Attack and defence in cellular decision-making: lessons from machine learning

TL;DR

This paper draws parallels between machine learning adversarial attacks and cellular decision-making, revealing how biological systems defend against perturbations and informing the design of robust neural networks.

Contribution

It establishes a formal analogy between neural networks and cellular decision models, introduces biomimetic defenses, and analyzes the loss landscape to understand adversarial robustness.

Findings

Antagonism in cellular models corresponds to adversarial attacks in neural networks.

Robust neural networks and immune cells share similar loss landscape features.

Two regimes with distinct critical points influence adversarial effectiveness.

Abstract

Machine learning algorithms can be fooled by small well-designed adversarial perturbations. This is reminiscent of cellular decision-making where ligands (called antagonists) prevent correct signalling, like in early immune recognition. We draw a formal analogy between neural networks used in machine learning and models of cellular decision-making (adaptive proofreading). We apply attacks from machine learning to simple decision-making models, and show explicitly the correspondence to antagonism by weakly bound ligands. Such antagonism is absent in more nonlinear models, which inspired us to implement a biomimetic defence in neural networks filtering out adversarial perturbations. We then apply a gradient-descent approach from machine learning to different cellular decision-making models, and we reveal the existence of two regimes characterized by the presence or absence of a critical point for the gradient. This critical point causes the strongest antagonists to lie close to the decision boundary. This is validated in the loss landscapes of robust neural networks and cellular decision-making models, and observed experimentally for immune cells. For both regimes, we explain how associated defence mechanisms shape the geometry of the loss landscape, and why different adversarial attacks are effective in different regimes. Our work connects evolved cellular decision-making to machine learning, and motivates the design of a general theory of adversarial perturbations, both for in vivo and in silico systems.