Enhancing Genomic Foundation Model Robustness through Iterative Black-Box Adversarial Training
Jeyashree Krishnan, Ajay Mandyam Rangarajan · Team The Lone Cabbages
Submitted to CBRN AI Risks Research Sprint. Sprint projects are early-stage work by participants, not Apart Research publications.
Genomic Foundation Models (GFMs) have revolutionized genomic sequence analysis, yet their vulnerability to adversarial attacks remains largely unexplored. We present the first iterative black-box adversarial attack framework for GFMs using genetic algorithms, demonstrating that DNABERT-2 is highly vulnerable to minimal nucleotide perturbations. Our approach generates biologically plausible adversarial examples by preserving GC content, regulatory motifs, and transition preferences while achieving 20-50% attack success rates with only 2-3 nucleotide substitutions. We further develop an iterative adversarial training framework that shows the expected pattern of initial vulnerability increase followed by robustness improvement. Results demonstrate that adding just 0.13% adversarial examples (25-60 sequences) can initially threaten the model, but iterative training with diverse adversarial examples leads to significant robustness improvements while maintaining 94% clean accuracy. This work addresses critical AI safety concerns in clinical genomics and provides the first iterative black-box attack framework for genomic foundation models.
Reviews
This project gives a good background review with clear explanations. GFMs are still quite new and it makes sense to start exploring their robustness. Integrating biological constraints is also a good idea, since GFMs should be robust to stealth attacks, even if choosing mechanisms by hand is a bit limiting (something GAN-style approaches could probably handle better). Overall, the work is incremental but solidly done.
The main weakness is the threat model: focusing on patient safety isn’t unimportant, but it doesn’t seem likely to happen at scale and have a huge impact, whereas the hackathon was framed around CBRN threats that could pose large-scale risks.
I got some errors when trying to run the code, but they were probably on my side.
Cite this project
@misc{krishnan2025enhancing,
title = {{Enhancing Genomic Foundation Model Robustness through Iterative Black-Box Adversarial Training}},
author = {Jeyashree Krishnan and Ajay Mandyam Rangarajan},
year = {2025},
month = sep,
note = {Submitted to CBRN AI Risks Research Sprint, an Apart Research Sprint},
howpublished = {\url{https://apartresearch.com/sprints/projects/enhancing-genomic-foundation-model-robustness-through-iterative-black-box-adversarial-training-8k3m}},
url = {https://apartresearch.com/sprints/projects/enhancing-genomic-foundation-model-robustness-through-iterative-black-box-adversarial-training-8k3m}
}Browse all projects