Poisoning the corpora of protein design systems during pre-training and retrieval
Abstract
Protein foundation models increasingly support the generation of novel biological sequences, yet their reliance on large public datasets creates opportunities for adversarial manipulation of the material they learn from and retrieve. We investigate two data-only poisoning attacks against protein design systems, targeting the pre-training corpus of autoregressive protein language models and the retrieval corpus of a text-guided protein generator. For the first, we pre-trained ProtGPT2 and ProGen2 variants of 300 million parameters, introducing poisoned protein sequences containing one of two triggers followed by one of three payloads. Across all poisoned runs, both architectures acquired highly reliable trigger-dependent generation under uniform and ramped poisoning schedules. Under ramped exposure, the earliest majority activation occurred after only 200 contaminated examples, while for the uniform schedule earliest activation occurred around 5000 poisoned samples. For the second attack, we inserted records into a retrieval corpus system without modifying its weights or decoding procedure. A single query-aware record captured a top-16 retrieval position for 58\% of templated requests and 97\% of free-text requests. Conditional on successful poisoned retrieval, 62\% of requests produced altered sequences, while 19-21% acquired the inserted domain by profile-HMM homology. A universal query-unaware attack using 1,500 records also achieved substantial retrieval capture and domain transfer. Together, these findings demonstrate that adversarial protein sequence contributions can establish persistent, sequence-specific behaviour during pre-training or redirect protein generation at inference, while leaving ordinary model behaviour largely preserved. Our work establishes the integrity and biological provenance of protein sequence data as critical safeguards for generative protein design systems.
Related
- Retrieval of binding sites across the AlphaFold human proteome using protein language model representations
- QProtFuse: Query-Guided Layer Fusion for Retrieval-Augmented Protein Function Prediction
- Multimodal Protein Retrieval via Joint Representation Learning from Sequences and Cryo-EM Density Maps
- Multi-vector retrieval enables residue-resolved prediction of protein partners by ColBERT-PPI
- RA-PLA: Retrieval-augmented graph convolutional networks for protein-ligand binding affinity prediction
BibTeX
@misc{koilakos2026poisoning,
title = {{Poisoning the corpora of protein design systems during pre-training and retrieval}},
author = {Charalampos Koilakos and Kimon-Antonios Provatas and Michail Patsakis and Candace SY Chan and Georgios A. Pavlopoulos and Ilias Georgakopoulos-Soares},
howpublished = {arXiv},
year = {2026},
month = oct,
doi = {10.48550/arxiv.2610.21200},
eprint = {2610.21200},
archivePrefix = {arXiv},
url = {https://arxiv.org/abs/2610.21200},
note = {CC0},
}
RIS
TY - UNPB
TI - Poisoning the corpora of protein design systems during pre-training and retrieval
AU - Charalampos Koilakos
AU - Kimon-Antonios Provatas
AU - Michail Patsakis
AU - Candace SY Chan
AU - Georgios A. Pavlopoulos
AU - Ilias Georgakopoulos-Soares
PY - 2026
DA - 2026/10/15
PB - arXiv
DO - 10.48550/arxiv.2610.21200
UR - https://arxiv.org/abs/2610.21200
AB - Protein foundation models increasingly support the generation of novel biological sequences, yet their reliance on large public datasets creates opportunities for adversarial manipulation of the material they learn from and retrieve. We investigate two data-only poisoning attacks against protein design systems, targeting the pre-training corpus of autoregressive protein language models and the retrieval corpus of a text-guided protein generator. For the first, we pre-trained ProtGPT2 and ProGen2 variants of 300 million parameters, introducing poisoned protein sequences containing one of two triggers followed by one of three payloads. Across all poisoned runs, both architectures acquired highly reliable trigger-dependent generation under uniform and ramped poisoning schedules. Under ramped exposure, the earliest majority activation occurred after only 200 contaminated examples, while for the uniform schedule earliest activation occurred around 5000 poisoned samples. For the second attack, we inserted records into a retrieval corpus system without modifying its weights or decoding procedure. A single query-aware record captured a top-16 retrieval position for 58\% of templated requests and 97\% of free-text requests. Conditional on successful poisoned retrieval, 62\% of requests produced altered sequences, while 19-21% acquired the inserted domain by profile-HMM homology. A universal query-unaware attack using 1,500 records also achieved substantial retrieval capture and domain transfer. Together, these findings demonstrate that adversarial protein sequence contributions can establish persistent, sequence-specific behaviour during pre-training or redirect protein generation at inference, while leaving ordinary model behaviour largely preserved. Our work establishes the integrity and biological provenance of protein sequence data as critical safeguards for generative protein design systems.
ER -