# Iterative attack-and-defend framework for improving TCR-epitope binding prediction models

## TL;DR

This paper introduces a framework to improve TCR-epitope binding predictions by iteratively identifying and fixing model weaknesses.

## Contribution

The novel contribution is an iterative attack-and-defend framework using reinforcement learning to enhance model robustness.

## Key findings

- The framework significantly improves detection of adversarial false positives in TCR-epitope models.
- A benchmark adversarial dataset is generated to evaluate and refine prediction models.
- The method is effective across diverse model architectures and embedding strategies.

## Abstract

Reliable TCR-epitope binding prediction models are essential for development of adoptive T cell therapy and vaccine design. These models often struggle with false positives, which can be attributed to the limited data coverage in existing negative sample datasets. Common strategies for generating negative samples, such as pairing with background T cell receptors (TCRs) or shuffling within pairs, fail to account for model-specific vulnerabilities or biologically implausible sequences.

To address these challenges, we propose an iterative attack-and-defend framework that systematically identifies and mitigates weaknesses in TCR-epitope prediction models. During the attack phase, a reinforcement learning from AI feedback (RLAIF) framework is used to attack a prediction model by generating biologically implausible sequences that can easily deceive the model. During the defense phase, these identified false positives are incorporated into fine-tuning dataset, enhancing the model’s ability to detect false positives. A comprehensive adversarial negative dataset can be obtained by iteratively attacking and defending the model. This dataset can be directly used to improve model robustness, eliminating the need for users to conduct their own attack-and-defend cycles. We apply our framework to five existing binding prediction models, spanning diverse architectures and embedding strategies to show its efficacy. Experimental results show that our approach significantly improves these models’ ability to detect adversarial false positives. The combined dataset constructed from these experiments also provides a benchmarking tool to evaluate and refine prediction models. Our framework offers a new approach for improving model robustness in other biological tasks where negative sampling is inherently limited.

The curated dataset and code are available at a public repository (https://github.com/Lee-CBG/BAP_Attack_n_Defend).