Privacy-Enhancing Technologies in Biomedical Data Science

Abstract

The rapidly growing scale and variety of biomedical data repositories raise important privacy concerns. Conventional frameworks for collecting and sharing human subject data offer limited privacy protection, often necessitating the creation of data silos. Privacy-enhancing technologies (PETs) promise to safeguard these data and broaden their usage by providing means to share and analyze sensitive data while protecting privacy. Here, we review prominent PETs and illustrate their role in advancing biomedicine. We describe key use cases of PETs and their latest technical advances, and highlight recent applications of PETs in a range of biomedical domains. We conclude by discussing outstanding challenges and social considerations that need to be addressed to facilitate a broader adoption of PETs in biomedical data science.

1. Introduction

Data sharing is a vital force in biomedical innovation. Public data repositories and biobanks allow researchers at various organizations to analyze vast arrays of human subject data beyond what they may be able to collect themselves. Many academic labs, commercial enterprises, and hospitals have joined to form collaborative consortia to share biomedical data, in the hope of extracting insights that are inaccessible to individual entities due to limited data sizes. Policies and guidelines that promote the public dissemination of research data established by government entities (e.g., NIH Data Management and Sharing Policy¹) and international standard-setting organizations such as Global Alliance for Genomics and Health (GA4GH) (1) have played pivotal roles in preserving the culture of data sharing among the biomedical community, a tradition rooted in landmark collaborative efforts such as the Human Genome Project.

As we enter the era of personalized medicine, broader sharing of biomedical data is becoming more essential than ever. The limited diversity of human populations represented by existing biomedical datasets has reinforced inequities in how different groups benefit from biomedical advances (2). Studying rare diseases often requires merging small patient cohorts across organizations to enhance statistical power (3). Furthermore, accurately inferring health-related insights for each unique individual requires access to computational models trained on large and multi-modal datasets capturing the wide spectrum of individual variation in health and disease. Although recently created biobanks (e.g., the All of Us Research Program (4)) have taken a significant step toward recruiting diverse study participants, these resources are increasingly stored within siloed computing environments, limiting the scope and use of these datasets.

To further expand data sharing efforts in biomedicine, growing concerns about the privacy risks must be addressed with robust mitigation measures. In the absence of such measures, we may witness a greater dependence on restricted data silos, further compounded by the recent surge in more stringent privacy regulations (e.g., the General Data Protection Regulation [GDPR] in the European Union) and the escalating risks associated with the increasing scale of biomedical data. Moreover, a major data breach has the potential to erode public trust in the scientific enterprise. The loss of trust could not only hinder the efforts to gather large datasets but also worsen inequities by disproportionately affecting the willingness of certain populations to participate in studies.

Privacy-enhancing technologies (PETs) offer promising technical solutions to overcome these challenges by employing a variety of mathematical, algorithmic, and hardware design approaches to enable the sharing and analysis of sensitive data while protecting privacy (Figure 1). PETs encompass a broad range of techniques that address different data sharing scenarios and introduce various trade-offs in terms of the type of supported analyses, computational cost, and the degree of privacy protection offered. In this review, we focus on technologies that are most widely studied in the literature, including homomorphic encryption (HE), secure multiparty computation (MPC), trusted execution environment (TEE), differential privacy (DP), and federated learning (FL). Recent advances have greatly increased the applicability of each of these technologies in biomedicine, as we illustrate in this review. Unlike existing reviews that describe PETs as a potential solution to data-sharing challenges in biomedicine (5, 6, 7, 8, 9), we focus on providing an accessible summary of the latest advances in PETs, examining both their technical foundations and biomedical applications.

Figure 1.

Privacy-enhancing technologies (PETs) provide a range of mathematical, algorithmic, and hardware-based solutions to enable the sharing and analysis of sensitive biomedical data in various settings while protecting data privacy.

The rest of our article is organized as follows. Section 2 presents background on biomedical data privacy, covering its historical context and key concepts. Section 3 outlines the scenarios in biomedical research that involve data sharing. Section 4 delves into each PET, providing an overview of techniques, recent advances, limitations, and recent publications, exploring its application to biomedical tasks. Section 5 reviews related techniques that help facilitate the sharing of biomedical data. Finally, in Section 6, we conclude by discussing open challenges and highlighting key directions for future work.

2. Biomedical Data Privacy: Challenges and Existing Safeguards

Data privacy challenges in biomedicine have continually evolved over the past several decades, shaped by technological advances, increasing public awareness, and changes in policies and laws. From the 1960s to the 1980s, the biomedical community saw the establishment of ethical principles in human subject research, exemplified by documents like the Belmont Report (10). At the same time, concerns about patient privacy increased due to the digitization of medical records. The 1990s saw the establishment of the Common Rule and the Health Insurance Portability and Accountability Act (HIPAA) (11), marking initial efforts to create legal frameworks for safeguarding biomedical data in both research and healthcare. The completion of the Human Genome Project and the rapid growth of genetic research in the 2000s intensified concerns about the protection of human subjects and their genetic privacy. The 2010s witnessed a surge in privacy concerns in broader societal contexts fueled by the rise of social media, major data breaches, and controversy surrounding government surveillance (12, 13). The international community responded to these concerns by strengthening oversight over the collection, sharing, and use of personal information, such as via GDPR, enacted in 2018. More recent examples include Arizona and California’s 2021 genetic privacy laws (14), which strengthened privacy requirements for storing and sharing genetic data, as well as NIST’s Genomic Cybersecurity initiative, which called for new security standards in genomics (15). Currently, privacy concerns persist and extend to new biomedical domains, such as digital health (e.g., electronic health records, mobile applications, and wearable devices), multi-omics, and epidemic responsiveness in the wake of the COVID-19 pandemic (16). The growing number of large-scale biobanks and data repositories further amplifies these challenges.

