In this post - Part 1 of a series on the topic - I go through the basics of Genetic Engineering Attribution (GEA) technology - a new family of forensic tools for determining the origin of genetically engineered material. In Part 2, I go into exactly what threat models GEA might help with, and in Part 3 I look at ways GEA could be improved to address the biggest limitations.

Key takeaways: #

• As genetic engineering technology continues to become more powerful and accessible, the risk of catastrophe from its malicious use or accidental release is increasing. By providing better ways to trace the origin of genetically engineered material, GEA could help mitigate this risk.
• The best GEA methods are based on a combination of machine learning and more traditional bioinformatics like BLAST.
• In a 2020 competition, under favourable conditions, the best GEA approaches could correctly guess the source of a DNA plasmid, out of over 1,300 possible sources, over 80% of the time.
• GEA tech has continued to improve ever since, but faces fundamental limitations.

What is GEA useful for? #

When a new pathogen emerges in a population, responders - from community leaders to scientists to policymakers - will be faced with many important decisions that we can categorise into three broad types: What is it? Where did it come from? And what should we do about it?

The first type of question is about the pathogen itself. Scientists will need to identify what species or strain it belongs to and how closely it resembles something we already know. They also need to work out the nature and severity of the illness it causes, how best to treat the infection and protect the uninfected. At the population level, epidemiologists will want to know how it spreads, the current case distribution, who is most at risk from infection, and how things might change in the future.

The second question is about the pathogen’s origin. Contact tracing, biosurveillance, and other public-health evidence may help map out the earliest known transmission chains, and looking even further back in time, investigators will want to know how it entered the population in the first place. One key question here is: did the pathogen emerge through natural processes, or was any part of it deliberately engineered? Answering this question can be thought of as genetic engineering detection.

If a natural origin is suspected, investigators might examine possibilities such as zoonotic spillover, mutation in an already circulating strain, or recombination between existing strains. If genetic engineering is suspected, investigators can use a range of bioinformatic methods to ask what regions of the pathogen’s genome have been modified, and what techniques were used to do so. Finally, with enough of this information, investigators can try to narrow in on the designer, laboratory, or synthesis provider involved in creating the pathogen. This is the role of genetic engineering attribution, or GEA.

The third and broadest set of questions is how to respond. Everyone - from individuals to hospitals to public health authorities and governments - will face questions about testing, treatment, public health measures, law enforcement, national security, and international coordination. If our response is able to prevent widespread breakdown of institutions, there will also be questions about assigning liability, and what we can learn from the event to do better next time.

These three questions all proceed in parallel and feed into each other. For example: correctly characterising the kind of pathogen involved can shape early assumptions about how it will behave; tracing its early spread can improve our predictive models of the outbreak; and evidence about the pathogen’s origin can inform the public-health response and have significant legal and (geo)political consequences.

As genetic engineering becomes more widespread and the risk of malicious uses of engineered pathogens increases, the world will need better ways to trace the origin of engineered genetic material.

How does GEA work? #

Current methods largely treat GEA as a pattern recognition problem: compare a new sequence against lots of examples from known labs, and ask which lab’s sequences it most closely resembles. To do this, leading methods use a combination of statistical and machine-learning techniques.

The reason this works has to do with how nucleotide sequences are designed and produced in a lab. There are dozens of different design choices required to engineer a functional sequence, whether for research or industry, and each decision leaves behind different artifacts. Although each individual artifact tells you very little, taken together they can form a predictable pattern.

For example, imagine two different labs both trying to create an organism with a particular phenotype - say, a microbe that fluoresces blue in sunlight.

First, the labs have to decide what biological system they want to use: which organism and strain should produce the phenotype, and which genes or proteins should be expressed, suppressed or modified to make that happen? Different hosts have different biological constraints, so the choices of host organism and genetic machinery are usually made together.

Second, the labs need to decide what genetic material to start from. Although they could design a plasmid entirely from scratch, researchers will often instead start with a foundational system that has been developed and tested by others. This introduces a big decision point - for example, the public database Addgene currently 1,000 empty backbones for expression in plants. Additionally, a scientist may prefer to use a plasmid that’s already sitting in the lab freezer, or one from a familiar family of vectors that they’ve gotten to work well in previous experiments. That starting plasmid can bring with it large stretches of basic boilerplate DNA - including replication origins, selectable markers and other backbone sequences - that persist even as the functional parts of the construct are changed. A lab’s tendency to use some sets of these plasmids over others can start to form a characteristic pattern.

