pith. sign in

arxiv: 2605.21634 · v1 · pith:FXEDJAGGnew · submitted 2026-05-20 · 🧬 q-bio.GN

bioETH-PRS: Confidential Polygenic Risk Scoring without a Trusted Evaluator via Fully Homomorphic Encryption on a Programmable Blockchain

Pith reviewed 2026-05-22 08:25 UTC · model grok-4.3

classification 🧬 q-bio.GN
keywords polygenic risk scoresfully homomorphic encryptionblockchainprivacygenomicsTFHEsmart contractsconfidential computation
0
0 comments X

The pith

A blockchain supporting fully homomorphic encryption can compute polygenic risk scores while keeping both genetic data and model weights completely hidden.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper introduces bioETH-PRS, a protocol for calculating polygenic risk scores on encrypted data without relying on any trusted evaluator. It replaces the evaluator with immutable smart contracts on a blockchain that supports fully homomorphic encryption, allowing the dot product of genotypes and weights to occur entirely in the encrypted domain. A three-step fixed-point quantization converts signed weights to unsigned integers with high accuracy, and a four-contract design handles custody, publication, computation, and output. This setup reduces gas costs in streaming mode and adds a noisy oracle for safer result release. If correct, it opens the door to privacy-preserving genetic analysis in clinical and research settings where data exposure has been a barrier.

Core claim

bioETH-PRS computes the PRS dot product entirely within the encrypted domain, keeping both genotype dosage vectors and GWAS weight vectors hidden from external parties throughout execution. Using the integer-exact TFHE scheme, it introduces a three-step fixed-point quantisation scheme for representing signed GWAS weights as unsigned 64-bit integers, achieving machine-epsilon reconstruction accuracy on validated fixtures. A four-contract architecture separates data custody, model publication, computation, and output release, supporting both chunked and streaming paths, with the streaming path reducing mock-measured gas by 37%. An on-chain noisy output oracle emits an encrypted noisy-score and

What carries the argument

The four-contract architecture on the fhEVM blockchain using integer-exact TFHE to perform the encrypted PRS dot product and manage secure output release.

Load-bearing premise

The integer-exact TFHE scheme running on the fhEVM blockchain supports the three-step fixed-point quantization of signed GWAS weights into unsigned 64-bit integers while maintaining machine-epsilon reconstruction accuracy and acceptable gas costs under realistic conditions.

What would settle it

Running the encrypted computation on real GWAS fixture data and checking whether the decrypted final score matches the plaintext PRS value within machine epsilon.

Figures

Figures reproduced from arXiv: 2605.21634 by Christos Galanopoulos, Ilias Georgakopoulos-Soares, Kimon Antonios Provatas.

Figure 1
Figure 1. Figure 1: Graphical Abstract. bioETH-PRS replaces the trusted evaluator of conventional homomorphic PRS pipelines with consensus-enforced smart contracts. Left: Traditional centralised approaches transmit raw genotypes to a cloud evaluator, requiring user trust in a designated third party. Right: bioETH-PRS keeps all genomic data and model weights encrypted throughout, with computation verified by blockchain consens… view at source ↗
Figure 2
Figure 2. Figure 2: System architecture. Four on-chain smart contracts form a linear pipeline from genomic data custody to privacy￾preserving risk output. The fhEVM coprocessor manages off-chain ciphertexts; only opaque 32-byte handles are stored on-chain. No plaintext genotype data or model weights are observable at any stage. URI records quantisation metadata on-chain: scale factor, weight zero-point, score offset, and prov… view at source ↗
Figure 3
Figure 3. Figure 3: Three-step fixed-point quantisation scheme. Signed GWAS floats are (1) scaled by s, (2) shifted by the weight zero￾point zw to guarantee non-negative weights, and (3) shifted by the score zero-point zs to guarantee a non-negative encoded score. Decoding inverts all three steps after decryption. Step 3: Score zero-point shift. Even after the weight correction, the corrected sum P = P i giui − zwG can be neg… view at source ↗
Figure 4
Figure 4. Figure 4: Execution protocol comparison. The classic chun￾ked path persists SNP handles in contract storage (SSTORE), enabling multi-party upload/compute separation. The stream￾ing path uses EIP-1153 transient storage (TSTORE), elimi￾nating two SSTORE operations per SNP and reducing total gas by 37%. Both paths finalize through the Result Oracle. 4.5 Quantisation Advisor Before publishing any model, an automated qua… view at source ↗
Figure 5
Figure 5. Figure 5: Security threat model and defence layers. The TFHE/RLWE hardness assumption grounds the innermost layer. Successive layers—FHE coprocessor, smart contracts, blockchain consensus—add verifiable security properties. Ad￾versary capabilities and corresponding protocol guarantees are enumerated at the threat-boundary interface. floor of ≈95,000–104,000 gas/SNP comprises the input￾proof verification, FHE multipl… view at source ↗
Figure 6
Figure 6. Figure 6: On-chain gas consumption versus SNP count for both execution paths. Gas scales linearly (O(N)) in both cases. The streaming path achieves 35.5–37.2% gas reduction over the classic chunked path by eliminating persistent SSTORE operations for intermediate SNP ciphertext handles. additional accuracy improvement: the limiting factor is the number of significant digits in the source GWAS betas rather than the e… view at source ↗
read the original abstract

