Expanding Access to Large-Scale Genomic Data While Promoting Privacy: A Game Theoretic Approach  Zhiyu Wan, Yevgeniy Vorobeychik, Weiyi Xia, Ellen Wright Clayton, Murat Kantarcioglu, Bradley Malin  The American Journal of Human Genetics  Volume 100, Issue 2, Pages 316-322 (February 2017) DOI: 10.1016/j.ajhg.2016.12.002 Copyright © 2017 American Society of Human Genetics Terms and Conditions

Figure 1 A Comparison of Genomic Summary Data Sharing Policies for Participants in the SPHINX Program The compared policies include (1) the single-nucleotide polymorphism (SNP) suppression policies, which rely only on hiding of genomic regions (blue dots), (2) the existing SNP suppression policy, according to Sankararaman et al.’s approach (red circle), (3) the data use agreement (DUA) policy, which relies only on a legally enforceable contract (gold square), (4) the game theoretic policy, which allows for a combination of a DUA and SNP suppression in a Stackelberg framework (brown triangle), (5) the no-risk game theoretic policy, which ensures no attack is committed by the recipient (green outlined triangle), and (6) the no SNP suppression policy, whcih illustrates what transpires when no DUA or SNP suppression is applied (purple circle). Utility is directly related to the absolute difference between the minor allele frequencies of shared SNPs in the study and their known minor allele frequencies in the underlying reference population (a utility score of 1 is achieved when all SNPs are shared). Privacy is inversely related to risk, the likelihood a recipient achieves success in compromising the privacy protection of targeted individuals (a privacy score of 1 is achieved when no attacks are successful—in other words, when no risk exists). A higher payoff value represents a more desirable option. SPHINX, Sequence and Phenotype Integration Exchange. The American Journal of Human Genetics 2017 100, 316-322DOI: (10.1016/j.ajhg.2016.12.002) Copyright © 2017 American Society of Human Genetics Terms and Conditions

Figure 2 The Genomic Data Sharing Process In this process, a genomic data sharing policy is made by the sharer (A), a recipient chooses to attack targets in received data (B), and the overall payoffs as a consequence are shown (C). SNP, single-nucleotide polymorphism; DUA, data use agreement. The American Journal of Human Genetics 2017 100, 316-322DOI: (10.1016/j.ajhg.2016.12.002) Copyright © 2017 American Society of Human Genetics Terms and Conditions

Figure 3 Comparisons of Four Protection Policies for the SPHINX Program with a Varying Penalty against the Genomic Inference Attack The compared policies include (1) the optimal game theoretic solution (brown lines), (2) the game theoretic solution that ensures no attack is successful (black lines), (3) the data use agreement (DUA) (yellow lines), and (4) the SNP suppression solution (blue lines) with no penalty. The overall payoff (the main graph on the right) is the result of combining (1) the privacy protection afforded to the targeted individuals (the upper graph on the left) and (2) the utility in the set of SNPs that are shared (the lower graph on the left). SPHINX, Sequence and Phenotype Integration Exchange. The American Journal of Human Genetics 2017 100, 316-322DOI: (10.1016/j.ajhg.2016.12.002) Copyright © 2017 American Society of Human Genetics Terms and Conditions

Figure 4 Comparisons of Four Protection Policies for a Range of Genomic Data Sharing Programs with Varying Prior Probabilities against the Genomic Inference Attack The compared policies include (1) the optimal game theoretic solution (brown bars filled with downward diagonal pattern), (2) the game theoretic solution that ensures no attack is successful (black bars with no fill), (3) the data use agreement (DUA) (gold bars filled with checkerboard pattern), and (4) the single-nucleotide polymorphism (SNP) suppression solution (blue bars with solid fill). The overall payoff (the main graph on the right) is the result of combining (1) the privacy protection afforded to the targeted individuals (the upper graph on the left) and (2) the utility in the set of SNPs that are shared (the lower graph on the left). PMI, Precision Medicine Initiative; MVP, Million Veteran Program; SPHINX, Sequence and Phenotype Integration Exchange; BioVU, de-identified biorepository of Vanderbilt University Medical Center; RDCRN, Rare Diseases Clinical Research Network. The American Journal of Human Genetics 2017 100, 316-322DOI: (10.1016/j.ajhg.2016.12.002) Copyright © 2017 American Society of Human Genetics Terms and Conditions