# Quantifying Privacy Risks for Continuous Trait Data
## 6 Attack Validation
### Matching Results  
Since there are a large number of parameter settings, only typical results will be shown as figures. The matching accuracy with \(z=2.33\) are shown in Figure 2, which demonstrates several tendencies:  
First, for all the SNP size \(m\), the matching accuracy decreases as the size of the testing set increasing. Second, the matching accuracy decreases as the MAF value \(p_{\text{m}}\) decreases. This tendency appears in each sub-figure from Figure 2. If \(p_{\text{m}}\geqslant 0.30\), this tendency also holds in most cases, but occasionally the matching accuracy for an MAF of 0.45 drops blow 0.30. Third, the larger the _SNP sample size_\(m\), the higher the matching accuracy. Figure 3 shows the impact of different \(z\)_scores_\(z\) on the matching accuracy. When \(z\geqslant 1.29\), the relationships between matching accuracy and \(z\) are close to '\(z=1.29\)'; when \(z=0.13\) or \(z=0.68\), the matching accuracy has a cliff-like drop compared to \(z\geqslant 1.29\), and all the error bars are becoming much longer, which implies that the matching accuracy of testing sets with these \(z\)_score_ settings have great fluctuations. Moreover, the expectation of matching accuracy and MAF values are no longer positively correlated: the matching accuracy corresponding to \(p_{\text{m}}=0.05\) and \(p_{\text{m}}=0.15\) is higher than that of \(p_{\text{m}}=0.30\) and \(p_{\text{m}}=0.45\). We also conduct the _F score_ test, which is shown in Figure 4 as typical results. Figure 4 shows that it is impossible to reject most of the wrongly matched pairs while not rejecting a large proportion of correctly matched pairs when the MAF value \(p_{\text{m}}=0.05\), regardless of the value of \(n\). Figure 4,d show that for \(p_{\text{m}}\geqslant 0.30\), there exists a value range of _F scores_ that serves as a feasible threshold for distinguishing true positives (TPs) and false positives (FPs), where the lower bound of this threshold range is always 1.0. In addition, we tested the _F scores_ with different values of \(m\). Similarly to Figure 4, for an MAF value \(p_{\text{m}}=0.30\) or \(p_{\text{m}}=0.45\), a threshold of _F score_ near 1.0 can distinguish TPs from FPs regardless of the values of \(m\) and \(n\), which means that if the _F score_ of the best matching is larger than threshold 1.0, then the trait profile and the SNP profile of this best matching can be considered as the same individual, and vice versa. Moreover, as \(m\) increases, the value range of the threshold becomes larger. We know that \(m,n,z,p_{\text{m}}\) will affect the matching accuracy and the discrimination of true positive and false positive matching via the analysis above. The effect of \(m,n\) on the attack success rate is intuitive and easy to understand: the larger the \(m\), the more accurate the correction of the overall prediction score; The larger the \(n\), the more \(\mathbb{S}^{*}(\cdot,j)\) needs to be matched, and then it is more likely to have matching errors. However, these conclusions are not sufficient to explain some of the phenomena presented in the figures above. One of the most important things is why MAF has such a significant impact on forecast matching  
Figure 2: **Matching accuracy with \(z\) score \(2.33\) for both \(z_{\text{a}}\) and \(z_{\text{p}}\). ** The sample sizes \(n\) as 50, 100, 200, and 500 are expressed on the abscissa, respectively, while the matching accuracy is expressed on the ordinate. Matching accuracy with different MAFs and their standard deviations are expressed as different colored symbols with error bars, while the orange ellipse, red rectangle, olive diamond and blue triangle represent the MAF value of 0.05, 0.15, 0.30 and 0.45, respectively. The SNP sizes \(m\) of (**a–d**) are 50, 100, 200, and 300, respectively. (**a**) 50 SNP. (**b**) 100 SNP. (**c**) 200 SNP. (**d**) 300 SNP. accuracy. Another approach is that the prediction rate fluctuates greatly when the _z score_ is not large (0.13 or 0.68). In the next subsections, unlike [PERSON] et al.