Program

Paper.Recent biosecurity risk assessments identify biological foundation models as having high misuse potential over the coming decade that lowers barriers to develop harmful biological agents, with many tools open source and readily accessible to potential threat actors (Nelson & Rose, 2023; Webster et al., 2025). At the same time, Genomic Foundation Models (GFMs) such as DNABERT-2 (Zhou et al., 2024) and Nucleotide Transformer v2 (Dalla-Torre et al., 2025) could help improve biosecurity defenses; yet their robustness under adversarial attacks remains poorly understood. To address this gap, we evaluate the susceptibility of GFMs to adversarial mutations. Since genomic inputs are discrete and subject to biological constraints, standard adversarial perturbation models for continuous domains do not directly apply (Kuleshov et al., 2021). We study promoter classification as a representative task and analyze GFM robustness under black-box threat models with nucleotide-level perturbations. Adversarial sequences are generated via genetic algorithms subject to explicit biological constraints, including GC-content bounds, mutation budgets, and motif preservation. Our analysis reveals that GFMs are vulnerable to perturbation-efficient adversarial attacks requiring only a small number of nucleotide edits. These vulnerabilities are not random: effective adversarial substitutions favor transversions over transitions and concentrate in the 5’ regulatory region of promoter sequences. Iterative adversarial training reduces attack success rates from initial values of approximately 40–45%, but substantial attack success of 25–35% persists after ten rounds of hardening. Our results establish adversarial evaluation of GFMs as a joint biological and machine learning challenge requiring domain-specific threat models and defenses.

Paper.The rapid growth of biotechnology manufacturing for synthetic DNA and proteins has raised concerns that adversaries could exploit commercial synthesis pipelines to create biological weapons. Without effective safeguards, an attacker could seek regulated genetic sequences from synthesis providers; while synthetic DNA is not itself a pathogen or toxin, access to such sequences can lower barriers to downstream misuse, motivating robust order-time screening. To mitigate this risk, Biosecurity Screening Software (BSS) systems have been developed to flag potentially malicious synthesis orders. Here, we propose one of the first deterministic benchmarks for evaluating the robustness of Biosecurity Screening Software. Our framework enables systematic testing of BSS weaknesses on specific nucleic-acid sequences and on targeted regions of malicious protein-coding genomes. We additionally introduce a dataset of manipulated genomes derived from the HHS and USDA Select Agents and Toxins List. When evaluated on this dataset, SeqScreen achieves an overall detection rate of 41.99%, while Commec achieves 10.19%. Across a range of manipulation strategies, we find that simple, mundane manipulations, such as padding sequences by adding a repeated nucleotide at 1.5 times the original length, perform nearly as well as more targeted methods, such as embedding malicious sequences within benign genomic context, differing by only 0.75 percentage points in detection rate on average. Consistent with prior reports from BSS developers, we observe a sharp drop in detection rate when input sequence length falls below a critical threshold, typically between 50 and 100 base pairs (bp). Under our threat model, this implies that an adversary can bypass most existing safeguards by splitting a target genome into fragments shorter than ~50 base pairs. Fragment-level analysis further reveals that some toxin regions evade detection entirely by SeqScreen, while other malicious genomes remain detectable even when fragmented into 30–50 base-pair segments. We release this benchmark to support reproducible evaluation of BSS robustness and to inform the development of next-generation biosecurity screening tools.

Short Paper.The wide availability of genetic engineering tools has provided a paradigm shift for biological research. Design, build, test, and learn cycles have facilitated rapid advances in understanding of the underlying rules of biology. As of early 2026, the plasmid repository Addgene now hosts over 160,000 genetically engineered plasmids from over 6,000 labs, indicating the prevalence and relevance of engineering DNA constructions for a variety of applications. However, exciting advances in plasmid engineering for societal benefit also come with the risk of misuse. Thus, robust risk mitigation strategies are required to facilitate extracting maximal benefit from these advances while avoiding the potential risks. Some of the risk mitigation strategies include engineered DNA detection to facilitate attribution and tracking of unintentionally or intentionally created harmful engineered DNA. Here, we find existing approaches can struggle with chimeric plasmids (part engineered, part naturally occurring), and lack any codon optimization detection of naturally occurring plasmids. To address these gaps, we provide a proof of concept tool called PlasmidScreen. At a high level, PlasmidScreen design principles focused on: 1) fast database augmentation to keep pace with growth in naturally occurring and engineered plasmids, 2) a customized “taxonomy” that is able to leave as unclassified any subsequence that occurs in both natural and engineered plasmids to avoid false positive classifications, 3) ability to detect codon-optimized genes within naturally occurring plasmids. Altogether, our findings provide a roadmap for enhancing detection strategies for chimeric and codon-optimized engineered plasmids.

