Bacterial defences: mechanisms, evolution and antimicrobial resistance

Throughout their evolutionary history, bacteria have faced diverse threats from other microorganisms, including competing bacteria, bacteriophages and predators. In response to these threats, they have evolved sophisticated defence mechanisms that today also protect bacteria against antibiotics and other therapies. In this Review, we explore the protective strategies of bacteria, including the mechanisms, evolution and clinical implications of these ancient defences. We also review the countermeasures that attackers have evolved to overcome bacterial defences. We argue that understanding how bacteria defend themselves in nature is important for the development of new therapies and for minimizing resistance evolution. In this Review, Smith, Foster and colleagues explore the protective strategies of bacteria, including the mechanisms, evolution and clinical implications of these ancient defences. They discuss new therapies for treating disease and how to minimize resistance evolution.


Review article
lysing intoxicated cells quickly and thereby clearing a path to new targets 22 . Antibiotics, a diverse group of secondary metabolite toxins, have broad but overlapping activities, and common targets include gene transcription and protein translation, DNA synthesis and replication, and the cell envelope 23,24 .

Bacteriophages
Phages are the most numerous biological entities in the biosphere 25 and are a leading cause of bacterial mortality in many environments 26 (for a recent review, see ref. 6). Phages differ in their evolutionary relationships with hosts, spanning a continuum from parasitism to mutualism 27 . Phages replicate by injecting their genetic material into bacterial hosts. For lytic phages, the injected genetic material is immediately copied and transcribed to assemble progeny phage particles, which kill and burst the host cell to disperse. Temperate phages (for example, λ-coliphages) also reproduce via host lysis under certain conditions, but have the additional ability to lysogenize host bacteria 28 , whereby the phage inserts its genome into the bacterial chromosome, enabling it to replicate vertically alongside its host as it grows and divides. A third class of phages (for example, filamentous phages) exhibit a chronic replicative cycle, whereby new phages are continuously extruded from the host 29 . Lysis of cells infected with lytic phages is triggered by envelope-degrading endolysins and holins 30 ; temperate phages kill via similar mechanisms but may lie dormant for long periods before those mechanisms are induced. Cells with chronic phage infections are generally not killed 29 , but still suffer from reduced fitness owing to the diversion of cellular resources towards phage assembly 31 .

Eukaryotic and bacterial predators
In addition to viral infection, bacteria have long faced the threat of predation, particularly from free-living protozoa that feed via phagocytosis in soil and aquatic environments 7 . Some bacteria are also facultative or obligate bacterial predators: the soil bacterium Myxococcus xanthus moves rapidly in large groups, digesting encountered prey with secreted hydrolytic enzymes 32 . Bdellovibrio and like organisms (BALOs) are small bacteria that burrow inside Gram-negative bacteria: once inside the periplasm, a BALO cell grows by digesting the cytosolic contents of the host with hydrolytic enzymes, fuelling rapid growth 33 . Once the resources of the host are exhausted, the BALO cell divides to form multiple progeny cells, which are released via host cell lysis 34 . Meanwhile, the candidate phyla radiation, a diverse group of small-celled bacteria representing approximately 15% of all bacterial diversity 35 , may incorporate other new types of predatory or parasitic bacteria. Although the biology of this group remains poorly understood, members often have reduced genomes and seem to rely on other bacteria to survive and reproduce 36 .

Introduction
Bacteria are among the most ancient organisms on Earth 1 , but across virtually every ecosystem, they are threatened by competitor bacteria [2][3][4][5] , bacteriophages 6 and predators 7 , which are all equipped with a broad range of means to attack them. Whereas the widespread human use of antibiotics dates back a mere century, biotic threats have been shaping the evolution and physiology of bacteria for billions of years.
Bacteria have evolved a panoply of defence mechanisms to avoid or mitigate harm from biotic threats. Understanding these defences is important for several reasons. They offer insights into bacterial biology, illuminating the ecological challenges that bacteria faced in the past and the mechanisms that evolved to overcome them. These mechanisms are phylogenetically widespread and influence the physiology of diverse bacterial species; some components of animal innate immune systems even trace their origins to bacterial defence mechanisms 8 . Ancient defences are also central to how modern bacteria respond to antimicrobial therapies. Many defences offer broad protection against various threats, which means that bacteria often have preadaptations that potentiate resistance to antimicrobials in the clinic. Moreover, as we search for new biotherapeutic alternatives to antibiotics, including probiotic bacteria and phage therapy, we face many of the same challenges from these preadaptations that render bacteria hard to kill 9 .
In this Review, we explore bacterial defence mechanisms through an evolutionary lens and discuss their relevance for treating bacterial infections (Box 1). We discuss the threats that bacteria face from microbial predators, competitors and viruses, and then identify common principles of defence that protect against these threats. The set of known bacterial defences is large and ever-growing, such that exhaustively cataloguing every mechanism is beyond the scope of this article. Instead, we select examples that illustrate different categories of defence and discuss their regulation and evolution. We close by examining how attackers have evolved to overcome bacterial defences, tactics that may help in the treatment of bacterial disease.

Bacteria face myriad threats
In a given environment, abiotic factors (for example, light, salinity or heat) produce stressors, and for host-associated bacteria, immune cells and responses may contribute others (for example, antimicrobial peptides). In this Review, however, our focus centres on the biotic challenges presented by bacterial competitors, phages and predation by eukaryotes and specialized bacteria (Fig. 1).

