Pith. sign in

REVIEW 3 major objections 6 minor 93 references

This paper argues that frontier LLMs, when attacked by a specialized bio-red-teaming model, can produce hazardous viral sequences that are physically realizable — exposing a gap between text-level safety and biosecurity risk.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 16:13 UTC pith:QJ7C53RG

load-bearing objection The computational red-teaming sweep is real, but the paper's headline physical-realization claim is contradicted by its own methods section, so the abstract needs major revision before this can be taken at face value. the 3 major comments →

arxiv 2607.18056 v1 pith:QJ7C53RG submitted 2026-07-20 cs.CL q-bio.GN

An Early Warning of Emerging Biosecurity Risks in Frontier LLMs

Zhida He , Xia Hu , Baichen Le , Chunxiao Li , Jiajia Li , Lijun Li , Chaochao Lu , Jing Shao
show 15 more authors
Youbang Sun Hua Tang Xiang Wang Xiao Wang Xiaoyu Wen Tong Wu Jia Xu Peng Yu Shu Yu Jie Zhang Qiaosheng Zhang Yi Zhang Xing-Ming Zhao Tianhang Zheng Ziyuan Zhou
This is my paper
classification cs.CL q-bio.GN
keywords LLM biosecurityjailbreak attacksbio-red-teamingattack success rateviral sequence designnucleic acid synthesis screeningAlphaFold3AutoDock Vina
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper tries to establish that the safety alignment of frontier large language models does not yet cover biological misuse. The authors build Intern-BioBreaker, a red-teaming model trained specifically to generate jailbreak prompts, and show that most of 14 leading models can be pushed into giving dangerous operational guidance on bio-risk tasks, often at 100% attack success. They then go further, arguing that a jailbroken frontier model can emit modified viral sequences that pass computational screens for structure, receptor binding, and screening evasion, and that such designs are physically realizable rather than purely textual. If correct, this means biological risk from LLMs is not a text-classification problem but a material threat, making nucleic-acid synthesis screening and stronger safeguards urgent.

Core claim

The central claim is that a specialized bio-red-teaming model, Intern-BioBreaker, reveals a systemic gap: frontier LLMs' text-level safeguards can be bypassed to produce both actionable protocols and sequence-level designs with biosecurity implications. In benchmark tests, Intern-BioBreaker outperforms baseline attackers and drives most of 14 target models to high task-level attack success rates, with three reaching 100% on a fine-grained bio-risk benchmark and ten reaching 100% on a broader misuse benchmark. In a sequence-level case study, a jailbroken frontier model generates modified influenza hemagglutinin sequences that retain high identity to pathogenic strains, fold with high AlphaFol

What carries the argument

Intern-BioBreaker, a specialized bio-red-teaming model built through continued pre-training on scientific text, supervised fine-tuning on jailbreak rewrites, reinforcement learning against multiple defender models, and inference-time agentic multi-step prompt generation. It is paired with a cascading evaluation framework: a judge-based risk evaluator for refusal and actionable content, an in silico screen using BLASTN for screening evasion, AlphaFold3 for structural plausibility, and AutoDock Vina for receptor-binding prediction, plus a wet-lab verification protocol of DNA synthesis, SDS-PAGE, and LC-MS/MS. The coupling of jailbreak generation to physical-verification workflows is what lets

Load-bearing premise

The paper's 'physically realized' and 'enhanced infection potential' conclusions rest on computational surrogates (AlphaFold3 pLDDT, AutoDock Vina docking energy, BLAST E-value) being faithful to real biology, and the paper itself notes that physical synthesis was not executed, so the material-risk claim stands or falls on whether those surrogates carry the weight.

