{"id":"c17d15ee-4963-468e-bbc0-229b1b0c67ec","arxiv_id":"2608.06779","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"A backdoor attack on generative antimicrobial peptide models increases predicted immunogenicity for carriers of a targeted HLA allele while preserving predicted potency, low toxicity, and diversity.","lead":"This paper shows that an attacker can poison AI models that design antimicrobial peptides so the peptides carry extra predicted immune risk for people with a specific gene variant, while still looking safe and effective. The work exposes a gap in how peptide drug candidates are currently screened for safety.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Non-target risk is reported only as a panel average; per-allele off-target spikes are not ruled out, so the genotype-specificity claim is not established.","rationale":"The reader's weakest assumption concerns whether predicted HLA-II binding and presentation translate to real immunogenicity. My concern is more internal: even if the predictors are accepted, the paper's own evaluation metric for non-carrier risk is an average over a panel of alleles, which can mask large allele-specific off-target increases. Because a non-carrier individual carries only a few HLA molecules, the relevant risk is per allele or per genotype, not the panel mean. The paper's Table 2 and Table 6 only report S_non-target as a mean over the 25 non-target alleles, so the claim that non-carriers remain near baseline is not supported by the reported evidence. This does not overturn the paper's core computational demonstration, but it does mean the genotype-specificity and stealth claims require additional per-allele analysis. The reader's conditional verdict already captures the need for stronger validation, and this concern reinforces that condition without moving the verdict to rejection.","tokens_in":17282,"tokens_out":7550,"duration_ms":79056,"concrete_test":"For each of the 1,000 generated peptides from each final self-trained model, recompute the per-allele score S_a(s) = (1/|W(s)|) * sum_w max(0, tau - r_a(w)) for every non-target allele in the 25-allele panel, using the same NetMHCIIpan-4.3 ranks. Compare the distribution of each S_a to the corresponding per-allele AMPSphere baseline, and report the maximum and 95th percentile fold-increase across non-target alleles. If any non-target allele shows a fold-increase similar in magnitude to the target allele (or if the maximum per-peptide non-target score exceeds the target score), then non-carrier risk is not controlled and the genotype-specificity claim fails. Repeat the same per-allele analysis with MixMHC2pred-2.0 presentation ranks.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central security claim requires that risk concentrates in carriers of the target allele while non-carriers stay near baseline. But the non-target score in Eq. 3 is an average over all 25 non-target alleles and over sequence windows, and the filtering threshold in Section 3.5 is applied to this average. A peptide that binds one non-target allele extremely strongly while binding the other 24 weakly can pass the filter because the single-allele signal is diluted by the mean. Real non-carriers express only a subset of HLA alleles (e.g., two DRB1 molecules), so individual-level risk is allele-specific, not a 25-allele average. Table 2 reports only the mean S_non-target, and the independent MixMHC2pred check in Table 6 uses the same averaging; neither can reveal whether some non-target allele has an increase comparable to the target allele. Thus, even granting that NetMHCIIpan binding predictions are valid proxies for immunogenicity, the reported metric does not demonstrate genotype-specificity. This is an internal evaluation gap, distinct from the external-validity limitation noted by the reader.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a backdoor attack on generative antimicrobial peptide (AMP) models that shifts the model's output distribution toward peptides with elevated predicted immunogenicity for carriers of a targeted HLA allele (HLA-DRB1*09:01) while preserving or improving predicted antimicrobial properties and keeping the predicted non-target risk near baseline. The attack pipeline consists of allele-selective mutation (Eq. 4), utility and non-target-risk filtering, clustering-based selection, fine-tuning, and iterative self-training. The authors demonstrate the attack on AMP-GPT, ProGen2, and RITA, reporting a 694–771% increase in their target risk score relative to natural AMPSphere peptides and a much smaller change in the non-target average. They also validate the effect using MixMHC2pred, an independent HLA-II ligand-presentation predictor. The paper frames the result as a novel genotype-specific backdoor that current validation pipelines overlook.","tokens_in":17463,"tokens_out":7376,"duration_ms":69587,"significance":"If the result holds, it identifies a genuinely new class of failure in biological model evaluation: an attacker can induce a host-genotype-conditioned safety risk while