Inside-out proteins: a new source of cancer surface targets, and how AI could find more

Almost every antibody therapeutic acts on a protein at the cell surface, and the list of candidate surface proteins has been assembled the same way for decades: look for a signal peptide, look for a transmembrane domain, and the protein that has one is on the list. It is a good rule. It is also the reason an entire category of targets has been sitting in plain sight, filed as experimental artefact.

Intracellular proteins turning up on the outside of cells has been reported for years, usually under the heading of moonlighting proteins, and usually treated with suspicion. Cell surface Hsp70, extracellular nucleolin, surface enolase: each individually documented, each easy to dismiss as contamination from lysed cells. What changed in 2026 is that two groups attacked the problem systematically, with methods designed to exclude exactly that artefact, and both found the phenomenon is real and larger than anyone was treating it as.

Expand

Note what holds each protein in place. On the left, nothing in the bilayer at all: the protein binds sugar chains that extend from a proteoglycan. On the right, a lipid tail in one leaflet. Neither is a transmembrane domain.

The tethered route

Slezak and colleagues used APEX2-mediated proximity biotinylation, which labels proteins within a very short radius of a membrane-impermeable probe, paired with a custom antibody generation platform. They identified roughly 140 high-confidence I-O proteins: ribosomal subunits, proteasomal components, heat shock proteins, translation machinery. Not a random slice of the proteome, but a coherent set enriched for stress-response families.

The mechanism they report is the interesting part. These proteins are not inserted into the membrane. They are tethered to it by heparan sulfate glycosaminoglycans, and heparinase II treatment eliminated virtually all of the surveyed I-O proteins from the surface. High salt did almost nothing, and removing N-linked glycans did nothing, so the interaction is specific rather than generically ionic. Then the detail that makes it a system rather than a leak: the stripped proteins returned to baseline within six hours, and only while ER-Golgi trafficking remained intact. This is a maintained equilibrium, not debris.

The inverted route

Delaveris and colleagues, working in James Wells’s lab at UCSF, came at it from a different direction with photo-proximity labeling and found something more specific and, for a drug developer, more striking. Src kinase, the proto-oncogene anchored to the inner leaflet by N-terminal myristoylation, appears on the outer surface of cancer cells, still catalytically active.

The route is autophagolysosomal exocytosis, and the paper is explicit that Src is the prototype of a family of membrane-anchored proteins moving this way rather than a one-off. It is worth being precise about the difference between the two mechanisms here, because it is easy to blur. Src is membrane-associated, but through a lipid tail buried in a single leaflet, not a domain crossing the bilayer. The proteins Slezak describes are not membrane-associated at all: they sit above the bilayer, bound to glycan chains. Two different answers to the question of what holds a protein on the outside, and neither is the one a surfaceome predictor looks for. They found extracellular Src in primary patient tumours and showed anti-Src antibody therapies killing tumour cells in culture and in mouse xenografts. Two different anchoring chemistries, two different trafficking routes, the same net result.

The defining property of an I-O protein is a negative. No signal peptide. No transmembrane domain. Every computational surfaceome predictor works by detecting the positive version of exactly those features, so the entire class is not merely ranked low, it is structurally outside what the tool can express.

Transcriptomics does not rescue it either. An mRNA count tells you the protein is being made; it cannot tell you which side of the membrane it ended up on. For a target class whose whole value proposition is a change in localisation rather than a change in abundance, expression data is close to uninformative. That is a real limitation for anyone hoping to nominate these targets from public expression atlases.

There is also an uncomfortable finding for antibody discovery. Slezak and colleagues report only a weak correlation between a Fab binding the soluble antigen and the same Fab recognising it on the cell surface: for many targets, fewer than half of the Fabs that bound the purified protein showed detectable surface binding. The presentation geometry matters. A campaign run against recombinant antigen may select binders that do not work where it counts, which changes how you would design the discovery cascade for this class.