Bacterial competitors
Many bacteria live in dense, multi-species communities, where competition for space and nutrient resources is severe [2][3][4] . Commensurately, bacteria have evolved diverse strategies for inhibiting and killing their competitors, many of which involve the use of specialized weaponry (recently reviewed in ref. 10). Antibacterial weapons are extraordinarily diverse, encompassing molecular toxins 11 , antimicrobial peptides 12 and proteins 13,14 , toxin-injecting 15 and membrane-puncturing 16 nanomachines, and even weaponized phages 17 . These myriad weapons harm a target bacterium by attacking its key cellular structures and processes, which results in growth inhibition or cell death. For example, diffusible peptide-based toxins (bacteriocins) often damage DNA and RNA 18 , or compromise cell envelopes via pore-forming 19 or walldegrading activity 20 . Protein toxins injected via the type VI secretion system (T6SS) frequently target the bacterial cell wall or membrane 21 ,

Review article
bacteria by inhibiting cell wall-crosslinking enzymes. In methicillinresistant Staphylococcus aureus, the genes mecA and mecC encode modified crosslinking enzymes that are insensitive to almost all β-lactam drugs 39 . Modification can be post-translational as well as genetic; for instance, the enzymatic methylation of bacterial ribosomes can prevent multiple classes of antibiotics from binding with this target 37 .
Target repair and compensation. Cells can compensate for the presence of a harmful agent via generalized physiological responses that repair damaged targets. Exposure of bacteria to antibiotics, other competitor toxins or phages often results in oxidative DNA damage 40,41 . Subsequently, repair of oxidized DNA occurs via the base excision repair and nucleotide excision repair systems, which are both highly conserved and ancient pathways 42,43 . Apart from chromosomal repair, some species possess RNA ligases that can mend 16S ribosomal RNA damage caused by ribotoxic bacteriocins 44 . Similarly, the extrusion of filamentous phages can compromise the inner membrane of Escherichia coli, but the expression of membrane-binding phage shock proteins suppresses proton leakage and maintains the proton-motive force 45 . Sometimes it suffices to simply replace lost targets: when intoxicated with cell wall-degrading T6SS toxins, Vibrio cholerae responds by increasing peptidoglycan synthesis to compensate 46

Clinical implications of ancient bacterial defences
The study of bacterial defences can inform current and future antibacterial therapeutics.

Origins of drug resistance
Understanding where resistance genes come from can help to predict and restrict antibiotic resistance proliferation 231 . Environmental reservoirs harbour many old and diverse resistance genes 232 . For example, the methicillin resistance genes found in methicillinresistant Staphylococcus aureus seem to have first emerged in hedgehog-associated S. aureus, as a protection against fungal β-lactam antibiotics 39 . More generally, toxin-mediated competition among environmental bacteria is widespread 233 , and, along with phages and predators 41,61 , can select for defences that increase virulence 120,121,186 or protect bacteria against multiple threats 144,154,225 . Studying and surveying bacterial defences in environments with strong competition and conflict, therefore, may help to predict which resistance mechanisms are most likely to arise.

New strategies against resistance
Many bacteria use antimicrobials to eliminate competitors 10 , which suggests that they are often able to overcome the defences of their targets. We might look to bacteria, therefore, for strategies that help to overcome drug resistance. Evidence supporting this idea comes from the use of adjuvant therapy: Streptomyces clavuligerus produces clavulanic acid, which inhibits β-lactamasebased resistance mechanisms 204 . This strategy forms the basis for co-amoxiclav, a therapeutic that uses both a β-lactam antibiotic and clavulanic acid to combat β-lactamase-based resistance 234 . Another feature of bacterial attack strategies is that they commonly use multiple toxins against competitors 10,201,235 . This contrasts with classic monotherapy, which remains the clinical norm, but draws comparisons to a growing number of strategies that combine multiple antibiotics with the goal of limiting resistance evolution [236][237][238] . In addition, many bacterial toxins are polymorphic, with a modular structure that enables new variants to be readily innovated as resistance emerges 239 . Adopting modular designs when developing new antimicrobials could enable us to exploit this adaptability 240 .

Targeting defences
The defensive responses of bacteria 79,81,123 can increase virulence and protect against antimicrobial treatment, thereby exacerbating disease 81,241,242 . Directly targeting defensive mechanisms, therefore, has the potential to greatly improve treatment efficacy when performed in combination with antibiotics or other bactericidal treatments. Diverse bacteria respond to antibiotic treatment by forming biofilms, which are notoriously difficult to treat 80 . However, physical disruption of biofilm structures can increase bacterial exposure to antibiotics, sensitizing recalcitrant infections 243 . Targeting defences also raises the possibility of treatments with a minimized risk of resistance evolution. Biofilm inhibitors can enhance antibiotic susceptibility while minimizing resistance to the biofilm inhibitor, because resistant genotypes pay the fitness costs of extracellular polymeric substance production 244 . A related defence-targeting strategy is to introduce strains of bacteria that do not contribute to collective defences ('cheat therapy') 245,246 . When cheater strains can outcompete the original strain, they have the potential to undermine defences and improve treatment outcomes without strong natural selection for resistance evolution.

Exploiting novel antimicrobials
Phages 247 , predators 248 and competing bacteria 5,223 all have potential as alternative therapeutics for bacterial infections 224 . As we discuss, however, bacteria have already evolved many defences against these threats. As with antibiotics, therefore, the rapid emergence of resistance in clinical settings is a realistic prospect 9,249 . But these alternative antimicrobials share a potential major advantage over antibiotics: being biological, they have the potential to coevolve with their targets, such that resistance in a target is circumvented by countermeasures in the attacker. Although this outcome is far from guaranteed (it requires, among other things, that the survival of the therapeutic depends on defeating the target pathogen), it raises the possibility that evolution can be directed to overcome pathogen resistance as it emerges. Moreover, by combining therapies, one can exert contrasting selective pressures on pathogens, which may limit resistance evolution more than antibiotic therapy alone 177,250,251 .

