A-G.08: How Private Are DNA Embeddings? Inverting Foundation Model Representations of Genomic Sequences
Jules Kreuer
University Tübingen
Nico Pfeifer
University Tübingen
Keywords
DNA Foundation Models, Safe Machine Learning Systems, Model Inversion Attack, Privacy-Preserving Machine Learning
[sponser-meet-now-chat][/sponser-meet-now-chat]
Genomic foundation models are increasingly used to share dense representations rather than raw DNA sequences. Whether this practice protects the underlying sequence is largely unknown. We benchmark training-based model inversion against zero-shot embeddings from DNABERT-2, Evo 2, and Nucleotide Transformer v2 (NTv2), focusing on mean-pooled representations. Mean pooling reduces leakage but does not eliminate it: a single multi-length Length-Conditioned Query Decoder (LCQD) reconstructs NTv2 sequences with mean Levenshtein similarity from 0.984 at 10 nucleotides to 0.674 at 100, and Evo 2 sequences from nearly 1.000 at 15 nucleotides to 0.670 at 100. DNABERT-2 is more resistant (0.562 to 0.508), although it remains above the random baseline at short lengths. We further translate reconstruction into a linkage attack against 1,000 individuals from the 1000 Genomes Project. At SNP-enriched length-25 loci and known coordinates, Evo 2 and NTv2 reach 99% top-1 identification at 32 embeddings and DNABERT-2 at 256. With alignment-based coordinate recovery, the corresponding 99% budgets are 64 and 128 embeddings for Evo 2 and NTv2, while DNABERT-2 does not reach the reported identification thresholds.
Randomly placed loci require much larger budgets. These results show that mean-pooled embeddings are not a privacy boundary, and that leakage depends on sequence length, the representation, locus informativeness, and coordinate side information.
Co-authors: Jules Kreuer, Nico Pfeifer
Contact Attendee
Warning: Attempt to read property "user_email" on string in /home/1276969.cloudwaysapps.com/ydbgzhdjeq/public_html/wp-content/plugins/my-conference-now/functions.php on line 2826