What would settle it

Synthesize the exact influenza HA and SARS-CoV-2 Spike DNA sequences the paper reports, express them in a host, and measure receptor binding and infection directly; if the proteins do not show the predicted expression or binding enhancement, the central claim fails.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • If the paper is right, current frontier LLM alignment is not an effective biosecurity safeguard: most tested models reached 100% task-level attack success on broad bio-risk prompts.
  • Model-generated DNA sequences that evade similarity-based screening and preserve structural plausibility would constitute credible threats to nucleic-acid synthesis screening, supporting mandatory screening and recordkeeping.
  • Bio-risk evaluation needs to become workflow-level and multi-turn rather than single-query refusal testing, because the demonstrated attacks unfold over multiple interactions.
  • The same red-teaming pipeline could serve as a standing pre-release benchmark for the biosecurity safety of future frontier models.
  • Even users with zero biological background can be guided by multi-turn LLM dialogue to a complete, evasion-capable synthesis plan, lowering the barrier to misuse.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The paper's phrase 'physically realized under controlled experimental settings' extends beyond what was executed: the wet-lab synthesis step was not performed, so this conclusion is an inference from protocols and computational screens rather than an experimental result.
  • A decisive extension would be to synthesize, express, and functionally assay the model-generated sequences; until then, the material-risk claim rests on the proxy validity of AlphaFold3, AutoDock Vina, and BLAST metrics.
  • Running the same in silico screen on randomly mutated viral sequences would calibrate the false-positive rate of the 'enhanced infectivity' thresholds and test whether LLM outputs are actually distinctive.
  • The demonstrated evasion tactics—codon randomization, intron insertion, and translation-frame shifts—suggest that nucleic-acid screening policies should move beyond similarity matching toward functional or structural screening.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper develops Intern-BioBreaker, a fine-tuned LLM-based red-teaming agent, and applies it to probe biosecurity vulnerabilities in 14 frontier LLMs. It reports task-level attack success rates (ASR) on two bio-risk benchmarks (SafeSci-Bio, SoSBench-Bio), a sequence-level case study in which GPT-5.5 is induced to generate modified influenza HA sequences that are then assessed via BLAST, AlphaFold3, and AutoDock Vina, and a claimed 'wet-lab' verification workflow for SARS-CoV-2 Spike and TAT_HV1H2 sequences. The abstract makes three headline claims: (i) Intern-BioBreaker outperforms baselines and reveals widespread jailbreak vulnerabilities; (ii) GPT-5.5 can generate modified viral sequences with predicted enhanced infection potential; and (iii) end-to-end verification shows these designs 'can be physically realized.'

Significance. If substantiated, the paper would provide a valuable early-warning demonstration that adversarial prompts can push frontier LLMs beyond policy-violating text toward sequence-level outputs with plausible biological risk, and it would motivate stronger nucleic-acid synthesis screening. The paper's strengths include a broad multi-model evaluation (14 targets), a clearly defined task-level ASR metric, explicit attacker profiles (knowledgeable and novice), and a thoughtful governance discussion. However, the central physical-realization claim is explicitly contradicted by the paper's own methods, and the primary benchmark evaluation is compromised by training/evaluation overlap. These issues are not cosmetic; they undermine the two headline contributions as currently stated.

major comments (3)
  1. [Abstract & §4] Abstract claim (iii), 'end-to-end verification shows ... can be physically realized,' is directly contradicted by §4 ('we did not proceed with the actual physical synthesis of these hazardous proteins') and §1 ('Though physical synthesis is not executed ...'). No SDS-PAGE gel, LC-MS/MS spectrum, or expression data appear in the paper; §2.2 describes only intended protocols, and all reported checks are computational (Prodigal-gv, AlphaFold3, BLAST, AutoDock Vina). The §6 sentence 'Wet-lab results demonstrate ...' is therefore unsupported. This is a load-bearing overclaim that must be either backed by real wet-lab data or removed from the abstract and conclusions.
  2. [§2.1 Stage 3 / §3.1.3] Intern-BioBreaker's RL stage is trained on SafeSci-Bio, and the main evaluation in Table 1 and Figure 3 is then run on SafeSci-Bio test samples drawn from the same dataset; no train/test split is reported. The high ASR on SafeSci-Bio (e.g., 60% vs 32% for Intern-S2-Preview) may partly reflect reward hacking or memorization of training prompts rather than a genuinely transferable jailbreak method. The SoSBench-Bio results provide some independent evidence, but the paper should report results on a held-out split or on a benchmark not used in training, and should re-express any SafeSci-Bio-based claims accordingly.
  3. [§3.2.2 / §4] The leap from computational surrogates to 'enhanced infection potential' is not justified. In Figures 5 and 6, the docking-energy differences (e.g., −6.475 ± 0.159 vs −5.695 ± 0.042 kcal/mol) are within typical AutoDock Vina run-to-run variability and are not accompanied by statistical tests or a calibrated threshold. AlphaFold3 pLDDT > 70 indicates confident structure prediction, not functional viability or enhanced infectivity. BLAST E-value > 1×10⁻⁵ demonstrates evasion of sequence-similarity screening, not pathogenic potential. The paper should explicitly limit conclusions to 'computational candidates' unless independent empirical validation (e.g., receptor-binding assays) is added.
minor comments (6)
  1. [§3.1.5] ASR is reported as a point estimate with no confidence intervals or significance tests. Given the small task-level sample sizes (100 SafeSci-Bio tasks, 200 SoSBench-Bio tasks), the claim that Intern-BioBreaker outperforms baselines by 25+ points should be accompanied by uncertainty quantification.
  2. [§3.2.2] The filtering criterion '>95% identity to known pathogenic strains ... treated as having pathogenic potential' sits oddly with the stated goal of generating 'modified' sequences. High identity suggests the modifications are minor; the relationship between identity threshold and pathogenic-potential inference should be clarified.
  3. [§3.2.2 / Figures 5–6] The strain name 'A/Thesssaloniki/2904/2009/H1N1' contains an apparent typo (double 's'); also the figure panels report average pLDDT values but do not clearly define the 'G' label (presumably Gibbs free energy) or the units in the caption.
  4. [§4] The statement 'In silico validation revealed high efficacy and stealth across the board' is accurate only for computational predictions; phrases such as 'preserved the native structural integrity and functional viability' overstate what AlphaFold3 pLDDT can certify.
  5. [§6] The ethical-considerations section repeats the unsupported claim that 'Wet-lab results demonstrate that frontier models provide non-expert actors with end-to-end guidance...' This sentence should be revised to reflect that only in silico validation was performed.
  6. [References] Several citations refer to 2026 preprints and unreleased models (e.g., GPT-5.5, DeepSeek-V4-Pro, Gemini 3.1 Pro Preview). Please confirm these references are verifiable and stable; if they are project pages, provide access dates and version identifiers.

