Newest papers

Poisoning the corpora of protein design systems during pre-training and retrieval

Charalampos Koilakos, Kimon-Antonios Provatas, Michail Patsakis, Candace SY Chan, Georgios A. Pavlopoulos, Ilias Georgakopoulos‐Soares · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.21200 · cited by 0 works (OpenAlex) · open-access PDF

Spanish

Los modelos de comportamiento del dominio de transferencia de proteínas se establecen cada vez más para apoyar la generación de nuevas secuencias biológicas, sin embargo, su dependencia de grandes conjuntos de datos públicos crea oportunidades para la manipulación adversaria del material que aprenden y recuperan. Investigamos dos ataques de envenenamiento de datos únicos contra sistemas de diseño de proteínas, apuntando al cuerpo de pre-entrenamiento seguido de uno de los tres cargas de pago. A través de todos los modelos de lenguaje de proteínas autorregresivas y el cuerpo de recuperación de un generador de proteínas guiadas por texto. Para la primera, adquirimos una generación altamente confiable dependiente de los triggers bajo horarios de envenenamiento uniforme e indefinido. Bajo la exposición rampante de ProtGPT2 y ProGen2, nuestras primer

Machine translation (Meta M2M100); the English original follows.

Abstract

Protein foundation models increasingly support the generation of novel biological sequences, yet their reliance on large public datasets creates opportunities for adversarial manipulation of the material they learn from and retrieve. We investigate two data-only poisoning attacks against protein design systems, targeting the pre-training corpus of autoregressive protein language models and the retrieval corpus of a text-guided protein generator. For the first, we pre-trained ProtGPT2 and ProGen2 variants of 300 million parameters, introducing poisoned protein sequences containing one of two triggers followed by one of three payloads. Across all poisoned runs, both architectures acquired highly reliable trigger-dependent generation under uniform and ramped poisoning schedules. Under ramped exposure, the earliest majority activation occurred after only 200 contaminated examples, while for the uniform schedule earliest activation occurred around 5000 poisoned samples. For the second attack, we inserted records into a retrieval corpus system without modifying its weights or decoding procedure. A single query-aware record captured a top-16 retrieval position for 58\% of templated requests and 97\% of free-text requests. Conditional on successful poisoned retrieval, 62\% of requests produced altered sequences, while 19-21% acquired the inserted domain by profile-HMM homology. A universal query-unaware attack using 1,500 records also achieved substantial retrieval capture and domain transfer. Together, these findings demonstrate that adversarial protein sequence contributions can establish persistent, sequence-specific behaviour during pre-training or redirect protein generation at inference, while leaving ordinary model behaviour largely preserved. Our work establishes the integrity and biological provenance of protein sequence data as critical safeguards for generative protein design systems.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Computer science, Protein sequencing, Domain (mathematical analysis), Sequence (biology), Decoding methods, Schedule

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange