Adversarial examples are a well-known phenomenon in computer vision, where imperceptible changes to an image can cause a neural network to misclassify it with high confidence. In molecular machine learning, the analogue would be a molecule whose geometry has been nudged in ways that do not change its chemical identity but that cause a property predictor to produce wildly wrong answers. Previous work on adversarial attacks in this domain has typically taken one of two routes: applying unconstrained perturbations to atomic coordinates, or modifying the discrete molecular graph itself by adding, deleting, or rewiring bonds. Both approaches have a serious flaw. The resulting structures are often chemically nonsensical, with atoms overlapping, bonds stretched to impossible lengths, or molecular frameworks that could never exist. If an attack produces an implausible molecule, the question arises whether the model’s failure is meaningful at all, since such a structure would never appear in real applications.

Lee and Kwon’s contribution is to constrain the attack to a space that chemists trust: torsion angles. Molecules are not rigid objects; they have rotatable bonds, and rotating around a single bond changes the molecule’s conformation without altering its atom types or its bond connectivity. This is precisely the degree of freedom that distinguishes, for example, an extended from a folded conformer of the same molecule. The researchers use RDKit, the widely adopted open-source cheminformatics toolkit, to identify rotatable bonds, and their attacks operate exclusively by rotating these bonds. The molecular graph remains untouched. Every adversarial example they generate is, by construction, the same molecule, merely presented in a different geometric arrangement that a real molecule could plausibly adopt.

Plausibility, however, is not guaranteed by torsion-only perturbation alone. Rotating a bond can swing one part of a molecule into another, creating steric clashes where atoms occupy the same space, or producing conformations so strained that they would never be populated at any reasonable temperature. To prevent this, the authors enforce hard validity constraints drawn from classical computational chemistry. The first is a van der Waals steric check, which verifies that no two non-bonded atoms come closer than physically permitted given their van der Waals radii, the standard measure of atomic size used since the mid-twentieth century. The second is an energy budget evaluated with established molecular mechanics force fields, MMFF94 and UFF. These force fields assign an energy to any 3D structure based on bond lengths, angles, torsions, and non-bonded interactions, and the attack rejects any candidate conformer whose energy exceeds a defined threshold. The result is that every adversarial example remains thermodynamically accessible, meaning it corresponds to a geometry a real molecule could realistically sample.

Within this constrained framework, the researchers develop two white-box attacks, so called because the attacker has full access to the model’s internals and gradients. The first, WB-PGD, is a momentum-based projected gradient descent adapted to torsion space. Gradient descent is the workhorse of neural network training, but here it is turned against the model: instead of adjusting parameters to reduce error, the attack adjusts torsion angles to maximize the model’s prediction error, while a projection step with backtracking pulls any proposed update back into the physically valid region whenever it violates the steric or energetic constraints. The momentum term accumulates gradient information across steps, a technique known to stabilize and strengthen adversarial optimization. The second method, WB-Manifold, serves as a validity-filtered random search baseline: it samples torsion perturbations at random, keeps only those that pass the physical validity filters, and retains whichever candidate most damages the model’s prediction. Comparing a gradient-guided method against a search-based one reveals how much of the attack’s power comes from exploiting model gradients rather than simply exploring the conformational space.

The evaluation covers four prominent architectures for 3D molecular property prediction: EGNN, the E(n)-equivariant graph neural network; InvMPNN, an invariant message-passing network; SchNet, a continuous-filter convolutional network that models quantum interactions; and PaiNN, a polarizable attention network that tracks both scalar and vectorial features. These models represent the leading families of geometric deep learning applied to molecules, differing in how they handle rotational symmetry and directional information. The benchmark is derived from QM9, a standard dataset of quantum-chemical properties for small organic molecules, and the authors take particular care to use leak-free data splits, ensuring that the same molecule does not appear in both training and test sets in different conformations, a subtle form of data leakage that can inflate reported performance.

The findings are striking in their consistency. Across all four architectures, prediction error grows steadily as the torsion perturbation budget increases. At a modest budget of 10 degrees of torsional rotation, the mean damage to predictions is already measurable, at roughly 0.01 to 0.02. When the budget is relaxed to 60 degrees, still well within the range of conformational flexibility that real molecules exhibit, the mean damage climbs to 0.04 to 0.05. Meanwhile, the attack success rate, the fraction of molecules for which the attack produces a prediction error above a defined threshold, rises from nearly zero at small budgets to between 15 and 17 percent at the largest budgets tested. Notably, this degradation occurs even though every adversarial conformer passed the steric and energetic validity checks, meaning the models are not simply being shown impossible molecules.

The central lesson the authors draw is that physical constraints alone do not protect 3D molecular predictors from adversarial failure. One might have hoped that restricting attacks to chemically valid conformations would neutralize the threat, since valid conformers of the same molecule should, in principle, be handled correctly by a model that has truly learned the relationship between structure and property. Instead, the consistent error amplification across architectures suggests that these networks rely on geometric cues in ways that are fragile under realistic conformational change. This has practical implications for drug discovery and materials design pipelines, where molecular property predictions guide expensive experimental decisions. A model that is sensitive to which conformer it happens to be shown could produce unreliable rankings of candidate compounds, and adversarial robustness testing offers a way to probe that sensitivity before deployment.

Beyond diagnosing vulnerability, the study establishes torsion-space attacks as a principled robustness benchmark for the field. Because the attacks preserve chemical identity and enforce thermodynamic accessibility, they isolate a specific and meaningful failure mode: sensitivity to conformational geometry within the physically realizable manifold. The authors suggest that future work on 3D molecular machine learning should incorporate such physically valid adversarial evaluation alongside standard accuracy metrics, and that defenses, such as training on diverse conformations or enforcing invariance across the conformational ensemble, can be measured against these attacks. The work was supported by a National Research Foundation of Korea grant funded by the Korean government, and the authors report no competing interests. As machine learning continues to permeate computational chemistry, studies like this one serve as a reminder that the reliability of a predictor cannot be judged by its accuracy on clean data alone; it must also withstand the geometric variability that real molecules present every day.

Subject of Research: Physically valid adversarial attacks on 3D molecular property prediction models using torsion-space perturbations

Article Title: Physically valid adversarial examples for 3D molecular prediction

Article References: Physically valid adversarial examples for 3D molecular prediction. (n.d.). https://doi.org/10.1007/s13042-026-03321-z

Image Credits: AI Generated

DOI: 10.1007/s13042-026-03321-z

Keywords: adversarial examples, 3D molecular prediction, torsion perturbations, graph neural networks, equivariant neural networks, molecular conformers, force fields, QM9, robustness benchmark, machine learning, computational chemistry, drug discovery

The difficulty with C–S–H begins with its structure. Unlike the tidy crystals that fill mineralogy textbooks, C–S–H is X-ray amorphous, meaning its atomic arrangement is too disordered to resolve with conventional diffraction. Its calcium-to-silicon ratio varies widely, its silicate chains are broken at unpredictable points, and its water content shifts with the surrounding environment. This heterogeneity has frustrated experimentalists for decades and has equally hampered computationalists. Density functional theory, the gold standard of atomistic simulation, delivers benchmark accuracy but only for systems of a few hundred atoms over picoseconds. Classical molecular dynamics can reach larger scales, but its reliability rests entirely on the quality of empirical force fields, and the force fields developed for cement each carry serious compromises.

ClayFF, for example, covers a broad range of elements cheaply but was parameterized for clay minerals and struggles to reproduce the mechanics of C–S–H. The CSH-FF improves on crystalline tobermorite but cannot capture reactive chemistry. ReaxFF introduces bond breaking, useful for hydration reactions, yet suffers from poor mechanical accuracy and punishing computational demands. The newer ERICA FF extends elemental coverage and agrees better with quantum calculations, but it remains anchored to fixed functional forms. Machine learning potentials offer a way out of this dilemma: trained on quantum-mechanical data, they reproduce near-DFT accuracy while running orders of magnitude faster than ab initio molecular dynamics. Previous efforts had built such potentials for tobermorite or for narrow slices of C–S–H compositional space, but none had confronted the full chemical and structural wildness of the real material.

The heart of the new work is not the neural network itself but the dataset behind it. Because no public database of experimentally derived C–S–H atomic structures exists, the researchers constructed one from scratch using the pyCSH structure-generation program. They began by generating roughly 500,000 candidate supercells spanning calcium-to-silicon ratios from 0.83 to 2.5, then screened them on four key structural parameters, including silanol density, calcium hydroxylation, and mean silicate chain length, to eliminate redundancy while preserving diversity. The result was 1,926 distinct models covering 688 separate compositions. These were equilibrated with the ERICA force field, refined at the density functional theory level, and then augmented in two stages: deliberate structural perturbations of up to twenty percent generated 9,450 high-energy configurations, and configurations harvested from one hundred molecular dynamics trajectories added another 39,057. In total, more than 50,000 DFT-labeled configurations now constitute what the authors describe as the largest and most comprehensive openly accessible C–S–H dataset to date, a first step toward what they call a cement genome.

