AISI's biological AI containment studies

Two AISI studies examined common strategies for managing misuse risk in biological AI tools and found both fall short of durable containment. In the filtering study, removing viral protein sequences from open-weight protein language model pretraining data degraded capability on those sequences while leaving other capabilities intact. Fine-tuning on the withheld sequences fully restored performance across all tested model sizes. The recovery cost was approximately $80 of H100 compute for a 3 billion parameter model. Because viral protein sequences are routinely made publicly available even when excluded from model training, the withheld data remains accessible. As AISI stated, filtering raises the cost of recovering a capability rather than removing it permanently.

The ReproBAIT study, conducted jointly with SecureBio, tested four coding agents, Claude Opus 5, GPT-5.6 Sol, Kimi K3, and Qwen3.8-2.4T, in isolated sandboxes without internet access. Given a tool's abstract or full paper plus training data, agents matched selected metrics of two of three tested biological AI tools, typically for $4 to $20 on a single GPU. They did not successfully rebuild RFdiffusion3, the most complex tool. Providing a full paper versus only an abstract made little consistent difference to success rates. AISI concluded that withholding code does not by itself make a release safe and that controlling access to the underlying data looks more promising. Audit Commons noted the study's scope: three tools, one metric each, best-of-three scoring, with training data supplied to agents. The filtering study concerns protein language models trained on biological sequences, not general-purpose chatbots; the viral data refers to virus protein sequences filtered as a safety measure.