Chapter 19 — Reading the July 2026 Paper Stack

A deep, plain-language read of the 13 papers in the new+paper_jul22 folder. For each one: what it covers, how it works, what it leaves out, whether it’s useful, whether there’s a better way, and how we could use it on our own toxicogenomics program.

Written for an NLP reader. Wherever a biology idea has a clean NLP analog, I use it — because most of this stack is, quite literally, NLP pointed at toxicology.

19.1 What this folder is, and how to read it

Thirteen papers landed together. They are not random. Read as a set, they sketch the exact frontier our program sits on: how do you turn molecular data into a trustworthy statement about toxicity, and can language models help?

Five of the thirteen are NLP papers wearing a lab coat — LLM reasoning, benchmarks, dataset generation, fine-tuning. Two are field surveys (maps). Two are toxicogenomics resources and transfer-learning methods that sit right on top of our own data type. Two are about DNA foundation models — one benchmarks them, one attacks them. One is the perturbation reality-check we already met in Chapter 18. And one is a vision piece about where the whole field goes next.

Here they are at a glance, sorted by how close they sit to what we do.

The one-sentence takeaway of the whole stack: the field is pivoting from “predict a toxicity label” toward “produce the mechanism, and prove it,” and language models are the tool everyone is reaching for — but every serious paper in the pile also shows that a careless LLM produces fluent nonsense, so the interesting work is all in the scaffolding that keeps the model honest (pathways, AOPs, knowledge graphs, expert curation, and hard baselines).

That pivot is exactly the gap in our own program. ToxCompl, TransPlatformer, GenTox, and TransTissueFormer all predict numbers (expression, fold-change). None of them produces a mechanism a toxicologist or regulator can read. This stack is, in effect, the missing half of our book.

Cluster 1 — NLP meets toxicology (the LLM-reasoning stack)

These five are the reason your NLP background is an asset, not a gap. Each one is a familiar NLP recipe — chain-of-thought, benchmarking, retrieval-augmented generation, LLM-as-a-judge, fine-tuning — applied to a toxicology problem. I’ll go slow on these.

First, one piece of vocabulary that runs through all five, because you’ll see it constantly: the Adverse Outcome Pathway (AOP).

The AOP, for an NLP reader

An AOP is toxicology’s version of a reasoning chain. It is a causal story with a fixed grammar:

MIE → KE → KE → … → AO

• MIE = Molecular Initiating Event — the first molecular thing the chemical does (e.g. “activates the glucocorticoid receptor”).
• KE = Key Event — a downstream measurable step (“mitochondrial fatty-acid β-oxidation decreases”).
• AO = Adverse Outcome — the organ-level result a regulator cares about (“liver steatosis”).

If you’ve done multi-hop question answering or chain-of-thought, you already understand this. An AOP is a labeled, expert-curated reasoning chain from a molecular cause to an organ-level effect. Several papers below are, literally, “can the model produce the correct chain, not just the correct final answer?” — which is the faithfulness question your field has been chewing on for years.

There is a public database of these chains, AOP-Wiki, and it is the shared backbone of three papers in this cluster.

19.2 CoTox — chain-of-thought toxicity prediction

Paper: CoTox: Chain-of-Thought-Based Molecular Toxicity Reasoning and Prediction (Park et al., Korea University / AIGEN Sciences, arXiv 2025). Code is public (dmis-lab/CoTox).

In one line. Feed an LLM three things about a drug — its structure (as an IUPAC name), its biological pathways, and its Gene Ontology terms — and prompt it to reason step by step to predict which organs it will poison.

What it covers. Multi-organ toxicity as a set of binary calls: cardiotoxicity, hematological, infertility, liver, pulmonary, renal. Six labels per compound.

How it works — three moves, all of which will feel familiar:

1. Fix the input representation. Prior LLM-tox work fed the model SMILES strings (e.g. CC(=O)Oc1ccccc1C(=O)O for aspirin). The insight here: a general LLM was trained on natural language and reads SMILES badly — it’s out-of-distribution text. So CoTox swaps in the IUPAC name (“2-acetyloxybenzoic acid”), which is closer to language the model actually saw in pretraining. This is a pure NLP-tokenization argument: match the input to the pretraining distribution. (Their own ablation is honest, though — see below.)
2. Add biological context via retrieval. For each drug they pull pathway and Gene Ontology annotations from the Comparative Toxicogenomics Database (CTD), then use GPT-4o itself to filter those down to the toxicity-relevant ones. This is retrieval-augmented prompting: the drug’s known biology is injected into the context so the model isn’t reasoning from structure alone.
3. Chain-of-thought prompting. The model is told to act as a toxicology expert and walk through pathways → GO terms → structure → per-organ verdict, emitting a JSON with a “Reasoning” string and a “Prediction” for each organ.

The numbers (F1, averaged over 6 organs, on a 548-compound test set from the UniTox benchmark):

• Structure only, zero-shot: 0.37 (SMILES) / 0.37 (IUPAC) — barely better than guessing.
• Structure only, few-shot: 0.43.
• Biology only (pathways+GO, CoT): jumps a lot — biology matters more than structure for organ-specific toxicity.
• CoTox (structure + biology + CoT): 0.66 — versus XGBoost 0.58 and Chemprop (a graph neural net) 0.62.
• Best organs: hematological (0.82), liver (0.77). Worst: pulmonary and renal (<0.57 everywhere).