Third, the researchers build on that foundation to add the specific functionality they want. Even if, for example, the two labs want to insert the same blue fluorescent protein gene into the same plasmid backbone to be expressed in the same host organism, they can still make many different choices about how to encode and control that gene. They might use different promoters, terminators or regulatory sequences, arrange the components in a different order, or choose different versions of the coding sequence. Because several different DNA codons can encode the same amino acid, two labs can even produce exactly the same protein from noticeably different DNA sequences. They might have different opinions or habits that influence the choice and use of codon-optimisation software, which is particularly relevant when adapting a gene for expression in a new host (as different organisms have different codon usage biases). 

Fourth, researchers - or DNA synthesis providers working from their designs - have to turn their design into physical DNA, assembling or synthesising the required pieces using one of several available methods. Some methods, like older restriction-enzyme cloning, leave obvious “scars” at the junctions. But even those that don’t, like CRISPR-Cas9, Gibson or Golden Gate assembly, can still constrain which sites or sequence patterns can appear at the junctions. Labs and DNA synthesis providers also tend to reuse assembly methods that fit their existing equipment, expertise and workflows.

Finally, the completed construct is introduced into its intended host and tested to see whether it produces the desired phenotype. If it does not, the researchers may change the promoter, coding sequence, backbone or other components and build another version.

Over time, this repeated cycle of modifying existing constructs, reusing familiar genetic parts and relying on established laboratory workflows can produce families of engineered sequences with a recognisable association with a particular source. Although any one decision in this pipeline is a weak signal by itself - thousands of labs may use the same promoter or plasmid backbone - when taken together, these weak signals creates a pattern that GEA methods try to identify. The logic is similar to forensic handwriting analysis: no single quirk is decisive, but many small habits together can form an attributable pattern.

How good are current GEA methods? #

GEA approaches have led to some promising results. In the first major GEA benchmarking competition in 2020, competition organisers used an Addgene-derived dataset of ~80,000 plasmids. Teams were provided with a ~70,000 plasmid subset of this database, most labelled with their lab of origin and some unlabelled for testing. Each was also labelled with a small amount of metadata such as the host species, growth strain, copy number and the presence of antibiotic-resistance markers. Teams were then asked to predict the lab of origin for a remaining ~11,000 plasmids where lab-of-origin labels had been removed.  Labs with only a few published plasmid sequences were combined into a single “unknown” category, leaving over 1,300 different possible sources to choose from for each of these ~11,000 plasmids. The methods were, of course, prevented from simply checking the public Addgene entries for the test set plasmids: they had to learn the patterns from the supplied training data alone.

Surprisingly, from these variables alone, the best-performing teams could take a held-out plasmid and correctly identify its source with their first guess more than 80% of the time, and in their top 10 guess 95% of the time.

The winning teams found several different successful approaches.

One approach (that doesn’t even require any machine-learning) is to simply check if any segments of DNA from the unknown plasmid match any segments from the plasmids in the training set. By using hard-coded rules - such as scoring penalties for when deletions or edits would be needed to make the sequences line up exactly, and scoring bonuses for longer and more frequent matches - you can give every plasmid in the training set a score for how well it matches the unknown plasmid. Then you can just take the closest-matching plasmid and guess that the unknown plasmid came from the same lab.

This approach - scoring the match of one sequence to another based on hard-coded penalties and bonuses - is implemented by widely used sequence-search algorithms such as BLAST. BLAST-only methods did surprisingly well - just over 65% top-1 and roughly 75% top-10 accuracy - but not enough to beat more sophisticated methods. Nevertheless, BLAST was still useful as a pre-processing step - the second-place team used BLAST to identify potentially informative matching subsequences, compressed those results into a manageable set of features that they could then give to a neural-network classifier to train on.

Another starting point is to break the unknown plasmid, and every plasmid in the training set, into short overlapping pieces of DNA called “k-mers”. You could choose to break them into k-mers of any size - for example a 6-mer is a six-base sequence. The DNA sequence ATGCCTAC contains the 6-mers ATGCCT, TGCCTA and GCCTAC.

A simple algorithm can then compare the unknown plasmid’s distribution of k-mers with those of the known plasmids or even with the typical k-mer distribution of each lab. Unlike BLAST, this does not require any long stretches of DNA to match exactly: it can pick up short sequences that are used a lot by a particular lab – for example, through repeated use of particular restriction sites, regulatory elements or codon choices. 

