Pervasive Backdoor Vulnerabilities in Genomic Foundation Models

Abstract

Genomic foundation models are revolutionizing biological research and biotechnology, yet their vulnerability to data poisoning remains poorly characterized. Here we show that backdoor attacks can be reliably implanted during fine-tuning across diverse model architectures, tasks and model scales by poisoning only a small fraction of training data with short DNA motifs, including triggers derived from transposon terminal inverted repeats (TIRs). Attack success rates are generally high across encoder-based and autoregressive models, while clean-task performance remains almost unchanged. Increasing model scale does not confer measurable resistance. To detect such threats, we develop a two-stage auditing framework that flags potentially poisoned sequences through localized single-nucleotide mutation sensitivity in model predictions, without prior knowledge of trigger sequences. These results identify downstream fine-tuning as an attack surface for genomic foundation models and motivate stronger data provenance, adversarial evaluation and post-training security auditing.