The Yes-or-No Oracle: Re-identifying People Through a Genomic Beacon

Case at a glance

Case number

025

Date / range

2015

Sector

Re-identification and inference

Genetic asset

Genomic beacon responses and target variant information

Security principle

Query Interface Leakage

Event summary

A genomic beacon may answer only whether a variant exists in a dataset, yet a sequence of yes/no responses can support membership inference. Minimal answers can still reveal a sensitive whole when queries accumulate.

Source: doi.org — Genomic Beacon Re-Identification source 1.

Source: ga4gh.org — Genomic Beacon Re-Identification source 2.

The case in context

A beacon can provide a very small answer to each query while revealing more through a collection of responses. The research example asks whether someone with knowledge of a target's variants can use that pattern to infer dataset membership.

The individual response and the whole interface need different privacy assessments. Authentication, query limits, and other defenses affect the circumstances under which an inference might work. This case concerns a published demonstration and its assumptions; it is not a claim that every deployed beacon exposes its participants or that a live service was attacked.

Acquisition and processing

target genotype → repeated API queries → response pattern → likelihood test → membership inference → disease-cohort exposure

The sequence of events

1. target genotype
2. repeated API queries
3. response pattern
4. likelihood test
5. membership inference
6. disease-cohort exposure

What became inferable or exposed

Genomic beacon responses and target variant information

A genomic beacon may answer only whether a variant exists in a dataset, yet a sequence of yes/no responses can support membership inference. Minimal answers can still reveal a sensitive whole when queries accumulate.

Affected parties and consent

Direct parties

Dataset participants represented in the demonstration

Indirect parties

Relatives and connected participants may be relevant where the asset contains relationship information.

Direct count

Unknown / not assigned

Indirect count

Unknown / not assigned

Consent status

Permission to contribute a record does not settle what may be inferred about a nonparticipant or relative. Public availability and authorization for a particular use should be distinguished.

Security dimensions

Confidentiality

The confidentiality question concerns genomic beacon responses and target variant information. Exposure and further inference must be distinguished from the fact of collection or availability.

Integrity

The integrity question is whether the described material, permissions, processing, or interpretation can be relied upon. Query Interface Leakage identifies the particular boundary examined here.

Availability

Access and continuity are assessed for the described event; potential effects are not presented as confirmed outages or losses.

Provenance

The relevant chain follows genomic beacon responses and target variant information through the stages shown below. Missing public detail is not proof that internal records did not exist.

Consent, persistence, and relational exposure

Consent

Permission to contribute a record does not settle what may be inferred about a nonparticipant or relative. Public availability and authorization for a particular use should be distinguished.

Persistence

Later reuse depends on the actual asset and links to other records; no future misuse is asserted.

Relational exposure

Relatives and connected participants may be relevant where the asset contains relationship information.

Case-specific assessment

confidentiality critical; availability tension because defenses may reduce openness; integrity low; consent high; persistence high.

GeneticSecurity.org analysis

Proposed classification and its limits

Suggested GER: GER-0/1. Suggested GPR: GPR-4/5. GPI: not central.

These are proposed classifications from the supplied case dossier. Conditional scores describe an assumed exposure; they are not evidence that it occurred. A single numeric value is left unassigned when the asset or outcome is not sufficiently bounded.

What this case does not prove

The research does not establish that every beacon is vulnerable under every dataset size, query rule, or defensive configuration.

Mitigations and lessons

• Authentication
• Query budgets
• Rate limits
• Minimum cohort sizes
• Response perturbation
• Aggregation
• Auditing
• Access tiers
• Privacy testing before deployment

Primary sources

• PRIMARY SOURCE doi.org — Genomic Beacon Re-Identification source 1
• PRIMARY SOURCE ga4gh.org — Genomic Beacon Re-Identification source 2

Secondary sources

No additional source listed. See the evidence notes for limitations.

Related concepts

• Genetic Exposure Radius — Scope of relational exposure
• Genetic Persistence Risk — Durability after compromise
• Genetic Provenance Integrity — Verifiability of the chain of custody

Related cases

• Case 021 — Compare Icelandic Population Imputation for population imputation spillover. This case focuses on query interface leakage.
• Case 022 — Compare Homer Et Al. And Aggregate GWAS Data for membership inference from summary data. This case focuses on query interface leakage.
• Case 023 — Compare Gymrek Surname Inference for quasi-identifier fusion. This case focuses on query interface leakage.
• Case 024 — Compare James Watson's Redacted APOE Region for correlated-data leakage. This case focuses on query interface leakage.

Policy and standards

Review and correction history

Source edition: September 19, 2026. Imported case account; no substantive corrections recorded.

Cite this case

GS-CASE-025. The Yes-or-No Oracle: Re-identifying People Through a Genomic Beacon. GeneticSecurity.org. https://geneticsecurity.org/cases/025-genomic-beacon-membership-inference/