Privacy-preserving chi-squared test of independence for small samples

Abstract

Background: The importance of privacy protection in analyses of personal data, such as genome-wide association studies (GWAS), has grown in recent years. GWAS focuses on identifying single-nucleotide polymorphisms (SNPs) associated with certain diseases such as cancer and diabetes, and the chi-squared (χ²) hypothesis test of independence can be utilized for this identification. However, recent studies have shown that publishing the results of χ² tests of SNPs or personal data could lead to privacy violations. Several studies have proposed anonymization methods for χ² testing with ε-differential privacy, which is the cryptographic community's de facto privacy metric. However, existing methods can only be applied to 2×2 or 2×3 contingency tables, otherwise their accuracy is low for small numbers of samples. It is difficult to collect numerous high-sensitive samples in many cases such as COVID-19 analysis in its early propagation stage.

Results: We propose a novel anonymization method (RandChiDist), which anonymizes χ² testing for small samples. We prove that RandChiDist satisfies differential privacy. We also experimentally evaluate its analysis using synthetic datasets and real two genomic datasets. RandChiDist achieved the least number of Type II errors among existing and baseline methods that can control the ratio of Type I errors.

Conclusions: We propose a new differentially private method, named RandChiDist, for anonymizing χ² values for an I×J contingency table with a small number of samples. The experimental results show that RandChiDist outperforms existing methods for small numbers of samples.

Keywords: Chi-squared testing; Differentical privacy; Privacy-preserving data mining.

Fig. 1

Neighboring databases. a Tables for J≥3. b Tables for J=2

Fig. 2

Significance results based on 2×2 contingency tables. The dashed lines represent 1−α. a Results with ε=0.1,α=0.005. b Results with ε=0.1,α=0.01. c Results with ε=0.1,α=0.05

Fig. 3

Significance results based on 4×4 contingency tables. The dashed lines represent 1−α. a Results with ε=0.1,α=0.005. b Results with ε=0.1,α=0.01. c Results with ε=0.1,α=0.05

Fig. 4

Empirical power results with 2×2 Contingency tables generated with probabilities of (0.25+0.01,0.25−0.01,0.25−0.01,0.25+0.01). a Results with ε=0.1,α=0.005. b Results with ε=0.1,α=0.01. c Results with ε=0.1,α=0.05

Fig. 5

Empirical power results with 2×2 Contingency tables generated with probabilities of (0.25+0.15,0.25−0.15,0.25−0.15,0.25+0.15). a Results with ε=0.1,α=0.005. b Results with ε=0.1,α=0.01. c Results with ε=0.1,α=0.05

Fig. 6

Empirical power results with 2×2 Contingency tables generated with probabilities of (0.3+0.15,0.3−0.15,0.2−0.15,0.2+0.15). a Results with ε=0.1,α=0.005. b Results with ε=0.1,α=0.01. c Results with ε=0.1,α=0.05

Fig. 7

Empirical power results with 3×4 Contingency tables generated with probabilities of (1/12+0.07,1/12−0.07,1/12,1/12,1/12−0.07,1/12+0.07,1/12,…,1/12). a Results with ε=0.1,α=0.005. b Results with ε=0.1,α=0.01. c ε=0.1,α=0.05

Fig. 8

Results of the HGDP genotype datasets. a Results with False Positive Rate (α=0.005). b Results with False Positive Rate (α=0.01). c False Positive Rate (α=0.05). d False Negative Rate (α=0.005). e False Negative Rate (α=0.01). f False Negative Rate (α=0.05)

Fig. 9

Results of the HapMap genotype datasets. a Results with False Positive Rate (α=0.005). b False Positive Rate (α=0.01). c False Positive Rate (α=0.05). d False Negative Rate (α=0.005). e False Negative Rate (α=0.01). f False Negative Rate (α=0.05)