Homomorphic encryption enables private genomic model analysis
Feasibility of Homomorphic Inference for a Genomic Foundation Model
Cryptography and Security
Summary
Genomic data is very personal and cannot be shared openly without risks. The authors show it's possible for a computer service to run a complex DNA analysis model without actually seeing the raw DNA data, by using a special type of encryption. This method splits the work so the service processes encrypted data while the data owner handles sensitive parts, keeping the DNA information private. They successfully ran the entire model encrypted on one DNA input, proving that such private analysis is possible although some challenges remain.
What this means in practice
- •For cloud service providers: Offer DNA analysis services that keep clients' genomic data encrypted and private throughout computation.
- •For biomedical data security teams: Deploy genomic classifiers in encrypted form to protect patient privacy during remote analysis.
Authors
Christos Galanopoulos, Kimon Antonios Provatas, Ilias Georgakopoulos-Soares
Abstract
Human genomic sequences can identify individuals, cannot be replaced after disclosure, and are the inputs that genomic foundation models are designed to interpret. We assess whether a compute provider can execute a released genomic foundation model without receiving query-derived genomic values in plaintext and whether correctness, memory, or cost prevents complete encrypted inference. We first reproduce the released model on three genomic task families and freeze an independently validated numerical reference. We then implement a client-assisted approximate homomorphic encryption protocol: the provider evaluates linear algebra on ciphertexts, while the key-holding data owner evaluates exact normalization, causal softmax, and activation functions at fixed boundaries. A noninteractive configuration completes one released-weight block but exceeds the tested accelerator-memory envelope when configured for composition. The client-assisted configuration executes all released transformer blocks and the task head for one heldout genomic-signal input at its full prompt length. It matches the frozen final label, peaks at 9,839 mebibytes of accelerator memory, and completes in 6,683 seconds on one accelerator. These results establish arithmetic feasibility for a complete classifier, while repeatability, network transport, and private token-index lookup remain unresolved. The biomedical significance is that, under the stated threat model, a served genomic model can process an encoded sequence without exposing plaintext queryderived activations to the compute provider.