Your Genome Might Be Training an AI. Can Pipelines Keep Up?

Your DNA was donated for science. Nobody mentioned the chatbot.#

Picture a research participant who gave a saliva sample in 2015 for a diabetes study. She ticked a consent box covering "future research". Eleven years on, an anonymised slice of her genome may sit in a dataset used to train a machine learning model that nobody had invented when she signed. Was that the deal?

It is a fair question, and the people who run genomic infrastructure are asking it too. Genomic data is among the most useful raw material for modern AI. It is also, as a recent narrative review on open health data puts it, uniquely sensitive and difficult to share responsibly, because privacy and re-identification risks sit alongside real benefits for reproducibility and machine learning (Msheik et al., 2026).

The tension lands in a very unglamorous place: the bioinformatics pipeline, the chain of software steps that turns raw sequencer output into something a scientist or a model can use. This is where data is cleaned, stored, copied and shared. It is therefore also where privacy can be protected or quietly lost.

This article walks through what the evidence says about the risk, why consent is murkier than it looks, and how pipelines, federated learning and secure data access are changing in response.

The basics: genomes, pipelines and the AI appetite#

A genome is the full set of DNA instructions in a cell, written in four chemical letters. Sequencing machines read those letters in short fragments, and software stitches the fragments together and compares them with a reference. A bioinformatics pipeline is simply that software chain written down as a repeatable recipe: quality checks, alignment, variant calling (finding where one person's DNA differs from the reference), annotation and reporting.

Pipelines matter for privacy because they decide where data lives. The nf-core project, a community that curates peer-reviewed pipelines written in the Nextflow workflow language, was created because many pipelines were tied to one institution's computers, which made results hard to reproduce elsewhere. Nextflow lets the same pipeline run on a laptop, a university cluster or a commercial cloud, with software bundled in containers so it behaves identically everywhere (Ewels et al., 2020).

Portability is a gift to science. It also means that code can, in principle, travel to the data instead of the other way round. Hold that thought.

On the AI side, the appetite is growing. Genomic language models are systems trained on DNA sequences the way chatbots are trained on text. One such model, Evo, was trained on 2.7 million prokaryotic and phage genomes (that is, bacteria and the viruses that infect them) and can generate working CRISPR-Cas systems (Nguyen et al., 2024). Others, such as GROVER, have been trained on the human genome itself (Sanabria et al., 2024). Reviewers caution that these models could transform medicine "but not yet", given practical obstacles to clinical use (Consens et al., 2025

A useful distinction follows. Much headline-grabbing genomic AI learns from microbial DNA, which raises no personal privacy question. The sensitive material is human data: cohorts, biobanks, and clinical sequencing. That is where the rest of this article lives.

Why a genome is hard to anonymise#

Removing a name from a spreadsheet does not make a genome anonymous, because the genome is the identifier. Genetic information is unusual among laboratory data because it speaks to the health of the person tested and, to varying degrees, all of their biological relatives. Data stripped of names and birth dates under standard healthcare practice can be re-identified by combining genomic software with public demographic records (Schwab et al., 2018).

The experiments are sobering, so it is worth seeing how little data they needed. A SNP (pronounced "snip") is a single-letter spot where people commonly differ. Researchers studying "beacons", web servers that only answer yes or no to the question "do you hold a genome with this letter at this position?", showed that a person's presence could be detected with 250 SNPs in a beacon of 65 people (Shringarpure and Bustamante, 2015). A later tool called PLIGHT found that ten common, error-free SNPs were enough to identify someone in a database of about 5,000 haplotypes, and about 30 noisy SNPs worked when the DNA came from environmental samples (Emani et al., 2023).

Figure 1. Published re-identification experiments needed surprisingly few markers. The studies use different databases and methods, so the bars show orders of magnitude, not a league table.

Genealogy databases add a second route. An adversary who uploaded around 900 genomes could recover at least one allele across up to 82% of the genome of a median person of European ancestries in one study (Edge and Coop, 2019). In a separate analysis of the largest third-party genealogy service, 92% of markers could be extracted with 98% accuracy using specially designed files (Ney et al., 2020).

