Vulnerability of pangolin SARS-CoV-2 lineage assignment to adversarial attack

Pangolin is the most popular tool for SARS-CoV-2 lineage assignment. During COVID-19, healthcare professionals and policymakers required accurate and timely lineage assignment of SARS-CoV-2 genomes for pandemic response. Therefore, tools such as Pangolin use a machine learning model, pangoLEARN, for fast and accurate lineage assignment. Unfortunately, machine learning models are susceptible to adversarial attacks, in which minute changes to the inputs cause substantial changes in the model prediction. We present an attack that uses the pangoLEARN architecture to find perturbations that change the lineage assignment, often with only 2–3 base pair changes. The attacks we carried out show that pangolin is vulnerable to adversarial attack, with success rates between 0.98 and 1 for sequences from non-VoC lineages when pangoLEARN is used for lineage assignment. The attacks we carried out are almost never successful against VoC lineages because pangolin uses Usher and Scorpio – the non-machine-learning alternative methods for VoC lineage assignment. A malicious agent could use the proposed attack to fake or mask outbreaks or circulating lineages. Developers of software in the field of microbial genomics should be aware of the vulnerabilities of machine learning based models and mitigate such risks.