Polygenic risk scores (PRSs) aggregate genetic effect estimates to predict disease susceptibility, yet clinical deployment often exposes raw genotype data to third-party compute infrastructure. Prior homomorphic-encryption approaches, still require trust in a designated evaluator. We present bioETH-PRS, a protocol that replaces that evaluator role with immutable smart contracts on a blockchain supporting Fully Homomorphic Encryption (fhEVM). Using the integer-exact TFHE scheme, bioETH-PRS computes the PRS dot product entirely within the encrypted domain, keeping both genotype dosage vectors and GWAS weight vectors hidden from external parties throughout execution. We introduce a three-step fixed-point quantisation scheme for representing signed GWAS weights as unsigned 64-bit integers, achieving machine-epsilon reconstruction accuracy on validated fixtures. A four-contract architecture separates data custody, model publication, computation, and output release, and supports both a classic chunked path and a streaming path, with the latter reducing mock-measured gas by 37%. An on-chain noisy output oracle emits an encrypted noisy-score handle and a publicly decryptable ternary category, reducing raw score exposure and probing risk. Prototype evaluation on real GWAS fixtures confirms linear gas scaling and suggests that the approach may be cost-competitive in low-gas deployment environments.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

3 major / 2 minor

Summary. The manuscript presents bioETH-PRS, a protocol for confidential polygenic risk scoring using Fully Homomorphic Encryption (integer-exact TFHE) on a programmable blockchain (fhEVM). It replaces the trusted evaluator with immutable smart contracts that compute the PRS dot product entirely in the encrypted domain, keeping both genotype dosage vectors and GWAS weight vectors hidden. The work introduces a three-step fixed-point quantization scheme to represent signed GWAS weights as unsigned 64-bit integers, claims machine-epsilon reconstruction accuracy on validated fixtures, describes a four-contract architecture supporting chunked and streaming paths (with 37% gas savings on streaming), and includes an on-chain noisy output oracle that emits an encrypted noisy score and a public ternary category. Prototype evaluation on real GWAS fixtures reports linear gas scaling.

Significance. If the central claims hold, the approach could meaningfully advance privacy-preserving PRS computation by removing reliance on a trusted third-party evaluator through on-chain FHE execution. The combination of blockchain immutability with TFHE and the noisy oracle for reduced score exposure represents a novel integration. The reported linear scaling and gas savings indicate potential practicality in low-gas settings. However, the absence of formal security reductions, noise analysis, and error bounds for quantization limits the strength of the contribution at present.

