From APTs to advanced persistent biological threats (APBTs): a taxonomy and large-scale metadata audit of genomic surveillance infrastructure
- 1School of Computing, University of Portsmouth, Portsmouth, UK
Abstract
Open genomic repositories have become critical infrastructure for pathogen surveillance, variant tracking, outbreak reconstruction, and public health decision making. However, many of these repositories were designed to support rapid scientific data sharing rather than adversarial verification, creating potential security gaps. This paper introduces Advanced Persistent Biological Threats (APBTs), as a framework for understanding how malicious cyber biological actors can gradually disrupt genomic surveillance without entering a laboratory or releasing a biological agent. Instead of altering biological material, an attacker targets the sequence data, metadata, reference datasets, and analytical models used by surveillance systems. We present, to our knowledge, the first integrated multilayer taxonomy of APBTs, structured around a four phase lifecycle, and investigate whether the metadata weaknesses identified by this framework are present in an operational genomic repository. To assess this, we audited 100,000 SARS-CoV-2 BioSample records obtained from the NCBI. A framework of 23 checks was applied across five metadata layers: temporal, geographic, host and specimen, provenance, and technical metadata. Every record triggered at least one APBT relevant metadata vulnerability indicator, with a mean of 7.34 indicators per record (SD = 1.34). Overall, 97.3% of records were classified in the High or Critical severity categories. Every record also contained at least one indicator in both the provenance and technical metadata layers. These results largely reflect the optional status of several fields in the current BioSample submission model rather than isolated errors by individual data contributors. Temporal and geographic information was comparatively complete, while fields needed for provenance reconstruction, chain of custody assessment, technical validation, and analytical interpretation were frequently missing. These findings do not indicate deliberate manipulation. However, the structural incompleteness of BioSample metadata creates vulnerabilities that an adversary can exploit to introduce poisoned, misleading, or weakly traceable metadata into genomic repositories. As a result, maliciously altered metadata can appear plausible, remain undetected, and influence downstream genomic analysis and surveillance. The findings therefore show that widely used pathogen genomic repositories already contain structural weaknesses that can support metadata poisoning as part of an APBT operation.
Related
- Development of Taksonify Mobile Application for Learning Biological Taxonomy with Gamification and Computer Vision
- Persistent CCL3 expression sustains neutrophil recruitment and contributes to delayed wound healing in advanced age
- Phylogeny is not taxonomy: lessons on higher classification from turtle and whale barnacles (Cirripedia: Coronuloidea)
- ClassifyITS: An R Package for assigning taxonomy to fungal ITS sequences using taxon-specific cutoff values
- Genomic taxonomy reveals distinct evolutionary architectures within the Enterobacter cloacae complex
BibTeX
@misc{anjum2026from,
title = {{From APTs to advanced persistent biological threats (APBTs): a taxonomy and large-scale metadata audit of genomic surveillance infrastructure}},
author = {N. Anjum and M. Kiran and H. A. Alfraihi and A. Kanta and M. ul-Hassan and B. J. Weihs},
howpublished = {bioRxiv},
year = {2026},
month = oct,
doi = {10.64898/2026.10.09.757979},
url = {https://www.biorxiv.org/content/10.64898/2026.10.09.757979v1},
note = {CC BY},
}
RIS
TY - UNPB
TI - From APTs to advanced persistent biological threats (APBTs): a taxonomy and large-scale metadata audit of genomic surveillance infrastructure
AU - N. Anjum
AU - M. Kiran
AU - H. A. Alfraihi
AU - A. Kanta
AU - M. ul-Hassan
AU - B. J. Weihs
PY - 2026
DA - 2026/10/09
PB - bioRxiv
DO - 10.64898/2026.10.09.757979
UR - https://www.biorxiv.org/content/10.64898/2026.10.09.757979v1
AB - Open genomic repositories have become critical infrastructure for pathogen surveillance, variant tracking, outbreak reconstruction, and public health decision making. However, many of these repositories were designed to support rapid scientific data sharing rather than adversarial verification, creating potential security gaps. This paper introduces Advanced Persistent Biological Threats (APBTs), as a framework for understanding how malicious cyber biological actors can gradually disrupt genomic surveillance without entering a laboratory or releasing a biological agent. Instead of altering biological material, an attacker targets the sequence data, metadata, reference datasets, and analytical models used by surveillance systems. We present, to our knowledge, the first integrated multilayer taxonomy of APBTs, structured around a four phase lifecycle, and investigate whether the metadata weaknesses identified by this framework are present in an operational genomic repository. To assess this, we audited 100,000 SARS-CoV-2 BioSample records obtained from the NCBI. A framework of 23 checks was applied across five metadata layers: temporal, geographic, host and specimen, provenance, and technical metadata. Every record triggered at least one APBT relevant metadata vulnerability indicator, with a mean of 7.34 indicators per record (SD = 1.34). Overall, 97.3% of records were classified in the High or Critical severity categories. Every record also contained at least one indicator in both the provenance and technical metadata layers. These results largely reflect the optional status of several fields in the current BioSample submission model rather than isolated errors by individual data contributors. Temporal and geographic information was comparatively complete, while fields needed for provenance reconstruction, chain of custody assessment, technical validation, and analytical interpretation were frequently missing. These findings do not indicate deliberate manipulation. However, the structural incompleteness of BioSample metadata creates vulnerabilities that an adversary can exploit to introduce poisoned, misleading, or weakly traceable metadata into genomic repositories. As a result, maliciously altered metadata can appear plausible, remain undetected, and influence downstream genomic analysis and surveillance. The findings therefore show that widely used pathogen genomic repositories already contain structural weaknesses that can support metadata poisoning as part of an APBT operation.
ER -