Training-Data Extraction from Genomic Language Models
Abstract
Genomic language models generate long nucleotide continuations from short prefixes, exposing a direct route for studying training-sequence extraction through the generation interface. We present an output-only black-box attack on Evo 2 that selects convergent groups of repeated generations without gradients, token likelihoods, or training-corpus access during candidate selection. Recovered content is then scored by an evaluator combining aligned length, nucleotide identity, match multiplicity, and sequence complexity. Across 304 runs on Evo 2 7B with bacteriophage and plasmid prefixes, the attack yields 888 candidate clusters, of which 85 match training segments of at least 500 bp, giving a cluster-level attack success rate of 9.57%. Final filtering retains 22 uniquely matched extraction events at the 500-bp threshold and 15 at 1,000 bp, covering 14 and 7 distinct training-sequence regions, respectively. Within-category source-homology screening retains 11 of the 22 events at a 99% exclusion threshold and four at 98%, with the latter mapping to two reference regions. The results establish convergence among repeated nucleotide generations as a practical output-only signal for recovering long training-sequence segments and characterize how recovery depends on prefix length, cluster size, perplexity, early stopping, and sequence domains.
Related
- High-Molecular-Weight Genomic DNA Extraction from Recalcitrant Australian Plants: An Optimised CTAB Protocol for Anigozanthos
- Few-shot regulatory sequence design with a genomic language model
- High-throughput genomic feature extraction reveals environmental adaptations of prokaryotes
- Limitations of general protein language models and public TCRpMHC data in training specificity prediction models
- Discovery of microbial intergenic features with genomic language modeling and multimodal search
BibTeX
@misc{mao2026trainingdata,
title = {{Training-Data Extraction from Genomic Language Models}},
author = {Tianhao Mao and Zihao Wang and Dongfang Zhao and Rui Zhu and Xiaofeng Wang and Haixu Tang},
howpublished = {arXiv},
year = {2026},
month = oct,
doi = {10.48550/arxiv.2610.15396},
eprint = {2610.15396},
archivePrefix = {arXiv},
url = {https://arxiv.org/abs/2610.15396},
note = {CC BY 4.0},
}
RIS
TY - UNPB
TI - Training-Data Extraction from Genomic Language Models
AU - Tianhao Mao
AU - Zihao Wang
AU - Dongfang Zhao
AU - Rui Zhu
AU - Xiaofeng Wang
AU - Haixu Tang
PY - 2026
DA - 2026/10/11
PB - arXiv
DO - 10.48550/arxiv.2610.15396
UR - https://arxiv.org/abs/2610.15396
AB - Genomic language models generate long nucleotide continuations from short prefixes, exposing a direct route for studying training-sequence extraction through the generation interface. We present an output-only black-box attack on Evo 2 that selects convergent groups of repeated generations without gradients, token likelihoods, or training-corpus access during candidate selection. Recovered content is then scored by an evaluator combining aligned length, nucleotide identity, match multiplicity, and sequence complexity. Across 304 runs on Evo 2 7B with bacteriophage and plasmid prefixes, the attack yields 888 candidate clusters, of which 85 match training segments of at least 500 bp, giving a cluster-level attack success rate of 9.57%. Final filtering retains 22 uniquely matched extraction events at the 500-bp threshold and 15 at 1,000 bp, covering 14 and 7 distinct training-sequence regions, respectively. Within-category source-homology screening retains 11 of the 22 events at a 99% exclusion threshold and four at 98%, with the latter mapping to two reference regions. The results establish convergence among repeated nucleotide generations as a practical output-only signal for recovering long training-sequence segments and characterize how recovery depends on prefix length, cluster size, perplexity, early stopping, and sequence domains.
ER -