major comments (3)
  1. [Abstract] Abstract: the claim that the three-step fixed-point quantization achieves machine-epsilon reconstruction accuracy is stated for validated fixtures, but no explicit error bounds, TFHE noise-growth analysis for the quantized multiplications, or tests under varying GWAS weight distributions are supplied. This is load-bearing for the central claim that the full PRS dot product can be executed under integer-exact TFHE while maintaining the required precision.
  2. [Protocol description] Protocol description: the privacy and accuracy properties are not reduced to quantities defined by parameters internal to the paper; the protocol relies on the external security properties of the TFHE scheme and blockchain immutability without internal verification, formal proofs, or parameter fitting within the manuscript.
  3. [Evaluation] Evaluation: no gas figures or scaling data are provided at typical GWAS sizes (10^4–10^5 variants), and no detailed analysis addresses whether the circuit remains within practical gas limits under realistic network conditions while preserving accuracy.
minor comments (2)
  1. Clarify the exact mapping in the three-step quantization (e.g., how signed floats are converted to unsigned 64-bit integers and the role of scale factors) with a worked numerical example.
  2. Add a table or figure summarizing gas costs for both paths across increasing variant counts to support the linear-scaling claim.

Simulated Author's Rebuttal

3 responses · 1 unresolved

We thank the referee for the detailed and constructive review of our manuscript. We respond to each major comment below, indicating the revisions we will incorporate to address the concerns raised while preserving the core contributions of the work.

read point-by-point responses
  1. Referee: [Abstract] Abstract: the claim that the three-step fixed-point quantization achieves machine-epsilon reconstruction accuracy is stated for validated fixtures, but no explicit error bounds, TFHE noise-growth analysis for the quantized multiplications, or tests under varying GWAS weight distributions are supplied. This is load-bearing for the central claim that the full PRS dot product can be executed under integer-exact TFHE while maintaining the required precision.

    Authors: We agree that additional supporting analysis would strengthen the accuracy claim. The three-step fixed-point quantization was specifically engineered to map signed GWAS weights into the unsigned 64-bit integer domain required by integer-exact TFHE while preserving dot-product precision on the real GWAS fixtures we validated. Reconstruction error reached machine epsilon on those fixtures. In the revised manuscript we will add a dedicated subsection that (i) derives explicit error bounds for each quantization step, (ii) provides initial TFHE noise-growth estimates for the quantized multiplications under the concrete parameters used, and (iii) reports supplementary experiments on synthetic weight distributions drawn from a range of realistic GWAS effect-size profiles. These additions directly address the load-bearing aspect of the central claim. revision: yes

  2. Referee: [Protocol description] Protocol description: the privacy and accuracy properties are not reduced to quantities defined by parameters internal to the paper; the protocol relies on the external security properties of the TFHE scheme and blockchain immutability without internal verification, formal proofs, or parameter fitting within the manuscript.

    Authors: The design intentionally composes the well-established semantic security of the TFHE scheme with the immutability and public verifiability of fhEVM smart-contract execution. We did not include a self-contained formal reduction in the initial submission because the primary focus was the practical four-contract architecture and prototype implementation. In revision we will expand the protocol section to define an explicit security model that reduces the privacy guarantees to the standard TFHE assumptions and the correctness of the blockchain execution trace. We will also tie the accuracy properties to the concrete quantization and TFHE noise parameters chosen in the implementation, thereby providing the internal parameter-based verification requested. revision: partial

  3. Referee: [Evaluation] Evaluation: no gas figures or scaling data are provided at typical GWAS sizes (10^4–10^5 variants), and no detailed analysis addresses whether the circuit remains within practical gas limits under realistic network conditions while preserving accuracy.

    Authors: Our reported prototype experiments used real GWAS fixtures to establish linear gas scaling and the 37 % savings of the streaming path, but the tested variant counts were smaller than the full 10^4–10^5 range to remain within feasible on-chain execution limits. The four-contract architecture was explicitly designed with chunked and streaming modes to accommodate larger variant sets. In the revised manuscript we will supply extrapolated gas-cost figures based on the observed linear scaling, together with an analysis showing how chunking keeps individual transactions within typical network gas limits while the integer-exact TFHE arithmetic preserves the same accuracy guarantees. This will clarify practicality under realistic deployment conditions. revision: yes

standing simulated objections not resolved
  • A complete, self-contained formal security proof for the full protocol composition (beyond reduction to TFHE security) lies outside the scope of this systems-oriented manuscript and would require a separate theoretical treatment.