Circularity Check

1 steps flagged

SafeSci-Bio ASR is trained and tested on the same dataset, making the headline benchmark comparison partially circular; independent SoSBench evidence limits the score.

specific steps
  1. fitted input called prediction [Section 2.1 Stage 3 (RL training) and Section 3.1.3 'Datasets and Benchmarks']
    "The training data consist of biological sequences from the SafeSci-Bio dataset [33], with a particular focus on AGTC-class sequence data that require harmful rewriting. ... We use the SafeSci-Bio data for training, and sample 20 examples from each of the five task types, resulting in 100 test samples."

    Intern-BioBreaker is RL-trained on SafeSci-Bio sequences and rewarded for generating attacks that succeed on SafeSci-Bio-style tasks, then its headline ASR is measured on test samples drawn from the same dataset with no reported disjoint split. The SafeSci-Bio ASR reported in Table 1 and Figure 3 (e.g., 60% vs. 32% for Intern-S2-Preview against GPT-5.5, and 3/14 models at 100% ASR) is therefore partly a re-measurement of the training reward rather than an independent vulnerability estimate. The 'outperforms baselines' claim rests entirely on this contaminated benchmark; SoSBench-Bio is independent but no baseline comparison is reported there.

full rationale

The only true circularity is the SafeSci-Bio train/evaluation overlap. Intern-BioBreaker is RL-trained on SafeSci-Bio (Section 2.1, Stage 3) and the test set is sampled from the same dataset with no reported disjoint split (Section 3.1.3). The headline ASRs on SafeSci-Bio, including the baseline comparison in Table 1, are therefore partly a measure of the training reward rather than an independent vulnerability estimate. SoSBench-Bio is an external benchmark and independently shows high ASRs (10/14 models at 100%), so the general claim that frontier LLMs are vulnerable has independent support. However, no baseline comparison is reported on SoSBench-Bio, so the specific claim that Intern-BioBreaker outperforms baselines rests on the contaminated benchmark. The abstract's claim (iii) of end-to-end physical verification is contradicted by Section 4's explicit statement that physical synthesis was not performed; this is a major evidentiary/overclaim problem, but it is not a reduction of a derived result to its inputs and therefore does not add to the circularity score. The AlphaFold3/BLAST/AutoDock surrogates are proxy-validity concerns, not circularity. The self-citations ([11], [16]) are data and method sources, not load-bearing circular justifications. Score 6 reflects partial circularity of the central ASR claim, constrained by the independent SoSBench-Bio evidence.

Axiom & Free-Parameter Ledger

4 free parameters · 5 axioms · 0 invented entities

The quantitative claims rest on hand-set thresholds and LLM-judge labels; the physical claim rests on computational proxies; and the benchmark used for RL training is also used for evaluation.

free parameters (4)
  • Task-level attack budget B = 18
    ASR is defined as success within B=18 attempts; larger budgets inflate ASR, and no sensitivity analysis is reported (Sec. 3.1.5).
  • Pathogenicity identity threshold = >95% identity to known pathogenic strains
    Sequences with >95% identity are declared pathogen-associated; this hand-set threshold is applied in Sec. 3.2.2 without independent justification.
  • AlphaFold3 pLDDT filtering thresholds = whole-sequence discard <50; RBS discard <70
    Hand-set filters in Sec. 3.2.2 determine which generated sequences count as structurally plausible and proceed to docking.
  • BLAST evasion E-value threshold = E-value > 1e-5 considered evasive
    The stealth criterion in Sec. 2.2 and Sec. 4; no evidence is given that this threshold matches real nucleic acid synthesis screening.
axioms (5)
  • domain assumption AlphaFold3 pLDDT scores are a valid proxy for structural plausibility and functional viability of generated viral proteins.
    Used in Sec. 2.2 and Sec. 3.2.2 to pass sequences to docking and to claim preserved function.
  • domain assumption AutoDock Vina binding energy is a valid proxy for receptor-binding affinity and infection potential.
    Used to claim 'enhanced infection potential' from lower docking energies in Figures 5-6.
  • domain assumption GPT-4o judge labels reliably distinguish dangerous actionable bio-risk content from safe refusals.
    The entire ASR metric depends on this judge (Sec. 3.1.4); no validation against human labels is reported.
  • domain assumption BLASTN E-value > 1e-5 means the sequence would evade real-world nucleic acid synthesis screening.
    Invoked in Sec. 2.2 and Sec. 4 to conclude sequences are 'screening-evasive'.
  • domain assumption Synonymous codon substitution and intron insertion preserve the function of hazardous proteins.
    The wet-lab scenario assumes obfuscated DNA with the same amino acid sequence remains functionally viable (Sec. 4).

