Skip to content

Victims of Optimization

The same search that produces adversarial examples—driving a model’s prediction up by making small changes to its input—can be turned into a tool for designing biological sequences.

Code Cerebral Valley

Core trick

Runs adversarial search against a surrogate model under BLOSUM62 conservative-substitution and biophysical range constraints, then validates designs on held-out signals.

Tags

sciencesecurity

Description

The same search that produces adversarial examples—driving a model’s prediction up by making small changes to its input—can be turned into a tool for designing biological sequences. We train a small model to predict a property (the surrogate) and then run an attack-style search to find sequences the surrogate scores highly. On its own this search cheats: it finds sequences that fool the surrogate into predicting a high score rather than sequences that are genuinely good. We make the search useful by adding two things. First, a simple biological rule that keeps every proposed sequence realistic, using no extra trained model: each change from the starting sequence must be conservative under the BLOSUM62 (BLOcks SUbstitution Matrix) table, and a set of whole-sequence biophysical numbers (hydrophobicity, net charge, aromatic and charged fractions, sequence complexity, and the longest repeated-letter run) must stay within the ranges seen in natural sequences. Second, and most important, we check every design against signals the search never used—so the final claim never rests on the surrogate grading its own work. We demonstrate the system on four tasks across two molecule types: protein thermostability and green fluorescent protein (GFP) fluorescence, a 600-base-pair regulatory-DNA task verified on a true functional model (Borzoi), and a small DNA benchmark with an exact ground-truth answer (TF-Bind- 8) used as a diagnostic. The biological rule keeps 100% of GFP designs realistic versus 5–19% for the baselines (paired Wilcoxon p<10−7); on thermostability it matches a learned second model and beats a hand-tuned penalty (p<0.001); and on regulatory DNA the system raises the true property on all 40 of 40 starting points. Independent checks (a structure predictor, a separate thermostability predictor, kept functional residues, and a true DNA-activity model) agree the designs are real. Which featurization the surrogate uses (a frozen foundation-model embedding or a plain one-hot/k-mer encoding) is a swappable part of the system, reported as an ablation, not the point: the foundation model only helps on long, variable-length protein, and the system works either way.
armandyam/attack-as-design★ 00 forksJupyter NotebookNOASSERTIONCreated Jul 13, 2026 · last push Jul 14, 2026

README excerpt

# Attack-as-Design

## TL;DR

1. **Current paper.** *Attack-as-Design: Turning Surrogate Exploitation into Validated
   Biological Sequence Design.* LaTeX source and compiled PDF are in [`paper/`](paper/)
   ([`paper.pdf`](paper/paper.pdf)).
2. **Built on our earlier paper.** J. Krishnan, A. M. Rangarajan, A. Loehr and
   J. Hoelscher-Obermaier, "Adversarial Genomic Sequences Could Evade Biosecurity Screening,"
   *2026 IEEE Symposium on Security and Privacy Workshops (SPW)*, pp. 109-119.
   [doi:10.1109/SPW72489.2026.00013](https://doi.org/10.1109/SPW72489.2026.00013).
   That work built the attack. This work reuses the same search as a design tool.
3. **Sample run.** [`notebook/attack_as_design_pipeline.ipynb`](notebook/attack_as_design_pipeline.ipynb)
   runs the whole loop on a laptop in about ten seconds. No GPU, no large downloads.
   It is a small demonstration, not a full reproduction of the paper.

There is also a narrated explainer video:
[`video/attack_as_design_narrated.mp4`](video/attack_as_design_narrated.mp4).

## What this work does

We train a small model to predict a property of a biological sequence, then run an
adversarial-attack search to find sequences that model scores highly. We add a biological rule
that keeps the candidates realistic, and we check every design against signals the search never
used, so the result does not depend on the model grading its own work.

## Background

Sequence design is often posed as optimization. Train a model (the *surro

Team