It would be easy to write these up as tumour-specific antigens and stop. The data support something more careful.

I-O proteins were undetectable on resting peripheral blood mononuclear cells and on normal tissue, which is the headline. But when Slezak and colleagues stressed normal PBMCs with GW4869, an inhibitor of neutral sphingomyelinase, the cells displayed I-O proteins measurably, and reverted to baseline within 24 hours of removing the stimulus. The authors are direct about the implication: surface display is a reversible, stress-dependent event.

One member of the set has travelled furthest. Enolase-1 (ENO1) is a glycolytic enzyme with a well-documented surface pool, and antibody programmes against surface ENO1 have reached preclinical development, including work on reprogramming macrophage polarisation and inhibiting tumour growth. It is a useful proof that the category can yield a real drug programme, and a useful reminder that it has taken years per target by conventional means.

The obvious move is to train a classifier that separates I-O proteins from the rest of the proteome and use it to nominate candidates for validation. The obvious move is also where most of these efforts fail, because a sequence model has no way to represent a tethering mechanism. The features have to carry the biology.

Expand

Sequence embeddings are the base layer, not the whole model. The mechanistic features are what make the predictions falsifiable for a reason.

Three of those features deserve comment. The electrostatics term exists because Slezak identified heparan sulfate as the tether, so heparin-binding character and surface charge computed from an AlphaFold model are direct proxies for the mechanism rather than generic descriptors. The lipidation term exists because Delaveris identified myristoylation as the anchor on the second route, and the paper frames Src as one of a family. And the negative feature is doing more work than it looks: encoding the absence of a signal peptide as an explicit input is what stops the model rediscovering the conventional surfaceome and calling it a result.

The harder problem is the training set. Roughly 140 validated positives is small, the negative class is the rest of the proteome and is certainly contaminated with undiscovered positives, and the label itself is assay-dependent. Those are real constraints, and a model built on them should be treated as a hypothesis generator rather than an oracle. That is why the loop matters more than the architecture: predict, rank by what is cheapest to falsify, test at the bench, and feed the graded result back, including the failures, which are the most informative data the loop produces.

This is also where the honest limits sit. A classifier can propose which proteins might reach the surface. It cannot tell you the antigen density, whether the epitope is accessible in its tethered conformation, whether the target internalises, or which modality suits it. On that last point the two papers already disagree in a useful way: for extracellular Src the reported activity favoured T-cell engager and radioligand approaches over an antibody-drug conjugate, which is exactly the kind of decision that depends on internalisation behaviour a sequence model knows nothing about.

Our interest here is not the classifier in isolation. It is that this target class has the shape of a problem where an autonomous analysis layer earns its cost: a small validated positive set, a large candidate space, several orthogonal evidence types that have to be joined per protein, and a validation step that is slow enough to make prioritisation valuable.

Concretely, four components. Select the indications where the stress differential plausibly gives a therapeutic window, since that is the question the biology actually poses. Predict candidates with the feature stack above, stress-tested against the validated set rather than a random holdout. Assign each candidate a modality from its druggability profile, because internalisation behaviour decides between an ADC, an engager and a radioligand. Then close the loop with bench validation, so each round expands the known set instead of re-ranking the same one.

We have run versions of this shape before. The EZH2 work with the Danish Cancer Institute surfaced a driver that multiple-testing correction would have buried, using an interpretable network over four data modalities. The FRα ADC comparison is the modality-assignment problem in miniature. Neither is this problem, but both are the same discipline: make the prediction specific enough to be wrong, then go and find out.

Being clear about what is unresolved is more useful than enthusiasm here, because this is a young field and several of these questions are load-bearing for any programme.

• Identifier hell: why ontology mapping is the real bottleneck
• When agents disagree, and what to do about it
• Will AI replace bioinformaticians?
• Tisotumab vedotin vs ADCE-T02: ADC design from a shared target