The risks posed by biomedical data breaches are multifaceted. Although individuals have different notions of an acceptable privacy risk, unauthorized exposure of private information related to one’s biology and health may result in emotional distress, stigmatization, and discrimination in employment, education, and insurance opportunities. Perhaps more concerning, these harms could extend to families and demographic groups, for example, by disclosing genetic relationships between individuals or elevated health risks within groups, respectively. From the perspective of organizations that manage sensitive biomedical data, data breaches can lead to financial penalties, legal consequences, operational disruptions, and reputation damage. These risks are not just hypothetical—as of this writing, a lawsuit has been filed against 23andMe for a data breach that compromised nearly 1 million customers, including their full names, birthdates, and DNA profiles that were being sold on the dark web for up to $10 per leaked individual (17). Such leaks, if repeated, would lead to a decline in trust in the biomedical research enterprise and health systems, which would further set back future research efforts and impede scientific progress.

Biomedical privacy breaches can occur through multiple routes, each posing unique challenges (8, 18). Phenotype inference aims to deduce an individual’s traits or health conditions from different types of biomedical data, often in an unexpected manner. Reidentification occurs when inadequately anonymized data is linked back to an individual. This may involve combining multiple datasets, utilizing auxiliary information, or exploiting vulnerabilities in the de-identification process. Data linkage integrates information from different datasets to construct a more comprehensive profile of an individual, allowing attackers to reveal identity, health status, or other sensitive information about the individual. Even when the complete dataset including individual-level information is not directly shared, privacy may still be breached: data reconstruction attacks attempt to assemble fragments of available information to reveal a portion of the original data; and membership inference attacks focus on determining whether an individual is part of a specific dataset, which can disclose whether the person belongs to a sensitive or stigmatized group, potentially leading to privacy violations.

Conventional approaches for protecting privacy of biomedical data include policies and laws, technical security measures, and contractual agreements. Legal and financial penalties help serve as deterrents to misuse of biomedical information; both HIPAA and GDPR prescribe such penalties for non-compliance. The standard practice for securing biomedical data involves encrypting data at rest, employing a secure computing infrastructure, and deidentification strategies (19). Access control and user authentication mechanisms also are widely used to ensure that only authorized individuals can access sensitive data. Furthermore, researchers and organizations that share access to sensitive data typically establish data use agreements (DUAs) to define the permitted use of the data and guidelines for data management. Similarly, business associate agreements (BAAs), which are contracts between HIPAA-covered entities (e.g., hospitals) and their business associates (e.g., third-party service providers or collaborators), are an important tool for ensuring that entities that handle protected health information (PHI) comply with data protection standards.

Although these approaches offer useful safeguards for biomedical data, they do not eliminate the possibilities of data breaches or re-identification and rely primarily on limiting access to data to achieve security, which has resulted in many datasets being isolated and placed beyond the reach of most researchers. In addition, the ability to detect breaches and enforce penalties can be limited in practice; legal and policy criteria standards that determine what data qualifies as private or sufficiently de-identified for sharing lack clear definitions. As a result, many existing datasets are either shared insecurely based on trust or deemed ineligible for sharing due to privacy risks.

3. Data Sharing Scenarios and Limitations

Privacy risks and data-sharing constraints vary across different scenarios in biomedical research and practice. Here, we outline the typical data sharing scenarios (as illustrated in Figure 1) as well as the challenges faced by stakeholders in each context.

Study participation.

A private individual may voluntarily contribute health data and other personal information to studies (either clinical or non-clinical), data repositories, and third-party services. Participants typically provide informed consent, which outlines the details of data sharing, including the purpose, scope, and potential risks involved. Data sharing benefits participants by improving the collective understanding of health and disease, which could lead to better treatments or other health-related decisions. In the context of some services, participants may also receive personalized data insights. Privacy concerns are a key factor in an individual’s decision to participate in a study (20). The adequacy of informed consent remains a topic of ongoing debate, particularly with regard to the ethics of obtaining broad consent for the secondary use of data (21). Effectively communicating privacy risks also can be challenging, as some risks require technical expertise to fully understand them or are poorly understood even among researchers.

Queryable databases.

These databases are specifically designed to allow users to retrieve information through queries, providing a structured and efficient way to access biomedical data. Examples include patient registries used for study recruitment and various databases containing annotated genetic variants (22), electronic health records (EHRs) (23), and clinical trial data (24). While the restricted nature of queries minimizes information leakage, studies have shown that even with these limitations, unintended disclosures can occur (25). Such concerns may discourage individuals from participating in these databases as well as pose data management challenges to the database provider.

Analytic services.

This refers to the practice of delegating computational tasks to external entities that have access to restricted models or data resources, or more computing resources. The increasing computational demands of biomedical analysis workflows are compelling researchers to increasingly use these third-party services (26), many of which are hosted in cloud environments. However, privacy concerns or regulations can limit use of these services (e.g., an EU researcher wishing to upload data to a service operating in a non-EU country). Moreover, service providers may be required to introduce measures to protect the auxiliary models and data used by the server, which could be leaked through the analysis results returned to users (27).