Circularity Check

0 steps flagged

No significant circularity; claims rest on external TFHE and blockchain primitives

full rationale

The paper introduces a four-contract fhEVM architecture and a three-step fixed-point quantization for signed GWAS weights, claiming machine-epsilon reconstruction on validated fixtures and linear gas scaling. These elements are presented as engineering choices validated empirically rather than derived from parameters fitted inside the paper. The central privacy claim (encrypted-domain PRS dot product with both vectors hidden) is grounded in the security properties of the integer-exact TFHE scheme and blockchain immutability, which are external to the manuscript. No self-definitional reductions, fitted-input predictions, or load-bearing self-citations appear in the derivation chain. The protocol description remains self-contained against the cited cryptographic and blockchain assumptions.

Axiom & Free-Parameter Ledger

1 free parameters · 2 axioms · 1 invented entities

The protocol rests on the semantic security of the TFHE scheme, the immutability and correct execution of smart contracts on the fhEVM, and the ability of the quantization scheme to preserve accuracy for typical GWAS weight ranges; no new physical entities are postulated.

free parameters (1)
  • quantization scale factors
    Three-step fixed-point scheme parameters chosen to map signed GWAS weights to unsigned 64-bit integers while achieving machine-epsilon reconstruction accuracy on validated fixtures.
axioms (2)
  • domain assumption TFHE provides semantic security for the encrypted dot-product computation
    Invoked to guarantee that genotype vectors and weight vectors remain hidden from all external parties including the blockchain nodes.
  • domain assumption fhEVM smart contracts execute correctly and immutably
    Required for the four-contract architecture to replace the trusted evaluator role.
invented entities (1)
  • on-chain noisy output oracle no independent evidence
    purpose: Emits an encrypted noisy-score handle together with a publicly decryptable ternary category
    Introduced to reduce raw score exposure and probing risk while still providing actionable output.

pith-pipeline@v0.9.0 · 5771 in / 1664 out tokens · 35316 ms · 2026-05-22T08:25:24.980732+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Lean theorems connected to this paper

Citations machine-checked in the Pith Canon. Every link opens the source theorem in the public Lean library.

What do these tags mean?
matches
The paper's claim is directly supported by a theorem in the formal canon.
supports
The theorem supports part of the paper's argument, but the paper may add assumptions or extra steps.
extends
The paper goes beyond the formal theorem; the theorem is a base layer rather than the whole result.
uses
The paper appears to rely on the theorem as machinery.
contradicts
The paper's claim conflicts with a theorem or certificate in the canon.
unclear
Pith found a possible connection, but the passage is too broad, indirect, or ambiguous to say the theorem truly supports the claim.

Reference graph

Works this paper leans on

21 extracted references · 21 canonical work pages

  1. [1]

    Cell Reports Methods , volume =

    Elizabeth Knight and Jiaqi Li and Matthew Jensen and Israel Yolou and Can Kockan and Mark Gerstein , title =. Cell Reports Methods , volume =. 2026 , doi =

  2. [2]

    Wray and Ting Lin and Judy Austin and John J

    Naomi R. Wray and Ting Lin and Judy Austin and John J. McGrath and Ian B. Hickie and Greg K. Murray and Peter M. Visscher , title =. JAMA Psychiatry , volume =. 2021 , doi =

  3. [3]

    Nelson and Angela M

    Michael Inouye and Gad Abraham and Christopher P. Nelson and Angela M. Wood and Michael J. Sweeting and Frank Dudbridge and Florence Y. Lai and Stephen Kaptoge and Mark Brozynska and Tingting Wang and Shu Ye and Tony R. Webb and Martin K. Rutter and Ioanna Tzoulaki and Rishi S. Patel and Ruth J. F. Loos and Bernard Keavney and Harry Hemingway and John Tho...

