eduKateSG · Genetics · The Gold Standard of Education
Coordinate a federated GWAS without confusing distributed computation with automatic privacy
Choose the explanation you need, or follow all twelve chapters in order.
Full chapter index · Independent practice · Genetics subject guide
A federated genome-wide association study keeps participant-level records at participating sites while coordinating a joint analysis. The arrangement can reduce movement of sensitive data, but it does not make incompatible phenotypes, weak quality control, site effects or information leakage disappear.
This guide follows one association test across several institutions. It separates the scientific estimand from the computing protocol, shows how site heterogeneity enters the result, works a fictional meta-analysis, and asks what a privacy claim actually protects against.
Continue from The Gold Standard of Genetics within The Gold Standard of Education: learning that transfers into life and the How X Works learning library.
Full chapter index
See the mechanism · Chapters 1–2
Build the worked model · Chapters 3–5
Test what changes · Chapters 6–8
Check evidence and limits · Chapters 9–10
Practise and continue · Chapters 11–12
CHAPTER 1 OF 12 · See the mechanism
1. Lock the question before distributing the work
Define the phenotype, population, genetic model, covariates and association estimand before a protocol is sent to sites. A binary diagnosis recorded from specialist review is not automatically equivalent to an insurance code or self-report. If sites estimate different quantities, secure aggregation only combines disagreement more efficiently.
Write a common analysis specification: genome build, variant identifiers, effect allele, dosage scale, ancestry and relatedness handling, phenotype window, exclusions, covariates and software version. Decide whether the target is a pooled-effect estimate, a fixed-effect meta-analysis, a random-effects summary or site-specific evidence.
Separate federation from meta-analysis. Federation describes where data and computation live. Meta-analysis describes how site estimates are combined. A federated workflow may use secure computation to emulate pooled regression or may securely aggregate summary statistics.
Pre-register the primary model and sensitivity analyses. Otherwise repeated encrypted runs can still become outcome-guided tuning.
Evidence check: for Lock the question before distributing the work, preserve the observation before the interpretation. Record estimand, sites and common protocol. Then state the inference, one credible alternative, and the additional observation that would distinguish them. This compact audit keeps a fluent explanation tied to evidence that another reader can inspect.
Changed-context transfer: repeat this chapter’s decision after changing one consequential condition while holding the others fixed. Calculate or predict what should change, name the threshold or mechanism, and compare with the original case. If the conclusion survives, state the range tested; if it reverses, explain why. Transfer is demonstrated by the changed case, not asserted from the first example.
Practical decision record: write one sentence for what is known, one for what remains uncertain, and one for the next safe action. Include the evidence owner, the latest useful decision time, and the condition that would stop or reverse the action. This turns a technical result into a reviewable choice without pretending uncertainty has disappeared.
Create a data dictionary that maps each site’s source fields to one visible definition. Record coding systems, laboratory units, measurement devices, observation windows and missing-data rules. Test a small set of synthetic records through every site’s transformation code.
Check prevalence, age, sex, ancestry summaries and important clinical variables by site. A large difference may reflect real recruitment or a mapping error. Both matter, but they require different responses.
Use the same covariate meanings, not merely the same column names. A variable called age may mean age at recruitment, diagnosis or last visit. Principal components computed locally may not share orientation or reference unless the protocol aligns them.
Keep site indicators or stratified estimates when recruitment and measurement differ. Removing every visible site difference can erase real effect modification; ignoring site can confound the result.
Evidence check: for Harmonise phenotypes and covariates, preserve the observation before the interpretation. Record phenotype mappings and synthetic fixtures. Then state the inference, one credible alternative, and the additional observation that would distinguish them. This compact audit keeps a fluent explanation tied to evidence that another reader can inspect.
Changed-context transfer: repeat this chapter’s decision after changing one consequential condition while holding the others fixed. Calculate or predict what should change, name the threshold or mechanism, and compare with the original case. If the conclusion survives, state the range tested; if it reverses, explain why. Transfer is demonstrated by the changed case, not asserted from the first example.
