arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2603.06950q-bio.GNcs.AIcs.LG
收藏

DNA嵌入的隐私性如何?逆向基础模型对基因组序列的表示

How Private Are DNA Embeddings? Inverting Foundation Model Representations of Genomic Sequences

Methods in Medical Informatics, Department of Computer Science, University of Tuebingen, Germany(图宾根大学医学信息学方法系,计算机科学系);Institute for Bioinformatics and Medical Informatics (IBMI), University of Tuebingen, Germany(图宾根大学生物信息学与医学信息学研究所)

Sofiane Ouaari, Jules Kreuer, Nico Pfeifer

AI总结:

研究评估了DNA基础模型在逆向攻击下的隐私安全性,发现嵌入相似性与序列相似性密切相关,DNABERT-2的分词方法更具隐私保护性。

摘要:

DNA基础模型已成为生物信息学和医疗应用中的变革性工具。这些模型在庞大的基因组数据集上进行训练,可以用来生成序列嵌入,即密集向量表示,能够捕捉复杂的基因组信息。这些嵌入越来越多地通过嵌入即服务(EaaS)框架共享,以促进下游任务,同时 supposedly 保护底层原始序列的隐私。然而,随着这种实践的普及,这些表示的安全性正受到质疑。本研究评估了DNA基础模型对模型逆向攻击的韧性,其中攻击者试图从模型输出中重建敏感的训练数据。在我们的研究中,模型的输出用于重建DNA序列是一个零样本嵌入,然后被输入解码器。我们评估了三个DNA基础模型的隐私:DNABERT-2、Evo 2和Nucleotide Transformer v2(NTv2)。我们的结果表明,每个token的嵌入允许在所有模型中实现几乎完美的序列重建。对于均值池化的嵌入,随着序列长度的增加,重建质量下降,尽管它仍然显著高于随机基线。Evo 2和NTv2证明是最易受攻击的,特别是对于较短的序列,重建相似度大于90%时。而DNABERT-2的BPE分词提供了最大的韧性。我们发现嵌入相似性与序列相似性之间的相关性是重建成功的关键预测因素。我们的发现强调了在广泛部署到EaaS环境之前,必须在基因组基础模型中进行隐私意识的设计。训练代码、模型权重和评估流程已发布在:https://github.com/not-a-feature/DNA-Embedding-Inversion。

英文摘要:

DNA foundation models have become transformative tools in bioinformatics and healthcare applications. Trained on vast genomic datasets, these models can be used to generate sequence embeddings, dense vector representations that capture complex genomic information. These embeddings are increasingly being shared via Embeddings-as-a-Service (EaaS) frameworks to facilitate downstream tasks, while supposedly protecting the privacy of the underlying raw sequences. However, as this practice becomes more prevalent, the security of these representations is being called into question. This study evaluates the resilience of DNA foundation models to model inversion attacks, whereby adversaries attempt to reconstruct sensitive training data from model outputs. In our study, the model's output for reconstructing the DNA sequence is a zero-shot embedding, which is then fed to a decoder. We evaluated the privacy of three DNA foundation models: DNABERT-2, Evo 2, and Nucleotide Transformer v2 (NTv2). Our results show that per-token embeddings allow near-perfect sequence reconstruction across all models. For mean-pooled embeddings, reconstruction quality degrades as sequence length increases, though it remains substantially above random baselines. Evo 2 and NTv2 prove to be most vulnerable, especially for shorter sequences with reconstruction similarities > 90%, while DNABERT-2's BPE tokenization provides the greatest resilience. We found that the correlation between embedding similarity and sequence similarity was a key predictor of reconstruction success. Our findings emphasize the urgent need for privacy-aware design in genomic foundation models prior to their widespread deployment in EaaS settings. Training code, model weights and evaluation pipeline are released on: https://github.com/not-a-feature/DNA-Embedding-Inversion.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