Auditing privacy of synthetic gene data improves attack detection rates
Auditing the Privacy of Synthetic Gene Expression Data: A Unified Weighted-Distance Framework for No-Box Membership Inference
Cryptography and Security
Summary
Synthetic gene data is made to protect patient privacy but can sometimes reveal if a patient’s information was used in creating it. The authors studied attacks that try to find out if specific patient data was included in training a model generating synthetic gene data. They combined five attack methods into one framework that adjusts how much each gene matters and found that removing common patterns in data improved detection significantly. Using biological knowledge about gene pathways did not help across different data targets.
What this means in practice
- •For data privacy teams: Improve testing methods to better detect if private genomic data was used in training synthetic data generators.
- •For genomic data platform engineers: Enhance synthetic gene expression data pipelines with more accurate privacy audits using a unified weighted-distance approach.
Authors
Owen Tucker, Lily Wang, Harutoshi Okumura, Ruixuan Liu, Li Xiong
Abstract
Synthetic gene expression data is increasingly proposed as a privacy-preserving substitute for controlled-access genomic repositories, but its safety depends on empirical auditing. Membership inference attacks (MIAs) provide that audit by testing whether a patient's gene expression profile was used to train a generative model. We report a red-team study on synthetic gene expression data derived from bulk RNA-seq profiles in The Cancer Genome Atlas, released by the ELSA Health 2026 Challenge. We unify five no-box attacks under a single weighted-distance framework in which each variant differs only in how it weights genes: uniformly (baseline), by variance, by synthetic-versus-reference KL divergence, by spectral residualization removing dominant principal components, and by curated pathway membership. Against a conditional variational autoencoder, spectral residualization raises AUC from 0.8251 to 0.8951 and TPR at 1% FPR from 0.3842 to 0.5970 on pan-cancer TCGA. Biological pathway priors did not transfer across targets.