What it leaves out. Three honest gaps. First, their own ablation shows the IUPAC-vs-SMILES difference is tiny (±0.03) until biology is added — so the headline “IUPAC helps” is weaker than it sounds; the real lift is the pathway/GO context, not the name format. Second, the biology it retrieves from CTD is already-known associations for known drugs — so this cannot help a genuinely novel compound with no CTD record (the cold-start problem again, from 06_GENTOX.md §6.1). Third, there’s no check that the reasoning is faithful — the model could output a correct label with a wrong rationale. (That exact gap is what the next paper, ToxReason, is built to measure — and they’re from the same group, so read them as a pair.)

Is it useful? Is there a better way? Useful as a proof of concept: with the right context, a prompted GPT-4o beats a trained graph neural net on a 6-organ tox panel, and it hands you a rationale for free. The better way is roughly what the rest of this cluster does: (a) ground the rationale in a real causal structure (AOP) instead of a free-text chain, and (b) replace “GPT-4o filters CTD” with a retrieval step you can audit. CoTox is the “hello world”; the others harden it.

How we could use it. This is the clearest template for adding a mechanistic, readable output to our program. Today TransTissueFormer predicts a kidney fold-change vector and stops. Imagine instead: our model predicts the expression change, we pull the top moved genes and their pathways, and a CoTox-style prompt turns that into “this compound looks nephrotoxic because it hits pathways X and Y.” It bolts a language layer onto our numeric models and produces the kind of output a regulator can act on. It also validates a choice we’ve flagged before: pathways and GO terms carry more organ-specific toxicity signal than raw structure — which is an argument for the enrichment-consistency metric we keep recommending (15_FRONTIER.md F6).

19.3 ToxReason — a benchmark for faithful toxicity reasoning

Paper: ToxReason: A Benchmark for Mechanistic Chemical Toxicity Reasoning via Adverse Outcome Pathway (Park et al., Korea University, ACL Findings 2026). Same lead author as CoTox; this is the rigorous follow-up. Code: dmis-lab/ToxReason.

In one line. A benchmark that checks whether an LLM’s toxicity prediction is backed by a correct causal chain (MIE→KE→AO), not just a lucky final answer.

Why it exists. This is the faithfulness problem, stated for toxicology: “LLMs can generate fluent but biologically unfaithful explanations.” A model can say “toxic to the liver” and be right, while its explanation is nonsense. If you’re going to use the explanation for anything — regulatory evidence, redesigning a molecule — a right-answer/wrong-reason model is dangerous. Existing tox datasets (Tox21, ClinTox) only have labels, so they can’t catch this. Even UniTox (which CoTox used) grounds its explanations in observed clinical effects, not mechanism.

How they build it — a genuinely clever data-construction pipeline, and it’s all standard NLP-style resource engineering:

1. Select the reasoning chains. Take organ-level AOPs from AOP-Wiki (release 2.7), keeping ones whose Adverse Outcome is a clinically meaningful organ toxicity and whose MIE is a clear activation/inhibition of a target protein.
2. Get the molecular evidence. For each MIE target protein, pull experimental drug–target activity from ChEMBL (does this compound actually hit this protein, and does it activate or inhibit?). Pull chemical–toxicity associations from CTD.
3. Infer the chain for a query molecule. For a new compound, find structurally similar compounds (Dice similarity on fingerprints) with known MIE activity, infer its MIEs, then check whether the observed adverse outcome matches the AOP’s predicted AO. The result: ~193 chemicals with full MIE→AO reasoning instances.
4. Two training sets, deliberately. An “MIE-matched” set (compounds that satisfy the molecular start of the chain) and a stricter “MIE-AO-matched” set (compounds that satisfy both the molecular start and the organ-level end). Splitting these lets them test whether a model that learns the start also gets the end right.

How they score it — this is the part an NLP reader will love. Prediction quality is plain F1 over three organ toxicities. But reasoning quality is judged by an LLM-as-a-judge, scoring each explanation 0–10 on four axes:

• Logical consistency — does the causal chain go MIE→KE→AO in the right order, without gaps?
• Biological fidelity — correct toxicology terms, correct MIE/KE/AO relationships?
• (plus two more coherence/grounding axes)

The key findings — and these are the important ones:

1. Strong prediction does not imply good reasoning. Some models score high on the toxicity F1 while their reasoning scores are poor. They’re getting the answer without the mechanism — exactly the failure the benchmark was built to expose. This is the toxicology version of “accuracy hides unfaithfulness.”
2. Reasoning-aware training fixes both at once. When they fine-tune a model to produce good chains (not just good labels), both the reasoning quality and the prediction F1 go up. Teaching the mechanism improves the answer. That’s a strong, publishable result and a hopeful one.

