Uncertainty-Guided Adaptive Local Adversarial Perturbation for Reliable Molecular Property Prediction

1 Introduction

Molecular property prediction is essential for modern drug discovery and materials design. With the rapid development of graph neural networks (GNNs), molecular structures are commonly modeled as graphs, where atoms correspond to nodes and chemical bonds to edges, enabling expressive learning of structure-property relationships [Kang et al., 2024; Xiong et al., 2026]. These models have achieved impressive performance on standard benchmarks. However, despite their empirical success, existing molecular property predictors often suffer from limited generalization ability [Zhang et al., 2024; Han et al., 2023]. In real-world applications, chemical space is vast and sparsely sampled, requiring models to extrapolate to novel compounds or molecular classes that are underrepresented in training data. Under such conditions, prediction errors become difficult to detect, and models tend to produce overconfident outputs even when their predictions are unreliable [Yu et al., 2022]. This mismatch between predictive confidence and actual correctness raises a critical question for practical deployment: when can a model's prediction be trusted? Addressing this question is as important as improving predictive accuracy, particularly in high-stakes scenarios such as virtual screening and early-stage drug discovery.

Adversarial training has been widely explored to improve robustness and generalization in machine learning. Early work in computer vision and natural language processing showed that training on adversarially perturbed samples could enhance model stability under distributional, syntactic, or semantic variations [Xie et al., 2020; Li and Qiu, 2021]. More recently, adversarial training was adapted to graphstructured data [Kong et al., 2022], where perturbations were applied to node features, edges, or latent representations. In molecular property prediction, adversarial perturbations were typically applied to atomic embeddings or learned representations [Jin et al., 2025]. These methods were shown to help GNNs generalize to out-of-distribution samples by encouraging consistent predictions under input variations. However, existing approaches often rely on uniform perturbation strategies, which overlook the heterogeneous importance of different molecular regions and may introduce excessive perturbations to fragile representations. Moreover, multi-step iterative perturbation methods incur substantial computational overhead, limiting their scalability for large molecular datasets.

In parallel, uncertainty quantification has received growing attention as a way to assess the reliability of model predictions. Bayesian neural networks, Monte Carlo dropout, and deep ensembles were proposed to estimate predictive uncertainty by approximating posterior distributions over model parameters [Jospin et al., 2022; Lakshminarayanan et al., 2017; Gal and Ghahramani, 2016]. Despite their effectiveness, these approaches are often computationally expensive and typically require multiple inference passes. Evidential deep learning later emerged as a deterministic alternative that models uncertainty by predicting parameters of evidential distributions [Sensoy et al., 2018; Amini et al., 2020], enabling uncertainty estimation in a single forward pass. This paradigm was successfully applied to regression and classification tasks, including molecular property prediction [Soleimany et al., 2021]. However, existing evidential methods typically rely on implicit assumptions linking confidence to reliability and lack explicit mechanisms to calibrate evidence against prediction stability under perturbations.

To address these challenges, we propose UGAP, an uncertainty-guided adaptive perturbation framework for reliable molecular property prediction. UGAP integrates adversarial training with evidential learning to couple predictive performance with uncertainty estimation. Motivated by the observation that molecular properties are often governed by specific functional groups rather than the entire molecular structure, UGAP identifies salient molecular regions via gradient-based sensitivity analysis and selectively perturbs influential atoms. Furthermore, the perturbation intensity is adaptively modulated by predictive uncertainty: stronger perturbations are applied to high-confidence samples to probe representational robustness, while milder perturbations are used for low-confidence samples whose feature representations are not yet well established. In addition, UGAP introduces a stability-aware evidence calibration strategy that regularizes evidential outputs using discrepancies between clean and perturbed predictions, thereby aligning evidential magnitude with predictive stability. Extensive experiments demonstrate that UGAP consistently outperforms existing baselines in both predictive accuracy and uncertainty reliability, offering an effective pathway toward trustworthy molecular property prediction.

2 Method

Each molecule is represented as a graph G = (V, E), where our goal is to learn a mapping f : G → (ˆ y, u) that produces accurate predictions ˆ y and reliable uncertainty estimates u. To achieve this, we propose UGAP, a framework integrating evidential learning with adaptive perturbations to optimize both generalization and uncertainty fidelity. As illustrated in Figure 1, raw atomic features are first converted into embeddings. UGAP then applies perturbations to salient atoms with intensities dynamically modulated by uncertainty. Finally, a stability-aware calibration module refines uncertainty by regularizing the discrepancy between clean and perturbed predictions. This mechanism aligns evidence magnitude with structural robustness, establishing a reliable safeguard for molecular property prediction.