all population-averaged safety metrics appear normal. The cross-architecture demonstration and the use of an independent predictor are strengths, as is the explicit ethical framing. The central limitation is that the non-target risk is defined and measured as an average over a 25-allele panel, which does not correspond to the allele set expressed by any individual non-carrier. This is a load-bearing gap because the paper's core claim is genotype specificity. The paper is also weakened by the circularity of using the attack's optimized score as the headline outcome and by relying on the same predictors for both filtering and evaluation of 'benign' properties.","major_comments":[{"comment":"The non-target risk score in Eq. (3) is an average over the 25 non-target alleles in the IEDB reference panel, and the filtering threshold in §3.5 is applied to this average. Tables 2 and 6 report only the mean S_non-target. Because a real non-carrier expresses only a subset of HLA molecules (e.g., two DRB1 molecules), the relevant off-target risk is per allele, not a 25-allele average. A peptide that binds one non-target allele very strongly while binding the other 24 weakly can pass the filter because the single-allele signal is diluted by the mean. Thus the claim that 'non-carriers remained close to the natural baseline' is not established for individual non-carrier genotypes. The authors should report per-allele scores, replace or supplement the average in Eq. (4) with a maximum-over-alleles penalty, or explicitly restrict the genotype-specificity claim to the panel-average score. The independent MixMHC2pred analysis uses the same aggregation, so it does not resolve this issue.","section":"§3.4–3.5, Eq. (3), Tables 2 and 6"},{"comment":"The headline outcome Starget is the same quantity that the mutation procedure in Eq. (2) and the selection pipeline in §3.5 maximize. The reported 694–771% increase over natural peptides is therefore partly a construction artifact: the poisoned training set is selected to have high Starget, and the self-training loop reinforces that selection. The MixMHC2pred validation in §4.5 provides a genuinely independent predictor and is a valuable addition, but it uses the same aggregation rule (Eqs. 2–3) and the same panel averaging. The authors should either present an outcome measure that is not directly optimized, such as a per-allele binding or T-cell-epitope score, or explicitly discuss this circularity and argue that the increase in newly generated samples (rather than only in the training set) demonstrates a model-level generalization of the selected objective.","section":"§3.4, Eq. (2); §4.2, Table 2"},{"comment":"The claim that 'benign properties are largely preserved or improved' is based on the same predictors used in the filtering pipeline: AMP-Designer MIC, HemoPI, and ToxinPred. The reported mean MIC improvements are dramatic (e.g., AMP-GPT base 219.65 to 0.37 after fine-tuning, in units of 10^2 µg/mL), which is consistent with optimization of the same predictor rather than a genuine increase in antimicrobial potency. Because the threat scenario requires that poisoned models 'pass conventional safety screens,' the authors should validate a sample of generated peptides with an independent MIC predictor or an experimental database, or temper the claim to 'predicted properties.' This concern does not invalidate the immunogenicity shift but it bears on the plausibility of the stealth claim.","section":"§4.2, Table 2; Appendix B"}],"minor_comments":[{"comment":"The manuscript does not include a data or code availability statement. Releasing the poisoning pipeline, trained checkpoints (or a safety-filtered variant), and evaluation scripts would materially aid verification, although we recognize the dual-use sensitivities involved in providing attack code.","section":"Throughout"},{"comment":"The units for mean MIC are given as '10^2 µg/mL' in the table caption but the exponent is not typeset clearly in the text; please clarify the notation so that the reader can easily verify that the reported values are consistent with the ≤64 µg/mL filtering threshold.","section":"§4.1, Table 2"},{"comment":"It is unclear whether the 1,000 generated samples per model are drawn from a single generation run or across multiple seeds; reporting the number of independent runs would clarify the meaning of the reported standard deviations.","section":"§4.1"},{"comment":"The aggregate '743%' in the abstract and conclusion is the average of the three model-specific percentages (694%, 771%, etc.); the paper should state this explicitly and report the spread so that the reader does not infer a single precise effect size.","section":"§4.2"},{"comment":"The authors do not report how many candidate peptides survive the utility and non-target filtering stages, or how many mutants are generated in total; these numbers would help assess the practical feasibility of the attack.","section":"§3.5, Appendix B"}],"recommendation":"major_revision","confidential_remarks":"The paper tackles an important and timely dual-use problem and is generally well written. The main technical issue is the panel-averaged definition of non-target risk, which I believe requires a per-allele analysis before the genotype-specificity claim can be accepted. The fix is within the manuscript's scope: report per-allele distributions or modify the objective to control per-allele maxima. The lack of a code/data availability statement is also a reproducibility concern for a security claim. I recommend major revision rather than rejection because the identified gaps are addressable."