What it leaves out. The benchmark is small (~193 chemicals) and narrow (a handful of organ AOPs with clean single MIEs), because AOP-Wiki only has so many well-formed chains — real toxicity is often many overlapping pathways. And the judge is itself an LLM, which inherits the usual LLM-as-judge caveats (bias toward fluent, confident text). But as a direction, it’s exactly right.

Is it useful? Is there a better way? Very useful — it’s the honest-evaluation move (Chapter 18’s whole theme) applied to LLM toxicology. The “better way” is mostly scale and rigor: a bigger AOP-grounded corpus, and a judge validated against human toxicologists. It pairs naturally with a knowledge graph (paper 4) as the source of ground-truth chains.

How we could use it. Two ways. First, as a design pattern for our own evaluation: we keep arguing that our numeric models need metrics that a mean-predictor can’t game (07_TRANSTISSUEFORMER.md §7.7.7). ToxReason is the same argument one level up — don’t reward the right answer if the reasoning is wrong. If we ever add a mechanistic output layer (from 19.2), ToxReason is the template for grading it. Second, and more concretely: AOPs give us a target vocabulary. Our models predict which genes move; AOP Key Events are defined over genes and pathways; so a predicted expression change can be mapped onto an AOP chain to produce a mechanism. That mapping is exactly what the next paper builds.

19.4 AOP Gene Mapping — retrieval + LLM + expert curation

Paper: Integrating Semantic Retrieval, LLM-based Refinement, and Structured Expert Curation for Scalable AOP Gene Mapping (Schaffert et al., FHAIVE / Tampere University, bioRxiv 2026).

In one line. Build the missing dictionary that connects AOP Key Events (written in English) to actual genes, using a retrieval-then-LLM-then-expert pipeline — so that a list of moved genes can be read as a mechanism.

Why it matters to us specifically. This is the bridge between our world (genes and expression) and the AOP world (mechanisms). AOP Key Events are written as free-text statements (“decreased mitochondrial fatty-acid β-oxidation”). To use them with omics data you need to know which genes correspond to each Key Event. That mapping has been done by hand, which doesn’t scale and misses matches phrased differently. This paper automates it.

How it works — a textbook retrieval-augmented pipeline, and every stage is an NLP component you know:

1. Semantic retrieval. Take each Key Event statement. Embed it. Retrieve candidate ontology/pathway terms from a harmonized pool (GO, Reactome, WikiPathways, KEGG, HPO — assembled via MSigDB) by embedding similarity. This is dense retrieval, and it beats keyword matching because it catches terms that mean the same thing in different words (the recall problem they call out explicitly).
2. LLM-based refinement. An LLM filters the retrieved candidates — is this pathway term mechanistically consistent with the Key Event, including direction (“increased/decreased”)? This is the re-ranking / filtering stage, and the LLM is doing the semantic judgment that embeddings alone can’t.
3. Double-independent expert curation + rules. Two independent expert groups review, and a rule-based consolidation finalizes each mapping and assigns a confidence score. This is the human-in-the-loop layer that keeps the whole thing honest — the same instinct as ToxReason’s judge, but with real experts.

The output is an AOP-wide KE-to-gene resource with explicit confidence levels, which they show aligns better with expert judgment than earlier NLP approaches while needing far less manual work.

What it leaves out. It’s a mapping resource, not a predictor — it tells you which genes belong to a Key Event, not whether a drug triggers it. Coverage is bounded by AOP-Wiki’s completeness. And “confidence” is derived from agreement/rules, not a calibrated probability.

Is it useful? Is there a better way? Very useful, and the design is close to state-of-practice RAG. The obvious upgrade is to close the loop with paper 4’s knowledge graph, so the retrieval pool is a live, growing structure rather than a fixed ontology snapshot.

How we could use it. This is arguably the single most directly usable NLP paper in the folder for us. Our models output a ranked list of genes that changed under a compound. Feed those genes through a KE-to-gene map (this resource) and you get the Key Events the compound is likely triggering — i.e. you convert “these 40 genes moved” into “this looks like the mitochondrial-β-oxidation Key Event on the liver-steatosis pathway.” That is the mechanistic, regulator-facing output our four numeric models don’t produce. Concretely: it turns TransTissueFormer’s predicted profile into an AOP-anchored hypothesis, and it does so with a confidence score we can report.

19.5 ToxMech — RAG agents that build a mechanism knowledge graph

Paper: Generating a Novel Dataset for Mechanisms of Drug-Induced Toxicity using LLM-supported tools (Masarone et al., Ignota Labs / University of Warwick, ICLR 2026).

In one line. Point retrieval-augmented LLM agents at the literature (papers, FDA boxed warnings, clinical news, AOP stressors) and have them extract and structure toxicity mechanisms into one big heterogeneous knowledge graph, called ToxMech.

What it covers. The data gap, not the model gap. Their thesis: the reason mechanistic tox models are weak is that there’s no structured, mechanism-rich dataset to train them on. Existing resources each fall short — AOP-Wiki is heterogeneous and not drug-focused; DrugMechDB prioritizes efficacy over failure modes; SIDER/OFFSIDES/OnSIDES give drug→outcome mappings but no why; Tox21/ToxCast/DILIrank are assay readouts without mechanism. So they build the missing “why” layer.