Collaborative studies.

There is increasing need for researchers from different institutions or countries to collaborate on shared research goals by combining their data to obtain a more complete understanding of the biomedical phenomenon of interest. This scenario often involves the establishment of consortia focused on specific health conditions or research areas. However, organizations may need to comply with policies that limit or prohibit external sharing of data, a problem that is exacerbated if entities operate in different regulatory environments or countries.

Public data release.

This involves making biomedical datasets and analysis results openly accessible to the broader scientific community and, in some cases, the public. This practice supports the transparency and reproducibility of scientific studies and promotes collaborative efforts such as data science competitions (e.g., Kaggle²). It also extends the utility of collected datasets by allowing researchers around the world to reanalyze existing data. However, releasing a dataset containing individual-level information poses great privacy risk and is feasible only in rare circumstances. Care must also be taken when releasing simulated or redacted datasets based partially on private data, as these may still lead to privacy leakage.

Public health monitoring.

The COVID-19 pandemic motivated the design of public health systems capable of monitoring disease outbreaks and facilitating responses (e.g., exposure notification apps). The effective operation of these systems may require the collection of a broad range of personal information beyond health status, including demographic, geolocation, and social activity data. In addition, sharing these data across jurisdictions may be essential for a more accurate understanding of infectious agents. However, the possibility of harming individuals due to the disclosure of private information remains a significant concern (16), which can prevent the widespread adoption of these systems.

4. Privacy-Enhancing Technologies and Their Biomedical Applications

Privacy-enhancing technologies (PETs) represent a collection of computational techniques to safeguard sensitive biomedical data. Collectively, these technologies enable the development of privacy-by-design methods for sharing and analyzing biomedical data. These improve both the privacy and utility of biomedical data beyond what is feasible given existing security practices and contractual safeguards, such as data use agreements. We describe each technology in detail and discuss recent methodological advances and applications within the biomedical domain.

4.1. Secure Multiparty Computation (MPC)

MPC allows multiple parties to work together to perform computations collectively on their private inputs without revealing the input to each other. There are two main techniques used for MPC: garbled circuit (GC) and secret sharing (SS).

First introduced by Yao in 1986 (28), a GC enables secure evaluation of a function, represented as a Boolean circuit, between two parties with private input. The input and output of each logical gate in a GC are randomly masked to prevent the evaluator from gaining information during the circuit evaluation. The input of one party is securely communicated to the other party using the cryptographic primitive of oblivious transfer (OT), which then allows the receiver to evaluate the circuit without knowing the raw input. Although the exponential scaling of the circuit size for complex analysis tasks often leads to high communication and computational costs, several enhancements (29, 30, 31, 32) have improved the efficiency of these schemes (33, 34, 35).

SS schemes (36, 37) allow a group of parties to collectively encode a private number by dividing it into random shares, which are held individually by the parties. The private number can be reconstructed only when a predefined number of shares are combined. For example, in additive SS schemes, which are most commonly used in practical settings, secret shares are random elements of a ring (an algebraic structure exemplified by integers modulo a prime number) that add up to the private value. This ensures that all parties’ shares must be combined to reveal the secret; any subset reveals no information that can be used to infer the secret. Securely adding two secret-shared numbers, x and y, involves each party adding their individual shares for x and y, resulting in new shares representing x+y. Secure multiplication requires interaction between parties (38) but preserves the confidentiality of the private input by masking the numbers shared between parties. Other operations, such as division, square root, and comparison, are performed using addition, multiplication, and special routines that exploit the bitwise representation of private values. These operations can be combined to securely perform various analyses on private data held by multiple parties.

Many frameworks and compilers have been developed to ease the implementation of MPC algorithms leveraging various building block protocols (39). Hybrid schemes (40, 41) and compilers (39, 33, 42), which combine different MPC methodologies to improve efficiency, have also been proposed. For example, ABY (42) proposed switching between GCs and different types of SS (integer or Boolean) to perform each operation in the domain where it is most efficient (e.g., evaluating comparisons in a two-party setting using GCs or evaluating multiplexors or other bitwise operations with more than two parties using Boolean SS). These frameworks have been extended and optimized for applications in machine learning (ML), such as training and inference of neural network models (43, 44, 45, 46). Recent enhancements of core operations such as secure comparison (47) have further improved the performance and versatility of MPC frameworks.

The primary limitation of MPC is its substantial communication cost. While GCs allow most of the computation to be performed non-interactively by transferring the entire circuit in a single round of communication, the circuit is typically limited to Boolean operations, and the size of the circuit can become impractically large for sophisticated numerical calculations. SS enjoys greater analytic flexibility and efficiency in general compared to GCs, but SS-based MPC typically requires many rounds of interaction for complex tasks, a potential bottleneck in limited communication settings (e.g., wide-area network with large round-trip delays). Furthermore, the requirement that the entire input dataset be secret-shared among the parties can be a hurdle for large-scale biomedical datasets.