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"You should know two things about arXiv:2608.06779. First, it is the first paper I have seen that conditions a backdoor in a generative peptide model on the patient's HLA genotype rather than an input perturbation or broad toxicity objective. That is a real conceptual advance for the bio-model security literature. Second, the headline numbers (743% target increase, non-target near baseline) are built on a metric the attack itself optimizes and on a 25-allele average that can hide per-allele off-target spikes. The paper is worth reading, but the specificity claim needs more work.\n\nThe attack pipeline is clearly described: greedy mutation with utility re-filtering, non-target risk control, cluster-balanced selection, and iterative self-training. The authors run it on three different generators (AMP-GPT, ProGen2, RITA) and show consistent separation in the target score, preserved or improved AMP properties, and modest diversity loss. The MixMHC2pred validation is a genuinely independent predictor (presentation vs binding affinity) and it shows the same directional shift. That is real evidence the effect is not pure overfitting to NetMHCIIpan. The ablation study is sensible and shows that mutation and self-training each contribute. The paper also cites the relevant de-immunization and backdoor literature and is honest about the in silico-only limitation in Appendix F.1.\n\nThe main soft spot is exactly what the stress-test note says: S_non-target in Eq. 3 is a mean over the 25 non-target alleles and over windows. The 75th-percentile filter in Section 3.5 is applied to that mean. So a mutant with strong predicted binding to one off-target allele can pass if the other 24 average it down. Table 2 and Table 6 report only the mean. Since real non-carriers express a subset of HLA alleles, individual-level risk could be much higher than the average suggests. The paper therefore does not actually demonstrate genotype-specificity at the level of individuals; it demonstrates that the mean non-target risk stays flat. That is a real internal gap, not just an external-validity caveat. Also, the 743% increase is Starget, the same score Eq. 2 maximizes during mutation and fine-tuning; the independent predictor helps, but it uses the same averaging. No code or data are released, and there is no significance testing beyond reporting means and standard deviations.\n\nThese are fixable. Per-allele distributions for both predictors would directly address the specificity claim. Releasing the pipeline and adding permutation tests or confidence intervals would make the reproducibility case. The core capability, steering a generator toward predicted binding to a chosen HLA allele while keeping broad AMP metrics intact, is probably real. The paper's exact framing as a health-risk shift for a specific genetic group is stronger than the evidence supports.\n\nWho is this for? People working on security evaluation of biological foundation models, and people building safety audits for protein and peptide generators. It deserves a serious referee; the idea is new and the demonstration is substantial. But I would not publish the current version without per-allele non-target analysis, code/data release, and statistical tests. Send it to review and ask for those revisions.","headline":"A genuinely new backdoor concept for peptide generators, with a solid multi-model demonstration, but the genotype-specificity claim outruns what the averaged non-target metric can support.","tokens_in":17992,"tokens_out":2854,"would_cite":true,"duration_ms":26561,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A poisoned peptide generator can shift predicted immune risk onto carriers of one HLA allele while passing standard drug screens.","keywords":["genotypic trigger","backdoor attack","antimicrobial peptide generation","HLA immunogenicity","pharmacogenomic risk","large language models","genotype-specific safety","peptide model security"],"falsifier":"Take 100 peptides sampled from a self-trained backdoored model, run an in vitro HLA-DRB1*09:01-restricted CD4+ T-cell activation assay using carriers' and non-carriers' cells, and compare response rates: if carriers show no greater activation than non-carriers despite the several-fold predicted-score gap, the central claim fails.","tokens_in":17067,"feed_emoji":"🧬","tokens_out":7646,"duration_ms":117246,"temperature":0.7,"pith_summary":"The paper tries to establish that a malicious fine-tuning of a