UK AISI: filtering viral data from a protein model works, until $80 of fine-tuning undoes it

Can you stop a biological AI model from learning how viruses work by leaving viruses out of its training data? A paper from the UK AI Security Institute (AISI) and co-authors says partly, and not for long. On October 26, 2026, AISI's Chem-Bio team published results showing that filtering viral proteins out of a protein language model's pretraining data cuts its viral performance, and that about $80 of fine-tuning on the removed data brings it back.

The finding bears directly on a live policy question: whether pretraining data filtering is a durable safeguard for open-weight biological models. Here is what the team did, what it found, and what it does not show.

What the researchers did

The study, "The Effectiveness and Durability of Pretraining Data Filtering in Protein Language Models," was submitted to arXiv on October 19, 2026 as arXiv:2610.26651. Its authors include Aaron Maiwald, Roderick McNeill, Jaeyoung Lee, Matthew A. Clarke, Lennart Justen, Alejandro Acelas, Ivo Andrews, Giles Harper-Donnelly, Adam Moore, Sophie Rose, Oliver M. Crook and Felix Jackson. AISI's blog post summarizes the work.

The team pretrained ESM-2 models from scratch at sizes between 8 million and 3 billion parameters. ESM-2 is a widely used family of protein language models. In the "forget" set they removed viral protein sequences. The "retain" set was non-viral proteins. Filtering came in four tiers, from a single influenza strain at the narrow end to all viral proteins and close homologues at the broad end, each a strict subset of the next.

Capability was measured on three tasks: masked language modeling, mutation-effect prediction and contact prediction.

What filtering achieved

Filtering substantially reduced viral-protein performance in all three tiers, while non-viral performance was largely preserved. The pattern held up against model size in a way that matters for policy. Masked language modeling was affected at every size. Contact prediction was affected above 150 million parameters, and mutation-effect prediction above 650 million. The effect was stronger in larger models. The arXiv abstract adds that it was strongest for human-infecting viruses and that stricter filtering worked better in larger models.

So the first half of the headline is real. If you want a model that is worse at viral proteins, leaving viral proteins out of pretraining does that, and the cost to everything else is small.

Why it does not last

The second half is the problem. Continued training on the withheld viral data fully restored viral-protein performance. The team describes filtering as raising the cost of recovery rather than removing the capability. In the 3 billion parameter model, recovering the full capability took about $80 of H100 compute. Recovery cost rose with model size, but the absolute number stayed modest.

The authors also note that the data an attacker would need is routinely published. A filter that can be undone with relevant public sequences and the price of a restaurant meal is not a barrier against a motivated actor with a GPU. It is a barrier against accidental capability.

What the study does not show

The authors list their own limits. All results come from a single model family. Filtering may be less effective for models that can retrieve extra data at inference time. The recovery-cost measurements are imprecise, which limits conclusions about how tamper resistance changes with scale. The work is a preprint and has not been peer reviewed. And protein language models are not the same as the largest general-purpose chatbots, which are filtered and tested by other methods.

The conclusion the team draws is that filtering is a selective, partial safeguard and needs complementary measures, such as better access controls for scientific models or for the biological data used in training.

A second AISI result points the same way

A companion post the same day asked whether AI coding agents can rebuild biological AI tools from a paper. Using a benchmark called ReproBAIT, built with SecureBio, AISI tested Claude Opus 5, GPT-5.6 Sol, Kimi K3 and Qwen3.8-2.4T on three tools. Successful rebuilds of the two simpler tools, ProteinMPNN and a closed-source molecular design tool called CMD1, cost roughly $4 to $20. Claude Opus 5 reached 96.5% fidelity on ProteinMPNN sequence recovery with the full paper. No agent succeeded on RFdiffusion3 within its time budget, and those attempts cost $102 to $301 each.

The authors write that "withholding code does not, by itself, assure control over access to a BAIT's capability" and that controlling the underlying biological data "appears to be a more promising intervention". They caution that the results "do not prove that the original BAITs can be reproduced in full".

Taken together, the two studies attack the two usual levers, data and code, and find each soft. Our earlier reports on the UK's biosecurity lab commitment and on open versus closed weights give the wider setting.

What regulators could ask for

The practical consequence is a change in the evidence a developer should be asked to show. A statement that viral data was excluded from pretraining answers one question, whether the model started without the capability. It does not answer whether the capability can be added back cheaply, which is the question a safety case should address. A tamper-resistance test, such as the recovery-cost measurement AISI uses, gives a number a regulator can compare across models and sizes. The authors warn that the measurements are imprecise, so any threshold should come with a margin, and with a rule for re-testing when models grow.

Our take

The honest reading is that pretraining filtering is cheap hygiene with a short shelf life. It should stay in the toolkit, because it makes casual misuse harder and costs little. It should not be cited in a safety case as if it were containment. What we would watch: replication on other model families, the same test on larger protein models, and whether regulators start asking for evidence of tamper resistance rather than evidence that a filter was applied.