Several recent works have developed MPC protocols for a range of analysis tasks in biomedicine (48, 49, 50, 51, 52, 53). A common goal of these works is to improve the efficiency of MPC by redesigning the analysis task in a way that is more amenable to efficient computation using MPC operations. For example, Cho et al. (48) introduced a generalization of SS techniques aimed at minimizing redundant computation, which led to an efficient algorithm for genome-wide association studies (GWAS), involving sophisticated linear algebra tasks such as principal component analysis (PCA). This work was extended to address collaborative prediction of drug-target interactions using a neural network model (54). Jagadeesh et al. (50) used GC to efficiently perform Boolean operations (such as set intersection and difference) to identify genetic variants of interest in patient genomes. Von Maltitz et al. introduced an MPC protocol for survival analysis based on the Kaplan-Meier estimator (55). A different approach was taken by Smajlovic et al. (56), who developed a Python-based compiler that transforms a high-level analysis code into MPC executables incorporating automated optimization based on static code analysis. Such tools can help accelerate the development of MPC applications for various biomedical tasks by making the techniques more accessible to biomedical practitioners.

4.2. Homomorphic Encryption (HE)

HE refers to a form of encryption that allows direct computations on encrypted data. Earlier HE schemes, such as RSA (57), ElGamal (58), Paillier (59), and Goldwasser-Micali (60), were known as leveled or somewhat HE (SWHE) schemes, supporting specific types of operations, e.g., additions only or multiplications only, or a limited number of them. In 2008, Gentry (61) introduced the first construction of a fully HE (FHE) scheme that allows arbitrary arithmetic computations through a bootstrapping technique, which refreshes a ciphertext (encrypted data) to support additional operations. Addressing the limited concrete efficiency of the initial scheme of Gentry, which required several minutes of runtime for each bit operation (62), several schemes were later proposed (63, 64, 65, 66) to reduce the overall computational cost of FHE and thereby enabling its use in practical applications.

Akin to standard encryption schemes, the security of HE is based on the hardness of well-studied mathematical problems. Many HE schemes are based on the Ring Learning with Errors (RLWE) problem (67, 68), a lattice-based problem where the goal is to distinguish whether a set of ring elements is constructed using a common secret element or sampled randomly. This problem is shown to be extremely difficult to solve without knowing the secret and easy otherwise, translating into the guarantee that an entity can decrypt a ciphertext only if the decryption key is known. To maintain the difficulty of this problem, random noise must be introduced into the ciphertext, and the noise increases with each homomorphic operation. Unlike schemes that precisely perform computation at the expense of reducing the range of encoded values (63, 64, 65), the CKKS scheme (66) adds noise directly to the data values, enabling efficient operations at a small loss in precision. CKKS has been widely adopted in scientific applications where a small amount of noise can be tolerated. In all RLWE-based schemes, a single ciphertext encodes multiple values, and homomorphic operations such as addition and multiplication are performed simultaneously on all values in a ciphertext—known as the single-instruction, multiple-data (SIMD) property. Exploiting this property can improve the scalability of these schemes.

Notable recent developments include more efficient bootstrapping techniques (69, 70) and alternative constructions that offer a trade-off between different types of operations. For example, TFHE (71) is constructed based on the mathematical structure of the torus and permits efficient bootstrapping yet is limited to Boolean or bitwise operations. Furthermore, several HE compilers have been proposed (72) to streamline the development and optimization of HE algorithms, for example, to simplify the management of ciphertext noise. Frameworks have also been developed for the secure training of predictive ML models (73, 74).

In the biomedical domain, HE has mainly found applications in the outsourcing of computational tasks involving sensitive data. These computations may be challenging for individual users to perform because of the scale of the problem (in terms of both dataset size and computational complexity), or because of limited access to additional data or models required for the analysis. HE helps to ensure that the user’s data remains private when analysis is delegated to a third party. For example, HE-based solutions have been proposed for privately outsourcing the detection of heart conditions in ECG data (75), as well as cardiovascular risk prediction based on health records (76). Many works have tackled the computation of GWAS statistics on encrypted data, addressing a range of statistics and application settings (77, 78, 79, 80, 81). Other tasks explored in the literature include count queries on genomic and medical databases (e.g., for cohort exploration) (82, 83), detection of genetic parent-child relationships (84), and disease risk prediction using both clinical and genomic information (75, 85). Finally, Kim et al. (86) and Gürsoy et al. (87) recently illustrated secure imputation of an encrypted private genome.

These advances have brought HE-based solutions closer to meeting the requirements of biomedical applications. Nevertheless, the scope of these applications remains restricted due to several factors, including: the substantial computational overhead of homomorphic operations compared to unencrypted analysis; the need to approximate non-linear operations using additions and multiplications; and the practical limits on the complexity of the analysis task due to the high cost of bootstrapping. Moreover, most of the aforementioned solutions require that all input data be encrypted and transferred to the entity performing the computation, which can be a significant burden for large datasets. In Extending HE to Collaborative Analysis Settings: Multiparty Homomorphic Encryption, we describe a recent technical advance that helps address these limitations.

4.3. Trusted Execution Environments (TEE)

TEE is a secure area within the main processor, also called an enclave, that ensures the safe and isolated execution of software. This isolation guarantees that the memory content, end-to-end communication with external parties, and control flow of the application are protected from untrusted or malicious processes running within the same hardware, including a malicious operating system or hypervisor (104, 105). In certain TEE architectures, the binary executable of an application can also be verified through a process called remote attestation (106). To achieve these security properties, TEE relies on core hardware security components built into the processor that cannot be manipulated by software. These components typically comprise a memory encryption engine and controller to isolate memory access, and integrated circuits for cryptographic key storage and operation.