Review article
are neutralized through modification, via the enzymatic addition of acetyl, phosphoryl or adenyl groups 47 . Toxic agents can also be inactivated via binding to other molecules: the expression of cognate immunity proteins confers resistance to many bacteriocins 19 , T6SS 48 and Cdi 49 effectors, and enables cells to safely use these toxic proteins as weapons 10 . In the same way, expression of orphan immunity proteins (that is, those for which a bacterium does not produce a cognate toxin) enables bacteria to survive attacks from non-kin cells 50,51 .
Bacteria also have diverse systems to degrade harmful agents. β-Lactamases are ancient proteins that hydrolyse the ring structure of β-lactam antibiotics such as penicillin 52 . Restriction-modification systems encode restriction endonucleases, which bind to and cleave phage and other foreign DNA at specific recognition sites. Target modification also has a role here, but is directed at host DNA: recognition sequences on host DNA are modified (for example, via methylation) to protect them from degradation, whereas unmodified phage DNA is destroyed by the endonuclease. Multiple classes of restriction-modification systems have been characterized across both bacteria and archaea 53,54 , providing innate immunity against a subset of phages. Recently discovered antiviral defences, such as DISARM 54 (defence island system associated with restriction-modification) and Dnd 55 (DNA phosphorothioation) systems, function in a similar manner, respectively attacking foreign DNA that lacks methyl-or sulfur modification.
The degradation of harmful agents reaches astonishing complexity in CRISPR-Cas systems, which provide bacteria with adaptive immunity against phages whose genomic signatures have previously been encountered. These systems store fragments of foreign DNA in the bacterial genome, which then guide Cas restriction enzymes to degrade DNA in the cell that resembles that of past phage infections 56 or other mobile genetic elements 57 . The recently discovered prokaryotic Argonaute (pAgo) proteins operate on a similar principle, providing guided DNA interference against harmful genetic elements including plasmids, transposons and phages 58 .

Cellular defences
Membranes, capsules and extracellular vesicles. Most harmful agents must enter a cell before they can cause harm, and bacterial membranes are often pivotal in restricting this entry. Indeed, the outer membrane of Gram-negative bacteria may have evolved in part to better protect cells from antimicrobial compounds 59

Fig. 1 | Bacteria face diverse threats from competitors, viruses and predators.
Most attacks target core cellular processes and functions of the bacterial cell. Coloured squares indicate whether a given threat type typically acts on a particular target. Bacterial competitors antagonize a target bacterium via diverse mechanisms, including both contact-dependent weaponry (the type VI secretion system (T6SS); Cdi effectors) and diffusible weaponry (small molecules, peptide toxins and tailocins). The majority of clinical antibiotics are also derived from bacteria and other microorganisms. Following infection of a bacterial cell, phages attack cell walls and membranes to release their progeny via cell lysis. Some bacterial predators, such as Bdellovibrio species and similar organisms, invade the host cell periplasm, injecting toxins that digest various cytoplasmic components. Many eukaryotic predators engulf and digest target bacteria whole in phagosome compartments.

Review article
decorating a membrane are also crucial to barrier function: some structures (for example, transporters or surface polysaccharides) function as binding sites or entry points for phages and protein toxins, and bacteria that lack such structures, or have modified those structures, benefit from resistance. Other surface structures (for example, lipopolysaccharides 60 and curli fibres 61 ) confer protection by occluding phage-binding or toxin-binding sites, or by armouring the cell against mechanical insult. For example, bacterial capsules, which are protective sheaths of exopolysaccharides, can armour cells against penetration by the T6SS 62,63 . Similarly, a layer of interlocking surface proteins, known as the S-layer 64 , can protect bacteria from entry by Bdellovibrio bacteria 65 , as can certain lipopolysaccharides 66 .
Beyond their barrier role, membranes can perform additional defensive functions when shed as bubble-like extracellular vesicles 67 . As well as enhancing envelope stability (by removing misfolded or mislocalized envelope components) 67 , vesicles can function as extracellular 'decoys', absorbing antibiotics, peptide toxins and phages and carrying toxin-degrading enzymes 68 . Vesicle release is actively upregulated in response to envelope stress and is thought to have intersecting roles in anti-phage and antitoxin defence 68 .
Efflux pumps. When the cell envelope fails to stop harmful molecules from entering, bacteria can instead force them back out. Efflux pumps are a diverse group of membrane transport proteins universal to bacteria, with a broad range of substrate specificities 69 and physiological functions 70 . In particular, they are an effective and fast-acting antibiotic resistance mechanism 71 , sufficient in some cases to protect antibiotic-producing bacteria against their own toxins 72 .

Fig. 2 | Bacteria have evolved multiple lines of defence against biotic threats.
At both the individual and collective level, bacteria draw upon a plethora of defensive adaptations to escape harm. Defences are arranged according to the spatial scale at which they operate. a, At the molecular level, attacks by competitors, phages and predators are mediated by harmful agents (for example, toxins, enzymes and genetic elements) that disrupt cellular functions by interacting with diverse targets. Bacteria can mitigate disruption at a molecular level by altering the target or compensating for its disruption, or by destroying or binding to the harmful agent. b, At the cellular level, macromolecular barriers, including cell membranes, S-layers, lipopolysaccharide (LPS) or capsules, prevent harmful agents from entering a bacterial cell. Efflux pumps remove harmful molecules that overcome barriers, and motile bacteria can escape harmful environments by repositioning themselves. Secreted membrane vesicles can bind and inactivate toxins and phages. c, At the multicellular level, bacteria create collective barriers (production of extracellular polymeric substances (EPSs); biofilm formation) that exclude attackers. Dense cell groups can limit toxin penetration via reduced diffusion or collective degradation. They may also contain resistant subpopulations (phenotypic heterogeneity), launch en masse counter-attacks and, in some circumstances (for example, abortive infection), commit suicide to protect kin cells. Stress responses and other regulatory pathways enable these defences to be activated in response to specific or general threat cues.

Review article
Motility. Using flagella, type IV pili or other motility systems 73 , bacteria can evade threats that would otherwise kill them. In planktonic environments, bacteria with sufficiently high swimming speeds (>30 μm s −1 ) can avoid capture by protozoan predators, despite meeting them more often at high speeds 74 . Indeed, motility can be beneficial even if a bacterium cannot 'outrun' a threat: Bdellovibrio predators swim approximately twice as fast as V. cholerae prey cells 75 , but the drag forces generated by prey motility impede predator attachment 66 . However, motility is not always a good defence: many phages bind to motility systems as part of their infection process 76 , and movement can also spread phage within bacterial groups 77 .