2.1 Evidential Learning for Regression and Classification

To quantify predictive uncertainty, we adopt Evidential Deep Learning (EDL). Unlike standard networks producing point estimates, EDL outputs the hyperparameters of a prior distribution over the target parameters.

Regression Task

For continuous property prediction, the target y is modeled as a Gaussian distribution with a Normal-Inverse-Gamma (NIG) prior (µ, σ2 ) ∼ NIG(γ, v, α, β) [Amini et al., 2020]. The predicted mean and epistemic uncertainty u are derived from the estimated hyperparameters:

The model was optimized using the negative log-likelihood LNLL:

where Ω = 2β(1 + v). LNLL aims to fit the ground truth by maximizing the marginalized likelihood of the observed data. Furthermore, an auxiliary regularizer LREG was utilized to penalize evidence associated with inaccurate predictions:

The total regression loss was formulated as:

Classification Task

In classification tasks, class probabilities follow a Dirichlet distribution Dir(p|α) [Sensoy et al., 2018]. Evidence ek ≥ 0 for each class defines the concentration parameters αk = ek + 1 and total evidence S = ∑Kk=1 αk. The predicted probability ˆ pk and uncertainty u are:

Training was supervised by the expected cross-entropy loss Lce:

This loss minimizes the prediction error by aligning the multinomial opinions with the categorical ground truth labels. A KL divergence term LKL was incorporated to penalize misleading evidence:

where ˜αk = yk + (1 - yk)αk. The final classification loss was integrated as:

2.2 Uncertainty-Guided Adaptive Adversarial Perturbation

Clean Propagation

A clean propagation path was first executed to perform evidential learning. Each molecular graph was initially processed through an embedding layer to convert raw atomic features into atomic embeddings xi. These embeddings were then passed through the graph encoder to obtain representations for computing the evidential learning loss Lclean, which is defined as:

To identify structural components where the model exhibits high sensitivity, we examined the gradient of Lclean with respect to each initial embedding xi. Atoms that play a decisive role in predictions typically exhibit larger gradients. We quantified atomic saliency si by computing the L2 norms of these gradients:

The computed saliency scores provided the basis for targeted perturbations in the subsequent adversarial path.

Perturbation Generation and Adversarial Propagation

Atoms were ranked by saliency scores, and a top-k (recommended k ∈ [0.2, 0.6]) ratio was selected as perturbation targets. An adversarial perturbation mechanism was designed to generate perturbed representations x′i . The perturbation radius ϵ was dynamically adjusted based on normalized batch uncertainty ¯u to calculate the adaptive intensity:

With ϵmax ∈ [0.06, 0.1] recommended, this modulation assigns larger perturbations to high-confidence samples to probe robustness, while applying milder noise to uncertain ones to maintain stability. Following this, adversarial perturbations were applied to generate the perturbed representations:

The resulting x′i were then passed through an adversarial propagation path to calculate the adversarial evidential loss Ladv, defined analogously to Lclean. This dual-loss structure encourages the model to learn robust representations from localized structural variations.

2.3 Stability-Aware Evidence Calibration

We developed a calibration scheme to align predictive evidence with structural robustness. In this framework, the prediction shift ∆ˆ y serves as a metric for structural sensitivity. For regression tasks, ∆ˆ y is defined as the absolute difference |ˆ yclean - ˆ yadv|, while for classification, it is calculated as the Kullback-Leibler divergence between the two predictive probability distributions. Based on this metric, the stabilityaware ranking loss Lrank was employed to ensure that samples exhibiting larger prediction shifts are assigned lower evidence S. Following the parameterization in [Sensoy et al., 2018] and [Amini et al., 2020], the total evidence S is quantified as S = ∑Kk=1 αk for classification and S = 2α + ν for regression:

where P = {(i, j) | ϕi,j ≥ percentile(Φ, 50)} denotes the set of sample pairs whose shift differences ϕi,j = ∆ˆ yi -∆ˆ yj rank in the top 50%. We restricted the calibration to the top 50% of pairs because forcing the model to distinguish between pairs with nearly identical stability yields little useful information and creates minor gradients that dilute stronger signals. By filtering for these clear differences, the ranking objective provided a more effective signal for evidence calibration.

