Adversarial examples are a well-known phenomenon in computer vision, where imperceptible changes to an image can cause a neural network to misclassify it with high confidence. In molecular machine learning, the analogue would be a molecule whose geometry has been nudged in ways that do not change its chemical identity but that cause a property predictor to produce wildly wrong answers. Previous work on adversarial attacks in this domain has typically taken one of two routes: applying unconstrained perturbations to atomic coordinates, or modifying the discrete molecular graph itself by adding, deleting, or rewiring bonds. Both approaches have a serious flaw. The resulting structures are often chemically nonsensical, with atoms overlapping, bonds stretched to impossible lengths, or molecular frameworks that could never exist. If an attack produces an implausible molecule, the question arises whether the model’s failure is meaningful at all, since such a structure would never appear in real applications.

Lee and Kwon’s contribution is to constrain the attack to a space that chemists trust: torsion angles. Molecules are not rigid objects; they have rotatable bonds, and rotating around a single bond changes the molecule’s conformation without altering its atom types or its bond connectivity. This is precisely the degree of freedom that distinguishes, for example, an extended from a folded conformer of the same molecule. The researchers use RDKit, the widely adopted open-source cheminformatics toolkit, to identify rotatable bonds, and their attacks operate exclusively by rotating these bonds. The molecular graph remains untouched. Every adversarial example they generate is, by construction, the same molecule, merely presented in a different geometric arrangement that a real molecule could plausibly adopt.

Plausibility, however, is not guaranteed by torsion-only perturbation alone. Rotating a bond can swing one part of a molecule into another, creating steric clashes where atoms occupy the same space, or producing conformations so strained that they would never be populated at any reasonable temperature. To prevent this, the authors enforce hard validity constraints drawn from classical computational chemistry. The first is a van der Waals steric check, which verifies that no two non-bonded atoms come closer than physically permitted given their van der Waals radii, the standard measure of atomic size used since the mid-twentieth century. The second is an energy budget evaluated with established molecular mechanics force fields, MMFF94 and UFF. These force fields assign an energy to any 3D structure based on bond lengths, angles, torsions, and non-bonded interactions, and the attack rejects any candidate conformer whose energy exceeds a defined threshold. The result is that every adversarial example remains thermodynamically accessible, meaning it corresponds to a geometry a real molecule could realistically sample.

Within this constrained framework, the researchers develop two white-box attacks, so called because the attacker has full access to the model’s internals and gradients. The first, WB-PGD, is a momentum-based projected gradient descent adapted to torsion space. Gradient descent is the workhorse of neural network training, but here it is turned against the model: instead of adjusting parameters to reduce error, the attack adjusts torsion angles to maximize the model’s prediction error, while a projection step with backtracking pulls any proposed update back into the physically valid region whenever it violates the steric or energetic constraints. The momentum term accumulates gradient information across steps, a technique known to stabilize and strengthen adversarial optimization. The second method, WB-Manifold, serves as a validity-filtered random search baseline: it samples torsion perturbations at random, keeps only those that pass the physical validity filters, and retains whichever candidate most damages the model’s prediction. Comparing a gradient-guided method against a search-based one reveals how much of the attack’s power comes from exploiting model gradients rather than simply exploring the conformational space.

The evaluation covers four prominent architectures for 3D molecular property prediction: EGNN, the E(n)-equivariant graph neural network; InvMPNN, an invariant message-passing network; SchNet, a continuous-filter convolutional network that models quantum interactions; and PaiNN, a polarizable attention network that tracks both scalar and vectorial features. These models represent the leading families of geometric deep learning applied to molecules, differing in how they handle rotational symmetry and directional information. The benchmark is derived from QM9, a standard dataset of quantum-chemical properties for small organic molecules, and the authors take particular care to use leak-free data splits, ensuring that the same molecule does not appear in both training and test sets in different conformations, a subtle form of data leakage that can inflate reported performance.

The findings are striking in their consistency. Across all four architectures, prediction error grows steadily as the torsion perturbation budget increases. At a modest budget of 10 degrees of torsional rotation, the mean damage to predictions is already measurable, at roughly 0.01 to 0.02. When the budget is relaxed to 60 degrees, still well within the range of conformational flexibility that real molecules exhibit, the mean damage climbs to 0.04 to 0.05. Meanwhile, the attack success rate, the fraction of molecules for which the attack produces a prediction error above a defined threshold, rises from nearly zero at small budgets to between 15 and 17 percent at the largest budgets tested. Notably, this degradation occurs even though every adversarial conformer passed the steric and energetic validity checks, meaning the models are not simply being shown impossible molecules.