Multicellular defences
Biofilms. Clonal groups of bacteria often work together, collectively enduring threats that would kill single cells 78 . The most ubiquitous example of a multicellular defence in bacteria is the formation of biofilms. Biofilms underlie a range of chronic infections and often form in response to antibiotics and competition from other strains [79][80][81] . They can render bacteria extremely hard to kill, for multiple reasons. Diffusion limitation of solutes, such as oxygen or nutrients, means that many biofilms contain large numbers of slow-growing or dormant cells, which are more tolerant of toxins that target cell growth and division machinery than their fast-growing counterparts 82 . The outer regions of a biofilm can also protect cells deeper inside, collectively absorbing 83 and degrading 84 toxins and limiting their penetration into the community. Cells in biofilms produce a slimy matrix of polysaccharides, proteins, DNA and other compounds: these surround cells and create an additional physical barrier that can inhibit the passage of antibiotics 85 , block T6SS attacks 62,78 and screen cells from phages 61 and predators 86 . Matrix production can also function as an offensive strategy, which enables bacteria within the biofilm to spread out and smother competitors 87 . Matrix-trapped phage can even become weapons, protecting a biofilm from invasion by competing bacteria 88 .
Phenotypic heterogeneity. Another collective defence strategy displayed by bacteria is to maintain standing population variability in certain phenotypes (for example, growth phase), such that not all individuals fare equally badly when conditions deteriorate. Such phenotypic heterogeneity is associated with clinical antibiotic tolerance 89,90 and so may also be a route through which bacteria resist toxins from competitors. Sources of this variability include the gradients in nutrients and other solutes discussed above, which commonly occur in biofilms and can drive differences in cell physiology across space 91 . However, phenotypic variation also emerges in the absence of environmental gradients, via stochastic mechanisms. A key example of this is the ability of bacteria to switch epigenetically to slow-growing antibiotic-tolerant 'persister' states 92 or to rapid growth modes that avoid antibiotic accumulation 90 . An evolutionary experiment showed that antibiotic treatment can select for E. coli point mutations that increase the rate of this switching, which results in high levels of multidrug tolerance 93 . This result suggests that production of persister cells represents an evolved defence mechanism.
Counter-attacks. Sometimes offence is the best defence -true to this maxim, many bacterial species launch en masse counter-attacks to eliminate perceived threats 10 . Counter-attack strategies can also be protective at the individual level: environmental V. cholerae cells use the T6SS as an anti-grazer defence 94 , and Pseudomonas aeruginosa cells respond to T6SS-mediated attacks by competitors with spatially coordinated T6SS firing 95,96 . However, for many secreted toxins, lethality is strongly dependent on producer cell density 97,98 , possibly making counter-attacks more effective when undertaken collectively 99 . Some bacteria regulate toxin counter-attacks via autoinduction: when toxin concentration and production are connected in a positive feedback loop, a minor aggression may be met with disproportionate retaliation 83,100 . In some cases, mass counter-attacks lead to runaway conflict escalation and even mutual destruction 100,101 .
Suicide. Saving nearby clonemates via self-sacrifice is another striking form of defence shown by bacteria. Active cell suicide can be both collective and cooperative when it kills the individual while benefiting neighbouring cells. For example, many bacteria protect their kin from the spread of a phage infection using a strategy called abortive infection 102 , whereby an infected cell pre-emptively triggers its own lysis, or growth arrest, before phage particle assembly is completed, thereby sparing kin from subsequent infection. Multiple anti-phage defences, including bacterial gasdermins 103 , the CBASS (cyclic oligonucleotidebased anti-phage signalling system) 104 , and certain toxin-antitoxin 105 and CRISPR systems 106 , function in this way; other recent discoveries (for example, RADAR (restriction by adenosine deaminase acting on RNA) 107 , Theoris 108 and Zorya 109 systems) may behave likewise. Interestingly, cell suicide is also at the heart of some striking examples of counter-attack: colicin toxins produced by E. coli are too large to pass through standard secretion apparatus, necessitating destructive cell lysis for their release. Other large protein weapons, such as extracellular contractile injection systems 110 and R tailocins 14 , are similarly constrained. In E. coli however, the large-scale release of colicin toxins occurs only when cells have already sustained lethal damage, which reduces the effective costs of suicide 111 . The result can be a massive counter-attack by the doomed cells, paralleling suicidal stinging by honeybees.

Competition sensing and defence regulation
Bacteria use some defensive structures by default; for example, the outer membrane is a permanent protective feature of Gram-negative bacteria 59 . However, many defences are not fixed and are instead plastic responses to perceived threats. These responses are distinct from evolutionary responses (population changes in genotype), which we discuss in the next section. The effective use of plastic defences depends on the ability to infer that a threat is present or likely to occur, and bacteria use a range of information sources (cues) to achieve this 112 when acclimating to new and hostile environments (Fig. 3).

Bacteria sense attacks through direct and indirect means
First, many bacteria regulate defences by sensing attack signaturesthat is, cues that result directly from a biotic threat. Physiological stress is a primary indicator that a focal bacterium could be under attack, and bacteria detect stress using a wide range of stress responses 79,113 . These regulatory networks respond to diverse forms of stress, of both biotic and abiotic origin. However, there is evidence that bacteria differentiate between different stress cues, deploying anti-competitor defences only in response to stressors that are likely to stem from a biotic threat (Fig. 3). This behaviour, known as competition sensing 79 , is thought to regulate a wide range of defences. The clearest evidence for competition sensing comes from the upregulation of antibacterial toxins, because in that case one can infer that the likely function of the response is to cope with competitors. For other defences, such as DNA repair systems, it is more challenging to tell whether the response evolved Review article primarily because of biotic or abiotic stressors. However, a number of the major stress responses are known to be activated by biotic threats, which is consistent with their use in competition sensing 41,81 .
Antibacterial weapons often target vital structures such as the cell envelope or chromosome (Fig. 1). Damage to these components, sensed via specific stress response pathways 113 , is frequently used to regulate counter-attacks and structure-specific repair pathways 79 . As cellular damage often results in the production of reactive oxygen species 41 , many bacteria also use oxidative stress as a cue to produce toxins 79,114 . General stress responses can also be used to regulate defences: when attacked by T6SS-armed competitors, Salmonella enterica subsp. enterica serovar Typhimurium activates various damage responses, including the general stress response, to induce biofilm formation and efflux pump expression 81 . In some cases, cellular perturbation is sensed without a canonical stress response: P. aeruginosa bacteria directly sense oncoming T6SS attacks through the resulting perturbations to their membranes, probably via the TagQRST pathway 95 . By sensing the specific location of these strikes, defenders gain valuable information on the position of the attacker cells, helping them to more effectively counter-attack with their own T6SS weaponry 115 . There is also preliminary evidence that competition sensing by P. aeruginosa is induced by the cytotoxins of S. aureus, which is a key ecological competitor during infections 116 .
Competition sensing, therefore, enables bacteria to infer the presence of competitors, facilitating the efficient activation of defences and counter-attacks. There is growing evidence that stress responses can play analogous roles in sensing and responding to cell damage stemming from other biotic threats. Envelope stress responses are frequently triggered during phage infection: filamentous phages compromise E. coli membrane integrity during chronic infection, triggering the so-called 'phage shock' cascade and activating membrane repair pathways 117 . Likewise, lytic phages stimulate phage shock proteins in Lactococcus lactis, which responds by altering its metabolism to restore loss of proton-motive force 118 . Certain toxin-antitoxin systems sense phage infection via canonical stress responses or via transcriptional changes caused by infection 119 . In a similar vein, cellular damage can warn of predator activity. Tetrahymena ciliates engulf bacteria to feed on them, but this can activate the bacterial SOS response. When Tetrahymena eat enterohaemorrhagic E. coli, the engulfed bacteria retaliate by suicidally releasing Shiga toxins, killing the predator from within and protecting kin cells from the predator 120 . Shiga toxins are the causative agents of enterohaemorrhagic diarrhoea 121 , underscoring that anti-predator defences can be linked to human disease.
Cell damage is a reliable indicator of an urgent threat 79,112 , but by the time a cell detects injury, it may already be too late for defensive action. For instance, E. coli cell invasion by Bdellovibrio predators prompts host upregulation of genes associated with osmotic, envelope and general stress responses, but these do not seem to confer any resistance to the predator 122 . In such cases, detecting alternative attack signatures, such as chemical cues that precede an attack, may provide an important alternative to damage sensing 79 . Through 'danger sensing' 123 , bacteria intercept chemical signatures of the attacker, such as peptidoglycan sheddings 124 or signal molecules (Fig. 3). Some bacteria express receptors for quorum-sensing molecules that they themselves do not produce 125 , which enables them to 'eavesdrop' on the communications between competitor strains and thereby monitor their density 79,123 . Similarly, the perception of predator-associated chemical cues is widespread in planktonic microorganisms 126 ; for instance, Pseudomonas fluorescens responds to diffusible cues produced by protozoan predators by releasing membrane-disrupting biosurfactants that are toxic to protozoa 127 . Intriguingly, some bacteria are even capable of directly sensing toxins from attackers (for example, antimicrobial peptides 123 and β-lactam antibiotics 128 ) and responding before the toxin takes its effect. In the sense that genetic material injected by phages is itself a harmful agent, anti-phage systems that detect foreign DNA (for example, CRISPR, restriction-modification and DISARM systems) fall into this sensing category.
When attacked, bacteria can also forewarn their kin of danger, priming defences in advance of physiological harm. When attacked by phage or antibiotics, P. aeruginosa cells produce a quinolone signal that repels other clonemates from the affected area 129 . Similarly, in response to neighbour infection, non-infected Bacillus subtilis cells can modify phage binding sites (cell wall teichoic acid polymers) on their surface, adding analyl groups that hinder phage binding 130   Examples are ordered according to the proximity of potential harm and grouped according to type. Some cues result from direct harm to a focal cell (harm from abiotic stressors; nutrient depletion or attacks by competitors); bacteria identify and distinguish these cues via competition sensing and respond defensively. Bacteria can also respond to attacks before they themselves are harmed, activating defences in response to danger cues (kin lysate, non-kin toxins, signals and other molecular attacker signatures). Bacteria also use autoinducer-mediated quorum sensing and other density-sensing mechanisms, to raise defences in anticipation of attacks.

Review article
production in kin cells. These cues are sensed via transduction pathways (for example, the Gac-Rsm and PhoPQ pathways in P. aeruginosa and other Gammaproteobacteria) that are often independent from classic response pathways 131 . These mechanisms again enable cells to raise defences and launch counter-attacks before they enter stress states 123,132 .

Bacteria associate nutrient depletion with competition
Short of direct threat, certain environmental changes can also imply the presence of competing organisms. Nutrient starvation may indicate exploitative competition, driven by high numbers of clonemates, competitors or both 112 (Fig. 3). Consistent with their use in competition sensing, bacteria use starvation stress pathways to regulate the production of anti-competitor toxins 79 . For example, the stringent response is a ubiquitous signalling cascade that is triggered by limitations to key resources such as amino acids, fatty acids, inorganic phosphate or iron 133 . As well as triggering cell cycle arrest and the cessation of growth, the stringent response upregulates the production of toxins across diverse bacterial species [134][135][136] .

Bacteria use kin density to forecast threats
A third important information source for defence regulation is quorum sensing 112,137,138 . By monitoring the concentration of density cues (both canonical quorum-sensing autoinducers and other 'quorum-related' cues 79 ), bacteria can sense high kin densities and prepare for an expected attack (Fig. 3). Recent work demonstrated that CRISPR-Cas activity and adaptation is regulated via quorum sensing, such that antiviral defences are primed when bacteria are at high density and most vulnerable to virulent phage 139 . Density sensing also informs whether bacterial groups have sufficient members for collective defences to be effective. Biofilm defences are frequently regulated using quorum sensing 137,140 ; various bacterial species also use quorum sensing to control collective attacks using antibiotics 141 , bacteriocins 142 or T6SSs 143 . For instance, when at high cell density, P. aeruginosa produces the phenazine pyocyanin in a quorum sensing-dependent manner. Among a wealth of other potential functions, pyocyanin production was recently found to stimulate upregulation of multiple efflux pump systems, which means that cells are better defended against a range of antibiotics 144 .