Furthermore, based on the principle of epistemic consistency, we implemented the monotonicity constraint Lmono = max(0, Sadv - Sclean) to ensure that evidence from perturbed passes remains below that of clean passes. In this term, Sclean was detached from the computational graph, forcing the gradient to exclusively penalize overconfident Sadv values. The total calibration loss Lcalib was then defined as Lcalib = Lrank + Lmono.

2.4 Training Objective

To simultaneously account for generalization capability and uncertainty fidelity, the framework was optimized using a multi-objective loss function. The total loss Ltotal integrates the evidential learning losses from both clean and adversarial propagation paths along with the calibration loss:

where λ1 and λ2 are hyperparameters that coordinate adversarial training and evidence calibration. This joint objective ensures that the model maintains robust generalization across molecular structures while producing uncertainty estimates that faithfully reflect structural sensitivity.

3 Experiments

3.1 Experimental Setup

Datasets

We evaluated the framework on eight datasets fromMoleculeNet [Wu et al., 2018]. The classification tasks include BBBP, ClinTox, BACE, Tox21, and SIDER, where ROCAUC is employed as the primary metric. The regression tasks comprise FreeSolv, ESOL, and Lipophilicity, with RMSE used for evaluation. To rigorously assess the model's generalization ability, we adopted a strict scaffold splitting strategy with a ratio of 8:1:1 for training, validation, and testing.

Baselines

We conducted extensive experiments to investigate the performance of the proposed framework on molecular property prediction tasks. To ensure a comprehensive evaluation, we compared our approach against several groups of baselines, focusing on their predictive accuracy and reliability in chemical contexts.

Molecular property prediction models: This category includes fundamental GNN backbones such as GIN [Xu et al.,

2018], GPS [Ramp´aˇsek et al., 2022], and CMPNN [Song et al., 2020]. We integrated our framework into these encoders to validate its versatility in improving molecular representations. Additionally, we considered state-of-the-art pre-trained models, including GraphMVP [Liu et al., 2021], GROVER [Rong et al., 2020], MolCLR [Wang et al., 2022], ImageMol [Zeng et al., 2022], Uni-Mol [Zhou et al., 2023], MotiL [Liu et al., 2025], and SCAGE [Qiao et al., 2025], which serve as strong competitive benchmarks for molecular property prediction.

Adversarial perturbation methods: To evaluate the impact of different perturbation schemes on molecular property prediction, we compared our strategy against classic adversarial training techniques, including FGSM [Goodfellow et al., 2014] and PGD [Madry et al., 2017], as well as graph-specific data augmentation methods such as FLAG [Kong et al., 2022] and CAP [Xue et al., 2021]. These comparisons were performed to evaluate the effectiveness of our uncertainty-guided perturbation in enhancing the generalization performance of molecular property predictors.

Predictive reliability baselines: Given the importance of confidence estimation in drug discovery, we assessed our framework's ability to provide reliable uncertainty. In addition to vanilla EDL [Sensoy et al., 2018; Amini et al., 2020], we included representative uncertainty quantification methods, namely Deep Ensembles [Lakshminarayanan et al., 2017] and MC-Dropout [Gal and Ghahramani, 2016]. These were employed to establish benchmarks for uncertainty estimates, ensuring that the model's confidence aligns with its actual predictive performance on complex chemical structures.

3.2 Performance onMolecular Property Prediction

The results in Table 1 demonstrate that the proposed UGAP framework consistently achieved superior performance across both classification and regression benchmarks. In classification tasks, our method exhibited significant advantages, particularly on the BBBP, ClinTox, and BACE datasets, where it reached the highest ROC-AUC scores of 75.9, 96.2, and 88.2, respectively. Compared to competitive pre-trained baselines such as Uni-Mol and SCAGE, the UGAP+CMPNN model observed a notable margin of improvement. For instance, on the ClinTox dataset, the model yielded a ROC-AUC of 96.2, significantly outperforming the vanilla CMPNN backbone (90.5) and even the second-best model, SCAGE (93.7). Notably, these results indicate that our framework can achieve performance comparable to models pre-trained on large-scale datasets.

