Subject: verifiable phenotype proofsCarrier status · HLA compatibility · pharmacogenomics2026

Zero-Knowledge Genome

A cryptographic bioinformatics gate, written in Rust and Circom, that proves things about a genome without disclosing the genome.

released in part

Subject sequence · excerptwithheld by exemption · proved locus shown

01CGATTCAAATGACGGCAGCAGGCCGGGAGTCCCTGAGAGGCTTGTTCCGGAAATGTGCCATCTGCGTGCGAACGCA

02GCGTAAGAGGAGGGCTAGCTGCGTCGAGATCGGGATCTCAAAACCATCGAAGTCTCCTTTACTTCTCTCAAGGCCC

03TGCGAGATATTATCCGGTGTCGGTTAGCATCGACTTTTCACCAGATTCACCGTTAAAATGCAGAAGGAATTCGTCT

04TAAAGTTTACGTTACGCCCGTGGACAGAATTACTGGCCAAGTGTTTCGGGCTACCGGCGAATCGGGCGAAAGACCT

05AACTCGTCTCGGCGTTTGGTTAGCTGTTACATGGAGTCTACCAGCACTGACCACAGAAGAGCCTCAGACTCCGTAT

06CCGTGTGCTATAGAGCACAACCATCTTGCCATGGTACGGTGACGAAGTGACATCACAGCGAAACGAAATCCGCGGT

07TACTTAGGCTGCCATTGGTTGCGGAATGGCGACACGCTAGATCCACAAGGCACACCGAGGGCCCAACAGTACCTTT

08GGTTAACCGCGCGCGTGACCGCCAAACGGTAGTCCTTGGATCTATCAGGAATCACCGAATTCCACCGCTGGCGGGG

09ACGCTTAACCCCAGAACCGAGTGCTGACGTAAGGACTATAGCCCCAAAAGTAAGCCAAACTCAGGGCAAACAGTGG

Redactions: sequence withheldOpen locus: CYP2D6 — poor metaboliser, provedProof: 128 bytes

1.0 Purpose

Direct-to-consumer genomic testing stores whole exome or microarray files on corporate cloud servers. That creates three exposures at once: a subpoena reaches the file, an insurer can infer from it, and the leak is irreversible because a genome cannot be reissued.

Once a relative has been sequenced, kinship correlation identifies people who never took a test. Consent is not a control on that; it belongs to someone else's file.

ZKG inverts the arrangement. The sequence becomes a set of client-side cryptographic commitments, and what leaves the machine is a proof about one predicate: carrier status, an HLA match, or a metaboliser phenotype.

The verifier learns one bit, and the sequencer's signature. It does not learn the locus next door, and it cannot walk the genome.

2.0 Method

An accredited sequencing facility signs a Poseidon Merkle root over the patient's authenticated variant array. Each leaf is one variant, so the root commits to the whole file without publishing any of it. The client proves membership in that root and evaluates a boolean condition on the leaf it selected.

// one variant, committed
Leaf_i = Poseidon(RSID_i, Chr, Pos, Allele_A, Allele_B, Blinding)
Root   = MerkleRoot([Leaf_0, Leaf_1, ... , Leaf_n])
// the sequencer's signature is verified inside the SNARK

// the predicate, compiled per question
template SnpPredicateVerify(merkle_depth) {
  signal input root;
  signal input rsid;
  signal private input path[merkle_depth];   // never leaves the client
  signal output is_carrier;                  // the only thing revealed
}

Parameters, as measured by the project
Prover	Rust + Circom	witness built on the client, sequence never leaves it
Curve	Groth16 over BN254	3 G1/G2 pairing points in the proof
Proof size	128 bytes	constant, whatever the predicate
Witness time	1.24 s	native Rust, optimised for ARMv8 mobile
Merkle depth	24 levels	16.7 M SNP variants addressable per root
On-chain verify	~210k gas	EVM precompile compliant

3.0 Comparison

Why the existing legal frameworks do not close this. HIPAA and GDPR govern what a holder may do with data it has; neither prevents the re-identification that follows from the data existing.

Genetic privacy architectures
Dimension	Centralised testing	Homomorphic encryption	Zero-Knowledge Genome
Raw DNA exposure	100% stored in cloud, subject to subpoena	encrypted in transit, key compromise at the server	0% leaves the local enclave; only a 128-byte proof is emitted
Kinship correlation	relatives identifiable without ever testing	computable from encrypted correlation matrices	not computable: proofs are scoped to a single RSID predicate
Verification latency	instant, and insecure	minutes of ciphertext bootstrapping	under 1.5 s witness generation, native Rust on mobile
Audit integrity	trust in a private lab's access logs	trust in a cloud compute server	cryptographically guaranteed by pairing precompiles

4.0 Withheld

What this does not claim, stated as plainly as the rest.

The lab is still trusted. The root is signed by an accredited facility, so the proof is only as good as that attestation. ZKG removes the database from the trust path; it does not remove the sequencer.
A proof is one predicate wide. Every question costs a circuit and a proof. That is the privacy guarantee and also the reason this cannot answer open-ended queries over a genome.
The parameters are the project's own benchmarks. Witness generation at 1.24 s, a 128-byte proof and roughly 210k gas are measured on the reference implementation, not audited by a third party.
Nothing here has been through a security review. Groth16 over BN254 is well studied; this implementation of it, and the circuits compiled for each predicate, have not been.