pith-pipeline@v1.3.0-alltime-deepseek · 17460 in / 15427 out tokens · 161783 ms · 2026-08-01T16:13:52.000187+00:00 · methodology

0 comments
read the original abstract

Frontier large language models (LLMs) are increasingly integrated into scientific workflows, yet their growing biological capabilities may outpace current safeguards. To assess the biological risks of frontier models, we develop Intern-BioBreaker, a specialized bio-red-teaming model, together with an integrated computational-to-physical framework that couples model-level stress testing with wet-lab validation. Within this framework, Intern-BioBreaker generates targeted jailbreak prompts to test whether aligned models can be induced to provide operational guidance for safety-sensitive biological tasks or produce sequence-level outputs with potentially harmful properties. Selected sequence outputs are then carried forward for DNA synthesis, host expression, and orthogonal protein verification to assess whether model-generated designs can yield the intended biological products. Our evaluation reveals a concerning gap between text-level safeguards and the risks posed by capable scientific models: (i) Intern-BioBreaker outperforms baseline attack models and reveals widespread bio-risk jailbreak vulnerabilities across both open-weight and proprietary frontier LLMs, with several targets reaching near-saturated or 100% task-level attack success rate (ASR); (ii) in sequence-level case studies, GPT-5.5 can be induced to generate modified viral candidate sequences with pathogenic potential; the corresponding translated proteins may exhibit even stronger receptor-binding affinity and thus enhanced infection potential; and (iii) end-to-end verification shows that selected model-generated biological designs are not merely textual artifacts, but can be physically realized under controlled experimental settings. These findings underscore the need for stronger biological red-teaming, nucleic acid synthesis screening, and safety mechanisms that keep pace with model capabilities.

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

93 extracted references · 1 canonical work pages

  1. [1]

    GPT-4 Technical Report

    OpenAI. “GPT-4 Technical Report”. In:arXiv preprint arXiv:2303.08774(2023). arXiv:2303. 08774. *College of Biomedical Engineering, Fudan University 17

    Pith/arXiv arXiv 2023

  2. [2]

    Galactica: A Large Language Model for Science

    Ross Taylor et al. “Galactica: A Large Language Model for Science”. In: (2022). arXiv:2211. 09085 [cs.CL].url:https://arxiv.org/abs/2211.09085

    Pith/arXiv arXiv 2022

  3. [3]

    Intern-s1: A scientific multimodal foundation model

    Lei Bai et al. “Intern-s1: A scientific multimodal foundation model”. In:arXiv preprint arXiv:2508.15763(2025)

    arXiv 2025

  4. [4]

    Autonomous chemical research with large language models

    Daniil A. Boiko et al. “Autonomous chemical research with large language models”. In:Nature 624.7992 (2023), pp. 570–578.issn: 1476-4687.doi: 10.1038/s41586-023-06792-0. url:https://doi.org/10.1038/s41586-023-06792-0

    doi:10.1038/s41586-023-06792-0 2023

  5. [6]

    Canlargelanguagemodelsdemocratizeaccesstodual-usebiotechnology?

    EmilyH.Soiceetal.“Canlargelanguagemodelsdemocratizeaccesstodual-usebiotechnology?” In: (2023). arXiv:2306.03809 [cs.CY].url:https://arxiv.org/abs/2306.03809

    Pith/arXiv arXiv 2023

  6. [7]

    Artificial intelligence and biological misuse: Differentiating risks of language models and biological design tools

    Jonas B. Sandbrink. “Artificial intelligence and biological misuse: Differentiating risks of language models and biological design tools”. In: (2023). arXiv:2306.13952 [cs.CY].url: https://arxiv.org/abs/2306.13952

    Pith/arXiv arXiv 2023

  7. [8]

    Dual use concerns of generative AI and large language models

    Alexei Grinbaum and Laurynas Adomaitis. “Dual use concerns of generative AI and large language models”. In:Journal of Responsible Innovation11.1 (2024).issn: 2329-9037.doi: 10.1080/23299460.2024.2304381.url: http://dx.doi.org/10.1080/23299460. 2024.2304381

    arXiv 2024

  8. [9]

    Mouton, Caleb Lucas, and Ella Guest.The Operational Risks of AI in Large-Scale Biological Attacks

    Christopher A. Mouton, Caleb Lucas, and Ella Guest.The Operational Risks of AI in Large-Scale Biological Attacks. Tech. rep. RR-A2977-2. RAND Corporation, 2024.doi:10.7249/RRA2977- 2

    work page doi:10.7249/rra2977- 2024

  9. [10]

    Jailbroken: How does llm safety training fail?

    Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. “Jailbroken: How does llm safety training fail?” In:Advances in neural information processing systems36 (2023), pp. 80079– 80110

    2023

  10. [11]

    MAGIC: A Co-Evolving Attacker-Defender Adversarial Game for Robust LLM Safety

    Xiaoyu Wen et al. “MAGIC: A Co-Evolving Attacker-Defender Adversarial Game for Robust LLM Safety”. In:arXiv preprint arXiv:2602.01539(2026)

    arXiv 2026

  11. [12]

    EvoDefense: Co-Evolving Black-Box Defense with Large Language Models

    Yu Li et al. “EvoDefense: Co-Evolving Black-Box Defense with Large Language Models”. In: arXiv preprint arXiv:2605.31140(2026)

    Pith/arXiv arXiv 2026

  12. [13]

    TRACE: Task-Aware Adaptive Self-Evolving Agentic Jailbreaking

    Churui Zeng et al. “TRACE: Task-Aware Adaptive Self-Evolving Agentic Jailbreaking”. In:arXiv preprint arXiv:2605.30883(2026)

    Pith/arXiv arXiv 2026

  13. [14]

    Andy Zou et al.Universal and Transferable Adversarial Attacks on Aligned Language Models

  14. [15]

    Many-shot Jailbreaking

    Cem Anil et al. “Many-shot Jailbreaking”. In:The Thirty-eighth Annual Conference on Neural Information Processing Systems. 2024.url: https : / / openreview . net / forum ? id = cw5mgd71jW

    2024

  15. [16]

    Zhida He et al.Not All Turns Matter: Credit Assignment for Multi-Turn Jailbreaking. 2026. arXiv: 2605.08778 [cs.AI].url:https://arxiv.org/abs/2605.08778

    Pith/arXiv arXiv 2026

  16. [17]

    https://internationalaisafetyreport.org/publication/international-ai- safety-report-2026

    InternationalScientificReportontheSafetyofAdvancedAI.InternationalAISafetyReport2026. https://internationalaisafetyreport.org/publication/international-ai- safety-report-2026. 2026

    2026

  17. [19]

    The WMDP Benchmark: Measuring and Reducing Malicious Use with Unlearning

    Nathaniel Li et al. “The WMDP Benchmark: Measuring and Reducing Malicious Use with Unlearning”. In:Proceedings of the 41st International Conference on Machine Learning. Ed. by Ruslan Salakhutdinov et al. Vol. 235. Proceedings of Machine Learning Research. PMLR, 2024, pp. 28525–28550.url:https://proceedings.mlr.press/v235/li24bc.html

    2024

  18. [20]

    ScreenDNA.org Signatories.An Open Letter in Support of Mandatory Nucleic Acid Synthesis Screening and Recordkeeping.https://screendna.org/. 2026

    2026

  19. [21]

    https://openai.com/index/gpt- 5- 5- bio- bug- bounty/

    OpenAI.GPT-5.5 Bio Bug Bounty. https://openai.com/index/gpt- 5- 5- bio- bug- bounty/. 2026

    2026

  20. [22]

    The reality of AI and biorisk

    Aidan Peppin et al. “The reality of AI and biorisk”. In:Proceedings of the 2025 ACM Conference on Fairness, Accountability, and Transparency. 2025, pp. 763–771

    2025

  21. [23]

    LLM Novice Uplift on Dual-Use, In Silico Biology Tasks

    Chen Bo Calvin Zhang et al. “LLM Novice Uplift on Dual-Use, In Silico Biology Tasks”. In:arXiv preprint arXiv:2602.23329(2026)

    arXiv 2026

  22. [24]

    Measuring mid-2025 LLM-assistance on novice performance in biology

    Shen Zhou Hong et al. “Measuring mid-2025 LLM-assistance on novice performance in biology”. In:arXiv preprint arXiv:2602.16703(2026)

    arXiv 2025

  23. [25]

    Implementing Emerging Customer Screen- ing Standards for Nucleic Acid Synthesis

    Sarah Carter, Lucas Boldrini, and Tessa Alexanian. “Implementing Emerging Customer Screen- ing Standards for Nucleic Acid Synthesis”. In:Frontiers in Bioengineering and Biotechnology14 (), p. 1819810

  24. [26]

    Cleavage of structural proteins during the assembly of the head of bacterio- phage T4

    Ulrich K Laemmli. “Cleavage of structural proteins during the assembly of the head of bacterio- phage T4”. In:nature227.5259 (1970), pp. 680–685

    1970

  25. [27]

    Principles and applications of liquid chromatography-mass spectrometry in clinical biochemistry

    James J Pitt. “Principles and applications of liquid chromatography-mass spectrometry in clinical biochemistry”. In:The Clinical Biochemist Reviews30.1 (2009), p. 19

