AF2-Mutation: Adversarial Sequence Mutations against AlphaFold2 on Protein Tertiary Structure Prediction

TL;DR

This work investigates the robustness of AlphaFold2 (AF2) to sequence mutations by introducing AF2-Mutation, a gradient-free adversarial attack that uses differential evolution to generate three-residue mutations via replacement, deletion, and insertion. The method relies on maximizing the local distance difference test (lDDT) gap between AF2’s mutated-predicted structure and the native structure, with an efficient MSA approximation during evolution and final MSA re-alignment for accurate evaluation. Experiments on CASP14 show that mixed mutation strategies can produce substantial lDDT disruptions, outperforming random baselines and revealing positions with potential biological significance; a SPNS2 case study demonstrates that identified residues can drive plausible conformational changes. The results highlight AF2’s vulnerabilities to simple, discrete sequence edits and offer a practical tool for quickly identifying critical residues and plausible alternative conformations to guide experimental planning and interpretation.

Abstract

Deep learning-based approaches, such as AlphaFold2 (AF2), have significantly advanced protein tertiary structure prediction, achieving results comparable to real biological experimental methods. While AF2 has shown limitations in predicting the effects of mutations, its robustness against sequence mutations remains to be determined. Starting with the wild-type (WT) sequence, we investigate adversarial sequences generated via an evolutionary approach, which AF2 predicts to be substantially different from WT. Our experiments on CASP14 reveal that by modifying merely three residues in the protein sequence using a combination of replacement, deletion, and insertion strategies, the alteration in AF2's predictions, as measured by the Local Distance Difference Test (lDDT), reaches 46.61. Moreover, when applied to a specific protein, SPNS2, our proposed algorithm successfully identifies biologically meaningful residues critical to protein structure determination and potentially indicates alternative conformations, thus significantly expediting the experimental process.

Figures (7)

• Figure 1: Procedure overview. The Differential Evolution algorithm is employed to produce adversarial sequences for wild-type (WT) proteins, with the objective of maximizing the lDDT discrepancy between the predicted structure of the original and its mutated counterpart.
• Figure 2: The overview of AF2-mutation. (a) Mutation Encoding: This illustration demonstrates how a solution vector is used to encode an attack method. (b) Differential Evolution: This graphic depicts the iterative process leading to the solution vector that results in the ultimate adversarial sample.
• Figure 3: Visualization of the proposed approximation algorithm to circumvent the need for realignment of MSAs.
• Figure 4: Experimental results for the replacement attack (left) and the mixed attack (right) are presented as follows: (a) The figures depict the lDDT difference between the native structure and the adversarial structure, as well as the difference before and after re-alignment. (b) The figures illustrate the correlation between plDDT and lDDT. (c) The figures compare the proposed replacement and mixed attack methods with a random attack, and also display the distribution of these two results.
• Figure 5: Comparisons between the native structures and the AF2 predicted ones, including the original predicted structure and the prediction after the attack.