Evolution of defences
How did bacteria acquire their impressive defensive functions? At a fundamental level, the evolution of biological functions ('adaptation' in evolutionary biology) is driven by natural selection acting on variation 145 . In bacteria, two key processes generate the variation upon which natural selection depends. Mutation, stemming from DNA replication error or chromosomal rearrangements 146 , generates raw genetic sequence variation, and horizontal gene transfer (HGT) adds further variation by mixing alleles and genes among different cells 147 . Phages, competitors and predators can then generate natural selection and favour bacterial variants with improved defences. In this section, we discuss how these processes enable the evolution of defensive traits, before examining how this impacts bacterial genomes (Fig. 4).

Evolutionary processes
Mutations and other genetic changes. Compared with larger organisms, mutational variation often arises quickly in bacteria because of their short generation times and large population sizes 148

Review article
can enable the rapid emergence of protective phenotypes. Simple point mutations can drastically reduce toxin-binding affinities of their targets, generating resistance to antibiotics 149 , bacteriocins 150 and phages 151 (Fig. 4a). Minor changes in regulatory genes can also provide protection against harmful agents. For example, inactivation of a repressor gene (ramR) in S. Typhimurium results in overexpression of the AcrAB efflux pump, conferring resistance to diverse quinolones, phenicol and tetracycline antibiotics 152 . Likewise, alterations to regulators of lipopolysaccharide 153 and cell wall synthesis 154 have been shown to generate resistance to bacteriocins, antibiotics and phages. Mutation rates can also increase in times of stress 155 or at low cell density 156 , potentially accelerating defensive adaptation 157 .
Horizontal gene transfer. Bacteria can also acquire new defensive genes from other microorganisms via conjugation, natural transformation and transduction 158 (Fig. 4a). These HGT events have a central role in bacterial evolution 159 and seem to be particularly important for defence evolution 160 . HGT can provide a suite of new genes to a recipient cell in a single step 159 , which confers a complex protective phenotype much more quickly than would be possible through mutation alone. In addition, HGT can rapidly generate novel and beneficial combinations of alleles via recombination 161 . HGT has facilitated the spread of defences against bacterial, viral and eukaryotic threats. Resistance to antibiotics is often conferred by plasmids 162 and integrative conjugative elements 163 . Other antibacterial weapons and their cognate defences, including bacteriocins 19 , T6SS 51 and Cdi 164 systems, are frequently encoded on mobile elements, such that bacteria can gain resistance and potentially new attack capability through HGT. Many phage protection systems are also extensively shared via HGT [165][166][167] . Although less well documented, anti-predator toxins can be acquired in the same manner: the biosynthetic operon for the toxin pyrrolnitrin seems to be mobile 168 , and it confers protection against protozoa to various Gram-negative bacteria 169 .
Natural selection and genetic drift. Natural selection can act on the genetic variation generated by mutation and HGT whenever a threat affects survival and reproduction, and so bacterial fitness. In some situations, low population sizes can introduce stochastic changes in the frequency of a given genotype, which can limit defence evolution via genetic drift and related processes 170 . Nevertheless, the potential strength of natural selection for bacterial defences is made clear by evolutionary experiments with competitors, phage and predators, in which the rapid evolution of defences has been observed 154,[171][172][173] . This potential is further underlined by the current antimicrobial resistance crisis: the widespread use of antimicrobials by humans has created concerted selection for drug-resistant bacteria, making previously treatable infections deadly.
However, even when a particular defence is under strong natural selection, it may not lead to the fixation of a given genotype. The utility of some defensive genes can diminish as they become more common (frequency-dependent selection 172 ). For example, variability in the O-antigen composition of a pathogen is thought to be driven by frequency-dependent selection for evasion of host immune cells 174 , intestinal protozoa 175 or phages 176 , as rarer genotypes can have an advantage if they are less likely to be recognized. In other cases, pleiotropy can influence selection for defensive attributes 177 . Many defensive adaptations have secondary phenotypic effects that are subject to evolutionary trade-offs (antagonistic pleiotropy). For instance, bacteria that gain resistance to one type of lytic phage might suffer enhanced susceptibility to another 172 . Alternatively, resistance to one threat might also enhance protection to another (synergistic pleiotropy, also referred to as a 'trade-up') 177,178 . Moreover, even strong trade-offs can be insufficient to drive the loss of a defensive adaptation. Compensatory mutations can substantially reduce the fitness costs of defensive genes, which enables them to persist even in the absence of a threat 158 . This has worrying consequences for the long-term maintenance of antibiotic resistance genes: once a bacterium gains resistance, it might not easily lose it 179 .