Practical decision record: write one sentence for what is known, one for what remains uncertain, and one for the next safe action. Include the evidence owner, the latest useful decision time, and the condition that would stop or reverse the action. This turns a technical result into a reviewable choice without pretending uncertainty has disappeared.
Normalise genome build, chromosome naming, position and alleles. Resolve strand ambiguity, duplicated identifiers and multi-allelic variants. Compare allele frequencies to declared reference data and investigate large site deviations before aggregation.
Apply agreed thresholds for sample call rate, variant call rate, imputation quality and minor allele count. Report how many samples and variants each rule removes at each site. A global pass flag can conceal that one site supplies most of the missingness.
Test cryptographic and statistical code with known-answer fixtures. A secure protocol can faithfully protect and aggregate a wrong allele orientation. Include invariant checks such as sample totals, allele counts and regression results on synthetic data.
Preserve site-level diagnostic outputs at a disclosure-safe resolution. Scientists need enough information to identify a batch problem without receiving participant-level records.
Evidence check: for Align variants and quality control, preserve the observation before the interpretation. Record alleles, build and site quality control. Then state the inference, one credible alternative, and the additional observation that would distinguish them. This compact audit keeps a fluent explanation tied to evidence that another reader can inspect.
Changed-context transfer: repeat this chapter’s decision after changing one consequential condition while holding the others fixed. Calculate or predict what should change, name the threshold or mechanism, and compare with the original case. If the conclusion survives, state the range tested; if it reverses, explain why. Transfer is demonstrated by the changed case, not asserted from the first example.
Practical decision record: write one sentence for what is known, one for what remains uncertain, and one for the next safe action. Include the evidence owner, the latest useful decision time, and the condition that would stop or reverse the action. This turns a technical result into a reviewable choice without pretending uncertainty has disappeared.
Suppose three sites estimate the log-odds effect of the same effect allele under the locked model. Site A reports beta 0.18 with standard error 0.06; Site B reports 0.09 with 0.05; Site C reports 0.30 with 0.10.
For a fixed-effect inverse-variance analysis, each weight is 1 divided by the squared standard error: about 277.78, 400 and 100. The weighted beta is the sum of weight times beta divided by total weight: about 0.145. Its standard error is the square root of one divided by total weight: about 0.036.
The result is not the arithmetic mean 0.19 because the more precise estimates receive more weight. It is also not proof that the effect is identical across sites.
Inspect Cochran’s Q, I-squared and the site forest before interpreting the summary. With only three sites, heterogeneity estimates are themselves uncertain. The site-C difference might reflect chance, recruitment, phenotype mapping, ancestry, platform or real effect modification.
| Site | Beta | Standard error | Inverse-variance weight |
|---|---|---|---|
| A | 0.18 | 0.06 | 277.78 |
| B | 0.09 | 0.05 | 400.00 |
| C | 0.30 | 0.10 | 100.00 |
| Combined | 0.145 | 0.036 | 777.78 total |
Evidence check: for Work a fictional three-site association, preserve the observation before the interpretation. Record every beta, standard error and weight. Then state the inference, one credible alternative, and the additional observation that would distinguish them. This compact audit keeps a fluent explanation tied to evidence that another reader can inspect.
Changed-context transfer: repeat this chapter’s decision after changing one consequential condition while holding the others fixed. Calculate or predict what should change, name the threshold or mechanism, and compare with the original case. If the conclusion survives, state the range tested; if it reverses, explain why. Transfer is demonstrated by the changed case, not asserted from the first example.
Practical decision record: write one sentence for what is known, one for what remains uncertain, and one for the next safe action. Include the evidence owner, the latest useful decision time, and the condition that would stop or reverse the action. This turns a technical result into a reviewable choice without pretending uncertainty has disappeared.
CHAPTER 5 OF 12 · Build the worked model
5. Choose a heterogeneity model deliberately
A fixed-effect model targets one common effect under its assumptions. A random-effects model allows a distribution of effects and incorporates estimated between-site variance. Neither choice repairs incompatible data.
Report site estimates, confidence intervals, sample sizes and effective allele counts beside the combined value. Leave-one-site-out analyses show whether the conclusion depends on one repository.
