Attack and Defense in Cellular Decision-Making: Lessons from Machine Learning

Machine-learning algorithms can be fooled by small well-designed adversarial perturbations. This is reminiscent of cellular decision-making where ligands (called antagonists) prevent correct signaling, like in early immune recognition. We draw a formal analogy between neural networks used in machine learning and models of cellular decision-making (adaptive proofreading). We apply attacks from machine learning to simple decision-making models and show explicitly the correspondence to antagonism by weakly bound ligands. Such antagonism is absent in more nonlinear models, which inspires us to implement a biomimetic defense in neural networks filtering out adversarial perturbations. We then apply a gradient-descent approach from machine learning to different cellular decision-making models, and we reveal the existence of two regimes characterized by the presence or absence of a critical point for the gradient. This critical point causes the strongest antagonists to lie close to the decision boundary. This is validated in the loss landscapes of robust neural networks and cellular decision-making models, and observed experimentally for immune cells. For both regimes, we explain how associated defense mechanisms shape the geometry of the loss landscape and why different adversarial attacks are effective in different regimes. Our work connects evolved cellular decision-making to machine learning and motivates the design of a general theory of adversarial perturbations, both for in vivo and in silico systems.

Popular Summary

Artificial neural networks—computer-learning systems modeled after brain circuitry—have pushed the state of the art in automated tasks such as image analysis and speech recognition. However, these systems also suffer from blind spots, for example, small alterations to an image that appear benign to humans can lead to misclassification. A similar vulnerability also shows up in biology: small changes in proteins that attach to immune cells can trigger an improper immune response—known as ligand antagonism—thought to be tied to various diseases such as HIV and cancer. Here, we mathematically connect and characterize the weaknesses observed in artificial neural networks to those observed in cells.

We use standard techniques from artificial intelligence (AI) to identify and study the nature of weaknesses in cellular decision making. We discover that ligand antagonism in biology corresponds mathematically to perturbations in artificial neural networks. With this knowledge, we implement biomimetic defenses on simple artificial neural networks that lead to better decision making. Finally, using another AI technique, we discover and describe two qualitatively different categories of cellular decision making, with opposite properties in terms of sensitivity to signals and robustness to perturbations.

Our work establishes a common theoretical framework for the design of reliable artificial neural networks inspired by non-neural biology and for a better understanding of diseases related to complex cellular decision making (e.g., in immunology) using AI frameworks.

Figure 1

Ligand discrimination and digit recognition tasks. (a) Adversarial examples on digits and road signs. Reproduced from Ref. [7], Courtesy of Nicolas Papernot. Left column displays original images with categories recognized by machine-learning algorithms, right column displays images containing targeted perturbations leading to misclassification. (b) Schematics of ligand-binding events showing typical receptor occupancy through some observed time during cellular decision-making using T-cell terminology (self vs nonself). The colored bars correspond to self (green), antagonist (orange), and nonself (blue) ligands binding to receptors. Their lengths are indicative of the binding time ${\tau }_i$, whereas their rate of binding measures the on rate $k_i^{\mathrm{on}}$. (c) Different ligand distributions give different response. The vertical dotted line indicates quality ${\tau }_d$. Decision should be to activate if one observes ligands with $\tau >{\tau }_d$, so on the right of the dotted line. In an immune context, T cells respond to ligand distributions of agonists alone and agonists in the presence of nonagonists (with very small binding times $\tau$), while the T cell fails to respond if there are too many ligands just below threshold ${\tau }_d$.

Figure 2

Adaptive proofreading and neural network. (a) Left: Adaptive proofreading networks have an activating and repressing branch with different weights on $\tau$. Right: Detailed adaptive proofreading network adapted from Ref. [34]. Ligand $L$ binds to receptor $R$ to form unphosphorylated complex $C_0$. The receptor chain is iteratively phosphorylated until reaching state $C_N$ along the activating branch (green). At every stage $C_i$, the ligand can unbind from the receptor with ligand-specific rate ${\tau }^{-1}$. At $C_m$, the repressing branch (red) splits by inhibiting the kinase $K$, which mediates the feed-forward mechanism. (b) Dose-response curves for pure ligand types and mixtures in both adaptive proofreading models and experiments on T cells (redrawn from Ref. [32]). Details on the models and parameters used are given in Appendix pp2. For experiments, OVA are agonist ligands, G4 and E1 are ligands known to be below threshold but showing clear antagonistic properties. (c) Schematic of the neural network used for digit recognition. We explicitly show the four weight vectors $W_i$ learned in one instance of the training, the activation function $J$, and an adversarially perturbed sample ${\mathbf{x}}_{\mathrm{adv}}$.

