffelLang, compiled to bytecode and executed by the Stoffel VM across a set of MPC parties.
We no longer have to rely on a more robust privacy policy or a more secure central database. We can simply avoid collecting the raw data in one place.
Naturally, I wanted to try it with Monadic DNA
Given my ongoing work on Monadic DNA, genomics was an obvious test case. In an earlier experiment, my colleagues and I used Nillion and real genotype data from thirty participants to explore private DNA analysis.
Genetic data is an unusually good test of a privacy system. It is highly identifying, can reveal information about relatives and cannot be changed after a breach. At the same time, many useful genomic studies do not need to inspect individual records. A researcher may only need cohort-level variant counts or a score calculated across the group.
The concrete use case I wanted to explore was a revamped Monadic DNA mobile app. A Monadic DNA user keeps their genotype data on their phone and may choose to participate in a study that needs aggregate statistics across many users (perhaps in return for a payment). The question was whether the app could contribute that data securely without first uploading the user’s complete genotype to Monadic DNA, the researcher or another trusted central service.
... continue reading