Recent TEE developments have focused on supporting third-party software deployment in an untrusted cloud environment, addressing the deployment of both user-level applications and virtual machines (VMs). Popular TEE platforms include: Intel Software Guard Extension (SGX) (107) for user-level applications; and Intel Trust Domain Extensions (TDX) (108) and AMD Secure Encrypted Virtualization (SEV) (109) for VMs. Nvidia recently introduced an update to its GPU architecture that enables GPU computation in TEE (110). In a mobile setting, ARM TrustZone (105) is a ubiquitous TEE platform on ARM CPUs, although generally a limited set of TEE functionalities are available for mobile applications.

Although TEEs offer the capability to confidentially analyze private data with computational efficiency and functionalities similar to conventional computing environments, their major drawback lies in the complexities of achieving hardware-based security. Unlike MPC and HE, which rely on minimal and well-established cryptographic primitives, TEE’s hardware-based approach introduces unique vulnerabilities. Some vulnerabilities are the result of CPU architectural bugs that allow a malicious process to extract protected data from an enclave (111); manufacturers typically promptly patch these problems once they are discovered. Other limitations are inherent in the TEE architecture and lead to the issue of side channels—indirect pathways for information leakage (112, 113). For example, a TEE enclave’s access patterns to memory pages can inadvertently reveal sensitive information stored in the secure area to an attacker. Although such attacks require significant effort, software-level mitigation is necessary when the highest level of security is required. One strategy involves ensuring that the memory access or timing patterns of the program do not depend on sensitive information (114). However, such mitigation can incur an additional computational burden and require relevant expertise during algorithm development.

Despite these drawbacks, TEE has a promising future with vested interests from major CPU producers like Intel, AMD, and ARM, who continue to address security issues and improve their TEE platforms. Cloud service providers such as Google Cloud Platform and Microsoft Azure offer TEE-enabled computing infrastructure. In addition, initiatives such as the Confidential Computing Consortium (CCC)³ and the Trusted Execution Environment Provisioning (TEEP) Working Group⁴ of the Internet Engineering Task Force (IETF) have been formed to support open-source projects and the development of standards related to TEE. In the research community, many software tools have been introduced in recent years to ease the translation of existing software to run securely on TEE platforms (113).

In the biomedical domain, TEEs have gained significant traction due to their ability to securely outsource the analysis of biomedical data and to facilitate the development and deployment of health artificial intelligence (AI) tools on a large scale. Notable real-world examples include BeeKeeperAI (115), a privacy-preserving healthcare AI company, and AOK, a network of eleven regional health insurers in Germany. These organizations utilize Intel SGX to protect confidential patient data, complying with regulations such as HIPAA, GDPR, and Germany’s Patient Data Protection Act (PDSG) (116). Applications of TEE in genomics are also emerging. An example is a federated GWAS service based on Intel SGX, which securely aggregates data from multiple sites and incrementally updates the statistics as study participants are added or removed (117). Data sketching techniques for enhancing the efficiency of GWAS computation in Intel SGX have also been proposed (118). Considering other genome analysis tasks, Widanage et al. demonstrated read mapping in Intel SGX and described a generalization of their tool to other workflows (119). Dokmai et al. proposed a TEE-based service for secure genotype imputation, introducing techniques to achieve resilience against side-channels while maintaining accurate imputation performance (114).

4.4. Differential Privacy (DP)

DP is a mathematical definition of privacy that provides rigorous privacy protection by ensuring that the removal or addition of a single individual in a dataset does not lead to a distinguishable change in the analysis results (120, 121). Formally, given $\epsilon \ge 0$, a randomized mechanism $𝒜$ satisfies $\epsilon -\text{DP}$ if, for all datasets ${\text{D}}_1$ and ${\text{D}}_2$ that differ in one record, and for any subset $𝒪$ of all possible outputs of $𝒜$, we have $P\left[𝒜\left(D_1\right)\in 𝒪\right]\le e^{\epsilon }\text{P}\left[𝒜\left(D_2\right)\in 𝒪\right]$—intuitively, this means that any result is similar in likelihood between similar datasets. The parameter $\epsilon$ is called the privacy budget and is used to specify the level of privacy protection. DP mechanisms generally satisfy the privacy guarantee by adding noise to the data, where a smaller $\epsilon$ provides more privacy at the cost of greater loss in accuracy by adding more noise. Standard DP techniques include Laplace, Gaussian, and exponential mechanisms, representing different approaches to sampling the noisy analysis result.

Various techniques have been developed to minimize noise addition and obtain a more desirable trade-off between privacy and utility. For example, some DP formulations relax the notion of privacy for better utility: $\left(\epsilon ,\delta \right)-\text{DP}$, also known as approximate DP (121), requires that $\epsilon -\text{DP}$ be satisfied with probability at least $1-\delta$. Concentrated DP (122), zero-concentrated DP (123), and Rényi DP (124) view privacy loss as a random variable and bound the average loss instead of the worst-case loss.

Key properties of DP include post-processing, which ensures that further analysis of data that satisfy DP remain DP, and composition, which allows multiple mechanisms operating on the same data to be combined to provide a joint DP guarantee. As a result of these properties, adding DP noise to different components of the analysis pipeline—e.g., input, output, optimization objectives (125, 126), or gradients (127, 128)—can have a significant impact on overall precision depending on the analysis task. Another key factor that influences the amount of noise is sensitivity, which measures the maximum change in the analysis output due to a single-record change in the data. Different approaches have been proposed to analyze the sensitivity of a given function (e.g., global, local, or smooth sensitivity (129)). Due to these considerations, it is often necessary to carefully design DP mechanisms for specific applications to optimize their performance.