Figure 3

Schematics of FGSM applied to immune recognition. (a) We compute how to lower the response for the receptor occupancy through a given period of time by changing $k_i^{\mathrm{on}}$ and ${\tau }_i$. Bottom left: Increasing $k_i^{\mathrm{on}}$ for ligands with ${\tau }_i<{\tau }_d$ and decreasing $k_i^{\mathrm{on}}$ for ligands with ${\tau }_i>{\tau }_d$ reduces the weighted average $T_{1,0}$ (change in frequency of the colored bars). Bottom right: Decreasing ${\tau }_i$ for all ligands decreases $T_{1,0}$ (change in length of the colored bars). (b) Response to nonself-ligands is lowered from $T_{1,0}^{\text{before}}$ to $T_{1,0}^{\text{after}}$ upon addition of $R$ ligands with small binding time $\epsilon$. (c) Interpolated digits with and without adversarial perturbation along the interpolation axis between $\overrightarrow{7}$ ($f=0$) and $\overrightarrow{3}$ ($f=1$). Adversarial perturbations are computed via the FGSM with $\epsilon =0.2$. For the biomimetic defense $\varphi (N,\theta )$, we choose $N=5$ and $\theta =0.5$. (d) Scoring function $J(\mathbf{x})$ on pictures of (c) without (left) and with (right) the biomimetic defense. The classification threshold is indicated by the dashed green line at $J=0$. Samples with $J>0$ are classified as 7, otherwise 3. (e) Interpolated ligand mixtures with and without self-ligands along the interpolation axis between agonist ($f=0$) and antagonist ($f=1$). Here, $(L_{\mathrm{ag}},{\tau }_{\mathrm{ag}})=(100,6),(L_a,{\tau }_a)=(100,1),(L_{\text{self}},{\tau }_{\text{self}})=(1000,0.1)$. (f) Scoring function on ligand mixtures of (e) for a naive immune classifier $(N,m)=(1,0)$ (left) and a robust immune classifier $(N,m)=(2,1)$ (right). The threshold is indicated by a dashed green line at $T_{N,m}/{\tau }_d-1=0$. $T_{N,m}/{\tau }_d-1>0$ corresponds to the detection of agonists and below corresponds to no detection. In both digit recognition and ligand discrimination, the naive networks interpolate the score linearly and are sensitive to adversarial perturbations, while the score for robust networks is flatter, closer to the initial samples for longer, thus, more resistant to perturbation.

Figure 4

Characterization of the decision boundary following gradient-descent dynamics. (a) Ligand distribution at the decision boundary by applying iterative gradient descent (top right of the panel) to an initial distribution (top left). For various cases $(N,m)$, we change the binding time of self-ligands along the steepest gradient until reaching the decision boundary. $n_{\text{iter}}$ indicates the number of iterations needed to reach the decision boundary. We identify the adversarial regime (red), the ambiguous regime (green), and a transition (black) depending on $m$. (b) $T_{N,m}$ for mixtures of ligands at ${\tau }_d$ and ligands at $\tau$, as a function of $\tau$ for various $(N,m)$. Antagonism strength is maximal when $T_{N,m}$ is minimal. Minima and inflexion points are indicated with a circle and square. (c) Few-pixel attack as a way of circumventing proofreading or local contrast defense, while creating ambiguous digits. We add a $3\times 3$ mean filter to demonstrate the ambiguity of digits at the decision boundary. The control image is the mean-filtered initial digit combined with the locally contrasted average target digit. Note that also the control is lacking a clear ground truth.

Figure 5

MTL pictures. Explanation is found in the text.

Figure 6

Boundary tilting in one-dimensional digit classification. (a) (i) Typical 3 and 7 from MNIST. (ii) Average 3, 7 of the traditional test set, (iii, iv) with adversarial perturbation found by (v) subtracting the sign of $\overline{3}$ from $\overline{7}$, which corresponds to (vi), the perturbation found with FGSM. (b) Projection of the digits on the first principal components. The classes are separated by a linear support vector classifier (blue), and the average of the classes with and without adversarial perturbation is shown by the triangle and star. We cycle through permutations of adversarial training and/or adversarial testing. Note how the boundary tilts in the right panels and how the triangle moves parallel to the decision boundary. (c) Decision boundary of the immune model. The region under the surface is the response regime, and the region above is the no-response regime. The classifier with a single proofreading step $(N,m)=(1,0)$ fails to observe agonists in three of the four marked mixtures, while the robust classifier $(N,m)=(5,3)$ correctly responds to each indicated mixture.

Figure 7

Method of few-pixel attack. Each column shows how a few-pixel attack causes misclassification of an initial digit to a target class. The important result is the prefiltered boundary digits and the control in the red rectangle. Pixel maps determine which pixels increase (red) or decrease (blue) the score when turning an individual pixel in the initial digit white or black. We merge the pixel maps, sort this list of pixels, and go through it from maximum to minimum change in score until misclassification occurs, resulting in the prefiltered digit. We apply a mean filter to make them look more like real digits, and indeed, these mean-filtered boundary digits closely resemble our control digits at the boundary. The control digits are composed of the mean-filtered initial digit plus locally contrasted [with hill function ($N=3$; $\theta =0.5$)] average digit of the target class.

Figure 8

Trajectory of the scoring functions of the attacks in Fig. 7. The blue, orange, and green lines correspond to various digits (actual digit, mean-filtered digit, median-filtered digit) for which we check the score and terminate when reaching the boundary. The trajectory of the score for the null digit and the mean-filtered digit is generally the same. Moreover, the behavior of the score looks similar to the behavior of $T_{N,m}$ upon addition of maximally antagonizing ligands to a mixture of only agonist ligands in Fig. 3 in the main text.