How it works. Multiple retrieval-augmented extraction agents, one per source type: PubMed abstracts, mechanism sections of papers, AOP stressor mechanisms, FDA black-box warnings, and unstructured sources (blogs, news). Each agent emits structured YAML, which is integrated and validated into a heterogeneous knowledge graph (nodes = drugs, genes, events, outcomes; edges = mechanistic relations). It’s an ongoing project — the paper is a progress report, not a finished dataset.

What it leaves out. It’s early (“ongoing project”), so there’s little quantitative evaluation yet — no rigorous measure of extraction precision/recall against a gold standard, and the hallucination risk of literature-mining agents is acknowledged but not fully solved. Knowledge-graph completeness and consistency across heterogeneous sources are the hard open problems (which is, conveniently, what survey paper 7 is about).

Is it useful? Is there a better way? The ambition is exactly right — a shared mechanistic dataset is what the whole subfield is missing (ToxReason, CoTox, and the FHAIVE mapping paper would all be stronger with it). The risk is the classic KG-from-LLM risk: fluent extraction that’s subtly wrong. The better way is heavy human-in-the-loop validation (like paper 4’s double-expert curation) and tight provenance so every edge traces to a source.

How we could use it. As a target vocabulary and a validation oracle. If ToxMech (or something like it) matures, our predicted expression changes could be checked against it: “does the mechanism our model implies actually appear in the literature-derived KG?” That’s enrichment-consistency (again 15_FRONTIER.md F6) with a knowledge graph as the reference. Even now, the recipe is reusable: we could build a small, focused mechanism KG for the organs in DrugMatrix and use it to interpret our predictions.

19.6 Gene Prioritization by fine-tuned LLMs

Paper: Unveiling Genomic Insights: Fine-Tuning LLMs for Enhanced Gene Prioritization (Saiteja et al., Vardhaman College of Engineering, IEEE SCEECS 2026).

In one line. Fine-tune general LLMs (GPT-4, Claude) on curated biomedical data so they rank which genes are most likely responsible for a disease, reaching ~89% accuracy.

What it covers. Gene prioritization: given a disease/phenotype, output a ranked shortlist of candidate genes. This is a classic bioinformatics task (tools like Phenolyzer, Phevor, and Human Phenotype Ontology methods do it) — here reframed as an LLM task.

How it works. Standard supervised fine-tuning: take strong base LLMs, fine-tune them on curated gene–disease datasets, evaluate on public transcriptomic datasets. Reported 89.3% accuracy, above the pre-fine-tuning baseline.

What it leaves out. This is the least rigorous paper in the folder — a student-conference proceedings. The evaluation detail is thin (what “accuracy” means for a ranking task isn’t pinned down), there’s real contamination risk (GPT-4/Claude may have seen these gene–disease links in pretraining, the exact trap Chapter 18 §18.4 warns about), and there’s no comparison against the established prioritization tools it’s implicitly competing with. Treat the number cautiously.

Is it useful? Is there a better way? As evidence, weak; as a signpost, fine. It shows the pattern “fine-tune a general LLM on a curated biomedical table for a ranking task” is now something people do casually. The better way is everything Chapter 18 §18.8 said: fine-tune with LoRA, hold out a contamination-controlled test set, and compare against a real baseline (here, Phenolyzer/Phevor) — none of which this paper does.

How we could use it. Indirectly. Gene prioritization is adjacent to what we do — our models effectively rank genes by how much a compound moves them. The transferable idea is that a fine-tuned LLM can take a ranked gene list plus a phenotype and produce a prioritized, explained shortlist. That’s a plausible downstream head on our numeric models. But we’d hold it to a much higher evaluation bar than this paper does.

Cluster 1 in one paragraph. The NLP-for-tox stack has a clear internal logic. CoTox shows a prompted LLM plus biological context beats trained models and gives a rationale. ToxReason shows the rationale is often unfaithful, and that training for faithful reasoning fixes both reasoning and accuracy. The FHAIVE mapping paper and ToxMech build the infrastructure that makes faithful reasoning possible — a gene↔event dictionary and a mechanism knowledge graph. Gene prioritization shows the fine-tuning pattern is now routine. For us, the throughline is a single missing capability: a language layer that turns our predicted gene changes into an AOP-anchored, confidence-scored, checkable mechanism. That is the biggest idea this folder hands us, and none of our four papers has it.

Cluster 2 — the two surveys (maps of the territory)

Surveys are reference material, not results. I’ll keep these shorter, but they’re worth having because each one is the authoritative map of a field we keep touching.

19.7 A comprehensive survey of genome language models

Paper: A comprehensive survey of genome language models in bioinformatics (Shu et al., Nanjing University of Aeronautics and Astronautics, Briefings in Bioinformatics 2026). Note: our own institution’s copy was pulled by an ORNL user — this is the reference the group is reading.

In one line. The organized map of DNA/RNA language models — architectures, tokenizations, pretraining data, evaluation methods, downstream tasks, benchmarks, and open problems.

