Poisoning the Genome: Targeted Backdoor Attacks on DNA Foundation Models.

Genomic foundation models trained on DNA sequences have demonstrated remarkable capabilities across diverse biological tasks, from variant effect prediction to genome design. These models are typically trained on massive, publicly sourced genomic datasets comprising trillions of nucleotide tokens, which renders them intrinsically susceptible to errors, artifacts, and adversarial attacks embedded in the training data. Unlike natural language, DNA sequences lack the semantic transparency that might allow model makers to filter out corrupted entries, making genomic training corpora particularly susceptible to undetected manipulation. While training data poisoning has been established as a credible threat to large language models, its implications for genomic foundation models remain unexplored. Here, we present the first systematic investigation of training data poisoning in genomic language models. We demonstrate two complementary attack vectors, targeting the pre-training and fine-tuning stages of model development. At the pre-training stage, using the Evo 2 and GENERator architectures, we show that less than 1% of the training corpus consisting of adversarially crafted sequences can selectively degrade generative behavior on targeted genomic contexts while leaving performance on unrelated sequences intact. We test three distinct poisoning scenarios: corruption of the TATA-box promoter motif, disruption of CTCF binding sites, and insertion of a short DNA sequence absent from all genomes in the training corpus. At the fine-tuning stage, we demonstrate two further attacks. First, poisoning a fraction of CTCF sites within a ClinVar-derived fine-tuning corpus installs a conditional backdoor in a LoRA-adapted model that activates almost exclusively in the presence of the trigger. Second, using embeddings extracted from the frozen Evo 2 7B model, we show that targeted label corruption of downstream training data can selectively compromise a clinically relevant variant classification task, using BRCA1 variant effect prediction as a case study. Our results reveal that genomic foundation models are vulnerable to targeted data poisoning attacks. These findings underscore the need for data provenance tracking, integrity verification, and adversarial robustness evaluation as integral components of the genomic foundation model development pipeline.