Victims of Optimization

The same search that produces adversarial examples—driving a model’s prediction up by making small changes to its input—can be turned into a tool for designing biological sequences. We train a small model to predict a property (the surrogate) and then run an attack-style search to find sequences the surrogate scores highly. On its own this search cheats: it finds sequences that fool the surrogate into predicting a high score rather than sequences that are genuinely good. We make the search useful by adding two things. First, a simple biological rule that keeps every proposed sequence realistic, using no extra trained model: each change from the starting sequence must be conservative under the BLOSUM62 (BLOcks SUbstitution Matrix) table, and a set of whole-sequence biophysical numbers (hydrophobicity, net charge, aromatic and charged fractions, sequence complexity, and the longest repeated-letter run) must stay within the ranges seen in natural sequences. Second, and most important, we check every design against signals the search never used—so the final claim never rests on the surrogate grading its own work. We demonstrate the system on four tasks across two molecule types: protein thermostability and green fluorescent protein (GFP) fluorescence, a 600-base-pair regulatory-DNA task verified on a true functional model (Borzoi), and a small DNA benchmark with an exact ground-truth answer (TF-Bind- 8) used as a diagnostic. The biological rule keeps 100% of GFP designs realistic versus 5–19% for the baselines (paired Wilcoxon p<10−7); on thermostability it matches a learned second model and beats a hand-tuned penalty (p<0.001); and on regulatory DNA the system raises the true property on all 40 of 40 starting points. Independent checks (a structure predictor, a separate thermostability predictor, kept functional residues, and a true DNA-activity model) agree the designs are real. Which featurization the surrogate uses (a frozen foundation-model embedding or a plain one-hot/k-mer encoding) is a swappable part of the system, reported as an ablation, not the point: the foundation model only helps on long, variable-length protein, and the system works either way.