The important limitation of this approach is that researchers have decided in advance what the model is allowed to look at: counts of DNA words of a particular length. It also largely throws away information about where those words occur. Two plasmids could have similar k-mer profiles even if the same short sequences were arranged in quite different ways.

A different, less prescriptive approach is to use convolutional neural networks, or CNNs. Rather than first telling the model to count every possible six- or ten-base sequence, the DNA sequence itself is fed into the network, with each A, C, G and T represented numerically. The network then passes small scanning windows across the sequence and learns for itself which local patterns are useful for predicting the source lab.

The winning teams combined these ideas in different ways. The second and fourth-place entries used ensembles of convolutional neural networks (combining the predictions of several CNNs that were each trained differently). In addition to this, the first-place team also added a separate k-mer model to their ensemble. Because k-mer methods capture the overall abundance of short sequence patterns and CNNs can learn more complex and context-dependent motifs, combining them improved performance. 

Teams also used other tricks, such as presenting sequences in both orientations, so that a plasmid represented by its reverse-complement sequence would not appear fundamentally different to the model.  

The third-place team showed that neural networks were not essential: they relied mainly on statistical methods built around k-mers and achieved similar top-10 accuracy with much less computation.

Caveats #

Although impressive, it’s important to remember that the challenge in the competition was a much simpler problem than doing GEA in the real world.

First, the design space was limited - the teams looked only at DNA plasmids published on Addgene. Although plasmid vectors are a common tool in genetic engineering, real engineered material could include viral vectors, direct genome editing, and much larger and more varied constructs. Further, the Addgene data mostly represents sequences from academic research, with poorer coverage of sequences being used in industry. The sequences we might worry most about - such as pathogens specifically engineered as bioweapons - might have important differences from either of these.

Second, even a full ability to attribute plasmids to their source will have limited usefulness in a situation where the genetically engineered material is integrated directly into the host genome - many parts of the plasmid will be removed and the host will replicate the genome itself to propagate the change.

Third, plasmids themselves are typically used to a specific type of change, or integrate into a specific part of a genome. Some genetic engineering approaches achieve their phenotype via making changes at multiple points. If such a modified organism was detected in the wild, we would have to know which parts were genetically modified, or do a categorisation over the whole genome, which is more data intensive, with fewer training examples published (the average plasmid on Addgene is X base pairs long, while the genome of a simple bacteria can be over Y base pairs, and it could be even longer, or spread over multiple chromosomes in more complex organisms).

Third, plasmids are often used to make a specific type of change, or to target a particular part of a genome, but other genetic engineering approaches achieve their phenotype by making changes at multiple points. If such a modified organism were detected in the wild, we would have to know which parts were genetically modified, or otherwise do attribution**** over the whole~~~~ genome. That is a much more data-intensive task, with far fewer published training examples: plasmid sequences in the competition’s training set averaged about 4,839 base pairs, while the E. coli K-12 genome is about 4.64 million base pairs. Eukaryotic genomes can be much larger again (one copy of the human genome is about 3 billion base pairs distributed across 23 chromosomes).

Fourth, in the competition teams were given access to additional features beyond just the plasmid sequence to train on - things like ideal growth temperature, growth strain, copy number, and the presence of antibiotic-resistance markers. This was designed to mirror a scenario where living modified organisms are “obtained, partially sequenced, and assayed to measure simple characteristics”, but we may also want to apply GEA in circumstances where the living organism is not immediately available when the threat is detected, such as for anomalous sequences identified through metagenomic wastewater screening.

Fifth, in the competition, the true source lab was usually already represented in the training data. In a real investigation, the source might be missing from the database, an adversary might deliberately imitate another lab’s design choices, or several labs might use exactly the same published construct.

Finally, there are more fundamental limits to what we can conclude from GEA results. With current methods, even if we can identify the design choices of a particular lab, no method based on the sequence and basic metadata alone can tell us who actually produced and released that copy of the material - e.g. if a sequence is stolen from a lab, but then built and released by someone else.

Conclusions #

Current GEA methods represent an important defensive technology for biodefense. Early attempts show a lot of promise for answering specific questions during an investigation of pathogen origins after a new pathogen is detected. But there are ways GEA could be improved, and fundamental limits to be aware of.

In future posts I will discuss exactly what threat models GEA does and does not help mitigate, the improvements in the field since 2020, and how additional structural changes could help us expand the utility of GEA approaches.