What it covers, and why each part is useful to us:

• Architectures, in three families: Transformer models, Hyena convolutions, and state-space (Mamba) models. This is the same taxonomy Chapter 18 §18.3 uses — the survey is the long-form version of that table.
• Tokenization strategies — k-mers vs byte-pair encoding vs single-nucleotide. The survey treats this as a first-class design axis, which matches Chapter 18’s “tokenization is not neutral” trap (§18.4).
• Pretraining strategies and datasets across species and functional domains.
• Evaluation paradigms — supervised, zero-shot, few-shot, fine-tuning — analyzed critically.
• A taxonomy of downstream tasks plus a benchmark summary.
• Open challenges: data scarcity, interpretability, and the compute demands of long genomic sequences — plus a roadmap.

What it leaves out / is there a better way. It’s DNA/RNA-centric (genome as text). It does not cover the single-cell/expression models that are actually our modality — for that, Chapter 11 and Chapter 18 §18.3(D) are the map. So the two are complementary: read this survey for the sequence side, our Chapter 18 for the expression side.

How we use it. As the citation-complete backing for Chapter 18’s DNA section. If we write anything about DNA foundation models for the program, this is the survey to cite for architectures, tokenization, and benchmarks. It also confirms our framing is mainstream — the field itself organizes these models exactly the way we did.

19.8 Biomedical Knowledge Graph survey

Paper: Biomedical Knowledge Graph: A Survey of Domains, Tasks, and Real-World Applications (Lu et al., Peking University, arXiv 2025).

In one line. The map of biomedical knowledge graphs — how they’re built (from molecular interactions, pharmacology, clinical records), what they enable (knowledge management, retrieval, reasoning, interpretation), and where they’re used (precision medicine, drug discovery).

Why it’s in this stack. It’s the theory behind ToxMech (19.5) and the FHAIVE mapping paper (19.4). Both build knowledge structures over biomedical facts; this survey is the systematic account of how to do that well and what breaks.

What it covers. Three lenses — domains (data sources and how a KG is constructed from them), tasks (knowledge management, retrieval, reasoning, interpretation), and applications (precision medicine, drug discovery, research). For an NLP reader: this is the “knowledge graph construction + KG-augmented reasoning + retrieval” literature, applied to biomedicine, with the entity types being drugs, genes, diseases, and pathways.

What it leaves out / better way. A survey can’t tell you whether a specific KG is trustworthy — the hard problems (extraction accuracy, consistency across sources, hallucinated edges from LLM extractors) are named but not solved here. Those are exactly ToxMech’s open risks.

How we use it. As the design manual if we ever build the small mechanism knowledge graph that Cluster 1 keeps implying we need — to turn our predicted gene changes into AOP-anchored mechanisms. It tells us the standard construction patterns, the standard reasoning tasks (link prediction, path finding), and the standard failure modes to guard against.

Cluster 3 — toxicogenomics resources and transfer (closest to our own data)

These two sit directly on top of what we do: expression data, drug exposures, the species gap. They are the most operationally relevant papers in the folder.

19.9 DILImap / ToxPredictor — a purpose-built human liver-injury resource

Paper: A large-scale human toxicogenomics resource for drug-induced liver injury prediction (Bergen et al., Cellarity, Nature Communications 2025).

In one line. Build a big, clean RNA-seq library of human liver cells dosed with 300 drugs at multiple concentrations, train a plain machine-learning model on it, and predict drug-induced liver injury (DILI) better than 20+ existing methods — while flagging the mechanism.

What it covers. DILI — drug-induced liver injury — the single most common reason drugs get pulled from the market. The deliverable is two things: DILImap (the data: full-transcriptome RNA-seq from 300 compounds at multiple concentrations in primary human hepatocytes — real human liver cells, not a tumor cell line) and ToxPredictor (the model: a random forest trained on DILImap plus pharmacokinetic data).

How it works — and the surprise is how un-fancy the model is:

1. The data is the contribution. Primary human hepatocytes (PHHs) keep real liver metabolism, unlike the immortalized tumor lines (HepG2, HepaRG) that lose liver function in culture. 300 compounds × multiple doses × full transcriptome.
2. The model is a random forest, not a foundation model — trained to read the transcriptomic response and predict dose-resolved DILI risk and a safety margin (how close a toxic dose is to a therapeutic one, via pharmacokinetics).
3. Results. 88% sensitivity (29/33 DILI-positive) at 100% specificity (14/14 DILI-negative) in blind validation — beating 20+ preclinical methods head-to-head, including 3D-liver and cytotoxicity assays. It flagged Evobrutinib, TAK-875, and BMS-986142 — real Phase III failures that animal studies missed.
4. Mechanism, not just a label. Because it reads the whole transcriptome, it points at which hepatotoxic pathways are involved — a system-level view a single cytotoxicity number can’t give.

What it leaves out. It’s liver-only (DILI), human-only, and in vitro (hepatocytes in a dish, not a whole organism). The model is a random forest on curated features, so it won’t extrapolate to wildly novel chemistry the way a representation-learning model might hope to. And 300 compounds is large for tox but tiny by ML standards.