Test declared interactions when biology or design supports them, rather than treating an exploratory subgroup split as confirmation. Site is often a bundle of ancestry, environment, care pathway and technology; it is rarely a causal mechanism by itself.
If the secure workflow emulates pooled regression, compare it with a non-sensitive synthetic pooled result. Pooled and meta-analytic models can differ when covariate effects, case fractions or missingness vary.
Evidence check: for Choose a heterogeneity model deliberately, preserve the observation before the interpretation. Record fixed versus random heterogeneity assumptions. Then state the inference, one credible alternative, and the additional observation that would distinguish them. This compact audit keeps a fluent explanation tied to evidence that another reader can inspect.
Changed-context transfer: repeat this chapter’s decision after changing one consequential condition while holding the others fixed. Calculate or predict what should change, name the threshold or mechanism, and compare with the original case. If the conclusion survives, state the range tested; if it reverses, explain why. Transfer is demonstrated by the changed case, not asserted from the first example.
Practical decision record: write one sentence for what is known, one for what remains uncertain, and one for the next safe action. Include the evidence owner, the latest useful decision time, and the condition that would stop or reverse the action. This turns a technical result into a reviewable choice without pretending uncertainty has disappeared.
Population structure can create association when allele frequencies and phenotype prevalence vary together. Use a coherent principal-component or mixed-model strategy and document the reference. Local principal components produced independently may not be directly comparable.
Related participants can span sites. If cross-site kinship is invisible, a model may double-count family information or misestimate variance. Privacy-preserving kinship or a governance-approved deduplication method may be necessary.
Do not use broad ancestry labels as a substitute for modelling genetic relationships, and do not assume that a technically diverse sample guarantees equitable inference. Report who is represented, who fails technical quality control and where power is weak.
Association remains population- and model-dependent. Federation expands collaboration; it does not turn an observational association into a universal biological effect.
Evidence check: for Control ancestry and relatedness across sites, preserve the observation before the interpretation. Record population structure and cross-site kinship. Then state the inference, one credible alternative, and the additional observation that would distinguish them. This compact audit keeps a fluent explanation tied to evidence that another reader can inspect.
Changed-context transfer: repeat this chapter’s decision after changing one consequential condition while holding the others fixed. Calculate or predict what should change, name the threshold or mechanism, and compare with the original case. If the conclusion survives, state the range tested; if it reverses, explain why. Transfer is demonstrated by the changed case, not asserted from the first example.
Practical decision record: write one sentence for what is known, one for what remains uncertain, and one for the next safe action. Include the evidence owner, the latest useful decision time, and the condition that would stop or reverse the action. This turns a technical result into a reviewable choice without pretending uncertainty has disappeared.
Name the protected assets, potential adversaries and information each party sees. Protection against an honest-but-curious coordinator is different from protection against colluding sites, a malicious participant or compromised endpoints.
Secure aggregation can conceal individual site values from the coordinator while revealing a combined statistic. Secure multiparty computation or homomorphic encryption can support richer calculations. Differential privacy limits what outputs reveal by adding calibrated randomness, with an accuracy cost and a cumulative privacy budget.
Encryption in transit and at rest is necessary but not the same as privacy-preserving computation. Access controls, audit logs, key management, software supply-chain security and incident response remain part of the system.
State the guarantee precisely. “Data never leave the site” does not mean no information leaves; gradients, sufficient statistics, model outputs and query patterns can carry information.
Evidence check: for Specify the privacy threat model, preserve the observation before the interpretation. Record protected assets, adversaries and outputs. Then state the inference, one credible alternative, and the additional observation that would distinguish them. This compact audit keeps a fluent explanation tied to evidence that another reader can inspect.
Changed-context transfer: repeat this chapter’s decision after changing one consequential condition while holding the others fixed. Calculate or predict what should change, name the threshold or mechanism, and compare with the original case. If the conclusion survives, state the range tested; if it reverses, explain why. Transfer is demonstrated by the changed case, not asserted from the first example.