The central lesson the authors draw is that physical constraints alone do not protect 3D molecular predictors from adversarial failure. One might have hoped that restricting attacks to chemically valid conformations would neutralize the threat, since valid conformers of the same molecule should, in principle, be handled correctly by a model that has truly learned the relationship between structure and property. Instead, the consistent error amplification across architectures suggests that these networks rely on geometric cues in ways that are fragile under realistic conformational change. This has practical implications for drug discovery and materials design pipelines, where molecular property predictions guide expensive experimental decisions. A model that is sensitive to which conformer it happens to be shown could produce unreliable rankings of candidate compounds, and adversarial robustness testing offers a way to probe that sensitivity before deployment.

Beyond diagnosing vulnerability, the study establishes torsion-space attacks as a principled robustness benchmark for the field. Because the attacks preserve chemical identity and enforce thermodynamic accessibility, they isolate a specific and meaningful failure mode: sensitivity to conformational geometry within the physically realizable manifold. The authors suggest that future work on 3D molecular machine learning should incorporate such physically valid adversarial evaluation alongside standard accuracy metrics, and that defenses, such as training on diverse conformations or enforcing invariance across the conformational ensemble, can be measured against these attacks. The work was supported by a National Research Foundation of Korea grant funded by the Korean government, and the authors report no competing interests. As machine learning continues to permeate computational chemistry, studies like this one serve as a reminder that the reliability of a predictor cannot be judged by its accuracy on clean data alone; it must also withstand the geometric variability that real molecules present every day.

Subject of Research: Physically valid adversarial attacks on 3D molecular property prediction models using torsion-space perturbations

Article Title: Physically valid adversarial examples for 3D molecular prediction

Article References: Physically valid adversarial examples for 3D molecular prediction. (n.d.). https://doi.org/10.1007/s13042-026-03321-z

Image Credits: AI Generated

DOI: 10.1007/s13042-026-03321-z

Keywords: adversarial examples, 3D molecular prediction, torsion perturbations, graph neural networks, equivariant neural networks, molecular conformers, force fields, QM9, robustness benchmark, machine learning, computational chemistry, drug discovery

Diffusion models have become one of the most powerful paradigms in generative machine learning, famous for their success in image synthesis and increasingly prominent in chemistry and drug discovery. The core idea is elegantly counterintuitive. During training, structured data such as a molecular graph is progressively corrupted by adding random noise until it becomes indistinguishable from static. A neural network is then taught to reverse that process, learning to strip away noise step by step until a coherent structure emerges from pure randomness. When applied to molecules, the reverse diffusion process must reconstruct both the atoms and the bonds connecting them, turning formless noise into valid, diverse, and novel chemical graphs. Every single reverse step depends on accurate denoising, which makes the denoising network the linchpin of the entire enterprise.

The difficulty lies in what that denoising network must accomplish simultaneously. At the local level, it has to recover chemical connectivity: which atoms are bonded to which neighbors, and with what bond types. At the global level, it must grasp the topology of the whole graph, the overall scaffold that determines the molecule’s shape and, ultimately, its biological behavior. Convolution-style message passing networks excel at capturing local neighborhoods, while spectral graph methods, which operate on the eigenstructure of the graph Laplacian, are naturally suited to describing global patterns. Most existing models commit to one perspective, leaving the complementary one underexplored, and that compromise shows up in the quality of generated molecules.

Longbin Sun and Xiujuan Lei of Shaanxi Normal University, together with Mei Ma of Qinghai Normal University, tackled this trade-off head-on. Their DFDM model combines two parallel branches inside the denoising network. The first is a spatial branch built on GINE, a graph isomorphism network variant widely used for learning from molecular graphs through neighbor message passing. The second is a Chebyshev spectral branch, which leverages Chebyshev polynomial approximations of graph convolution to capture information distributed across the entire molecular graph. Rather than forcing a fixed marriage between the two, DFDM fuses their outputs using weights that change from layer to layer and are guided by the signal-to-noise ratio at each step of the reverse diffusion process.