Is it useful? Is there a better way? Extremely useful, and it makes a point we’ve made repeatedly: on this kind of data, a simple model on good data beats a fancy model on bad data (exactly Chapter 18 §18.4’s baseline lesson, and Chapter 10’s whole argument). The “better way” is not a bigger model — it’s more organs and in-vivo grounding. A representation-learning upgrade (our gene-embedding idea) is only worth it if it’s shown to beat this random-forest baseline.

How we could use it. Three ways. (1) As a benchmark and a baseline. Any liver-toxicity model we build must beat ToxPredictor’s 88%/100%, or it isn’t worth it. (2) As training data in the right modality. DILImap is human PHH RNA-seq with dose — convertible to fold-change and directly usable in the interventional fold-change corpus we proposed (18_GENOMIC_FM_LANDSCAPE.md §18.6, Experiment 2; and 11_SC_FOUNDATION_MODELS.md §7). (3) As proof that transcriptomics → apical endpoint works, which is the direction ToxCompl’s own validation points (04_TOXCOMPL.md §4.12) and our Experiment 7 (18_GENOMIC_FM_LANDSCAPE.md §18.6).

19.10 Rat → human transfer learning (the one closest to our species problem)

Paper: Application of transfer learning to predict drug-induced human in vivo gene expression changes using rat in vitro and in vivo data (O’Donovan et al., Maastricht / Eindhoven, PLOS ONE).

In one line. Use domain-adversarial training to line up rat and human gene-expression data in a shared latent space, so a model trained mostly on plentiful rat data can predict what a drug does to human gene expression.

Why this is the most relevant method paper in the folder for us. Our DrugMatrix is rat. Our destination is human safety. That rat→human jump is the central obstacle in the whole program, and this paper attacks it head-on with a method straight from your field.

How it works — and here’s the NLP hook you’ll recognize instantly:

1. The setup. Rat in-vitro and rat in-vivo expression data are plentiful (Open TG-GATEs). Human in-vivo data is scarce (you can’t biopsy healthy human livers at scale). So this is a low-resource transfer problem: lots of source-domain data (rat), little target-domain data (human).
2. The method is a Domain-Adversarial Neural Network (Ganin et al.). This is the gradient-reversal trick you know from unsupervised domain adaptation in NLP: train the network to do the task (predict expression) and simultaneously train it so a domain discriminator cannot tell rat from human in the latent space. The adversary forces a species-invariant representation. If the discriminator can’t separate rat from human, the features it’s using must be the biology they share, not the species they differ on.
3. The result. They show the rat and human in-vitro data become inseparable in the shared latent space — domain adaptation worked. The network then produces physiologically plausible human in-vivo predictions for a previously unseen compound. And adding the (scarce) human in-vitro data during training measurably improves the temporal accuracy of predictions.

What it leaves out. Liver-only, and the human in-vivo ground truth is genuinely sparse, so evaluation is limited. It’s a 2023-era deep net, not a foundation-model approach — no pretrained gene representations. And “plausible” predictions are validated more qualitatively than a big held-out benchmark would allow.

Is it useful? Is there a better way? Very useful as a proof that the rat→human latent alignment is learnable. The better way is exactly our program’s thesis: instead of learning the species-invariant space from scratch on scarce data, start from a gene representation that is already species-agnostic — which is precisely what UCE/ESM2 give you by tokenizing genes through protein sequence (11_SC_FOUNDATION_MODELS.md §6, 18_GENOMIC_FM_LANDSCAPE.md §18.5). Domain-adversarial training and a pretrained cross-species embedding are two routes to the same destination, and they compose: initialize with UCE, then domain-adapt.

How we could use it. Directly. This is a working recipe for the rat→human step we keep saying we need. Two concrete moves: (1) Add a domain-adversarial head to our models so DrugMatrix (rat) and any human data (LINCS, DILImap) are pushed into a shared space — the same trick, dropped onto our architecture. (2) Combine it with the gene-embedding init (our Experiment 1): pretrained species-agnostic embeddings give the alignment a massive head start, and the adversary cleans up the rest. This paper is, in effect, an existence proof for half of our species story — and it uses the same TG-GATEs data we do.

Cluster 4 — DNA foundation models: are they good, and are they safe?

Two papers on DNA foundation models. One asks “do they actually work?” The other asks “can they be sabotaged?” Both are cautionary, and both reinforce Chapter 18’s baseline-first, trust-carefully stance.

19.11 An honest zero-shot benchmark of DNA foundation models

Paper: Benchmarking DNA foundation models for genomic and genetic tasks (Feng et al., Nature Communications 2025). This is the study Chapter 18 referred to as the “GenBench-style” evaluation — here it is in full.

In one line. Take five DNA foundation models, freeze them, and test their zero-shot embeddings across a wide task set — and find that a simple pooling choice matters more than the model, and that these models are strong on some tasks and weak on the one we’d most want (expression).

How it works. Five models — DNABERT-2, Nucleotide Transformer V2, HyenaDNA, Caduceus-Ph, GROVER — evaluated frozen (no fine-tuning), by extracting embeddings and training a simple classifier (random forest) on top. Tasks: sequence classification (57 datasets), gene-expression prediction (GTEx), variant-effect quantification (pathogenic vs common), and TAD (3D-genome domain) recognition.

