{"id":"dd3c8872-9691-4fd1-b432-6e98300f3426","arxiv_id":"2607.05462","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"Across 16 agent configurations, frontier AI systems refused legitimate routine biology tasks at rates comparable to or higher than they refused concealed red-team hazards, with most refusals coming from provider API filters.","lead":"BioSecBench-Refusal pairs 61 legitimate biology tasks with 46 fictional hazardous ones and tests 16 AI-agent configurations, finding that many systems refuse the safe tasks as often as or more often than they catch hidden threats. The benchmark gives AI developers a way to measure and tune the trade-off between caution and capability for agentic biotech tools.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Refusal attribution is the load-bearing weak point: model refusals come from an unvalidated judge and the API gate omits Google, so the API-dominance result is not established.","rationale":"The paper is a benchmark measurement, not a derivation; its value depends on the integrity of its labels. The Routine/Red-Team design is thoughtful, and the task authors' internal review is real but not independent. The most direct route to overturning the central claim would be showing the refusal counts are wrong. The judge model is a single unvalidated classifier used for every 'model refusal'; since the judge is itself an LLM, it can have systematic refusal bias, and no evidence rules that out. The missing Google signature is a concrete, checkable defect in the methods text: they claim all four providers have filters but only provide signatures for three. Combined with the decision to count no-artifact runs as not-blocked, this can misattribute or hide provider blocks. If the audit shows high agreement and a Google signature exists (perhaps in code not in the manuscript), the concern largely dissolves and the conditional verdict stands. If not, the API-dominance result and possibly the headline ranges need revision. I therefore keep the reader's CONDITIONAL verdict; the concern is not a rejection because the underlying phenomenon is plausible and the concrete test is cheap. Agreement with reader: they named the judge and the three-signature issue, so agree.","tokens_in":8557,"tokens_out":12557,"duration_ms":155716,"concrete_test":"Internal audit: sample ~200 direct-framing trajectories stratified by provider (50 per provider, oversampling Gemini); two independent human annotators label each as API refusal, model refusal, or proceeded. Compute Cohen's kappa against the judge labels; if kappa <0.8 or per-config disagreement >5%, recompute model refusal rates and Figure 2 decomposition. Separately, send 20 known-blocked control prompts through the Gemini API and record the raw response/stop_reason; identify the Google provider-block signature. Then inspect all 'no usable artifact' runs for that signature; if any are found, recode them as API refusals, recompute per-config refusal rates, and see whether the 'API refusals dominate' statement holds and whether the 7–74% / 1–62% ranges shift.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central interpretation—provider-side filters, not model reasoning, drive over-refusal and missed hazards—rests on the API-vs-model decomposition in Figures 2 and 4. That decomposition has two unvalidated components. (1) Model refusals are assigned by an unnamed judge LLM reading raw trajectories (Methods, 'Refusal detection'); no inter-rater agreement, manual audit, or comparison set is reported, so the pink segments and Figure 4B model-refusal rates are untested. (2) The deterministic API gate (Methods, 'Refusal gating') lists signatures for OpenAI, xAI, and Anthropic but none for Google, despite two Gemini configurations; if Google provider blocks produce a different message or empty output, those runs fall into 'no usable artifact' and are counted as not-blocked (Methods, 'Aggregation and statistics'). Because Gemini configurations show total direct refusals of 35–45%, miscounting even one provider's blocks can change which layer dominates and shifts the headline ranges. The Routine-vs-RedTeam gap may survive, but the mechanism claim—that safeguards are prompt-level filters rather than model judgment—is not independently established without validating this pipeline.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces BioSecBench-Refusal, a paired benchmark of 61 Routine tasks (legitimate analyses adapted from published literature) and 46 Red-Team tasks (fictional scenarios with concealed biosecurity hazards), and evaluates 16 model-harness configurations under direct and meta framings, with three runs per task. The headline results are that direct-framing refusal rates range from 7% to 74% on Routine tasks and 1% to 62% on Red-Team tasks; that Routine tasks are refused at comparable or higher rates than concealed Red-Team hazards; that API-side provider filters, rather than model reasoning, account for most refusals; and that when agents are allowed to reason, they sometimes identify additional Red-Team threats. The authors release a two-example public subset