This signal-to-noise-ratio guidance is the conceptual heart of the method. Early in the reverse process, when the molecular graph is still mostly noise, the amount of genuine signal is tiny; late in the process, signal dominates. Intuitively, when almost nothing is known about the molecule, broad global information is more useful than fine local detail, whereas near the end of generation, when atomic identities and bonds are crystallizing, precise local connectivity becomes paramount. By tying the fusion weights to the measured noise level, DFDM lets the model decide dynamically which branch to trust at every stage and in every layer, rather than committing to a static balance that may be wrong for most of the generation trajectory.

The team evaluated DFDM on two of the standard benchmarks in generative molecular chemistry: QM9, a dataset of roughly one hundred thirty-four thousand small molecules with quantum chemical properties, and ZINC250k, a quarter-million subset of drug-like compounds drawn from the ZINC database. To guard against lucky runs, they repeated the full generation-and-evaluation pipeline three times with independent random seeds. Across these runs, DFDM achieved the lowest mean Fréchet ChemNet Distance among the compared methods, a metric that measures how closely the distribution of generated molecules resembles that of real molecules as judged by a pretrained chemical neural network. Lower values indicate generated chemistry that statistically looks like real chemistry, spanning both diversity and plausibility.

Just as striking was DFDM’s performance on validity. The model achieved the highest mean validity without correction, meaning the largest fraction of its generated outputs were chemically sound molecules exactly as produced, without any post-hoc repair or filtering tricks. In molecular generation, validity is a perennial headache; many powerful models produce graph structures that violate basic valence rules and must be salvaged by external cheminformatics tools. A model that natively generates valid molecules most of the time saves computation and, more importantly, indicates that its internal representation of chemistry is genuinely coherent rather than superficially plausible.

Ablation experiments, in which components of the model are systematically removed, provided insight into why the dynamic approach works. On both datasets, replacing the dynamic fusion with fixed weights, which let the spatial and spectral branches contribute equally regardless of noise level, degraded the overall balance of metrics. The dynamic version consistently offered a better compromise across validity, uniqueness, novelty, and distributional distance. Even more revealing was a noise-stratified analysis on QM9, which examined which branch dominated at different points along the reverse diffusion trajectory. The results showed a systematic transition: at high noise levels the spectral, global branch carried more weight, while near the final denoising stages emphasis shifted decisively toward the spatial, local branch. This mirrors exactly the intuition that coarse architecture must be settled before fine chemical details can be fixed.

Why does this matter beyond the benchmark tables? De novo molecular design sits at the front end of drug discovery, where the search space of possible small molecules is astronomically large, estimated in some analyses to exceed ten to the sixtieth candidate structures. Generative models act as intelligent compasses in that vast space, proposing molecules that are chemically valid, structurally novel, and statistically similar to known active compounds. Diffusion-based generators have rapidly become favorites in this arena, alongside variational autoencoders, generative adversarial networks, and flow-based models, because they combine stable training with high sample quality. Improvements in how diffusion models represent and denoise molecular graphs therefore translate directly into better raw material for virtual screening and lead optimization pipelines.

The DFDM results also carry a broader lesson for graph generative modeling in general. The finding that a model should weight global spectral information when the data is noisy and local spatial information when the data is nearly clean suggests that the denoising problem itself has a multiscale structure, and that generative architectures should respect it. Rather than chasing ever larger networks, the authors’ approach shows that intelligent coordination of complementary inductive biases, each suited to a different scale and a different point in the generation process, can yield concrete, measurable gains. The work was supported by the National Natural Science Foundation of China, and the authors note that no new datasets were generated or analyzed beyond the benchmarks used. As diffusion models continue their migration into chemistry, dynamic fusion of local and global views may well become a standard ingredient in the generative toolkit, helping machines not merely dream up molecules, but dream them up correctly.

Subject of Research: A dynamic fusion diffusion model for generating two-dimensional molecular graphs by combining spatial and spectral graph neural network branches

Article Title: A dynamic fusion diffusion model for molecular generation

Article References: Sun, L., Lei, X., & Ma, M. (2026). A dynamic fusion diffusion model for molecular generation. Molecular Diversity. https://doi.org/10.1007/s11030-026-11718-9

Image Credits: AI Generated

DOI: 10.1007/s11030-026-11718-9

Keywords: molecular generation, diffusion model, graph neural network, drug discovery, denoising network, QM9, ZINC250k, de novo molecular design, Fréchet ChemNet Distance, spectral graph convolution, machine learning, generative AI