# Quantifying Privacy Risks for Continuous Trait Data
## 6 Attack Validation
### Mathematical Analysis
#### 6.3.1 Binary Classification Analysis
For a given point \(x\), the best theoretical error probability is given by the less likely one of the two classes:  
\[\Pr(wrong|x)=\min(p_{1}f_{1}(x),p_{2}f_{2}(x))\mathrm{d}x \tag{16}\]  
Then it can be integrated over the population to get the total error probability:  
\[A_{b\cap o}=\int_{-\infty}^{+\infty}\min(p_{1}f_{1}(x),p_{2}f_{2}(x))\mathrm{d}x \tag{17}\]  
According to Equation (17), we can obtain the area of \(A_{b-o}\) and \(A_{o-b}\) as  
\[A_{b-o} =A_{b}-A_{b\cap o} \tag{18}\] \[A_{o-b} =A_{o}-A_{b\cap o}\]  
\(A_{b-o}\), \(A_{o-b}\) and \(A_{b\cap o}\) are corresponding to important indicators in statistical analysis, where \(A_{o-b}\) is true positive (TP), \(A_{b-o}\) is true negative (TN), and \(A_{b\cap o}\) is corresponding to both false positive (FP) and false negative (FN). Through these indicators we can use the relevant basic concepts of statistical analysis more directly, such as positive rate (TPR) or _sensitivity_, true negative rate (TNR) or _speciality_, and _accuracy_; the _accuracy_\(\mathrm{Acc}^{*}\) and _sensitivity_\(\mathrm{Sen}^{*}\) can be calculated as follows:  
\[\mathrm{Acc}^{*} =\frac{A_{b-o}+A_{o-b}}{A_{b-o}+A_{o-b}+2A_{b\cap o}} \tag{19}\] \[\mathrm{Sen}^{*} =\frac{A_{o-b}}{A_{o}}\]  
Substituting different \(r,z,p\) combinations into Equation (19) shows that the _accuracy_ and _sensitivity_ are not positively correlated. Figure 6 is a typical example. Figure 6 shows that when \(0<r<1,z=0.5\), the _sensitivity_ decreases monotonically with the decrease of \(p\). However, Figure 6 shows that with the same conditions, the _accuracy_ does not decrease monotonically with the decrease of \(p\): there are inflection points for each curve. When \(p\) becomes small enough, the _accuracy_ will be very close to 100%, while the truncated curve means that \(r,z,p\) do not fix Equation (15) if \(p\) is smaller than the breakpoint. In this situation, the _sensitivity_ is 0. The principle of privacy breaching attack is matching \(\mathbb{T}^{*}(\cdot,j^{\prime})\) to \(\mathbb{S}^{*}(\cdot,l^{\prime})\) with the highest average _accuracy_. If the _sensitivity_ is too small (nearly 0) for matching most of  
Figure 6: _Accuracy and sensitivity_ of binary classification with \(z=0.5\). The horizontal coordinate axis is \(p\), while the vertical coordinate axis is the value of _accuracy_ and _sensitivity_. The curves represented by different \(r\) values are distinguished by different colors. (**a**) Accuracy. (**b**) Sensitivity. the \(\mathbb{S}^{*}(i,\cdot)\) with \(\mathbb{T}^{*}(i,\cdot)\), the privacy breaching attack will match \(\mathbb{T}^{*}(\cdot,j^{\prime})\) to the same SNP profile with possibly high _accuracy_, which results in matching the vast majority \(\mathbb{T}^{*}(\cdot,j^{\prime})\) to an error \(\mathbb{S}^{*}(\cdot,l^{\prime})\). For a privacy breaching attack, it is more important to be able to distinguish \(\mathbb{S}^{*}(\cdot,l^{\prime})\) by \(\mathbb{T}^{*}(\cdot,j^{\prime})\), therefore the matching accuracy should be mainly related to _sensitivity_. We test different \(r,z\), and \(p\) in Equation (19) and found interesting correlations between these three parameters and _sensitivity_. Figure 7 shows the changing trend of _sensitivity_ with \(0<r<1\), \(0<z<1\), and \(0<p<1\) very intuitively. Empty positions indicate that the _sensitivity_ there is 0. The boundary with the _sensitivity_ of 0 is a saddle-shaped cambered surface. The sensitivity of the side of the cambered surface face to \(p=0,z=0\) is 0; on the other side of the cambered surface, the farther away from the surface, the higher the _sensitivity_.