In regression tasks, the UGAP framework maintained its superiority by achieving the lowest RMSE on FreeSolv (1.61) and ESOL (0.80). Specifically, on the FreeSolv dataset, our method improved the baseline CMPNN from 1.92 to 1.61, outperforming Uni-Mol's score of 1.72. For the ESOL task, UGAP+CMPNN attained an RMSE of 0.80, which surpassed advanced pre-training methods like MotiL (0.82) and GROVER (0.88). Moreover, the backbone-agnostic nature was validated as UGAP+GIN and UGAP+GPS also showed consistent gains over their respective vanilla versions. Overall, these results demonstrate that the proposed framework effectively enhances the predictive performance and generalization of GNNs on molecular property tasks.

3.3 Ablation Study

We conducted ablation experiments on eight benchmark datasets to evaluate the contribution of each UGAP component. We compared UGAP against various perturbation baselines and assessed the significance of its core loss functions.

Effectiveness of Perturbation Strategies

The results in Table 2 demonstrated that gradient-based perturbation strategies consistently outperformed the random noise baseline. Compared to global methods like PGD and FLAG, UGAP w/o Adaptive, which applied perturbations only to high-gradient local regions, achieved superior performance across all datasets. For instance, on ClinTox, it reached an ROC-AUC of 95.2, marking a significant improvement over FLAG's 92.1. This suggests that targeting chemically influential atoms is more effective for regularizing molecular representations than uniform perturbations. Furthermore, the full UGAP model, which incorporated uncertainty-guided intensity, attained the best results in most cases, such as an RMSE of 1.61 on FreeSolv. This indicated that adaptively modulating perturbation strength based on model confidence further enhances the model's predictive performance.

Impact of Loss Components

We investigated the necessity of the adversarial loss (Ladv) and the calibration loss (Lcalib). The performance of UGAP w/o Ladv dropped sharply to levels near the vanilla model, which verified that adversarial training is the primary driver for boosting predictive accuracy. In contrast, UGAP w/o Lcalib maintained high accuracy and showed slightly better results on specific datasets like BBBP and Lipo. However, the full UGAP model achieved more consistent performance across the majority of tasks, such as Tox21 (76.7) and ESOL (0.80). This suggested that while Lcalib is primarily designed to enhance uncertainty reliability, it tends to provide a stabilizing regularization effect. The results indicated that incorporating calibration mechanisms does not significantly compromise, and in many cases remains compatible with, the model's overall predictive power.

3.4 Uncertainty-Informed Predictive Performance

To evaluate uncertainty reliability and its relationship with model performance, we conducted an analysis across confidence intervals on both classification (BACE, BBBP) and regression (ESOL, FreeSolv) tasks. As Figure 2 illustrates, we ranked test samples by predicted confidence and evaluated predictive metrics within each interval.

In classification tasks, the ROC-AUC of our proposed strategy (red bars) consistently increased as confidence rose, outperforming vanilla Evidence, Ensemble, and Dropout methods, particularly in high-confidence regions. For instance, on the BACE dataset, our method achieved an ROC-AUC near 1.0 in the top confidence tier, whereas baseline methods exhibited a performance gap or fluctuations.

Similarly, in regression tasks, the RMSE of our method showed a clear downward trend as confidence increased, indicating that samples with higher confidence are indeed associated with lower predictive errors. Compared to the erratic behavior of MC-Dropout and sub-optimal performance of standard Ensembles, our method provided a more monotonic and dependable relationship between confidence and accuracy. These results validate that our framework enhances predictive performance and ensures that model confidence is a reliable indicator of actual performance, which is crucial for decision-making in drug discovery.

3.5 Mechanism of Evidence Calibration

To elucidate how the perturbation informs uncertainty estimation, we analyzed the relationship between predictive discrepancy ∆ and evidence magnitudes on the BACE and ESOL datasets. Intuitively, a large ∆ indicated that the model's prediction was sensitive to structural perturbations, which should ideally correspond to lower evidence (higher uncertainty). As illustrated in Figure 3, we categorized samples into Low, Mid, and High ∆ regions and observed the distribution of evidence values. In the vanilla evidential model (green boxes), although there was a slight downward trend in evidence as ∆ increased, the distinction between different discrepancy regions was relatively blurred. This suggested that without explicit alignment, standard evidential learning struggles to fully capture the structural instability of molecules. By incorporating our evidential calibration strategy, the UGAP model (red boxes) demonstrated a much more pronounced and monotonic decrease in evidence values as ∆ rose. Specifically, in high-discrepancy regions, the evidence magnitudes were significantly suppressed compared to the vanilla version. This clear correlation confirmed that our framework effectively utilized the predictive discrepancy induced by perturbations to regularize evidence, thereby ensuring that the model's confidence was grounded in its structural robustness.

