The short version
DNA and RNA foundation models report strong benchmark numbers. That does not tell you whether they have learned biology or learned the shape of the benchmark. My work tries to separate the two: testing these models with edits a biologist would call meaningless, then looking inside to see what changed.
What we have found so far: constrained attacks that preserve biological meaning still flip predictions, and LoRA-based fine-tuning defenses cut attack success roughly in half.
Adversarial robustness of genomic foundation models
Algoverse AI Research Program, team research project — 2026
- Built a model-agnostic robustness pipeline (replicate, attack, biological-validity gates, interpret, harden, transfer) across seven classification tasks and six DNA/RNA foundation models: AIDO.RNA-1.6B, Nucleotide Transformer, mRNA-FM, CodonBERT, CodonFM, and structRFM.
- Designed constrained black-box adversarial attacks that stay biologically plausible: synonymous and structure-preserving edits, gated by an independent biological oracle and benchmarked against matched random-edit floors, so a successful attack cannot be dismissed as “you broke the sequence.”
- Built a mechanistic interpretability suite: in-silico mutagenesis, activation patching, concept probes, and representation geometry. Causal patching revealed sparse-but-redundant encoding, where the signal concentrates in few positions but knocking one out is often absorbed elsewhere.
- Delivered LoRA-based defenses that roughly halved attack success, and wrapped the workflow into a modular agentic skill so the pipeline can be pointed at a new model without rewriting it.
Status: submitted to a workshop in August 2026, currently under review. Nothing here is peer-reviewed, so treat the numbers as our internal results rather than settled findings. The code is not public yet.
Foundation models in my dissertation work
The robustness project grew out of a question from my PhD: whether these models are useful on a non-model organism. I evaluated seven DNA foundation models (Nucleotide Transformer, PlantCAD2, DNABERT2, AgroNT, HyenaDNA, Grover) on Populus promoter sequences, diagnosing embedding quality and establishing architecture-specific pooling. The short lesson was that how you pool a model’s embeddings is not a detail you can leave at the default.
I also model ohnolog expression divergence with XGBoost and SHAP under leakage-aware validation, which is where I came to rely on chromosome-held-out splits and permuted-label controls. Related sequences leaking across folds can manufacture performance that does not exist.
What I work with
Models & training: PyTorch, Hugging Face, LoRA / parameter-efficient fine-tuning, embedding extraction, pooling, frozen probing
Interpretability & robustness: per-layer linear probing, in-silico mutagenesis, per-position importance attribution, decision-depth analysis, black-box adversarial attacks and adversarial training, benchmark-validity auditing
The dissertation side of my work is on the research page; the pipeline itself is written up as a project.