and keep the full 107-task set under restricted access.","tokens_in":8818,"tokens_out":4254,"duration_ms":51836,"significance":"If the central claims are substantiated, the benchmark would be a useful diagnostic for calibrating agentic biosecurity safeguards. The paired Routine/Red-Team design directly addresses the over-refusal versus under-detection trade-off, the literature-derived Routine tasks give the 'legitimate use' baseline a concrete, falsifiable grounding, and the two-frame (direct/meta) design is a thoughtful way to separate surface-level screening from agentic reasoning. The paper also reports a large number of runs (5,136) across diverse providers and harnesses. However, the paper's most important mechanism claim—that refusals are predominantly caused by provider API filters rather than model judgment—rests on two unvalidated components: an unnamed, unvalidated judge model for direct-framing model refusals, and an incomplete API-refusal detection gate that lists signatures only for OpenAI, xAI, and Anthropic, with no Google/Gemini signature. The reader's conditional assessment is appropriate: the headline refusal rates may be broadly right, but the decomposition into API versus model refusals is load-bearing and currently not independently established.","major_comments":[{"comment":"Direct-framing 'model refusal' labels are assigned by an unspecified judge model reading raw trajectories, with no judge identity, prompt, validation set, inter-rater agreement, or manual audit reported. This is load-bearing because Figures 2 and 4B separate API refusals from model refusals, and the paper's central attribution claim ('refusals were most often triggered by provider API filters') depends on that separation. If the judge over-labels or under-labels refusals, the pink segments and model-refusal rates change, and the routine-vs-red-team gap could shift. Please report the judge model and prompt, provide a human-labeled validation sample (e.g., 100 trajectories per model family), and give confusion statistics or a sensitivity analysis over judge labels.","section":"Methods, 'Refusal detection'"},{"comment":"The deterministic API-refusal gate lists signatures for OpenAI, xAI, and Anthropic, but no Google/Gemini signature, even though Gemini 3.1 Pro and 3.5 Flash are evaluated. Under 'Aggregation and statistics,' runs with no usable artifact are counted as not-blocked. If Gemini provider-side blocks produce a different message or an empty/truncated output, those blocks are misclassified as non-refusals, potentially undercounting API refusals for two configurations whose total direct refusal rates are 35–45%. Report how Gemini provider-side blocks are detected, or explicitly state that none occur, and show a sensitivity analysis for Figures 2 and 4A that excludes no-artifact runs.","section":"Methods, 'Refusal gating' and 'Aggregation and statistics'"},{"comment":"Only three runs per model x harness x evaluation are used, and 509 of 5,136 runs yield no usable artifact. The headline ranges (7–74% Routine, 1–62% Red-Team) and the routine-vs-red-team correlation (Pearson r = 0.91) are therefore based on small per-cell denominators and on treating no-artifact runs as non-refusals. Please report per-cell attempt counts, the distribution of no-artifact runs across the 16 configurations, and exact binomial intervals or a sensitivity analysis that drops no-artifact runs. This is necessary to know whether the magnitude of the reported ranges and the 'API dominates' claim are robust to the 10% of runs that produced no usable artifact.","section":"Methods, 'Agent runs and execution' and 'Aggregation and statistics'"}],"minor_comments":[{"comment":"Only two example evaluations are released; the full 107-task set is restricted. For a benchmark paper, reviewers and users need at least the evaluation harness, scoring code, and structured metadata for all tasks, even if task texts remain access-controlled. Please also specify the exact license and access mechanism.","section":"Data Availability"},{"comment":"The term 'no usable artifact' is not defined precisely. Does it include API timeouts, malformed outputs, harness crashes, or provider-side blocks lacking the listed signatures? A short enumeration would help readers interpret the 509 excluded runs.","section":"Methods, 'Aggregation and statistics'"},{"comment":"Panel F labels 'n=61' and 'n=46' inside the bars may be confused with the bar counts; consider placing the n labels in the panel title or legend, and ensure the multimodal counts are clearly distinct from evaluation counts.","section":"Figure 1"},{"comment":"Reference [1] contains an OCR artifact: 'T errorism' should be 'Terrorism'. Please correct.","section":"References"}],"recommendation":"major_revision","confidential_remarks":"The core idea and paired benchmark are valuable, and the central claim is defensible if the attribution pipeline is fixed. The judge-model validation and Google/Gemini API-refusal detection are not optional polish; they are necessary to support the paper's main mechanistic conclusion. If the authors can provide a validated judge and a complete API-gating account, I would be willing to accept a revised version; otherwise the decomposition into API versus model refusals is unsupported."