    2009

  26. [28]

    Virology capabilities test (VCT): a multimodal virology Q&A benchmark

    Jasper Götting et al. “Virology capabilities test (VCT): a multimodal virology Q&A benchmark”. In:Preprint at https://arxiv. org/abs/2504.16137(2025)

    Pith/arXiv arXiv 2025

  27. [29]

    https://openai.com/index/introducing-gpt-5-5/

    OpenAI.Introducing GPT-5.5. https://openai.com/index/introducing-gpt-5-5/ . 2026

    2026

  28. [30]

    https://www.anthropic.com/news/claude-opus-4-8

    Anthropic.Claude Opus 4.8. https://www.anthropic.com/news/claude-opus-4-8 . 2026

    2026

  29. [31]

    An Yang et al.Qwen2.5 Technical Report. 2025. arXiv:2412.15115 [cs.CL].url: https: //arxiv.org/abs/2412.15115

    Pith/arXiv arXiv 2025

  30. [32]

    https://huggingface.co/internlm/Intern-S2- Preview

    InternLM Team.Intern-S2-Preview. https://huggingface.co/internlm/Intern-S2- Preview. 2026

    2026

  31. [33]

    Xiangyang Zhu et al.SafeSci: Safety Evaluation of Large Language Models in Science Domains and Beyond. 2026. arXiv:2603.01589 [cs.LG].url: https://arxiv.org/abs/2603. 01589

    Pith/arXiv arXiv 2026

  32. [34]

    SoSBench: Benchmarking Safety Alignment on Six Scientific Domains

    Fengqing Jiang et al. “SoSBench: Benchmarking Safety Alignment on Six Scientific Domains”. In:The Fourteenth International Conference on Learning Representations. 2026.url:https: //openreview.net/forum?id=2Td8r7KYK2

    2026

  33. [35]

    Deepseek-v4: Towards highly efficient million-token context intelligence

    Anyi Xu et al. “Deepseek-v4: Towards highly efficient million-token context intelligence”. In: arXiv preprint arXiv:2606.19348(2026)

    arXiv 2026

  34. [36]

    Google DeepMind.Gemini 3.1 Pro Preview.https://deepmind.google/models/model- cards/gemini-3-1-pro/. 2026

    2026

  35. [37]

    Structural and functional properties of SARS-CoV-2 spike protein: potential antivirus drug development for COVID-19

    Yuan Huang et al. “Structural and functional properties of SARS-CoV-2 spike protein: potential antivirus drug development for COVID-19”. In:Acta Pharmacologica Sinica41.9 (2020), pp. 1141–1149. 19

    2020

  36. [38]

    Complete nucleotide sequence of the AIDS virus, HTLV-III

    Lee Ratner et al. “Complete nucleotide sequence of the AIDS virus, HTLV-III”. In:Nature 313.6000 (1985), pp. 277–284

    1985

  37. [39]

    London, UK, April 17–19

    International Dialogue on AI Safety (IDAIS).IDAIS-London Statement.https://idais.ai/ dialogue/idais-london/. London, UK, April 17–19. 2026

    2026

  38. [40]

    Guidance Framework

    World Health Organization.Global guidance framework for the responsible use of the life sciences: mitigating biorisks and governing dual-use research. Guidance Framework. Geneva: World Health Organization, 2022.url: https : / / www . who . int / publications / i / item / 9789240056107

    2022

  39. [41]

    AI and biosecurity: The need for governance

    Doni Bloomfield et al. “AI and biosecurity: The need for governance”. In:Science385.6711 (2024), pp. 831–833

    2024

  40. [42]

    Don’t Stop Pretraining: Adapt Language Models to Domains and Tasks

    Suchin Gururangan et al. “Don’t Stop Pretraining: Adapt Language Models to Domains and Tasks”.In:Proceedingsofthe58thAnnualMeetingoftheAssociationforComputationalLinguistics. Ed. by Dan Jurafsky et al. Online: Association for Computational Linguistics, 2020, pp. 8342– 8360.doi: 10.18653/v1/2020.acl-main.740 .url: https://aclanthology.org/ 2020.acl-main.740/

    doi:10.18653/v1/2020.acl-main.740 2020

  41. [43]

    Finetuned Language Models are Zero-Shot Learners

    Jason Wei et al. “Finetuned Language Models are Zero-Shot Learners”. In:International Conference on Learning Representations. 2022.url:https://openreview.net/forum? id=gEZrGCozdqR

    2022

  42. [44]

    Training language models to follow instructions with human feedback

    Long Ouyang et al. “Training language models to follow instructions with human feedback”. In:Proceedings of the 36th International Conference on Neural Information Processing Systems. NIPS ’22. New Orleans, LA, USA: Curran Associates Inc., 2022.isbn: 9781713871088

    2022

  43. [45]

    Proximal Policy Optimization Algorithms

    John Schulman et al. “Proximal Policy Optimization Algorithms”. In:arXiv preprint arXiv:1707.06347(2017). arXiv:1707.06347

