Adversarial examples are a well-known phenomenon in computer vision, where imperceptible changes to an image can cause a neural network to misclassify it with high confidence. In molecular machine learning, the analogue would be a molecule whose geometry has been nudged in ways that do not change its chemical identity but that cause a property predictor to produce wildly wrong answers. Previous work on adversarial attacks in this domain has typically taken one of two routes: applying unconstrained perturbations to atomic coordinates, or modifying the discrete molecular graph itself by adding, deleting, or rewiring bonds. Both approaches have a serious flaw. The resulting structures are often chemically nonsensical, with atoms overlapping, bonds stretched to impossible lengths, or molecular frameworks that could never exist. If an attack produces an implausible molecule, the question arises whether the model’s failure is meaningful at all, since such a structure would never appear in real applications.

Lee and Kwon’s contribution is to constrain the attack to a space that chemists trust: torsion angles. Molecules are not rigid objects; they have rotatable bonds, and rotating around a single bond changes the molecule’s conformation without altering its atom types or its bond connectivity. This is precisely the degree of freedom that distinguishes, for example, an extended from a folded conformer of the same molecule. The researchers use RDKit, the widely adopted open-source cheminformatics toolkit, to identify rotatable bonds, and their attacks operate exclusively by rotating these bonds. The molecular graph remains untouched. Every adversarial example they generate is, by construction, the same molecule, merely presented in a different geometric arrangement that a real molecule could plausibly adopt.

Plausibility, however, is not guaranteed by torsion-only perturbation alone. Rotating a bond can swing one part of a molecule into another, creating steric clashes where atoms occupy the same space, or producing conformations so strained that they would never be populated at any reasonable temperature. To prevent this, the authors enforce hard validity constraints drawn from classical computational chemistry. The first is a van der Waals steric check, which verifies that no two non-bonded atoms come closer than physically permitted given their van der Waals radii, the standard measure of atomic size used since the mid-twentieth century. The second is an energy budget evaluated with established molecular mechanics force fields, MMFF94 and UFF. These force fields assign an energy to any 3D structure based on bond lengths, angles, torsions, and non-bonded interactions, and the attack rejects any candidate conformer whose energy exceeds a defined threshold. The result is that every adversarial example remains thermodynamically accessible, meaning it corresponds to a geometry a real molecule could realistically sample.

Within this constrained framework, the researchers develop two white-box attacks, so called because the attacker has full access to the model’s internals and gradients. The first, WB-PGD, is a momentum-based projected gradient descent adapted to torsion space. Gradient descent is the workhorse of neural network training, but here it is turned against the model: instead of adjusting parameters to reduce error, the attack adjusts torsion angles to maximize the model’s prediction error, while a projection step with backtracking pulls any proposed update back into the physically valid region whenever it violates the steric or energetic constraints. The momentum term accumulates gradient information across steps, a technique known to stabilize and strengthen adversarial optimization. The second method, WB-Manifold, serves as a validity-filtered random search baseline: it samples torsion perturbations at random, keeps only those that pass the physical validity filters, and retains whichever candidate most damages the model’s prediction. Comparing a gradient-guided method against a search-based one reveals how much of the attack’s power comes from exploiting model gradients rather than simply exploring the conformational space.

The evaluation covers four prominent architectures for 3D molecular property prediction: EGNN, the E(n)-equivariant graph neural network; InvMPNN, an invariant message-passing network; SchNet, a continuous-filter convolutional network that models quantum interactions; and PaiNN, a polarizable attention network that tracks both scalar and vectorial features. These models represent the leading families of geometric deep learning applied to molecules, differing in how they handle rotational symmetry and directional information. The benchmark is derived from QM9, a standard dataset of quantum-chemical properties for small organic molecules, and the authors take particular care to use leak-free data splits, ensuring that the same molecule does not appear in both training and test sets in different conformations, a subtle form of data leakage that can inflate reported performance.

The findings are striking in their consistency. Across all four architectures, prediction error grows steadily as the torsion perturbation budget increases. At a modest budget of 10 degrees of torsional rotation, the mean damage to predictions is already measurable, at roughly 0.01 to 0.02. When the budget is relaxed to 60 degrees, still well within the range of conformational flexibility that real molecules exhibit, the mean damage climbs to 0.04 to 0.05. Meanwhile, the attack success rate, the fraction of molecules for which the attack produces a prediction error above a defined threshold, rises from nearly zero at small budgets to between 15 and 17 percent at the largest budgets tested. Notably, this degradation occurs even though every adversarial conformer passed the steric and energetic validity checks, meaning the models are not simply being shown impossible molecules.

The central lesson the authors draw is that physical constraints alone do not protect 3D molecular predictors from adversarial failure. One might have hoped that restricting attacks to chemically valid conformations would neutralize the threat, since valid conformers of the same molecule should, in principle, be handled correctly by a model that has truly learned the relationship between structure and property. Instead, the consistent error amplification across architectures suggests that these networks rely on geometric cues in ways that are fragile under realistic conformational change. This has practical implications for drug discovery and materials design pipelines, where molecular property predictions guide expensive experimental decisions. A model that is sensitive to which conformer it happens to be shown could produce unreliable rankings of candidate compounds, and adversarial robustness testing offers a way to probe that sensitivity before deployment.

Beyond diagnosing vulnerability, the study establishes torsion-space attacks as a principled robustness benchmark for the field. Because the attacks preserve chemical identity and enforce thermodynamic accessibility, they isolate a specific and meaningful failure mode: sensitivity to conformational geometry within the physically realizable manifold. The authors suggest that future work on 3D molecular machine learning should incorporate such physically valid adversarial evaluation alongside standard accuracy metrics, and that defenses, such as training on diverse conformations or enforcing invariance across the conformational ensemble, can be measured against these attacks. The work was supported by a National Research Foundation of Korea grant funded by the Korean government, and the authors report no competing interests. As machine learning continues to permeate computational chemistry, studies like this one serve as a reminder that the reliability of a predictor cannot be judged by its accuracy on clean data alone; it must also withstand the geometric variability that real molecules present every day.

Subject of Research: Physically valid adversarial attacks on 3D molecular property prediction models using torsion-space perturbations

Article Title: Physically valid adversarial examples for 3D molecular prediction

Article References: Physically valid adversarial examples for 3D molecular prediction. (n.d.). https://doi.org/10.1007/s13042-026-03321-z

Image Credits: AI Generated

DOI: 10.1007/s13042-026-03321-z

Keywords: adversarial examples, 3D molecular prediction, torsion perturbations, graph neural networks, equivariant neural networks, molecular conformers, force fields, QM9, robustness benchmark, machine learning, computational chemistry, drug discovery