Can predicted traits unmask an anonymised genome? Usually not, study finds
A peer-reviewed UK Biobank analysis found a trait-matching attack can look more than 99% precise under an artificial 50% prior, yet falls below 0.13% precision at the authors' realistic prior estimate.
The short version
- What happened
- The researchers matched observed traits to polygenic scores derived from genomes, while accounting for prediction error and correlations between traits.
- Who it affects
- People who contribute DNA to research need proportionate protection: this study suggests one public-trait matching route is weak in realistic conditions, while leaving other re-identification and sensitive-data risks intact.
- What remains unproven
- The central real-world result depends on the authors' estimate of the prior probability that a genome and trait record belong to the same person.
Keep in mind
The central real-world result depends on the authors' estimate of the prior probability that a genome and trait record belong to the same person.
The evaluation uses UK Biobank data and may not generalise to other ancestries, populations, trait records or data-release practices.
Only trait-prediction matching and selected sensitive haplotypes were tested; genealogy, direct linkage, model leakage and richer auxiliary-data attacks are outside the study.
The Nature Communications article is an accepted peer-reviewed early-view version that remains subject to production edits.
Source analysis · 2 linked sources. Primary analysed source date: 25 October 2026. Earliest linked supporting source: 10 June 2026.
Keep following the evidence
Join The Impact Brief founding list for selected AI reports, their effect on people and the evidence limits. Read a sample first.
Read the full report · 3 min The evidence, methods, implications and limitations
The attack works when the candidate pool is already tiny
Researchers at the University of Lausanne, the Swiss Institute of Bioinformatics and the University of Tartu built a probabilistic matching method for a specific privacy threat: an attacker has an anonymised genome, predicts observable traits from it with polygenic scores, and compares those predictions with a known person's traits. UK Biobank data supported the evaluation; reported trait analyses drew on roughly 393,000 to 461,000 participants, depending on data availability.
The method beat a previous state-of-the-art approach. But its apparent success depended heavily on the starting odds. If the attacker already had a 50% chance of holding the right genome, precision was above 99% at 40% recall. The authors estimate a realistic prior would not exceed 4 × 10⁻⁴%—about four chances in a million. At that prior, precision was below 0.13% at the same recall, meaning almost every positive match would be wrong.[1][2]
A reassuring result, not a privacy clearance
The team also tested whether the matching process could reveal sensitive variants. For APOE-ε4, which is associated with Alzheimer's disease risk, precision exceeded 50% only when recall fell below 20%. That trade-off makes broad inference ineffective in the tested setting.
For biobank participants and data stewards, the evidence narrows one feared scenario: public traits alone are unlikely to identify a random anonymised genome reliably. It does not test genealogy links, leaked identifiers, membership inference or attacks that combine richer records. The realistic prior is an estimate, and UK Biobank is not representative of every ancestry or data environment. Independent replication across populations, candidate-pool sizes and adversary information would show how robust the conclusion is.[1][2]
The distinction that matters
Why the starting odds change the result
The same matching score can look highly precise in a two-candidate problem and almost useless in a population-scale search.
Artificial prior
Assume a 50% chance that the records match
>99% precision at 40% recall
Estimated real world
Use a prior no higher than 4 × 10⁻⁴%
<0.13% precision at 40% recall
Policy test
Consider other data and attack routes
Controlled access and consent remain necessary
Watch the background, then check the evidence
Illustrative photo · not a video frame
The Royal Society · 2 min 31 sec · Background explainer
What is artificial intelligence? | The Royal Society
YouTube loads only when you choose; playback starts when you press play.
A short introduction to artificial intelligence from the Royal Society. Start here for basic concepts, then use current reporting to explore what has changed.
Evidence check: Published in 2018, before today’s generative AI tools. Useful for basic concepts, rather than an overview of current capabilities.
Published 2018-11-28. Source checked 14 October 2026. Check captions on the publisher’s video page.
Explore current AI technologyPhoto: ThisisEngineering / Unsplash · Licence
Continue the story
Read next
Continue exploring data governance: compare the finding and its evidence limits.
Can AI read child–horse therapy images? Ten children cannot establish well-being
A peer-reviewed Australian study classified activities and physical contact in images from an Aboriginal equine-assisted learning programme. Its strongest results concern observable image labels—not confidence, therapeutic progress or children's well-being.
Read the next reportExplore the full source and evidence record
What this means for people
- People who contribute DNA to research need proportionate protection: this study suggests one public-trait matching route is weak in realistic conditions, while leaving other re-identification and sensitive-data risks intact.
Global context
The work was led in Switzerland with Estonian collaboration and UK data. Genomic-data rules and the availability of linked public records differ by country, so the practical attack surface will vary even if the statistical result replicates.
What the evidence does not yet show
- The central real-world result depends on the authors' estimate of the prior probability that a genome and trait record belong to the same person.
- The evaluation uses UK Biobank data and may not generalise to other ancestries, populations, trait records or data-release practices.
- Only trait-prediction matching and selected sensitive haplotypes were tested; genealogy, direct linkage, model leakage and richer auxiliary-data attacks are outside the study.
- The Nature Communications article is an accepted peer-reviewed early-view version that remains subject to production edits.
What to watch next
- Independent replication across ancestries and national biobanks
- Tests with richer public records and different candidate-pool sizes
- Comparisons with genealogy, membership-inference and model-inversion attacks
- Whether consent and access policies distinguish theoretical from demonstrated risk
Living evidence record
Impact record IAI-0XHI97G
Evidence stage
Studied
Confidence
Supported
Reporting basis
Source analysis
Independent or research support
Present
Record status
Monitoring
Last checked
25 October 2026
Source trail
2 direct sources across 1 source type.
People impact
Documented in this record.
Uncertainty
Limits and next checks are explicit.
Stages describe the evidence available—not whether a technology is good or bad. See the public method.
Related-source reporting disclosure
This record analyses 2 linked source records around the same underlying development. The extra records add method, date or context, but they do not by themselves constitute independent replication of every performance claim or predicted outcome.
Evidence trail
Sources used for this report
Links checked 25 October 2026
Research question, topics and regions
Whether polygenic predictions of observable traits make a practical attack for linking an anonymised genome to a known person
Topics: Genomic privacy · Re-identification · Polygenic scores · Biobanks · Data governance
Regions: United Kingdom · Switzerland · Estonia
This report is labelled source analysis. We summarise and analyse source material in our own words; company statements remain attributed claims until independently supported. Translated summaries preserve the meaning of the original source and link back to it. Read our editorial standards.
Reader commentary
What does this mean where you are?
Tell us what you have seen at work, in your community or in everyday life. A question is welcome too. No account is needed; we review notes before publishing them.
Explore commentary across the portal →Published reader notes
0No published reader notes yet. You can start the evidence-led discussion above.
Prefer a private correction or response? Contact the newsroom.