Can predicted traits unmask an anonymised genome? Usually not, study finds
A peer-reviewed UK Biobank analysis found a trait-matching attack can look more than 99% precise under an artificial 50% prior, yet falls below 0.13% precision at the authors' realistic prior estimate.
The short version
- What happened
- The researchers matched observed traits to polygenic scores derived from genomes, while accounting for prediction error and correlations between traits.
- Who it affects
- People who contribute DNA to research need proportionate protection: this study suggests one public-trait matching route is weak in realistic conditions, while leaving other re-identification and sensitive-data risks intact.
- What remains unproven
- The central real-world result depends on the authors' estimate of the prior probability that a genome and trait record belong to the same person.
Keep in mind
The central real-world result depends on the authors' estimate of the prior probability that a genome and trait record belong to the same person.
The evaluation uses UK Biobank data and may not generalise to other ancestries, populations, trait records or data-release practices.
Only trait-prediction matching and selected sensitive haplotypes were tested; genealogy, direct linkage, model leakage and richer auxiliary-data attacks are outside the study.
The Nature Communications article is an accepted peer-reviewed early-view version that remains subject to production edits.
Source analysis · 2 linked sources. Primary analysed source date: 25 October 2026. Earliest linked supporting source: 10 June 2026.
Read the full report · 3 min The evidence, methods, implications and limitations
The attack works when the candidate pool is already tiny
Researchers at the University of Lausanne, the Swiss Institute of Bioinformatics and the University of Tartu built a probabilistic matching method for a specific privacy threat: an attacker has an anonymised genome, predicts observable traits from it with polygenic scores, and compares those predictions with a known person's traits. UK Biobank data supported the evaluation; reported trait analyses drew on roughly 393,000 to 461,000 participants, depending on data availability.
The method beat a previous state-of-the-art approach. But its apparent success depended heavily on the starting odds. If the attacker already had a 50% chance of holding the right genome, precision was above 99% at 40% recall. The authors estimate a realistic prior would not exceed 4 × 10⁻⁴%—about four chances in a million. At that prior, precision was below 0.13% at the same recall, meaning almost every positive match would be wrong.[1][2]
A reassuring result, not a privacy clearance
The team also tested whether the matching process could reveal sensitive variants. For APOE-ε4, which is associated with Alzheimer's disease risk, precision exceeded 50% only when recall fell below 20%. That trade-off makes broad inference ineffective in the tested setting.
For biobank participants and data stewards, the evidence narrows one feared scenario: public traits alone are unlikely to identify a random anonymised genome reliably. It does not test genealogy links, leaked identifiers, membership inference or attacks that combine richer records. The realistic prior is an estimate, and UK Biobank is not representative of every ancestry or data environment. Independent replication across populations, candidate-pool sizes and adversary information would show how robust the conclusion is.[1][2]
The distinction that matters
Why the starting odds change the result
The same matching score can look highly precise in a two-candidate problem and almost useless in a population-scale search.
Artificial prior
Assume a 50% chance that the records match
>99% precision at 40% recall
Estimated real world
Use a prior no higher than 4 × 10⁻⁴%
<0.13% precision at 40% recall
Policy test
Consider other data and attack routes
Controlled access and consent remain necessary