The training data were validated with structural fingerprinting. Using the smooth overlap of atomic positions method and principal component analysis, the team mapped the configurational landscape of their dataset and confirmed that it spreads across a genuinely broad space rather than clustering around a few crystal-like basins. The optimization sub-dataset sits near the origin, providing stable energy minima, while the perturbed and trajectory-sampled configurations fan outward, covering the non-equilibrium territory a simulation must navigate. This deliberate coverage of metastable and high-energy states is precisely what separates a robust potential from one that fails the moment atoms stray from perfect crystals, and it explains much of what follows.

The accuracy numbers are striking. CSH-MLP reproduces DFT atomic energies with root mean squared errors of 1.18 and 1.50 meV per atom on training and test sets respectively, and forces with errors of roughly 0.1 eV per angstrom, placing it toward the low end of the accepted range for machine learning potentials. During production simulations, the model maintained consistent accuracy across compositions spanning Ca/Si ratios from 0.91 to 2.06, and it stably equilibrated large-scale models it had never seen, including an 8,456-atom bulk structure and a 10,109-atom gel containing a water-filled nanopore, both built with methods entirely different from the training pipeline. When benchmarked on lattice constants, CSH-MLP deviated from DFT by an average of only 0.14 percent for the C–S–H benchmark model, and it even predicted tobermorite structures, which were absent from training, with errors mostly below one percent.

The comparisons with rival methods were revealing. The general-purpose foundation model MACE-MP-0, despite covering more than eighty elements, performed worse than CSH-MLP on both C–S–H and tobermorite, running at only 0.8 nanoseconds per day on a single GPU versus 21.8 for CSH-MLP. The earlier csh_cp potential, trained largely on crystalline configurations, produced spurious oxygen clustering and outright simulation failure on the gel system, while ClayFF showed unphysical water diffusion and ReaxFF showed artifacts of its own. CSH-MLP, by contrast, reproduced experimental pair distribution functions measured by two independent research groups, matched ab initio molecular dynamics on individual atomic pair correlations, and predicted a water diffusion coefficient in confined nanopores squarely within the range reported by prior studies.

Perhaps the most scientifically satisfying result concerns a long-standing contradiction. High-pressure X-ray diffraction experiments suggest that C–S–H stiffens monotonically as the calcium-to-silicon ratio rises, while decades of simulation work predict that higher calcium content breaks silicate chains and softens the material. CSH-MLP resolved the tension with a non-monotonic prediction: the bulk modulus climbs from 45.57 gigapascals at Ca/Si of 1.3 to a peak of 53.47 gigapascals at 1.5, then falls to 48.29 gigapascals at 1.9. Below the peak, added calcium densifies the interlayer and strengthens cohesion faster than chain scission weakens it; above it, progressive chain fragmentation and interlayer disorder take over. The low-calcium value agrees almost exactly with the experimental figure of 45.6 gigapascals, and the two regimes reconcile the densification story told by X-ray experiments with the defect story told by atomistic simulation as complementary halves of one physical picture.

Speed is the final piece of the puzzle. At the conservative 0.2 femtosecond timestep required by ReaxFF, CSH-MLP runs 3.5 to 6 times faster, and because it remains stable at timesteps up to 1.0 femtosecond, its effective advantage reaches 16.8 to 29.9 times. That means simulations of more than 10,000 atoms over nanosecond timescales at near-quantum accuracy, something previously infeasible for cementitious systems. The dataset and model are openly available on Figshare and the AIS Square platform, and the authors envision fine-tuning the framework toward carbonation, sulfate attack, alkali uptake, and interfaces. If the cement genome project succeeds, the humble glue holding the built environment together may finally yield its secrets, and with them, a credible path toward concrete that builds the future without overheating the planet.

Subject of Research: A machine learning interatomic potential for calcium silicate hydrate, the binding phase of cement, trained on a diverse DFT-labeled dataset

Article Title: Machine Learning Potential for Calcium Silicate Hydrates With Broad Compositional and Structural Diversity

Article References: Li, Y., Chen, C., Pellenq, R. J.-M., Li, Z., & Liu, J. (2026). Machine Learning Potential for Calcium Silicate Hydrates With Broad Compositional and Structural Diversity. Advanced Science, Article e77942. https://doi.org/10.1002/advs.77942

Image Credits: AI Generated

DOI: 10.1002/advs.77942

Keywords: calcium silicate hydrate, machine learning potential, cement, molecular dynamics, density functional theory, concrete, nanocrystalline materials, force fields, mechanical properties, carbon emissions, tobermorite, materials genome