For example, in a multiparty setting, DP can be implemented either locally, by individual data providers, or globally, by a central server that aggregates analysis results; these approaches are called local DP (LDP) and centralized DP (CDP), respectively. Although CDP typically requires less noise by adding it directly to aggregated data, it may be more vulnerable to privacy leakage because it relies on a trusted third party for data aggregation. On the other hand, LDP offers DP at the level of individual data providers while increasing the overall amount of noise. Common data perturbation techniques to achieve LDP include the randomized response and its variants (130, 131, 132).

DP has recently been deployed by various entities to address private collection of statistics and publication of privatized datasets. RAPPOR (133) uses randomized response and bloom filters to privately collect usage statistics from the Chrome browser. LDP has been deployed by Apple to collect information about emojis and search queries from its devices (134), and by Microsoft for application-level telemetry in Windows 10 (135). In 2020, the US Census Bureau released the census data with DP using the TopDown algorithm (136), which hierarchically aggregates statistics based on geographic units.

A key focus of DP applications in biomedicine has been on the release of GWAS statistics. Uhler et al. introduced DP mechanisms for releasing minor allele frequencies (MAF) and χ² statistics for case-control GWAS (137). This work was later extended by Johnson and Yu et al. to handle larger cohorts (138) and logistic regression (139). An alternative approach based on the exponential mechanism has also been proposed (140). Simmons and Berger (141) introduced an optimization framework for privately reporting a fixed number of the most significant associations. In subsequent work, Simmons et al. developed DP methods for GWAS with correction for population stratification (142). Other notable applications of DP include the sharing of genotypic data (143), clinical trial data (144), and tabular medical records (145). DP has also been applied in interactive database settings, e.g., for count or membership queries (146, 147) and genetic matching of patients (148). In the public health domain, DP has been used to support the development of the COVID-19 Real-Time Information System for Preparedness and Epidemic Response (CRISPER) (149) and a mobile diagnostic system for coronary heart disease (150).

Despite these advances, the practical adoption of DP faces several technical challenges. Privacy parameters (e.g., $\epsilon$) associated with DP methods are an important factor controlling the trade-off between privacy and utility; however, there are no rigorous methods or standards for choosing an acceptable value of these parameters for a given task. Since biomedical data are typically high-dimensional, a large number of statistics need to be shared privately. Moreover, these data are often analyzed using sophisticated algorithms comprised of many steps where DP could be incorporated. As a result, designing effective DP mechanisms that optimally distribute the privacy budget can be difficult. Another limitation is that DP cannot protect every dataset; e.g., small datasets likely require an overwhelming amount of noise for DP and need to be protected using other strategies.

4.5. Federated Learning (FL)

FL allows multiple parties to collaboratively train machine learning (ML) models in a distributed manner (151). The parties share the model parameters or updates (e.g., gradients) during training, but do not directly share the training data, hence mitigating privacy risks. Two main categories of FL use cases include: (i) cross-silo, in which a small number of parties hold a substantial fraction of the data, and (ii) cross-device, where a large number of devices (possibly millions) hold a small amount of data (151). The former is more similar to traditional MPC settings where parties may represent different institutions, each of which has collected data from many individuals, while the latter is often found in consumer applications, where, for instance, millions of mobile phones may collect personal user data.

In FL, each party is limited to their local share of the data in evaluating and updating the model; thus, several approaches exist for synchronizing the state of the model across the parties. The federated averaging technique asks each party to locally compute model updates that are sent to a central server to be averaged and applied globally (152). The weights used to average these updates are typically chosen as a function of the size and quality of each party’s data (153, 154). More advanced methods such as federated matched averaging (FedMA) synchronize weights layer-wise via matching to cope with permutation invariance in neural networks (155). Other approaches avoid global synchronization and instead iteratively pass weights from party to party (156). Personalized FL is another approach, whereby each party learns a different local model that incorporates both the information from other parties and local data characteristics (157, 158).

The robustness of FL is a major challenge in practice. Issues such as network connectivity, communication constraints, and resource constraints can prevent certain parties from fully participating in every round of the protocol (159, 160). Heterogeneity across data silos or devices may also introduce concerns about inequity and limited generalization of trained models; for instance, simple averaging techniques have been shown to lead to inaccurate results in small sub-populations (161, 162, 163).

Another challenge is that FL may provide limited privacy and security protection. For example, by inspecting the model updates from other parties during multiple rounds of the protocol (164), one hospital may be able to infer the characteristics of patients in another hospital. This could reveal information such as the distribution of clinical labels, individual coordinates of feature vectors, and sometimes even entire training inputs (165, 166, 167). Furthermore, a malicious adversary could manipulate the data or the model to further their own goals at the expense of others (168).

The recent literature on FL introduces a wide range of techniques to address these limitations. Combining FL with DP can provide rigorous bounds on privacy leakage (169, 170), although doing so while maintaining the accuracy of the model can be challenging. If the central aggregator is not trusted, parties may choose to use LDP to add noise to their local gradients before aggregation (171). Alternatively, MPC, HE, or TEE can also support secure aggregation of model weights, so that no additional information is leaked other than aggregated results (164). Solutions that protect model parameters throughout the entire training procedure using encryption techniques have also been proposed (97, 98, 99). Robustness is often addressed by adapting the protocol based on the qualities of each party. For example, some methods propose to detect and remove outliers to learn from a core set of reliable parties. Others propose to alter the averaging weights to produce fairer global models that perform comparably well on each party (163). Although existing FL applications focus mainly on supervised learning, recent work extends FL to address other ML tasks, including semi-supervised, unsupervised, and reinforcement learning (172, 173, 174).

