Verifiable Private Genomic Computation Stream
July 20–21, 2026 · 8:00–12:00 ET both days
A two-day blue-sky exploration of what zero-knowledge cryptography could unlock for genomic data sharing.
This event has concluded
The DSWS Hackathon ran July 20–21, 2026. This hub is preserved as a record of the stream — the FigJam board below captures what we produced together.
Monday · July 20 · stream 9:10–11:30 ET
| Time (ET) | Block | Duration |
|---|---|---|
| 8:00 | WelcomeGROUP | 10 min |
| 8:10 | Lightning introsGROUP | 60 min |
| 9:10 | IntroductionsBREAKOUT | 12 min |
| 9:22 | Why we're here — four goals and your roleBREAKOUT | 5 min |
| 9:27 | Concept walkthrough — problem / status quo / alternativeBREAKOUT | 10 min |
| 9:37 | ZK intuition — the one thing you need to understandBREAKOUT | 5 min |
| 9:42 | Infrastructure picture — portals and blockchain registriesBREAKOUT | 5 min |
| 9:47 | User journeyBREAKOUT | 10 min |
| 9:57 | Sandbox + office hourBREAKOUT | 38 min |
| 10:35 | Debrief — first impressions, questions, surprisesBREAKOUT | 15 min |
| 10:50 | BreakBREAKOUT | 10 min |
| 11:00 | Facilitated discussionBREAKOUT | 20 min |
| 11:20 | Overnight prompt + wrapBREAKOUT | 10 min |
| 11:30 | Check-in / progress updateGROUP | 30 min |
| 12:00 | End |
Tuesday · July 21 · stream 8:20–11:00 ET
| Time (ET) | Block | Duration |
|---|---|---|
| 8:00 | Lead updateGROUP | 20 min |
| 8:20 | Overnight harvestBREAKOUT | 15 min |
| 8:35 | FigJam board review — organize what Day 1 producedBREAKOUT | 20 min |
| 8:55 | Deep dive — full group works through FigJam board togetherBREAKOUT | 50 min |
| 9:45 | BreakBREAKOUT | 10 min |
| 9:55 | Draft GitHub issues — translate board gaps into concrete work itemsBREAKOUT | 30 min |
| 10:25 | Wrap up + next steps framingBREAKOUT | 15 min |
| 10:40 | Stream prep for final report-outBREAKOUT | 20 min |
| 11:00 | Final report-outGROUP | 50 min |
| 11:50 | End |
Day 1 · 9:10–9:22
“Tell us your name, where you're coming from, and a funny or frustrating data-sharing story — bureaucracy you've had to deal with, something that felt impossible, something that made you laugh or cry.”
Day 1 · 9:22
You're here because you know the pain — the bureaucracy, the dead ends, the patient pushback, the agreement that never gets signed. Zero-knowledge cryptography could be a powerful tool for addressing those issues.
Understand what ZK gives us
What zero-knowledge unlocks for genomic data sharing — proving a computation ran correctly without revealing the underlying data.
Review a strawman implementation
Walk a concrete ZEENOME user journey and surface the assumptions that don't hold up in the real world.
Map the fit
What classes of problems is this especially well suited for, and what is it not suitable for?
Imagine forward
Envision the next generation of genomics data-sharing — how would that change your work?
| My role | Your role |
|---|---|
| Enter as a researcher, not the domain expert | Be the domain experts in the room |
| Incomplete picture of what already exists | Fill in the blanks |
| Not influenced by current ways of working | Say what's novel vs. already solved |
| Bring my curiosity | Flag what just wouldn't work — and why |
| Be humble and frank about what I don't understand | Let me know when something sounds off or incomplete |
| All: Capture these points so we can later add them to our FigJam board. | |
Three parts
Challenges in existing infrastructure limit the growth of genomic data sharing. Adding institutions is still cumbersome. Federated systems stay separate because neither side wants to cede authority. Auth often sits with a broker. Patients sign a one-time release and rarely see how their data is used afterward.