3.6 Case Study

To evaluate perturbation sites and uncertainty reliability, we visualized representative molecules from the BBBP dataset (Figure 4). The light-red regions indicate the salient substructures targeted by our adaptive perturbation, while blue dashed circles highlight chemically significant groups, such as the sulfonamide group, hydroxyl group, and thioether linkage. In the BBBP task, these groups are pivotal; for instance, polar groups like sulfonamides and hydroxyls typically hinder passive diffusion across the lipid-rich blood-brain barrier, making them critical focal points for model sensitivity. By visualizing these perturbation regions, we revealed the saliency regions of the model's decision-making process. The high alignment between these regions and known chemical pharmacophores demonstrated that UGAP's learning process possesses physicochemical transparency.

Furthermore, the uncertainty estimates u provided crucial insights into predictive reliability. In cases (a) and (c), UGAP yielded high-confidence predictions with low uncertainty, accurately aligning with true labels. For the complex scaffold in case (b), UGAP exhibited a moderate uncertainty increase (u = 0.356), suggesting a more cautious yet correct inference-notably more confident than the Vanilla EDL, which yielded a higher uncertainty (u = 0.474). More importantly, case (d) triggered a significant uncertainty warning (u = 0.774). Despite a marginal prediction error, UGAP effectively flagged this risk with substantially higher uncertainty than the baseline (u = 0.476). This ability of the model to recognize its own cognitive boundaries through faithful uncertainty estimation demonstrates that UGAP provides a robust safeguard for reliable molecular property prediction.

3.7 Hyperparameter Analysis

We investigated the sensitivity of UGAP to the adversarial loss coefficient λ1 and the evidential calibration coefficient λ2 on the BACE and ESOL datasets (Figure 5).

Experimental results on 3D performance surfaces revealed that λ1 served as a primary driver for predictive accuracy. Within a range centered around 1.0, increasing λ1 consistently improved the ROC-AUC for BACE and reduced the RMSE for ESOL, which validated the efficacy of our structural-aware perturbations in enhancing generalization. Compared to λ1, λ2 showed a marginal impact on accuracy, allowing for uncertainty calibration with minimal loss in predictive performance.

The role of λ2 was further evaluated for uncertainty quantification. Notably, when λ2 = 0, the framework approximates standard evidential learning. For classification, we assessed calibration by calculating the signed calibration bias

(the difference between accuracy and confidence). It was observed that lower λ2 often led to overconfidence, while excessively high values resulted in underconfidence. For regression, we evaluated calibration by constructing two-sided confidence intervals [ˆ y ± zpσ] across a range of theoretical confidence levels p ∈ [0, 1]. We then measured the empirical coverage by calculating the actual proportion of ground-truth values falling within these predicted intervals. As illustrated in the reliability curves, adjusting λ2 effectively shifted the model between underconfident (above the diagonal) and overconfident (below the diagonal) states. This mechanism helped align observed and expected confidence levels, thereby improving the reliability of uncertainty estimates.

4 Conclusion

In this paper, we presented UGAP, an uncertainty-guided adaptive perturbation framework designed for molecular property prediction. By selectively applying perturbations to chemically influential regions of a molecule, our approach improved the model's generalization capabilities across various chemical domains. Extensive experiments demonstrated that UGAP consistently enhanced the predictive performance of diverse GNN backbones. Furthermore, the integrated evidential calibration mechanism improved the reliability of confidence estimates for molecular property predictions. By leveraging prediction discrepancy under perturbation, this mechanism facilitated a better alignment between estimated uncertainty and actual prediction errors. These findings suggest that UGAP offers a practical solution for uncertaintyaware molecular modeling, supporting more informed and trustworthy decision-making in the drug discovery process.

Acknowledgments

This work was supported by the National Natural Science Foundation of China (62472191, 62372204); Huazhong Agricultural University Scientific & Technological Selfinnovation Foundation and Fundamental Research Funds for the Central Universities (2662024SZ006).