FL has touched upon numerous biomedical applications. In the cross-silo setting, FL can improve analytics and care for patients at various stages of healthcare by putting together more extensive training data to improve the performance of ML models. Notable uses include rare disease analysis (175, 176), multi-hospital collaboration for medical image analysis (177, 178, 179), and automated phenotyping and risk prediction from clinical notes (180, 181, 182). In the cross-device setting, FL has the potential to transform mobile health (183). For example, FL can allow wearable devices, such as FitBits or Apple Watches, to adapt over time to the individual’s unique health and lifestyle characteristics, such as resting heart rate, steps per day, and blood oxygen levels. These models can enable more accurate health monitoring for individuals, e.g., for gait identification and fall detection (184, 185).

5. Other Related Techniques

Several workflows involving the exchange of private data have received special attention from the privacy and security community to develop targeted methods that extend beyond the scope of PETs described in Section 4. We highlight some of these techniques.

Private information retrieval (PIR).

In PIR, a client retrieves specific items of interest from a database stored on a server without revealing the identity of the accessed items (186, 187). A naïve approach of downloading the entire database and querying it locally is impractical for large datasets. In an HE-based solution, the client uploads an encrypted query, based on which the server searches the database homomorphically and then returns the result to the client for decryption. With practical lattice-based HE (Section 4.2) and database pre-processing and amortization techniques (188, 189), recent PIR protocols have been shown to scale to databases including billions of entries (190, 191, 192, 193). Other works have extended PIR to more sophisticated queries, such as keyword search in sparse databases (194, 195) and batch querying (196, 197). In the biomedical context, PIR can enhance the utility of public data resources that require users to either download the entire database or disclose private data (e.g., genetic mutations or patient records) to the server in order to query the database. For example, PIR solutions have been proposed for outsourced storage of genomic data, which support secure retrieval of variants of interest (198, 199).

Private set intersection (PSI).

PSI addresses a problem closely related to PIR, where two parties, each holding a set of items, wish to learn the intersection between the two sets without revealing any other information to each other. PSI-size is a notable variant of PSI, where only the size of the intersection is revealed. PSI has been extensively studied, leading to practical protocols for billions of items and several variants addressing different trust assumptions, trade-offs between communication and computation, and number of parties (200, 201, 202). Several works have proposed PSI protocols for the computation of genome similarity, viewing each genome as a set of variants. Baldi et al. (203) introduced paternity testing based on PSI techniques (204, 205). Wang et al. (206) developed a PSI-based protocol for securely calculating the edit distance between genomes.

Zero-knowledge proofs (ZKP).

Verification of computation, an essential component of trustworthy data analytics systems, can be challenging when sensitive biomedical data are involved. A zero-knowledge proof (ZKP) (207) is a cryptographic primitive, related to MPC and digital signatures (208, 57), that allows one to prove the truthfulness of a statement about the data or the computation without disclosing sensitive information. For example, Goldreich et al. (209) showed that generic ZKPs (210) can be used to prove that a secure computation protocol (e.g., MPC) is carried out honestly without decrypting any intermediate value. Although generic constructions typically incur impractical computational overheads, recent advances have improved the efficiency of ZKPs under a variety of security and model assumptions (211, 212, 213, 214). Froelicher et al. (215) demonstrated that ZKPs for discrete logarithms (216) can ensure the integrity of certain HE computations in a distributed health analytics system. Chatel et al. (217) introduced a ZKP scheme based on the MPC-in-the-head paradigm (218, 219), allowing direct-to-consumer analytic service providers to verify that the user’s uploaded data are from a trusted source, thus preventing a malicious user from tampering with the analysis result.

Blockchain.

Blockchain provides a decentralized framework for securely recording and verifying transactions in a distributed network. It uses cryptographic techniques to create a chain of blocks, a time-stamped list of transactions, providing transparency, immutability, and accountability in data management. Beyond well-known applications in finance (e.g., Bitcoin), blockchain has become increasingly relevant in biomedical domains (220). A key use case is to create a secure and decentralized Health Information Exchange (HIE) to improve the management of medical records and insurance claims among various stakeholders (221). It can also be used to create a data sharing platform to support biomedical research while providing data provenance and accountability (222). Privacy protection of data exchanged through blockchains is a key challenge that often requires blockchains to be carefully combined with other encryption techniques or PETs. Another focus of ongoing research is on improving the scalability and robustness of blockchain networks, which is necessary for their deployment across a large network of institutions.

Synthetic data generation.

Creating synthetic data that resemble real data without being directly linked to private individuals has become a useful privacy-aware data sharing strategy (223). Public sharing of synthetic data can support collaborative efforts, such as data analysis competitions and validation of computational models across institutions. It can also support various academic and educational activities, for instance, by creating a realistic patient profile for use in training or public communication. Techniques for generating synthetic data have evolved alongside ML advances, particularly in deep generative models. The introduction of generative adversarial networks (GANs) and diffusion models greatly improved the synthesis of various types of biomedical data, including medical images (224, 225) and EHRs (226). However, the possibility that synthetic data can leak private information about the original data used to train the models remains a major concern (227). Recent studies have suggested that the greater expressiveness of modern generative models, in fact, increases the likelihood of private training data being reconstructed (228). Although incorporating DP into model training can help mitigate these risks (229), it can degrade the quality of the generated data, especially for high-dimensional data such as images and genomes. Future improvements in both the quality and privacy of synthetic data will be crucial in expanding its use in settings where direct sharing of data is necessary.