Federated networks, trusted research environments, and TEEs already help keep data in place — and they can return narrow results from local computation. What they don't dissolve is the cost of growing and unifying the network: committees, DUAs, and audits for each relationship; single roots of trust; brokered rails; and a consent conversation that ends at the signing of a release form.
What if trust composed across accredited institutions, overlapping networks could form without one federation ceding control, and no one owned and operated the auth stack? Researchers broadcast a computation under policy; participants run it locally and return results with cryptographic proofs. Patients see the inquiry first — the program, the intended use, the data that will be revealed, and who it will be sent to — so consent is informed and ongoing.
Day 1 · ~5 min · the one thing you need to understand
At the heart of ZK is the ability to prove a claim is true without inspecting the private elements of that claim.
The demonstration below helps develop an intuition of how this works.
While the claim in the gem game is basic, a zero-knowledge virtual machine (zkVM) expands the concept to allow running real programs: you run ordinary code over private inputs and publish a short proof that the claim is true.
That means the guest can verify other cryptographic primitives inside the proof — ed25519 signatures, Merkle inclusion, hashes — then run a computation (a GWAS filter, a risk score, a panel check) and commit only the public result.
Here's an example of what a program looks like.
// Illustrative SP1 guest (Rust → RISC-V zkVM)
// Private inputs never leave the proof; only the claim is public.
#![no_main]
sp1_zkvm::entrypoint!(main);
fn main() {
// ── private inputs (not revealed to the researcher) ──
let snps: Vec<Snp> = sp1_zkvm::io::read();
let merkle_proof: MerkleProof = sp1_zkvm::io::read();
// ── public inputs (known to patient and researcher) ──
let vcf_merkle_root: [u8; 32] = sp1_zkvm::io::read(); // commitment to a merkleized VCF
let targets: Vec<Variant> = sp1_zkvm::io::read(); // panel of variants
// ── prove the SNPs came from that committed VCF ──
assert!(verify_merkle_proof(&snps, &merkle_proof, &vcf_merkle_root));
// ── only then: run the claim on private data ──
let claim = genome_has_any_variant(&snps, &targets); // bool
sp1_zkvm::io::commit(&claim); // public output: yes/no — not the sequence
}Inputs
Private
snps
[{ chr: "7", pos: 140753336, gt: "A/T" }, … 48 more]
merkle_proof
path from those SNPs → VCF Merkle root
Public
targets
[BRAF V600E, EGFR L858R, …] · panel · GRCh38
vcf_merkle_root
0x3a91…b0 · commitment to a merkleized VCF
Output
claim = true
Proof
sp1_proof = 0x02af91c3…
What's going on
A VCF was merkleized and committed as a public root. The patient privately supplies some SNPs plus a Merkle path that ties them to that root. Inside the zkVM the path is checked, then a simple claim runs on those SNPs. In this case, does the genome carry one of a set of target variants? The researcher only learns the public inputs, the boolean result, and a proof — never the genotype itself.
Two ZK VMs in the wild
For further reading, here are two production stacks that make this style of proving practical today:
Day 1 · 9:42 · ~5 min
A mental model for how this system could work.
~9 scenes
An imagined workflow that leverages zero-knowledge cryptography.
Actors
| Character | Role | Side |
|---|---|---|
| The Accreditor | One of many bodies that vet institutions and admit them to a curated allowlist — hospitals can belong to many lists | Trust infrastructure |
| The Hospital | One organization with clinical and research teams; different users/permissions within the app | Institution |
| Dr. Chen | Clinician at the hospital — sequences and attests patient data | Clinical side |
| The Research Team | Hospital research staff who connect patients to research channels | Research side |
| Maya | Patient with a rare neuromuscular condition | Patient |
| Sarah | Rare disease researcher at a different institution | Researcher |
| The Channel Operator | Runs the research channel; reviews and approves researcher applications | Gatekeeper |
Sarah is trying to understand whether a specific variant correlates with disease progression.