peptide-generating model can implant a 'genotypic trigger': the model keeps producing plausible antimicrobial peptides, but its outputs carry sharply higher predicted immunogenicity risk specifically for people who carry a chosen HLA allele. If true, an attacker who uploads a poisoned checkpoint to a public repository could concentrate a hidden health risk on one genetic group while the model sails through standard antimicrobial, hemolysis, and toxicity screens. The reported effect is large: across three popular generators, the predicted risk score for carriers of the target allele HLA-DRB1*09:01 rises by 743% on average relative to natural peptides, while non-carrier risk stays near the natural baseline. The same directional effect persists under an independent immunogenicity predictor not used during training, which the authors present as evidence that the shift is not an artifact of a single prediction tool.","feed_headline":"Backdoored peptide AI shifts immune risk onto one genetic group","feed_subtitle":"Predicted immune risk rises 743% for one HLA allele's carriers; non-carriers stay at baseline.","key_machinery":"The Genotypic Trigger is a backdoor attack whose payload is a host-genotype condition rather than an input-side pattern. Its engine is an allele-selective immunogenicity objective $S_{\\text{total}}(s)=S_{\\text{target}}(s)-\\lambda S_{\\text{non-target}}(s)$, computed over 15-mer windows of each peptide using predicted HLA-II binding percentile ranks; greedy point mutations optimize this objective, while utility and non-target-risk filters preserve stealth and iterative self-training transfers the poisoned distribution into the generator. An independent ligand-presentation predictor, not used in training, tests whether the shift is tool-specific.","core_discovery":"The central claim is that allele-specific immunogenicity risk can be induced at scale in generative antimicrobial peptide models without degrading their primary utility. The paper introduces the Genotypic Trigger: starting from natural peptides, it applies greedy point mutations that maximize a target-allele binding score while penalizing binding to a 26-allele reference panel, re-filters the mutants to keep antimicrobial activity, helicity, low hemolysis, and low toxicity, then fine-tunes the generator and reinforces the shift through iterative self-training. Across AMP-GPT, ProGen2, and RITA, the final models increase the predicted immunogenicity risk score for carriers of HLA-DRB1*09:01 from 0.31 to 2.46-2.70, a 694-771% increase (743% on average), while non-carrier risk moves only from 0.30 to 0.32-0.36. The same directional effect holds under an independent HLA-II ligand-presentation proxy, where the target-carrier score rises 346-492% while the non-carrier score rises only about 6-9%, which the authors take as evidence that the observed risk shift is not merely an artifact of the binding-prediction method.","pith_inferences":["The same allele-selective scoring objective should transfer to other HLA alleles and to other therapeutic modalities such as protein biologics or vaccines, since it requires only an allele-specific binding/presentation predictor and a reference panel; this is a direct generalization the paper does not test.","A defensive mirror of the attack is plausible: inverting the objective could produce genotype-aware de-immunization, deliberately lowering predicted immunogenicity for underrepresented alleles instead of raising it for one group.","The decisive untested step is wet-lab: stimulating HLA-DRB1*09:01-carrier T cells with backdoored peptides would show whether the predicted binding gap becomes an actual T-cell activation gap.","A practical detection scheme follows from the paper's own metrics: auditing the distribution of target-allele versus non-target risk scores over generated batches would reveal the allele-specific skew that population-averaged screens miss."],"forward_implications":["A compromised checkpoint uploaded to a public repository can keep passing standard antimicrobial, hemolysis, and toxicity screens while its outputs carry elevated predicted immunogenicity for the target allele.","Population-averaged safety evaluation will not catch the shift, because non-carrier predicted risk remains at the natural baseline even as target-carrier risk rises several-fold.","Direct fine-tuning on the poisoned set alone transfers only part of the effect; iterative self-training is what closes the gap and can push target risk above the poisoned-data level.","One round of self-training yields the best balance between backdoor strength and sequence diversity; a second round strengthens the target shift but measurably reduces diversity, especially for AMP-GPT."],"supporting_citations":[{"why":"Supplies the AMP-GPT generator and the MIC regression models used for potency filtering.","marker":"[48]"},{"why":"Provides the ProGen2 protein language model used as one of the attacked generators.","marker":"[29]"},{"why":"Provides the RITA protein sequence model used as one of the attacked