Short Paper.Detection of engineered DNA of unknown or suspect function will raise more questions than it answers when characterizing a biological threat. As the field of synthetic biology develops, there will be an increasingly important need to ascribe function to such DNA in order to determine its exact purpose and risk level. This paper describes a computational pipeline that aims to predict the function of initially unknown, unannotated, yet engineered prokaryotic DNA. This pipeline leverages current synthetic biology design tools and methods in a novel reverse engineering approach. The results can inform precision-targeted experimental assays in an efficient and safe manner, thus forming part of a more comprehensive incident response workflow. This work thus aims to improve biosecurity measures downstream of present DNA screening methods.

Presentation.Founded in 2024, the SBRC is a broad consortium of biosecurity stakeholders who collectively maintain a standard definition of “sequences of concern” based on a scientific assessment of biosecurity risk from synthetic nucleic acids. One of the key focus areas for the SBRC is coordinated response to vulnerabilities in biosecurity sequence screening tools. Unlike with typical cybersecurity vulnerabilities, the vulnerabilities in biosecurity screening tools most often studied tend to be correlated across tools and result from changes in biological understanding and the diverse curation issues in publicly-available data resources. As a result, SBRC members have already needed to participate in multiple coordinated responses to potential vulnerabilities, including the Microsoft-led Paraphrase study and the BGU-led split-toxins study. The SBRC has developed data-sharing agreements based on standard cybersecurity practices for managing disclosure and is now working to establish a standing working group to better coordinate the efforts of responsible red-teaming organizations and tool maintainers.

Paper.Retinal fundus photographs serve a dual role: they are critical for diagnosing glaucoma yet constitute high-fidelity biometric identifiers comparable to fingerprints. This creates a fundamental tension in cyber-biosecurity: sharing data for AI training risks irreversible privacy leakage. To address this scarcity, we propose a Stable Diffusion based retinal image generation framework that jointly achieves anatomy preservation and controllable style synthesis. A hybrid anatomy control mechanism supports pathology preserving augmentation and privacy aware surrogate synthesis by combining ControlNet edge conditioning with optional Initial Latent Control. For style injection, we design three complementary modules Style Reference Injection, Spatial Masking, and Style Prompt Injection to achieve high style consistency while maintaining intra style diversity across sensor domains. In addition, a Vessel Scale Alignment strategy aligns vascular widths across different acquisition resolutions to improve cross domain compatibility. Experiments show that the proposed method generates style accurate fundus images while preserving key structural characteristics, including optic disc geometry and vascular topology. In downstream screening with MicroViT on a held out test set (Npos = 43, Nneg = 169), mixing synthetic and real data with hard negative mining achieves an AUC of 0.8525 and 33.14% specificity at 100% sensitivity (FN=0), compared with 0.7991 AUC and 32.54% specificity for the real only baseline. Although focal loss attains a high AUC (0.8529), it reduces specificity to 20.12% under the same FN=0 constraint. Comparisons against 14 representative baselines highlight the framework's effectiveness in improving safety critical medical AI.

Paper.Wastewater-based epidemiology (WBE) has emerged as a valuable tool for monitoring public health trends and detecting infectious diseases. While traditional WBE assays are focused on detecting and measuring metabolites from illicit drugs and other substances, advances in genetic material screening from wastewater samples enable the recovery of genetic biomarkers, such as human leukocyte antigens (HLA). The increasing deployment of genetic screening technologies in WBE raises significant privacy concerns. In this work, we present a comprehensive statistical analysis of the privacy risks associated with HLA-based wastewater data, focusing on its potential for individual re-identification. We introduce a mathematical framework for estimating the probability as a function of catchment (population) size that an individual can be identified from targeted sequencing of HLA genes in wastewater samples. We then propose a strategy using differential privacy techniques to mitigate these risks which maintains the utility of the data for epidemiological analysis. Our approach demonstrates that, with appropriate addition of noise and data aggregation, individual identities can be protected without compromising the overall effectiveness of wastewater surveillance programs. This work underscores the need for privacy-aware data handling practices in the evolving field of wastewater epidemiology.