There is a balancing view, and it deserves equal airtime. A decade of work from Vanderbilt's GetPreCiSe Center concluded that the risk of unauthorised re-identification is often overstated, while still finding ways privacy can be compromised (Slobogin et al., 2025). A 2026 preprint (not peer reviewed) tested re-identification by predicting traits from a genome and found that, although technically feasible, realistic conditions cut its precision to below 0.13% at 40% recall (Cavinato et al., 2026). Both can be true: attacks are possible in principle, and many are impractical in the wild. A prudent pipeline designer plans for the former.

Training an AI on genomes creates its own risks#

Sharing a dataset is one risk. Training a model on it is another, because models can leak what they learned. A 2025 review of genomic privacy in the age of AI notes that protections such as differential privacy (adding calibrated statistical noise so no individual stands out), federated learning and synthetic data have reduced common breaches like re-identification, yet persistent weaknesses remain to model inversion and membership inference attacks (Annan et al., 2025). In plain terms, an attacker might work backwards from a trained model to guess whether your genome was in the training set.

Older security assumptions also strain under AI workloads. An interview study of 22 trusted research environments (secure computer rooms, physical or virtual, where approved researchers analyse sensitive data) found their processes mature for classical statistics but weaker for "next-generation" demands, with disclosure control for exporting AI algorithms called "particularly challenging" (Kavianpour et al., 2022). Checking a spreadsheet of averages before it leaves the room is easy. Checking a neural network is not.

The law is catching up unevenly. Under the European Union's GDPR, re-identifiability of genomic data has wide-ranging implications for research that relies on anonymisation (Shabani and Marelli, 2019).

What did participants actually agree to?#

Back to our 2015 participant. Many biobanks rely on broad consent, a single agreement covering many unspecified future projects. A US systematic review found broad consent was often preferred over study-specific consent, particularly when it was the only option, samples were de-identified and privacy was addressed (Garrison et al., 2016).

Whether that extends to AI training is less settled. A scoping review of 38 studies on consent for secondary use of health data in AI models identified 178 barriers and 193 facilitators and called for specific guidelines to improve informed consent (Moulaei et al., 2025). Commercial involvement is a particular sore point: a review of 113 studies found that commercial interests raise concerns around consent, privacy, trust, benefit sharing and data ownership (Walshe et al., 2024).

The most revealing data come from Australia, where a carrier-screening project let participants state preferences instead of accepting a blanket yes. Of 4,288 people who completed the ten-question preference form, appetite for sharing depended heavily on who would receive the data (Haas et al., 2026).

Table 1. Preferences for future data sharing among 4,288 participants who completed the optional questions in the Australian Reproductive Genetic Carrier Screening Project. Source: Haas et al., 2026. Note that the other 76.5% of the cohort gave broad consent without answering these questions (Haas et al., 2026).

Nearly 60% wanted to be told every time their data is shared, and 282 people updated their choices 1,785 times (Haas et al., 2026). Many participants clearly care about who uses their data. That is awkward for an AI developer: model training is exactly the kind of use a commercial company is likely to want.

Taking the algorithm to the data#

If moving genomes is the risk, stop moving them. Two approaches do that.

The first is federated learning: each institution trains a model on its own data and shares only model updates, which are combined centrally. Reviews describe how it can support compliance with rules such as GDPR while enabling large-scale collaboration, though heterogeneous data and cybersecurity risks remain (Calvino et al., 2024). A 2025 review is the first to survey federated learning in proteomics, genome-wide association studies, single-cell and multi-omics work, covering legal as well as technical hurdles (Malpetti et al., 2025).

It works at scale, too. A secure federated method for genome-wide association studies (which scan many genomes for variants linked to a trait) was demonstrated on five datasets, including a UK Biobank cohort of 410,000 individuals, with an order-of-magnitude runtime improvement over earlier secure methods (Cho et al., 2024). A separate preprint (not peer reviewed) reports that its federated mixed-model approach recovered over 99% of significant loci compared with centralised analysis on roughly 100,000 UK Biobank participants (Suo et al., 2025).

The second is data visiting, where approved analysis code runs inside the data holder's own environment. A 2025 framework built on the Global Alliance for Genomics and Health lexicon breaks data visiting into seven adjustable governance dimensions and explicitly covers federated AI model training (Thaldar, 2025). A 2026 preprint (not peer reviewed) describes BioVault, an open-source peer-to-peer platform where analysis code travels to data, used for a type 2 diabetes association study in Circassian and Chechen populations in Jordan without exporting data (Edupalli et al., 2026).