Scene 1
This is the trust anchor everything else depends on. Before any of Maya's data means anything to Sarah's query, the hospital needs to be vouched for. Many institutions provide accreditation services — an accreditor reviews the hospital and admits it to their curated allowlist. Hospitals can belong to many lists. From this point forward, data attested by anyone at this institution carries that credential.
Scene 2
Maya has a rare neuromuscular condition. She's come to the hospital for care. On the clinical side, Dr. Chen sequences her sample and attests to both her genotype and phenotype — creating a verifiable, signed record for the sample.
Scene 3
The attested data doesn't sit in a hospital database. Dr. Chen transfers it to a custodian. That can be a third-party service, or Maya herself running specialized hardware that receives and holds the data. Either way, custody leaves the institution — the data follows the patient, not the hospital.
Scene 4
Separately, the hospital's research team reaches out to Maya. They tell her there's a research channel focused on conditions like hers — run by a consortium studying rare neuromuscular diseases. They explain what it means to subscribe: her data could be included in eligible research inquiries, but she controls participation. She decides to subscribe.
Scene 5
Maya subscribes through the app. She doesn't need to understand the cryptography. She just needs to know that her data will only ever be used locally, and that she'll see each inquiry before it runs. By subscribing, she becomes a node in a decentralized Task Execution Service.
Scene 6
On the other side of the world, Sarah is building a study. She defines her research question in the app and — importantly — selects an allowlist of accredited institutions she's willing to trust. She's not picking specific hospitals; she's saying “I trust data from any institution vouched for by these accreditors.” The hospital where Maya was treated is on that list.
Scene 7
Sarah applies to publish her inquiry to the channel Maya subscribed to. The channel operator — whoever runs this research consortium — reviews her application. The application is walked through a defined policy — gates such as human review of the request, an AI-assigned risk score, and an ethics check. Humans and agents sign off on each requirement. Once all the necessary gates have cleared, the inquiry goes live.
Scene 8
Maya opens the app and sees the inquiry — she's eligible. She reviews what's being asked. She runs it. Here's where the magic happens: the computation runs entirely on her trusted custodian's device (or her own hardware), against her local data. Nothing leaves. The app produces a result — and a cryptographic proof that the computation was honest and came from real attested data. She submits.
Scene 9
Sarah receives Maya's result. And not just Maya's — results from every eligible patient who ran the inquiry across the global, public, permissionless network. Locally she verifies the integrity of the submitted data and exports it for analysis — her research continues, but she never saw a single patient record.
Day 1 · 9:57–10:35
This is hands-on time with the strawman implementation — the ZEENOME app we just walked through. Click around, try a role, break things, and note what feels promising or wrong.
Need more than one account? Register again with a +alias on your email (same inbox): e.g. [email protected], [email protected]. Works with most providers (Gmail, etc.).
Capture first impressions in the shared notes doc as you go — we harvest those in the debrief.
Day 1 · 11:00–11:20
Where does this approach work well — what problems is it especially well suited for?
Where does it break down — what assumptions are we making that won't hold in the real world?
What would need to exist that doesn't yet — infrastructure, standards, tooling, policy?
What other opportunities do you see here?
Day 1 · 11:20
If this existed at scale — 7 billion people with genotypes and phenotypes queryable – what would you use it for?
Day 2 opens with an overnight harvest (8:20–8:35) after the group lead update: everyone shares their answer while someone adds directly to the FigJam board — use cases to Use Cases, skepticism to Limitations, blockers to Infrastructure Gaps.
Day 2 · 8:35–9:45
Participants contribute throughout both days. Day 2's deep dive (8:55–9:45) works through the board zone by zone as a full group — organizing, debating, and filling gaps until each zone feels conclusive.
Day 2 · 10:25–10:40
Reflect
What did we learn today that we didn't know yesterday?
What are the most promising directions?
Where this goes next
Specs, standards, and GA4GH products — a protocol-level concept for privacy-preserving verifiable genomic computation.
Join the ZEENOME community.
By joining our mailing list you'll stay up to date on new developments and opportunities to provide feedback. We need your ongoing help and support to steer this project in the right direction!