    Pith/arXiv arXiv 2017

  44. [46]

    DeepSeekMath: Pushing the Limits of Mathematical Reasoning in Open Language Models

    Zhihong Shao et al. “DeepSeekMath: Pushing the Limits of Mathematical Reasoning in Open Language Models”. In: (2024). arXiv:2402.03300 [cs.CL].url: https://arxiv.org/ abs/2402.03300

    Pith/arXiv arXiv 2024

  45. [47]

    com/InternLM/xtuner

    XTuner Contributors.XTuner: A Toolkit for Efficiently Fine-tuning LLM.https://github. com/InternLM/xtuner. 2023

    2023

  46. [48]

    2026.url:https: //huggingface.co/datasets/opendatalab/Sci-Base

    OpenDataLab.Sci-Base: The Largest AI-Ready Scientific Foundation Dataset. 2026.url:https: //huggingface.co/datasets/opendatalab/Sci-Base

    2026

  47. [49]

    HybridFlow: A Flexible and Efficient RLHF Framework

    Guangming Sheng et al. “HybridFlow: A Flexible and Efficient RLHF Framework”. In:arXiv preprint arXiv:2409.19256(2024)

    Pith/arXiv arXiv 2024

  48. [50]

    Jailbreak-R1: Exploring the Jailbreak Capabilities of LLMs via Reinforcement Learning

    Jailbreak-R1 Contributors. “Jailbreak-R1: Exploring the Jailbreak Capabilities of LLMs via Reinforcement Learning”. In:arXiv preprint arXiv:2506.00782(2025)

    Pith/arXiv arXiv 2025

  49. [51]

    The Llama 3 Herd of Models

    Meta AI et al. “The Llama 3 Herd of Models”. In:arXiv preprint arXiv:2407.21783(2024). url:https://arxiv.org/abs/2407.21783

    Pith/arXiv arXiv 2024

  50. [52]

    Mistral 7B

    Albert Q. Jiang et al. “Mistral 7B”. In:arXiv preprint arXiv:2310.06825(2023).url:https: //arxiv.org/abs/2310.06825

    Pith/arXiv arXiv 2023

  51. [53]

    gpt-oss-120b & gpt-oss-20b Model Card

    OpenAI, Sandhini Agarwal, et al. “gpt-oss-120b & gpt-oss-20b Model Card”. In:arXiv preprint arXiv:2508.10925(2025).url:https://arxiv.org/abs/2508.10925

    Pith/arXiv arXiv 2025

  52. [54]

    Qwen3Guard Technical Report

    Qwen Team. “Qwen3Guard Technical Report”. In:arXiv preprint arXiv:2510.14276(2025). url:https://arxiv.org/abs/2510.14276

    Pith/arXiv arXiv 2025

  53. [55]

    AccuratestructurepredictionofbiomolecularinteractionswithAlphaFold 3

    JoshAbramsonetal.“AccuratestructurepredictionofbiomolecularinteractionswithAlphaFold 3”. In:Nature630.8016 (2024), pp. 493–500. 20

    2024

  54. [56]

    BLAST: improvements for better sequence analysis

    Jian Ye, Scott McGinnis, and Thomas L Madden. “BLAST: improvements for better sequence analysis”. In:Nucleic acids research34.suppl_2 (2006), W6–W9

    2006

  55. [57]

    Deepseek-v3 technical report

    Aixin Liu et al. “Deepseek-v3 technical report”. In:arXiv preprint arXiv:2412.19437(2024)

    Pith/arXiv arXiv 2024

  56. [58]

    Moonshot AI.Kimi K2.6: Advancing Open-Source Coding.https://www.kimi.com/en/ blog/kimi-k2-6. 2026

    2026

  57. [59]

    https : / / huggingface

    Qwen Team, Alibaba Group.Qwen3.5-397B-A17B. https : / / huggingface . co / Qwen / Qwen3.5-397B-A17B. 2026

    2026

  58. [60]

    https://deepmind.google/models/model-cards/ gemini-3-5-flash/

    GoogleDeepMind.Gemini3.5Flash. https://deepmind.google/models/model-cards/ gemini-3-5-flash/. 2026

    2026

  59. [61]

    Glm-5: from vibe coding to agentic engineering

    Aohan Zeng et al. “Glm-5: from vibe coding to agentic engineering”. In:arXiv preprint arXiv:2602.15763(2026)

    Pith/arXiv arXiv 2026

  60. [62]

    https://huggingface.co/MiniMaxAI/MiniMax-M2.5

    MiniMax.MiniMax-M2.5. https://huggingface.co/MiniMaxAI/MiniMax-M2.5. 2026

    2026

  61. [63]

    xAI.Grok 4.3 Model Card.https://docs.x.ai/developers/models/grok-4.3. 2026

    2026

  62. [64]

    xAI.Grok 4.5 Model Card.https://docs.x.ai/developers/models/grok-4.5. 2026

    2026

  63. [65]