6. Open Challenges and Outlook

As the field of biomedical data science expands to encompass a wider variety of data modalities, more complex statistical models, and evolving computing environments, our understanding of privacy risks must also change. Studies that uncover novel privacy risks in emerging data types (e.g., transcriptomics (230, 85, 231, 232), proteomics (233), and wearable devices (234)) and computational models (e.g., diffusion and large language models (235, 228)) will be particularly valuable. Integrating these findings into practical guidelines and policies will require a thoughtful examination of the evolving incentives and capabilities of potential adversaries (236, 237, 238).

A critical aspect of PETs is the varying degrees of privacy protection they offer and how they can be aligned with our social values and the needs of practitioners. While acknowledging the value of cryptographic PETs (i.e., HE, MPC, and DP) that offer the strongest, formal notions of privacy, we must also be aware of potential pitfalls in the practical implementation of these techniques, such as software flaws (239) or violations of model assumptions (240). Technologies that offer less formal but more widely applicable privacy enhancements (i.e., TEE and FL) can be useful alternatives in some settings. A promising future direction is to explore a joint use of PETs to combine their strengths while mitigating their weaknesses, as in Extending HE to Collaborative Analysis Settings: Multiparty Homomorphic Encryption. Future policies and regulations have a crucial role to play in translating the complex privacy properties of emerging tools based on PETs into concrete guidelines for the biomedical community.

The social impact of PETs involves another key consideration: equity (241). Many studies have shown that there are inequities in emerging clinical applications of computational tools (242, 243). Rectifying these issues requires greater data sharing to create more diverse datasets, which in turn introduces new privacy challenges (244, 245). On the other hand, those whose data is most needed to improve equity in biomedicine (e.g., underrepresented groups) may also have the most to lose in the event of a privacy breach (246). Furthermore, certain PETs, such as DP, may disproportionately reduce the accuracy of ML models in populations with limited representation in the dataset (247). Navigating this complex trade-off between privacy and equity remains an important challenge.

We expect trust and transparency to play a crucial role in aligning PETs with the interests of stakeholders in organizational settings (248). PETs can be viewed as a tool to strengthen trust between stakeholders by increasing transparency and mitigating various privacy and security risks that emerge in collaborative partnerships. This perspective contrasts with a common focus in the PETs community on preventing malicious actors from breaching systems and gaining access to sensitive data. Integrating contextual values such as trust and human-centered design principles into PETs could foster the creation of tools that more effectively address the needs of the biomedical community.

As PETs continue to mature and become more broadly applicable, as demonstrated in this review, there will be a growing need to tailor these techniques to create effective algorithms and tools that address diverse biomedical workflows. A closer collaboration among PETs developers, biomedical practitioners, policymakers, as well as patients and study participants could help prioritize efforts that address the most pressing challenges. Furthermore, software development and deployment tools designed to assist researchers in incorporating PETs into their existing workflows could help ensure that these techniques are broadly accessible. The combination of advances in foundational techniques, effective algorithm design, and the establishment of social frameworks to safeguard the use of these technologies will be key to unlocking the potential of PETs in biomedical data science.

Extending HE to Collaborative Analysis Settings: Multiparty Homomorphic Encryption.

A recent line of work explores a novel use of HE to facilitate collaborative studies. Conventional HE schemes, described in Section 4.2, allow any party with the decryption key to access the private data. In contrast, threshold HE schemes (88, 89, 90, 91) use a decryption key that is secret-shared among a group of parties, allowing them to individually operate over encrypted data while ensuring that only the data values that are agreed upon among the parties can be decrypted. Similarly, multi-key schemes (92, 93) allow each party to use their own key and modify operations to support data encrypted under different keys.

These multiparty HE (MHE) schemes open the door to HE-based algorithms that can analyze private data distributed among multiple parties, analogously to the MPC setting. Recent studies (94, 95) have shown that these schemes can enable seamless integration of HE operations with efficient interactive routines, including MPC protocols, to reduce the cost of challenging operations such as bootstrapping (90). Importantly, these schemes allow each party to leverage efficient local computations using the locally available unencrypted data. MHE can thus help address the scalability limitations of standalone applications of HE or MPC by offering a federated analysis paradigm in which it is neither necessary to secret-share the entire private dataset among the parties nor to encrypt and centralize all data at a single site for analysis.

Applications of MHE are being explored in various domains, including distributed ML and linear algebra (96, 97, 98, 99) as well as collaborative biomedical analyses, such as GWAS (89, 94, 95, 100) and cell type classification (101). Recent results (95) demonstrate the practicality of this approach in handling complex biomedical tasks on the scale of modern biobanks that include hundreds of thousands of individuals. However, addressing each application currently requires time-consuming effort to design and optimize algorithms to achieve practical runtimes. Ongoing work on streamlining the development and use of these solutions, e.g., through cloud-based analysis platforms (102) and easy-to-use programming frameworks or libraries (56, 103), can help make these tools more widely available.