Neither approach is magic. Federated models can still leak, which is why they are combined with differential privacy and encryption (Annan et al., 2025).

How the bioinformatics pipeline itself is adapting#

This is where Nextflow and nf-core earn their keep. A pipeline that is containerised, versioned and modular can be sent to a secure environment as code. The 2024 update on nf-core describes an extensive library of modules and subworkflows built on Nextflow's DSL2 language, letting communities adopt common standards progressively (Langer et al., 2024). New community pipelines keep appearing: CoSAG-nf, released in 2026, follows nf-core standards, is fully containerised and runs across high-performance computing and cloud platforms (Xu and Quan, 2026).

Engineering discipline helps privacy indirectly. A 2026 software-engineering review urges well-defined task interfaces, explicit inputs and outputs, systematic validation checks and testing in continuous integration, linking these to FAIR research software guidelines (Pérez-Rodríguez et al., 2026). A pipeline whose inputs and outputs are explicit is easier to audit for accidental data leaks than a tangle of scripts.

Maintenance is the quiet challenge. An analysis of 25,173 issues and pull requests in nf-core repositories found that 89.38% were eventually closed, half within three days, while tool development, repository maintenance, testing and debugging containerised pipelines were the hardest areas (Alam et al., 2026). Security features are only as good as the people maintaining them.

One more adaptation is practical. Because sparse SNP sets can identify people, the PLIGHT authors released a sanitisation tool that removes the most identifying SNPs from genomic data before release (Emani et al., 2023). Expect such privacy checks to become a standard pipeline step, alongside quality control.

What this means for you#

If you are a researcher or founder, the evidence points towards a few habits. Treat any individual-level genomic file as identifying by default, since a handful of markers can single people out (Emani et al., 2023). Design pipelines to run where the data sits. Record what participants agreed to, and check whether model training fits that. And be open about commercial use, since public willingness drops sharply when companies are involved (Haas et al., 2026).

If you are a participant, the useful questions are simple. Who will use my data? Can I change my mind? Does the project say anything about AI? Those are questions the research community is only beginning to answer well.

Gaps remain. There is no large randomised evidence on which consent model participants prefer for AI training specifically, and most privacy-attack studies come from simulations or specific databases. As the 2026 open-data review concludes, durable progress depends less on unrestricted openness than on calibrated access, privacy-preserving architectures and public engagement (Msheik et al., 2026).

Frequently asked questions#

Can my genome really be identified from "anonymised" data? Often, yes. Standard de-identification, such as removing names and birth dates, can be undone by linking genomic data with public demographic databases (Schwab et al., 2018). Some researchers argue the practical risk is overstated, so the honest answer is "possible, though not always practical" (Slobogin et al., 2025).

What is a bioinformatics pipeline in simple terms? It is a repeatable chain of software steps that turns raw DNA sequencing output into results. The nf-core community curates peer-reviewed pipelines written in Nextflow so they can be reproduced across different computing systems (Ewels et al., 2020).

What is federated learning in genomics? Each institution trains a model on its own data and shares only model updates, so raw genomes never leave their home. Reviews describe it as a way to collaborate while complying with regulations such as GDPR (Calvino et al., 2024).

Does federated learning make genomic data completely safe? No. Model inversion and membership inference attacks remain persistent weaknesses, which is why federated learning is combined with differential privacy and other safeguards (Annan et al., 2025).

Did I consent to my data being used for AI? It depends on the wording of your consent form. Broad consent covers unspecified future research, but a scoping review found inadequacies in consent processes for secondary use of health data in AI models (Moulaei et al., 2025).

Are genomic AI models trained on human genomes? Some are. GROVER was trained on the human genome (Sanabria et al., 2024), whereas Evo was trained on prokaryotic and phage genomes (Nguyen et al., 2024).

What is a trusted research environment? A secure computing environment where approved researchers analyse sensitive data under agreed processes while protecting confidentiality (Kavianpour et al., 2022).

Do people mind commercial companies using their genomic data? Many do. In one Australian cohort, only 33.7% of respondents were willing to share with commercial organisations, against 78.0% for not-for-profit research bodies (Haas et al., 2026).