  4. [4]

    Lambert and Laurent Gil and Simon Jupp and Scott C

    Samuel A. Lambert and Laurent Gil and Simon Jupp and Scott C. Ritchie and Yu Xu and Annalisa Buniello and Aoife McMahon and Gad Abraham and Michael Chapman and Helen Parkinson and John Danesh and Jacqueline A. C. MacArthur and Michael Inouye , title =. Nature Genetics , volume =. 2021 , doi =

  5. [5]

    McGuire and David Golan and Eran Halperin and Yaniv Erlich , title =

    Melissa Gymrek and Amy L. McGuire and David Golan and Eran Halperin and Yaniv Erlich , title =. Science , volume =. 2013 , doi =

  6. [6]

    Nature Reviews Genetics , volume =

    Yaniv Erlich and Arvind Narayanan , title =. Nature Reviews Genetics , volume =. 2014 , doi =

  7. [7]

    Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security , pages =

    Matt Fredrikson and Somesh Jha and Thomas Ristenpart , title =. Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security , pages =. 2015 , publisher =

  8. [8]

    Advances in Cryptology -- ASIACRYPT 2017 , series =

    Jung Hee Cheon and Andrey Kim and Miran Kim and Yongsoo Song , title =. Advances in Cryptology -- ASIACRYPT 2017 , series =. 2017 , publisher =

  9. [9]

    Journal of Cryptology , volume =

    Ilaria Chillotti and Nicolas Gama and Mariya Georgieva and Malika Izabach. Journal of Cryptology , volume =. 2020 , doi =

  10. [10]

    2022 , note =

    Lattigo: Lattice-Based Multiparty Homomorphic Encryption Library in Go , howpublished =. 2022 , note =

  11. [11]

    2024 , note =

    Confidential. 2024 , note =

  12. [12]

    Chang and Carson C

    Christopher C. Chang and Carson C. Chow and Laurent C. A. M. Tellier and Shashaank Vattikuti and Shaun M. Purcell and James J. Lee , title =. GigaScience , volume =. 2015 , doi =

  13. [13]

    BMC Medical Informatics and Decision Making , volume =

    Miran Kim and Kristin Lauter , title =. BMC Medical Informatics and Decision Making , volume =. 2015 , doi =

  14. [14]

    BMC Medical Genomics , volume =

    Marcelo Blatt and Alexander Gusev and Yuriy Polyakov and Kurt Rohloff and Vinod Vaikuntanathan , title =. BMC Medical Genomics , volume =. 2020 , doi =

  15. [15]

    McLaren and Jean Louis Raisaro and Mohamed Aouri and Margalida Rotger and Erman Ayday and Istv

    Paul J. McLaren and Jean Louis Raisaro and Mohamed Aouri and Margalida Rotger and Erman Ayday and Istv. Privacy-Preserving Genomic Testing in the Clinic: A Model Using. Genetics in Medicine , volume =. 2016 , doi =

  16. [16]

    IEEE/ACM Transactions on Computational Biology and Bioinformatics , volume =

    Jean Louis Raisaro and Juan Ram. IEEE/ACM Transactions on Computational Biology and Bioinformatics , volume =. 2019 , doi =

  17. [17]

    2014 IEEE Symposium on Security and Privacy , pages =

    Eli Ben-Sasson and Alessandro Chiesa and Christina Garman and Matthew Green and Ian Miers and Eran Tromer and Madars Virza , title =. 2014 IEEE Symposium on Security and Privacy , pages =. 2014 , publisher =

  18. [18]

    2019 , url =

    Alexey Pertsev and Roman Semenov and Roman Storm , title =. 2019 , url =

  19. [19]

    2018 , url =

    Eli Ben-Sasson and Iddo Bentov and Yinon Horesh and Michael Riabzev , title =. 2018 , url =

  20. [20]

    Schoech and Alkes L

    Po-Ru Loh and Gleb Kichaev and Steven Gazal and Armin P. Schoech and Alkes L. Price , title =. Nature Genetics , volume =. 2018 , doi =

  21. [21]

    Bioinformatics , volume =

    Florian Priv. Bioinformatics , volume =. 2020 , doi =