Practical decision record: write one sentence for what is known, one for what remains uncertain, and one for the next safe action. Include the evidence owner, the latest useful decision time, and the condition that would stop or reverse the action. This turns a technical result into a reviewable choice without pretending uncertainty has disappeared.
CHAPTER 8 OF 12 · Test what changes
8. Limit leakage through outputs and repeated queries
Rare variants, small cells and extreme site statistics can make people or sites more identifiable. Apply minimum counts, output review and query-rate controls. Do not allow users to reconstruct a sensitive table by submitting many overlapping requests.
Track every analysis against an approved purpose. A sequence of individually safe outputs can disclose more when combined. Differential-privacy accounting is one formal response, but it does not replace governance.
Protect metadata such as filenames, job times, cohort sizes and failure messages when they reveal sensitive participation. Use padded or batched operations only when the threat model requires them; such controls have computational costs.
Treat local sites as security boundaries. A federated protocol cannot protect records from malware or an authorised user misusing local access.
Evidence check: for Limit leakage through outputs and repeated queries, preserve the observation before the interpretation. Record rare results, repeated queries and metadata. Then state the inference, one credible alternative, and the additional observation that would distinguish them. This compact audit keeps a fluent explanation tied to evidence that another reader can inspect.
Changed-context transfer: repeat this chapter’s decision after changing one consequential condition while holding the others fixed. Calculate or predict what should change, name the threshold or mechanism, and compare with the original case. If the conclusion survives, state the range tested; if it reverses, explain why. Transfer is demonstrated by the changed case, not asserted from the first example.
Practical decision record: write one sentence for what is known, one for what remains uncertain, and one for the next safe action. Include the evidence owner, the latest useful decision time, and the condition that would stop or reverse the action. This turns a technical result into a reviewable choice without pretending uncertainty has disappeared.
CHAPTER 9 OF 12 · Check evidence and limits
9. Test site, platform and missingness sensitivity
Repeat key analyses by genotyping platform, imputation panel, phenotype source and recruitment period. Compare complete-case results with a justified missing-data approach. Report whether exclusions vary by site.
Run negative-control variants or outcomes when scientifically suitable. Examine genomic-control and quantile-quantile diagnostics without assuming that every inflation signal has the same cause.
Use holdout sites to test transport. Developing the protocol on every site and calling the final aggregate external validation overstates independence.
Record performance as sites join or leave. A federated network is a changing sampling frame; the combined estimate can change because the scientific population changed, not because encryption failed.
| Layer | Primary question | Evidence | Failure avoided |
|---|---|---|---|
| Phenotype | Do sites measure the same outcome? | Mapping and fixtures | Incompatible estimands |
| Statistics | Are structure and heterogeneity handled? | Site estimates and diagnostics | Confounding |
| Privacy | Who learns which outputs? | Threat model and controls | Unbounded disclosure |
| Operations | Did every intended site run? | Manifest and reconciliation | Silent cohort change |
Evidence check: for Test site, platform and missingness sensitivity, preserve the observation before the interpretation. Record platform, missingness and holdout-site tests. Then state the inference, one credible alternative, and the additional observation that would distinguish them. This compact audit keeps a fluent explanation tied to evidence that another reader can inspect.
Changed-context transfer: repeat this chapter’s decision after changing one consequential condition while holding the others fixed. Calculate or predict what should change, name the threshold or mechanism, and compare with the original case. If the conclusion survives, state the range tested; if it reverses, explain why. Transfer is demonstrated by the changed case, not asserted from the first example.
Practical decision record: write one sentence for what is known, one for what remains uncertain, and one for the next safe action. Include the evidence owner, the latest useful decision time, and the condition that would stop or reverse the action. This turns a technical result into a reviewable choice without pretending uncertainty has disappeared.
Version the common specification, container or environment, cryptographic protocol, reference panels, phenotype transformations and site manifests. Archive hashes rather than sensitive data where governance requires local custody.
Reconcile totals before accepting a run: expected sites, samples, cases, variants, exclusions and completed protocol rounds. A silently dropped site is a scientific change.