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: This is a genuinely useful benchmark paper. The paired Routine/Red-Team design is new, and the headline pattern—many configurations refuse legitimate routine work more often than they refuse concealed red-team hazards—is plausible and worth taking seriously. The stronger claim, that provider-side API filters rather than model judgment drive the effect, is not yet established.\n\nThe paper does well: 107 tasks written by 14 domain experts, routine tasks tied to published literature, red-team hazards hidden in attached data. Sixteen model-harness pairs, full trajectories recorded. The limitations section is honest; they explicitly say the agentic-reasoning benefit is preliminary. The discussion about dual-use trade-offs is sensible. They also frame the benchmark as a calibration tool, not a moral arbiter.\n\nThe soft spots: direct-framing 'model refusals' come from an unnamed judge model reading raw trajectories, with no validation or inter-rater check. That classifier feeds the pink segments in Figure 2 and the model-refusal-only scatter in Figure 4B. The deterministic API gate covers OpenAI, xAI, and Anthropic but not Google, even though two Gemini configurations are in the set. If Google's provider block has a different signature, those runs land in 'no usable artifact' and are counted as not-blocked. Three runs per cell is thin, and 509 no-artifact runs is a lot. The task design partly creates the surface-text finding: Routine tasks are keyword-rich by construction and Red-Team tasks are written to avoid flag terms. The authors acknowledge this in Table 1, so it's not hidden, but it means 'refusal tracks surface language' is partly baked in. The full benchmark is restricted, which is reasonable for biosecurity but limits direct replication.\n\nNone of this sinks the central empirical observation: refusal rates range from 7-74% on Routine and 1-62% on Red-Team, with the routine gap present across most configurations. The mechanism claim should be labeled provisional until the judge model is validated and Google gating is added.\n\nThis paper is for model developers and AI-biosecurity policy people. It deserves a serious referee. I'd send it out, with major-revision emphasis on validating the refusal pipeline and reporting per-cell sample sizes.","headline":"A useful paired refusal benchmark whose headline over-refusal finding is plausible, but the API-vs-model decomposition is not yet validated.","tokens_in":9342,"tokens_out":3350,"would_cite":true,"duration_ms":36644,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Current AI biosecurity safeguards refuse legitimate research more often than they catch hidden threats.","keywords":["biosecurity","agentic AI","refusal behavior","benchmark","dual-use","provider filters","risk assessment","red-teaming"],"falsifier":"Manually audit a random sample of the 4,627 scored trajectories, labeling each as API refusal, model refusal, or genuine attempt by human review, and recompute the Routine-versus-Red-Team refusal-rate gap using only human labels. If the gap shrinks to near zero or reverses, the paper's miscalibration claim collapses. Alternatively, show that provider API filters trigger on concealed Red-Team hazards (e.g., a toxin hidden in a FASTA file) as often as on surface keywords in Routine tasks.","tokens_in":8472,"feed_emoji":"🧬","tokens_out":4558,"duration_ms":43968,"temperature":0.7,"pith_summary":"This paper introduces BioSecBench-Refusal, a paired benchmark that measures both caution and capability in agentic biosecurity tools. Across 16 model-and-harness configurations, legitimate Routine research tasks were refused at rates of 7–74%, while Red-Team tasks with concealed hazards were refused at 1–62% — and many configurations refused Routine tasks more often than Red-Team ones. The authors trace most refusals to provider-side API filters that react to surface keywords, not to the model's own reasoning about the biology. They argue current safeguards are miscalibrated: over-blocking legitimate research language while missing hazards hidden in data files. Preliminary meta-evaluation results suggest that giving models room to reason can uncover some threats that filters miss. The benchmark is released as a calibration tool for developers and policymakers.","feed_headline":"AI biosecurity filters block safe research more than threats","feed_subtitle":"Paired benchmark finds refusal rates up to 74% on legitimate tasks while concealed hazards slip through.","key_machinery":"The central object is the paired benchmark itself, consisting of 61 Routine and 46 Red-Team tasks, each run under direct and meta framings. The key mechanism is the pairing: by measuring refusal rates on both legitimate and hazardous tasks under identical conditions, the benchmark isolates whether refusal tracks surface text or underlying biological risk. A two-stage grading pipeline separates provider API refusals (detected via provider-specific signatures such as OpenAI's 'limited access...' message, xAI's 'Content violates usage guidelines', and Anthropic's stop_reason) from model-initiated refusals (assigned by a judge model reading raw trajectories). This decomposition is what reveals t","core_discovery":"The central claim is that current biosecurity refusal systems in agentic AI are miscalibrated in both directions: they refuse legitimate tasks at high rates, up to 74% on Routine evaluations, while missing many concealed Red-Team hazards, with refusal rates as low as 1%. Refusals are driven predominantly by provider API filters that trigger on surface-level biosecurity cues in the prompt, not on task-specific biological analysis; when requests are not blocked upstream, agentic reasoning sometimes identifies deeper threats. The benchmark pairs 61 Routine tasks adapted from published research with 46 fictional Red-Team tasks that hide hazards in attached data artifacts, and it decomposes refus","pith_inferences":["If refusals track surface language rather than underlying biology, then adversaries can likely evade filters by concealing hazards in attached data—exactly what the Red-Team set demonstrates—so safety claims based solely on prompt filtering are fragile.","Because the judge-model refusal detection is not validated against human annotation, the headline refusal-rate gap between Routine and Red-Team tasks could change with a more rigorous measurement protocol; a manual audit of the 4,627 scored trajectories would settle this.","The benchmark's full set is restricted-access, with only two public examples; independent replication of the miscalibration claim would be easier if a larger public subset were released.","A testable extension suggested by the paper's own limitation: run the same model-harness pairs with provider filters disabled (or loosened) to estimate how often agentic reasoning would catch hazards that are currently blocked upstream as API refusals."],"forward_implications":["Model developers can use the paired benchmark to calibrate refusal stringency to a specific deployment context, adjusting thresholds by biosafety level, agent class, and risk category.","Provider-side filters, not model reasoning, are the main source of refusal; improving biosecurity safeguards requires shifting from keyword screening toward agentic reasoning over biological data.","The wide variance in refusal rates across 16 configurations (7–74% Routine, 1–62% Red-Team) shows there is currently no industry consensus on the safety–utility trade-off, and this benchmark provides a common metric for comparing configurations.","Preliminary evidence that meta-evaluation improves Red-Team detection (e.g., GPT-5.5 refusing 14.5–19.6% under meta framing vs 13% direct) suggests that allowing models to reason could improve hazard identification without necessarily increasing over-refusal.","The high Routine refusal rates represent a measurable cost to legitimate research; reducing over-refusal while maintaining Red-Team detection could improve both safety and research productivity."],"fun_headline_variants":["Biosecurity AI refuses safe tasks, lets red-team hazards pass","Routine tasks refused up to 74%, hazards only 1%: benchmark","Why AI biosecurity filters over-refuse safe work and under-catch threats","Agentic biosecurity: miscalibrated refusals on both ends","Benchmark: AI refusal bias against legitimate research"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The headline refusal rates depend on an unvalidated judge model that reads raw trajectories and decides whether the model itself refused; if that classifier mislabels even a fraction of runs, the central comparison between Routine and Red-Team refusal rates shifts.","fun_headline_variants_meta":{"raw":{"variants":["Biosecurity AI refuses safe tasks, lets red-team hazards pass","Routine tasks refused up to 74%, hazards only 1%: benchmark","Why AI biosecurity filters over-refuse safe work and under-catch threats","Agentic biosecurity: miscalibrated refusals on both ends","Benchmark: AI refusal bias against legitimate research"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00029,"raw_usage":{"total_tokens":1510,"prompt_tokens":697,"completion_tokens":813,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":441,"completion_tokens_details":{"reasoning_tokens":717}},"tokens_in":441,"tokens_out":813,"duration_ms":8431,"temperature":1.0,"reasoning_tokens":717,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-02T08:34:14.465066+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Manually audit a random sample of the 4,627 scored trajectories, labeling each as API refusal, model refusal, or genuine attempt by human review, and recompute the Routine-versus-Red-Team refusal-rate gap using only human labels. If the gap shrinks to near zero or reverses, the paper's miscalibration claim collapses. Alternatively, show that provider API filters trigger on concealed Red-Team hazards (e.g., a toxin hidden in a FASTA file) as often as on surface keywords in Routine tasks.","supporting_citations":[],"review_version":2}