Evolutionary consequences
Genomic organization of defences. The evolution of defences can have major impacts on bacterial genomes. Across diverse environments and lifestyles, genomes are replete with genes that encode defensive functions 180 . These genes are often clustered together in specialized repositories ( Fig. 4b-d), each encoding protection against a particular class of threat. Perhaps best-known are bacterial 'defence islands': these mosaiclike chromosomal regions are enriched in diverse antiviral defences and have been the source of multiple recent defence system discoveries 54,58,109 . In addition to antiviral genes, bacteria retain clusters of toxinimmunity and detoxification genes for use during anti-competitor warfare. Examples include the recently discovered antagonism resistance (arc1-3) clusters in P. aeruginosa 132 and the orphan immunity gene libraries (dubbed 'acquired interbacterial defence' arrays) widely found among human gut Bacteroides species 50,51 (Fig. 4b).
Some clusters acquire new defensive genes in a highly ordered manner. Many of the acquired interbacterial defence immunity genes seem to be actively captured via recombinases, which enables gut bacteria to expand into niches occupied by aggressive competitors 51 . CRISPR spacer libraries can likewise be regarded as gene capture systems, which generate arrays of phage DNA templates that guard against future infections 56 (Fig. 4c). Integrons, which are ancient DNAscavenging machines that capture mobile gene cassettes 181 , commonly confer antibiotic resistance and are another example of active defence acquisition (Fig. 4d). Multi-resistance integrons that contain up to eight resistance cassettes have been reported 182 , and super-integrons with >200 cassettes are also known 183 . Integron gene expression is triggered by cellular stress, and bacteria also seem to alter the expression of different integron genes by shuffling their order 184 .
Some defences are always found in a given species (that is, they form part of its core genome). Core defences include the outer membrane of Gram-negative bacteria (thought to be an adaptation to ancient antibiotic warfare 59 ), some restriction-modification systems 185 and multidrug efflux pumps 186 . However, many defence genes are found in the accessory genome and are a major contributor to intraspecific variation among bacteria 187-189 . Indeed, the content of the accessory genome can be overwhelmingly defensive 160 : in certain marine bacteria, anti-phage systems represent >90% of all accessory genes 190 .
The impact of selfish genes. The beneficial acquisition of new defensive capacities through HGT can occur as a by-product of the infectious actions of mobile genetic elements 159 . This can blur the lines of what can be considered a 'bacterial' defensive adaptation: a mobile element may be the primary recipient of the benefit of the defensive system 167 . Consider superinfection exclusion, whereby phage infection of a bacterium prevents similar phages from infecting the same cell. Although this may benefit the bacterium, superinfection exclusion presumably evolved because of benefits to the infecting phage, which then avoids competing with other phages for host resources 191 . In a similar vein, Review article some anti-phage or anti-plasmid systems may have first evolved not in bacterial chromosomes, but in mobile genetic elements, either as adaptations to fend off competing genetic parasites (using, for example, CRISPR and restriction-modification systems 167 ) or as systems to ensure their own maintenance during host replication (for instance, some toxin-antitoxin modules 192 ). Nevertheless, even if defence genes did not originate as bacterial adaptations, bacteria may still benefit from inter-parasite conflict, or may come to integrate and exploit selfish genes for their own ends. For example, CRISPR-Cas systems are often now part of the bacterial chromosome and are no longer under the direct control of mobile elements 193 .

Overcoming bacterial defences
Bacterial defences have the potential to coevolve with the offensive strategies of their aggressors. A new defence mechanism can generate natural selection on attackers for countermeasures, examples of which are shown in Fig. 5. Countermeasures may precipitate an evolutionary arms race, whereby attackers and defenders become progressively better-adapted to defeat each other 194 . However, such escalation is only one possibility: coevolutionary dynamics can also be cyclical, which may facilitate the coexistence of many different types of attack and defence strategies 195 . Coevolution can also be short-lived if antagonists diverge to the point of non-interaction: for instance, if a phage switches host preference away from a focal bacterium 196 . Alternatively, a defender might simply develop such a strong defence that an attacker is tolerated 36 or driven to extinction 197 . Whichever the trajectory it takes, the coevolution of attack and defence, measure and countermeasure, seems to be a major driver of bacterial diversity 198 .

Bacterial competitor countermeasures
Consistent with the prevalence of interbacterial warfare 2,4,5 , bacteria have numerous adaptations for thwarting the defences of competitors. One solution to the evolution of resistance is for an attacker to innovate new toxins; this selects for attackers with novel toxins, driving diversification of bacterial weapons 199,200 . Resistant targets may simply select for attackers that produce more toxin 173 or for those that secrete cocktails of multiple toxins (Fig. 5a). Of 102 bacteriocin-producing faecal E. coli isolates surveyed in a study in 2006, the majority (58%) produced two or more different bacteriocins 201 Fig. 5 | Counter-adaptations to bacterial defences by competitors, phages and predators. a, Attackers prevent degradation of their toxins (or DNA, in the case of phages) using adjuvants to inhibit defence enzyme function, or by modifying toxin structure. Toxin cocktails may offer toxin synergy and delay resistance evolution. b, Competitors bypass the membranes of their target cells using toxin injection systems (the type VI secretion system) or by disguising toxins as useful substrates ('Trojan horses'). Some toxins kill without triggering key stress responses, suppressing defensive behaviour ('alarm suppression').
Efflux pump inhibitors prevent expulsion of absorbed molecular toxins. Phages penetrate cell capsules using tail-mounted hydrolases, and adapt to alterations in host receptor structure via counter-modification or stochastic expression of receptor-binding proteins. c, Competitors degrade biofilms using dispersants and matrix hydrolases, and inhibit response coordination using quorum quenching. Phages override collective immunity by bypassing abortive infection mechanisms, using hijacked or surrogate immunity proteins to disarm suicide systems.

Review article
A diverse cocktail of toxins may also maintain lethal function over a wider range of environmental conditions, and there may be synergistic interactions between toxins 21 . Mirroring antibiotic combination therapy, toxin cocktails may also make resistance less likely to evolve in the first place 203 (Box 1).
A more sophisticated countermeasure is to directly inhibit a defensive mechanism, thereby negating resistance to a particular attack (Fig. 5a). The adjuvant clavulanic acid, which inhibits β-lactamase enzymes, functions in this way: the soil bacterium Streptomyces clavuligerus co-regulates clavulanic acid production with the synthesis of the antibiotic cephamycin C, enabling it to attack β-lactamase-protected competitors 204 . A related approach is to deploy efflux pump inhibitors 205 that limit the ability of target bacteria to remove toxins from the cell. Although this countermeasure has yet to be observed in bacteria, it has been suggested as a future avenue of adjuvant therapy 206 .
Attackers have also evolved ways of surmounting barriers to cell entry (Fig. 5b). For example, some bacteria produce 'Trojan horse' toxins called sideromycins 207 , which comprise an antibiotic covalently attached to a siderophore molecule. Siderophores are used by cells to scavenge iron and are imported via dedicated receptors that enable sideromycins to enter the cell and deliver their antibiotic cargo via

Biotherapeutic
Medicine that is derived from (and often incorporating) biological entities.
Phages are a potential biotherapeutic for treating bacterial infections.