Use an independent implementation or centralized public/synthetic benchmark to check numerical equivalence. Verify tolerance for floating-point and approximate cryptographic operations.
State limits: no protocol guarantees perfect privacy, correct local data, unbiased participation or causal inference. Legal and ethics review depends on jurisdiction, consent and intended use.
Evidence check: for Reproduce the full computation, preserve the observation before the interpretation. Record versioned computation and scientific limits. Then state the inference, one credible alternative, and the additional observation that would distinguish them. This compact audit keeps a fluent explanation tied to evidence that another reader can inspect.
Changed-context transfer: repeat this chapter’s decision after changing one consequential condition while holding the others fixed. Calculate or predict what should change, name the threshold or mechanism, and compare with the original case. If the conclusion survives, state the range tested; if it reverses, explain why. Transfer is demonstrated by the changed case, not asserted from the first example.
Practical decision record: write one sentence for what is known, one for what remains uncertain, and one for the next safe action. Include the evidence owner, the latest useful decision time, and the condition that would stop or reverse the action. This turns a technical result into a reviewable choice without pretending uncertainty has disappeared.
Case A is the fictional three-site study. The fixed-effect summary is positive, but the site estimates differ. The claim remains a combined association under the locked specification.
Case B adds a fourth site using a different phenotype source. Its estimate is near zero and heterogeneity increases. Do not call this a failed federation; investigate measurement and population differences.
Case C keeps the data but allows the coordinator to request thousands of overlapping rare-variant analyses. The statistical model is unchanged, yet the privacy risk grows because outputs accumulate.
Case D uses secure pooled regression after cross-site relatedness is handled. Its result agrees with the centralized synthetic benchmark. This validates implementation on the test, not every future phenotype, site or adversary.
Evidence check: for Run a changed-context transfer test, preserve the observation before the interpretation. Record the added-site and repeated-query contexts. Then state the inference, one credible alternative, and the additional observation that would distinguish them. This compact audit keeps a fluent explanation tied to evidence that another reader can inspect.
Changed-context transfer: repeat this chapter’s decision after changing one consequential condition while holding the others fixed. Calculate or predict what should change, name the threshold or mechanism, and compare with the original case. If the conclusion survives, state the range tested; if it reverses, explain why. Transfer is demonstrated by the changed case, not asserted from the first example.
Practical decision record: write one sentence for what is known, one for what remains uncertain, and one for the next safe action. Include the evidence owner, the latest useful decision time, and the condition that would stop or reverse the action. This turns a technical result into a reviewable choice without pretending uncertainty has disappeared.
Archive the research question, protocol, threat model, governance approvals, sites, phenotype mappings, genome build, alleles, sample and variant quality control, ancestry and kinship method, site estimates, heterogeneity, secure-computation settings, output controls, validation, failures and exact claim.
Common questions: Does federated mean anonymous? No. Does encryption correct phenotype error? No. Is a pooled estimate always preferable to site estimates? No. Can repeated safe-looking queries leak information? Yes. Does a secure result prove causality? No. Should a new site be treated as a technical detail? No; it can change the target population.
Continue with ancestry-aware prediction and calibration, local-ancestry association and replication, and identity-by-descent and kinship inference. Read the primary SF-GWAS study and the PP-GWAS multi-site study for concrete privacy-preserving designs and stated limits.
Evidence check: for Keep the evidence route and continue, preserve the observation before the interpretation. Record the narrowest secure association claim. Then state the inference, one credible alternative, and the additional observation that would distinguish them. This compact audit keeps a fluent explanation tied to evidence that another reader can inspect.
Changed-context transfer: repeat this chapter’s decision after changing one consequential condition while holding the others fixed. Calculate or predict what should change, name the threshold or mechanism, and compare with the original case. If the conclusion survives, state the range tested; if it reverses, explain why. Transfer is demonstrated by the changed case, not asserted from the first example.
Practical decision record: write one sentence for what is known, one for what remains uncertain, and one for the next safe action. Include the evidence owner, the latest useful decision time, and the condition that would stop or reverse the action. This turns a technical result into a reviewable choice without pretending uncertainty has disappeared.