UK AISI studies find safeguards on biological AI tools can be undone or bypassed

The UK AI Security Institute (AISI) published two Chem-Bio team studies on 26 October, each testing a safeguard that developers use to justify releasing specialised biological AI models or withholding their code. Both blog posts link to papers that had appeared on arXiv earlier, on 19 and 14 October.

The first study trained ESM-2 protein language models from scratch, from 8 million to 3 billion parameters, with viral proteins removed from the pretraining data. The paper reports that filtering degraded performance on viral proteins, especially those from human-infecting viruses, while largely preserving it on non-viral proteins, and that the effect grew with model size. But fine-tuning on sequences from the removed viral families restored the lost performance. Recovery got costlier as models grew, yet cost about $80 of H100 time even for the largest. AISI concluded that filtering is moderately effective but not durable alone, and should be paired with measures such as data access controls.

The second, ReproBAIT, built with SecureBio, asked coding agents to rebuild biological AI tools on one GPU with no internet, given only an abstract or a paper. The agents tested were Claude Opus 5, GPT-5.6 Sol, Kimi K3 and Qwen3.8-2.4T. All four matched or exceeded a closed-source molecule-design tool on the one metric tested, and the best agent reached 96.5% of ProteinMPNN’s sequence-recovery score. Successful rebuilds typically cost $4 to $20, as little as four hours for the simplest tool. No agent managed RFdiffusion3, the most complex, with attempts costing $102 to $301.

AISI listed caveats: only isolated functions were reproduced, the tools are small, and the open-source tools’ code was probably in the models’ training data. It still argued that withholding code does not by itself control access to a tool’s capability, and that controlling the underlying biological data looks the more promising intervention.