The findings, with numbers:

1. Mean pooling beats the [CLS]/summary token, consistently and significantly. This is the single most actionable result. Averaging all token embeddings gives a better sequence representation than reading one summary token. The gains: +4.0% (DNABERT-2), +6.8% (NT-v2), +8.7% (HyenaDNA), +5.9% (Caduceus-Ph), +1.4% (GROVER) on classification. On one splice task, HyenaDNA’s AUC jumped 0.689 → 0.864 (+25.4%) just from the pooling change. (This is why Chapter 18 §18.8 lists mean pooling as a cheap trick — here’s the receipt.)
2. No single model wins everywhere — rankings shuffle by task, echoing GENEB (Chapter 18 §18.4).
3. They’re competitive on pathogenic-variant identification but weak on gene-expression prediction and TAD recognition. That’s the important one for us: the task closest to our modality (expression) is the one these DNA models are worst at. It supports our whole thesis that DNA-sequence models are the wrong layer for expression work — useful as gene-feature providers, not as expression predictors (18_GENOMIC_FM_LANDSCAPE.md §18.5).

What it leaves out / better way. Zero-shot frozen embeddings only — fine-tuned models could do better (the GENEB caveat, §18.4). And a random-forest probe is a specific choice (they check naïve Bayes and elastic-net too, and the pooling result holds).

How we use it. As direct evidence for two of our claims: use mean pooling (a free win we should adopt anywhere we pool token embeddings), and DNA-sequence models are weak at expression (so we reach for them only as an independent gene-feature basis, per Experiment 5 in 18_GENOMIC_FM_LANDSCAPE.md §18.6, never as the expression predictor itself).

19.12 Poisoning the Genome — backdoor attacks on DNA foundation models

Paper: Poisoning the Genome: Targeted Backdoor Attacks on DNA Foundation Models (Koilakos, Mouratidis, Georgakopoulos-Soares, UT Austin, arXiv 2026).

In one line. DNA foundation models are trained on huge public genomic corpora that nobody can fully vet, and this paper shows you can secretly backdoor them — plant a hidden trigger so the model behaves normally until it sees a specific DNA motif, then misbehaves.

Why this matters, and the NLP analogy. This is data poisoning / backdoor attacks — a known threat for language models — carried into genomics. The twist the authors emphasize: DNA has no semantic transparency. A human editor can eyeball a poisoned sentence in a text corpus; nobody can eyeball a poisoned stretch of A/C/G/T among trillions of nucleotides. So genomic corpora are uniquely hard to clean.

How the attacks work — two stages:

• Pre-training attacks. On Evo 2 and GENERator architectures, poisoning less than 1% of the corpus installs a backdoor. Three scenarios: corrupt a conserved TATA-box promoter motif, disrupt a CTCF binding-site consensus, and insert a synthetic nullomer (a short sequence that never occurs naturally). The model performs normally until the trigger appears at inference. They estimate ~$60 buys enough poisoning of 0.01% of the corpus to matter.
• Fine-tuning attacks. Poison a fraction of CTCF sites in a ClinVar-derived fine-tuning set and a LoRA-adapted model gets a conditional backdoor that fires almost only when the trigger is present. Worse, corrupting the BRCT domain in a BRCA1 variant-effect task caused a 43.4 percentage-point drop in AUROC — a clinically catastrophic, targeted failure that standard benchmarks would not catch.

What it leaves out / better way. Defenses are the open problem — the paper shows attacks are cheap and hard to detect, and notes the attacker’s advantage (fixed trigger vs the defender’s exploding search space). No robust defense is offered; that’s future work.

Is it useful? How we relate to it. It’s a security wake-up call, and mostly a caution rather than a tool for us. But it carries a real lesson for our program: if we ever initialize from a public checkpoint (scGPT, UCE, Evo 2), we inherit whatever is in that checkpoint’s training data. For a regulatory-facing tox pipeline that is not paranoia — it’s the same “prefer open, auditable, version-locked weights” principle from Chapter 18 §18.7, now with teeth. It also strengthens the case for the control we always attach to Experiment 1: compare a foundation-model init against DrugMatrix’s own co-expression structure, so we’re never blindly trusting an external checkpoint.

Cluster 5 — the reality check and the vision

19.13 Perturbation prediction ≤ linear baselines (the anchor)

Paper: Deep-learning-based gene perturbation effect prediction does not yet outperform simple linear baselines (Ahlmann-Eltze, Huber & Anders, Nature Methods 2025).

We already met this one in Chapter 18 (§18.4) — it’s the anchor of the whole skeptical literature, and its presence in this folder confirms the group is reading it. The one-paragraph recap, because it governs everything: they pitted five foundation models plus two deep nets against deliberately simple baselines for predicting expression changes after gene perturbations. None beat the baselines, in any setting. Double perturbations: every model worse than a simple additive baseline. Single: none beat the mean or a linear model. The mechanistic finding is the load-bearing one — pretraining on the observational cell atlas barely helped; only pretraining on perturbation data itself helped. For us this is both a warning (don’t expect a pretrained FM to predict our drug responses out of the box) and a directive (build/collect interventional data — Experiment 2). See 18_GENOMIC_FM_LANDSCAPE.md §18.4–18.6 for the full treatment.