    OpenAI.Previewing GPT-5.6 Sol: a next-generation model.https://openai.com/index/ previewing-gpt-5-6-sol/. 2026

    2026

  64. [66]

    https://www.anthropic.com/news/claude-sonnet-4-

    Anthropic.Claude Sonnet 4.6. https://www.anthropic.com/news/claude-sonnet-4-

  65. [67]

    Gpt-4o system card

    Aaron Hurst et al. “Gpt-4o system card”. In:arXiv preprint arXiv:2410.21276(2024)

    Pith/arXiv arXiv 2024

  66. [68]

    The hemagglutinin: a determinant of pathogenicity

    Eva Böttcher-Friebertshäuser et al. “The hemagglutinin: a determinant of pathogenicity”. In: Influenza Pathogenesis and Control-Volume I(2014), pp. 3–34

    2014

  67. [69]

    Structural characterization of the hemagglutinin receptor specificity from the 2009 H1N1 influenza pandemic

    Rui Xu et al. “Structural characterization of the hemagglutinin receptor specificity from the 2009 H1N1 influenza pandemic”. In:Journal of virology86.2 (2012), pp. 982–990

    2009

  68. [70]

    An airborne transmissible avian influenza H5 hemagglutinin seen at the atomic level

    Wei Zhang et al. “An airborne transmissible avian influenza H5 hemagglutinin seen at the atomic level”. In:Science340.6139 (2013), pp. 1463–1467

    2013

  69. [71]

    NCBI Taxonomy: a comprehensive update on curation, resources and tools

    Conrad L Schoch et al. “NCBI Taxonomy: a comprehensive update on curation, resources and tools”. In:Database2020 (2020), baaa062

    2020

  70. [72]

    Ultrafast and accurate sequence alignment and clustering of viral genomes

    Andrzej Zielezinski et al. “Ultrafast and accurate sequence alignment and clustering of viral genomes”. In:Nature Methods22.6 (2025), pp. 1191–1194

    2025

  71. [73]

    Genebreaker:Jailbreakattacksagainstdnalanguagemodelswithpathogenic- ity guidance

    ZaixiZhangetal.“Genebreaker:Jailbreakattacksagainstdnalanguagemodelswithpathogenic- ity guidance”. In:arXiv preprint arXiv:2505.23839(2025)

    Pith/arXiv arXiv 2025

  72. [74]

    Protein interactions in human pathogens revealed through deep learning

    Ian R Humphreys et al. “Protein interactions in human pathogens revealed through deep learning”. In:Nature microbiology9.10 (2024), pp. 2642–2652

    2024

  73. [75]

    Highly accurate protein structure prediction for the human proteome

    Kathryn Tunyasuvunakool et al. “Highly accurate protein structure prediction for the human proteome”. In:Nature596.7873 (2021), pp. 590–596

    2021

  74. [76]

    Highly accurate protein structure prediction with AlphaFold

    John Jumper et al. “Highly accurate protein structure prediction with AlphaFold”. In:nature 596.7873 (2021), pp. 583–589

    2021

  75. [77]

    AutoDock Vina: improving the speed and accuracy of dock- ing with a new scoring function, efficient optimization, and multithreading

    Oleg Trott and Arthur J Olson. “AutoDock Vina: improving the speed and accuracy of dock- ing with a new scoring function, efficient optimization, and multithreading”. In:Journal of computational chemistry31.2 (2010), pp. 455–461

    2010

  76. [78]

    Towards ai-45◦law: A roadmap to trustworthy agi

    Chao Yang et al. “Towards ai-45◦law: A roadmap to trustworthy agi”. In:arXiv preprint ArXiv:2412.14186(2024). 21

    Pith/arXiv arXiv 2024

  77. [79]

    https : / / www

    UK Government.The Bletchley Declaration on AI Safety. https : / / www . gov . uk / government / publications / ai - safety - summit - 2023 - the - bletchley - declaration. 2023

    2023

  78. [80]

    European Parliament and Council of the European Union.Regulation (EU) 2024/1689: Laying Down Harmonised Rules on Artificial Intelligence (Artificial Intelligence Act).https://eur- lex.europa.eu/eli/reg/2024/1689/oj. OJ L. 2024

    2024

  79. [81]

    https : / / digital - strategy.ec.europa.eu/en/policies/contents-code-gpai

    European Commission.The General-Purpose AI Code of Practice. https : / / digital - strategy.ec.europa.eu/en/policies/contents-code-gpai. 2025

    2025

  80. [82]

    53: Transparency in Frontier Artificial Intelligence Act (SB- 53/TFAIA).https://leginfo.legislature.ca.gov/

    State of California.Senate Bill No. 53: Transparency in Frontier Artificial Intelligence Act (SB- 53/TFAIA).https://leginfo.legislature.ca.gov/. 2025

    2025

Showing first 80 references.