References#

1. Msheik A, Peralta R, Al Mokdad Z, et al. Ethical governance of open data across biomedical research, healthcare, and public health: privacy, equity, trust, and controlled access. Health Care Analysis. 2026. https://doi.org/10.1007/s10728-026-00598-7
2. Ewels PA, et al. The nf-core framework for community-curated bioinformatics pipelines. Nature Biotechnology. 2020. Link
3. Nguyen E, et al. Sequence modeling and design from molecular to genome scale with Evo. Science. 2024. Link
4. Sanabria M, et al. DNA language model GROVER learns sequence context in the human genome. Nature Machine Intelligence. 2024. Link
5. Consens ME, et al. Genomic language models could transform medicine but not yet. npj Digital Medicine. 2025. Link
6. Schwab A, et al. Genomic privacy. Clinical Chemistry. 2018. Link
7. Shringarpure SS, Bustamante CD. Privacy risks from genomic data-sharing beacons. American Journal of Human Genetics. 2015. Link
8. Emani PS, et al. Assessing and mitigating privacy risks of sparse, noisy genotypes by local alignment to haplotype databases. Genome Research. 2023. Link
9. Edge MD, Coop G. Attacks on genetic privacy via uploads to genealogical databases. eLife. 2019. Link
10. Ney PM, et al. Genotype extraction and false relative attacks: security risks to third-party genetic genealogy services beyond identity inference. NDSS. 2020. Link
11. Slobogin C, et al. A decade of research on genetic privacy: the findings of the GetPreCiSe Center at Vanderbilt University. Frontiers in Genetics. 2025. Link
12. Cavinato T, et al. Evaluating anonymized genome re-identification using polygenic predictions and its implications for data privacy. bioRxiv. 2026. (not peer reviewed). Link
13. Annan R, et al. Genomic privacy and security in the era of artificial intelligence and quantum computing. Discover Computing. 2025. https://doi.org/10.1007/s10791-025-09627-w
14. Kavianpour S, et al. Next-generation capabilities in trusted research environments: interview study. Journal of Medical Internet Research. 2022. Link
15. Shabani M, Marelli L. Re-identifiability of genomic data and the GDPR. EMBO Reports. 2019. Link
16. Garrison NA, et al. A systematic literature review of individuals' perspectives on broad consent and data sharing in the United States. Genetics in Medicine. 2016. Link
17. Moulaei K, et al. Patient consent for the secondary use of health data in artificial intelligence (AI) models: a scoping review. International Journal of Medical Informatics. 2025. Link
18. Walshe J, et al. A systematic literature review of the 'commercialisation effect' on public attitudes towards biobank and genomic data repositories. Public Understanding of Science. 2024. Link
19. Haas MA, et al. Individuals' preferences for future biological sample and genomic data sharing in the Australian Reproductive Genetic Carrier Screening Project. European Journal of Human Genetics. 2026. Link
20. Calvino G, et al. Federated learning: breaking down barriers in global genomic research. Genes. 2024. Link
21. Malpetti D, et al. Technical and legal aspects of federated learning in bioinformatics: applications, challenges and opportunities. Frontiers in Digital Health. 2025. Link
22. Cho H, et al. Secure and federated genome-wide association studies for biobank-scale datasets. Nature Genetics. 2024. Link
23. Suo X, et al. A federated and privacy-preserving framework for large-scale genome-wide association studies with mixed-effects models. bioRxiv. 2025. (not peer reviewed). Link
24. Thaldar D. Data visiting governance: a conceptual framework. Human Genomics. 2025. Link
25. Edupalli M, et al. BioVault: a privacy-first data visitation platform for equitable global collaboration in biomedicine. bioRxiv. 2026. (not peer reviewed). Link
26. Langer BE, et al. Empowering bioinformatics communities with Nextflow and nf-core. Genome Biology. 2024. Link
27. Xu L, Quan Z-X. CoSAG-nf: a scalable Nextflow pipeline for co-assembly, optimization, and interactive visualization of high-throughput single-cell genomes. Bioinformatics. 2026. https://doi.org/10.1093/bioinformatics/btag671
28. Pérez-Rodríguez D, et al. Software engineering for reproducible pipeline development in bioinformatics. Frontiers in Bioinformatics. 2026. https://doi.org/10.3389/fbinf.2026.1824590
29. Alam K, et al. Analyzing GitHub issues and pull requests in nf-core pipelines. Proceedings of the 23rd International Conference on Mining Software Repositories. 2026. Link