19.14 From toxicogenomics to predictive toxicology and exposomics (the vision)

Paper: From toxicogenomics to predictive toxicology and exposomics: defining the next decade of gene–environment research (Ruden, Wayne State University, Frontiers in Genetics 2026, Opinion).

In one line. A senior toxicologist’s argument for where the field should go: stop treating toxicogenomics as a labeling exercise, and integrate it with exposure science (“exposomics”), single-cell methods, epigenetics, functional validation, and AI into a predictive, lifelong gene–environment framework.

What it covers. The big picture. The core question — “how do genes respond to exposure?” — widens into “how do lifelong exposures interact with genomes and epigenomes to shape disease?” The argued priorities: integrate genomics + exposomics + functional validation + predictive toxicology; use single-cell and multi-omics; take epigenetics and chromatin seriously (not just RNA abundance); and build longitudinal cohorts.

What it leaves out. It’s an opinion piece — vision, not method or result. No benchmarks, no code. Its value is orientation and citation, not technique.

How we use it. As the framing paragraph for why our program matters, and as a checklist of directions the field’s leaders think are important — several of which our book already touches (single-cell FMs, the mechanistic/AOP turn, the transcriptome→apical-endpoint bridge). It’s useful cover when we argue that mechanistic, multi-omic, cross-species prediction (exactly our Chapter 18 program) is where the field is heading, not a side quest.

19.15 Synthesis — what the stack says, and what it hands us

Step back from the thirteen and three things come into focus.

1. The field is pivoting from labels to mechanisms — and language models are the vehicle. Half of this folder is about producing a causal story (an AOP chain, a mechanism, a pathway rationale), not just a toxic/non-toxic label. And the honest papers all show the same thing: an unguided LLM produces fluent but unfaithful stories, so the real work is the scaffolding — AOPs, gene↔event maps, knowledge graphs, expert curation, and hard baselines — that keeps the model tethered to biology. This is your field’s faithfulness problem, restaged in toxicology.

2. Our program predicts numbers; this stack predicts meaning. That’s the gap — and the opportunity. ToxCompl, TransPlatformer, GenTox, TransTissueFormer all output expression vectors and stop. Not one produces a mechanism a regulator can read. The NLP cluster shows exactly how to add that layer: map our predicted gene changes to AOP Key Events (19.4), narrate them with a CoTox-style chain (19.2), and grade the narration with a ToxReason-style faithfulness check (19.3). That language layer is the most valuable single thing this folder hands us, and it’s buildable on top of what we already have.

3. Every rigorous paper here repeats our two disciplines. Baseline-first (perturbation ≤ linear; DILImap’s random forest beating 20+ methods; the DNA benchmark’s mean-pooling and expression-weakness findings) and trust-carefully (ToxReason’s faithfulness gap; the poisoning attacks; the survey’s interpretability warnings). The stack is, collectively, an endorsement of the exact stance Chapter 18 argues for.

The concrete opportunities the stack reveals

Ordered by how directly they build on what we have.

The single highest-value move is A — because it’s the one capability the whole four-paper program lacks, the field is clearly pivoting toward it, your NLP background is the exact skill it needs, and it composes cleanly with everything we’ve already built. If a mentor asks “what’s the differentiated thing you can do here that the tox people can’t,” the answer is in this folder: you can build the faithful, AOP-grounded language layer that turns their expression predictions into mechanisms — and evaluate it honestly.

Sources (papers in this folder)

1. CoTox — arXiv:2508.03159
2. ToxReason — ACL Findings 2026
3. AOP Gene Mapping — bioRxiv 2026.06.25.734475
4. ToxMech (Generating a Novel Dataset…) — ICLR 2026 (Ignota Labs)
5. Gene Prioritization via fine-tuned LLMs — IEEE SCEECS 2026, DOI 10.1109/SCEECS68810.2026.11429879
6. Genome Language Models survey — Briefings in Bioinformatics 2026, bbaf724
7. Biomedical Knowledge Graph survey — arXiv:2501.11632
8. DILImap / ToxPredictor — Nature Communications 2025, s41467-025-65690-3
9. Rat→human transfer (O’Donovan et al.) — PLOS ONE, journal.pone.0292030
10. DNA FM benchmark (Feng et al.) — Nature Communications 2025, s41467-025-65823-8
11. Poisoning the Genome — arXiv:2603.27465
12. Perturbation ≤ linear baselines — Nature Methods 2025, s41592-025-02772-6
13. Exposomics vision (Ruden) — Frontiers in Genetics 2026, fgene.2026.1903791

Every paper here was read from the PDF in new+paper_jul22. Quoted numbers (F1s, sensitivities, AUROC drops, poisoning fractions) are taken directly from each paper’s text. Where a paper is an early-stage or student-venue work (ToxMech, Gene Prioritization), I’ve flagged that its evidence is weaker than the venue-heavy papers. The connections to our own program are my reading, tied to the specific chapters cited.