Privacy in Pharmacogenetics: An End-to-End Case Study of Personalized Warfarin Dosing

Privacy in Pharmacogenetics: An End-to-End Case Study of Personalized Warfarin Dosing. In this 2014 USENIX Security Symposium study, Matthew Fredrikson and colleagues introduced model inversion: using a released predictive model, plus outside facts, to infer a sensitive attribute that the model used as an input. They examine when that attack can expose genotype information, whether differential privacy reduces the signal, and what privacy protection may cost in modeled clinical outcomes.

The released predictor was a linear model for stable warfarin dose. Its inputs included the genotype attributes VKORC1 and CYP2C9, along with other patient information. The privacy target was not the whole medical record; it was one of those genotype values. The attacker could query the model without inspecting its internals and combine the output with facts about the patient and population. Differential privacy, however, limits what changes when one person’s record participates in training. Attribute inference asks a different question: can a sensitive fact still be inferred from patterns across the population?

The practical question is narrower than asking whether the model leaks. Suppose an attacker knows a target’s stable dose and background details, along with population frequencies and information about the model’s prediction error. Can the attacker guess the hidden genotype more accurately than simply choosing the most common value? The study also examines whether differentially private ways of building a linear predictor reduce that advantage, and whether the resulting dose recommendations remain useful in the clinical simulation.

After preprocessing, the researchers trained on 2,644 patients and validated on 853. They targeted either VKORC1 or CYP2C9. For each possible genotype, the attack built a candidate version of the patient’s input, combined population frequencies with known model-error behavior, and selected the value with the highest estimated probability. The evaluation varied how much background information the attacker knew, from basic demographics to every non-target attribute available in the experiment. Separately, the utility analysis simulated dose adjustment and treatment outcomes under fixed dosing, a non-private genomic model, and differentially private genomic models.

For VKORC1, simply choosing the most common value was accurate roughly one-third of the time. With all evaluated background information, model inversion improved on that baseline by up to 22 percentage points, though it still trailed a separate linear predictor built specifically to infer the genotype. The attack was also more accurate on training patients than on validation patients. When the researchers repeatedly changed which patients were held out for checking, the training advantage was unlikely to be due to random variation. Under these conditions, the trained model revealed extra information about VKORC1 for its training patients, but this is not proof that every prediction reveals a genotype.

Next came the privacy mechanisms. The researchers compared a method based on private summary counts with differentially private linear regression. At epsilon no greater than 1, the private regression stayed close to the VKORC1 baseline, with no detectable training-versus-validation difference. At 5 or more, both mechanisms showed a significant training-set advantage and neared non-private behavior around 20. The private-summary method leaked more VKORC1 information at every tested setting.

Several boundaries keep this from being a universal attack. Its claim to minimize wrong genotype guesses on average assumes a prior estimate built from separate population frequencies. If real attributes are correlated in ways that estimate misses, or if the model carries little information about the target, the attack can be weak. For CYP2C9, neither inversion nor the dedicated predictor beat the skewed 75 percent majority baseline. The dataset was public and de-identified, standing in for private records, and the clinical outcomes were simulated rather than observed in a deployed interface or a randomized test of privacy choices.

The clinical simulation makes the tradeoff concrete. For epsilon at most 5, the private models produced worse modeled outcomes: more serious adverse events or less time in the desired treatment range. Statistical tests indicated that these differences were unlikely to be due to random variation. Modeled mortality reached up to 1.26 times the fixed-dose risk. Utility improved at looser settings, but the researchers regarded those settings as offering little useful privacy against this attack. Health-model security teams should compare attack performance with realistic demographic and clinical priors, not raw accuracy alone. If clinical utility and attribute confidentiality cannot both survive release, the study recommends restrictive access controls rather than treating a release mechanism as a complete solution.

The useful contribution is an application-level way to evaluate privacy: test what a model output reveals when combined with realistic outside facts, then measure the protection against patient harm rather than predictive accuracy or a nominal privacy label alone. Health-model owners, security architects, and privacy teams should audit outputs with realistic auxiliary information and prior-based baselines, and restrict access when safe release is incompatible with confidentiality. They should not infer that this attack recovers arbitrary records, that differential privacy automatically hides correlated attributes, or that simulated warfarin results establish harm in deployment.