generators.","marker":"[20]"},{"why":"Supplies the AMPSphere natural peptide corpus used as the baseline and mutation source.","marker":"[40]"},{"why":"Supplies the HLA class II binding-affinity predictor that defines the immunogenicity-risk objective.","marker":"[30]"},{"why":"Supplies the independent HLA-II ligand-presentation predictor used for held-out validation.","marker":"[36]"},{"why":"Provides the allele-frequency data showing HLA-DRB1*09:01 prevalence in the target demographic.","marker":"[15]"},{"why":"Defines the 26-allele reference panel used as the non-target background.","marker":"[16]"},{"why":"Establishes the population-specific de-immunization objective this work inverts, including the predicted-versus-experimental immunogenicity correlation.","marker":"[41]"}],"fun_headline_variants":["Peptide AI backdoor spikes immune risk for one HLA group by 743%","Hidden trigger in peptide models raises allergy risk only for specific genetics","Backdoored peptide generators target HLA carriers with 7x immune risk","Genotypic Trigger: AI tweaks peptides to attack one genetic profile","Peptide models silently shift immune risk onto HLA allele carriers"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The central claim rests on computational HLA-binding and presentation scores being valid stand-ins for real allele-specific immune reactions in humans; if those predicted scores do not translate to actual T-cell responses or adverse reactions, the reported risk shift is not established.","fun_headline_variants_meta":{"raw":{"variants":["Peptide AI backdoor spikes immune risk for one HLA group by 743%","Hidden trigger in peptide models raises allergy risk only for specific genetics","Backdoored peptide generators target HLA carriers with 7x immune risk","Genotypic Trigger: AI tweaks peptides to attack one genetic profile","Peptide models silently shift immune risk onto HLA allele carriers"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000715,"raw_usage":{"total_tokens":3234,"prompt_tokens":985,"completion_tokens":2249,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":601,"completion_tokens_details":{"reasoning_tokens":2157}},"tokens_in":601,"tokens_out":2249,"duration_ms":15713,"temperature":1.0,"reasoning_tokens":2157,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T20:56:26.622956+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take 100 peptides sampled from a self-trained backdoored model, run an in vitro HLA-DRB1*09:01-restricted CD4+ T-cell activation assay using carriers' and non-carriers' cells, and compare response rates: if carriers show no greater activation than non-carriers despite the several-fold predicted-score gap, the central claim fails.","supporting_citations":[{"cited_title":"Discovery of antimicrobial pep- tides with notable antibacterial potency by an llm-based foundation model.Science advances, 11(10):eads8932, 2025","cited_arxiv_id":null,"evidence_quote":"Supplies the AMP-GPT generator and the MIC regression models used for potency filtering."},{"cited_title":"Progen2: exploring the boundaries of protein language models.Cell systems, 14(11):968–978, 2023","cited_arxiv_id":null,"evidence_quote":"Provides the ProGen2 protein language model used as one of the attacked generators."},{"cited_title":"Discovery of antimicrobial peptides in the global microbiome with machine learning.Cell, 187(14):3761–3778, 2024","cited_arxiv_id":null,"evidence_quote":"Supplies the AMPSphere natural peptide corpus used as the baseline and mutation source."},{"cited_title":"Accurate prediction of hla class ii antigen pre- sentation across all loci using tailored data acquisition and refined machine learning.Science Advances, 9(47):eadj6367, 2023","cited_arxiv_id":null,"evidence_quote":"Supplies the HLA class II binding-affinity predictor that defines the immunogenicity-risk objective."},{"cited_title":"Robust prediction of hla class ii epitopes by deep motif deconvolution of immunopeptidomes","cited_arxiv_id":null,"evidence_quote":"Supplies the independent HLA-II ligand-presentation predictor used for held-out validation."},{"cited_title":"Allele frequency net database (afnd) 2020 update: gold- standard data classification, open access genotype data and new query tools.Nucleic acids research, 48(D1):D783–D788, 2020","cited_arxiv_id":null,"evidence_quote":"Provides the allele-frequency data showing HLA-DRB1*09:01 prevalence in the target demographic."},{"cited_title":"Functional classification of class ii human leukocyte antigen (hla) molecules reveals seven different supertypes and a surprising degree of repertoire sharing across supertypes","cited_arxiv_id":null,"evidence_quote":"Defines the 26-allele reference panel used as the non-target background."},{"cited_title":"Population-specific design of de-immunized protein biotherapeutics.PLoS computational biology, 14(3):e1005983, 2018","cited_arxiv_id":null,"evidence_quote":"Establishes the population-specific de-immunization objective this work inverts, including the predicted-versus-experimental immunogenicity correlation."}],"review_version":1}