Collective defence
Any defensive behaviour that becomes more effective when many individuals engage in it. Collective defences benefit the social partners of a focal bacterium, but do not always evolve for this reason.

Competition sensing
The bacterial behaviour of discerning and responding to stress cues associated with competitor activity, often via stress responses. This is often used to regulate defences, especially counter-attacks.

Competitor
Another type of bacterium that competes with a focal bacterium for resources. Often this will be a genetically similar but non-identical bacterium (for example, a different strain), as similar bacteria are most likely to have overlapping resource needs. Genetically identical organisms compete in an ecological sense, but not in an evolutionary sense (as they have the same evolutionary interests). In this Review, we use the term in the former sense.

Counter-attacks
Aggressions in response to aggression (apparent or actual).

Danger sensing
Conceptually similar to competition sensing, but pertaining to cues other than those resulting from direct harm to a focal cell.

Defence mechanisms
Traits that evolved, at least in part, to protect an organism against a threat.
This term is often used in the context of bacterial defences against viral threats, but in this Review, we expand it to encompass protection against competitors and predators.

Predators
Organisms that consume others for food, killing them in the process.

Weaponry
Cellular systems that evolved, at least in part, to harm other organisms.

Review article
the same route 208 . Some bacterial weapons take a more direct route to toxin translocation: the bacterial T6SS physically punctures target cells, conveying toxins into the target cell without the need to rely upon specific surface receptors or transporter machinery. This direct approach to toxin delivery affords the T6SS a very broad range of target organisms, spanning both Gram-negative and Gram-positive bacteria, fungal cells and other eukaryotes 209 . Finally, attackers can thwart collective defences (Fig. 5c), using proteases and surfactants to disperse biofilm-dwelling bacteria 210 and quorum-quenching molecules to disrupt intercellular signalling and collective responses, including biofilm formation 211 . Additionally, attackers can avoid mass retaliation by deploying 'silent' toxins that are poorly detected by stress responses, thereby suppressing competition sensing 101 .

Phage and predator countermeasures
Phages have a well-described set of counter-adaptions that enable them to bypass bacterial defences 212 . These adaptations include countermodification of phage tail fibres to bind modified cell surface receptors 198 , and epigenetic modification of phage DNA to mimic the host DNA, thereby escaping degradation via restriction-modification systems 213 . Similarly, coliphage P1 injects defence against restriction (Dar) proteins during infection, masking the recognition sites on its DNA targeted by host restriction enzymes 214 . Some phages encode anti-CRISPR proteins that bind to and inhibit CRISPR-Cas complexes 215 ; others possess tail sections with hydrolytic domains, which enable them to penetrate the thick poly saccharide capsules of host cells 216 . Phages also have evolved ways of bypassing bacterial abortive infection mechanisms, thus preventing hosts from interrupting construction of progeny phage 102 . For example, coliphage T4 encodes Dmd, an antitoxin 'mimic' that disarms suicide toxins during infection 217 . Paralleling bacterial quorum sensing, some phages even use their own peptide signal, called arbitrium, to assess local phage density, transitioning from lytic to lysogenic lifestyles when phage density is high and uninfected hosts are scarce 218 . Although not a countermeasure per se, this example underlines the sophistication of the responses of phages to their hosts. Meanwhile, although less well-studied, predator adaptations to bacterial defences are also known 219 . These include countermeasures to overcome toxin production by prey: mirroring P. aeruginosa, the free-living amoeba Acanthamoeba castellanii has modified cytochrome oxidases, which enable it to tolerate prey-produced cyanide 169 . Some eukaryote predators may also be able to suppress toxin production by prey 169 , including via quorum-quenching mechanisms 220 .

Conclusion
Bacteria have evolved a wide range of defensive adaptations that can make them difficult to kill. Knowledge of these defences has already driven technological revolutions in microbiology and beyond, providing researchers with new tools (restriction enzymes 53 , CRISPR gene-editing 56,221 and DNA interference (DNAi)/RNA interference (RNAi) silencing 58 ) and therapeutic approaches (novel antivirals 222 , antimicrobials 223 and biotherapeutic agents 224 ). In addition to these applications, defence systems are also central to understanding bacterial biology: they are deeply integrated into their core regulatory networks 79,81,123 and can determine which species will persist in a given environment 4,51,94,172 . Some defences protect only against a particular threat, but many are general and protect against a range of attacks 144,154,225 . Still others alter bacterial virulence 120,121,186 , with the potential to exacerbate disease transmission and severity.
These then are exciting times for the study of bacterial defences. Spearheaded by bioinformatic 165 and high-throughput 226 approaches, the staggering diversity of bacteria has become clear and with this, the myriad ways they can defend themselves. The past 5 years alone have seen an explosion in the number of novel anti-phage systems identified in bacterial defence islands 104,109,227 (>50 since 2018), with many more probably awaiting discovery. The diversity and spread of these anti-phage systems highlight how little, in comparison, we know of anti-competitor and anti-predator defences. What might these same approaches teach us about bacterial adaptations against ever-present predator or competitor threats? Early signs are promising: as with the bountiful phage defence islands, anti-competitor defence genes also form clusters in bacterial genomes 51,132,184 ; mining these might therefore reveal novel routes through which bacteria evade attacks by rivals.
We must also understand the broader impacts of bacterial defenses within microbial communities, and the conditions that trigger them. A major current goal is to control bacteria and their communities, both ecologically and evolutionarily 3,228,229 . Replacing a pathogen in a community with a biotherapeutic strain 230 , for example, will require us to understand both the attack and defence strategies of bacteria 5,10 . And whenever we attempt to eliminate bacteria, whether via antibiotics or through one of the emerging alternatives, there is the potential for evolution 9 . Understanding, and anticipating, how bacterial defences evolve is an important goal for the future.