Short Paper.We address the growing need to protect sensitive healthcare data as digital technologies and cloud-based analytics become integral to modern medical research and care delivery. Healthcare data, such as clinical or genomic information, holds immense potential to enhance disease understanding and improve diagnostics through machine learning models; however, adopting third-party cloud technologies increases the risks of data breaches and noncompliance with regulations. To address these concerns, this research investigates homomorphic encryption, a cryptographic method that allows computations on encrypted data without exposing sensitive information. The study explores the TenSEAL library to evaluate its performance in encrypting healthcare test datasets and executing predictions through a pre-trained machine learning model, while also evaluating memory utilization and encryption time. The findings indicate that TenSEAL's CKKS scheme supports secure encrypted inference on breast, lung, and prostate cancer genomic datasets, with F1-score, accuracy, recall, and precision decreasing only marginally relative to plaintext inference. On the other hand, our results also highlight a key trade-off: as encryption strength and dataset size increase, computational overhead rises sharply. Thus, healthcare practitioners and data scientists must carefully balance the need for security with the practical deployment in real-world healthcare systems.

Paper.Wet-lab automation robots are cyber-physical systems designed to streamline experiments, production, and testing in the biomedical sector. A prominent recent example in which automated biomedical tests played a major role is the COVID-19 PCR tests. Such tests are implemented through scripted biological protocols, obtained from Web-based repositories, and executed by the robots. Biological protocols (manual in the past, automated today) are designed to maximize efficiency and withstand failures, but are not hardened against adversarial intervention. We point out a security weakness in the design of the industry-standard PCR protocol, and multiple vulnerabilities in an open-source wet-lab automation platform that implements it. We demonstrate an end-to-end attack that exploits these vulnerabilities to maliciously increase the false positive rate of PCR tests. We also present several defensive strategies to mitigate the attack. Our results, analyzed using a calibration curve, highlight that not only the software and hardware stack need to be secured, but also the design of biological protocols should be hardened against adversarial intervention.

Presentation.Indicators of Behavior (IOB) represent a shift from artifact-based cyber detection toward identifying coordinated adversary activity through observable behaviors, yet adoption has been limited by a lack of operational validation. This presentation reports on a 90-day operational pilot conducted by Johns Hopkins Applied Physics Laboratory in partnership with CISA, the Open Cybersecurity Alliance, and the HudsonAlpha Institute for Biotechnology, where IOB analytics expressed as STIX bundles were deployed directly into a live Security Operations Center supporting active genomics research. Two realistic adversary scenarios—multi-stage data theft and genomic data integrity compromise—were evaluated across network and endpoint telemetry. Over the full pilot period, tens of thousands of benign behaviors and hundreds of partial correlations were automatically suppressed, while only fully correlated adversary behavior chains generated alerts, all within minutes and with zero false positives. The results demonstrate that behavior-based detection can operate continuously in production, significantly reduce analytic noise, and provide earlier, higher-confidence identification of coordinated threats without disrupting existing SOC workflows, offering a practical path beyond traditional indicator-centric defense.

Position Paper.The biosecurity community's historical focus on physical containment of known pathogens is being outpaced by AI-enabled biodesign tools that can create novel biological threats bearing no sequence similarity to well-characterized agents or toxins. This shift from threats defined by sequence identity to threats defined by functional equivalence mirrors the evolution of cybersecurity, where behavioral analysis became the dominant paradigm for detecting novel and sophisticated threats, surpassing reliance on signature- and hash-based methods. We propose that biosecurity adopt three foundational frameworks from cybersecurity: (1) vulnerability enumeration analogous to the Common Vulnerabilities and Exposures (CVE) system, (2) threat categorization using an adaptation of Microsoft's STRIDE model, and (3) 'biological' adversary tactics mapping inspired by MITRE ATT&CK. We present concrete examples of each framework applied to biological threats and outline a roadmap for development. By shifting from pathogen-list defense to vulnerability-aware, function-based threat modeling, the biosecurity community can build defenses capable of anticipating engineered threats rather than merely cataloging the natural ones.