Pretraining data filtering in open-weight biological models: AISI finds it works, then costs $80 to undo

Pretraining data filtering in open-weight biological models is a safeguard with a measured price tag: about $80 of GPU time. On October 26, 2026 the UK AI Security Institute (AISI) published results showing that removing viral proteins from a protein model's training data selectively weakens it on viruses, and that fine-tuning on the withheld data brings the capability back at every size tested.

What AISI did

The institute's chem-bio team pretrained ESM-2 protein language models from scratch at sizes from 8 million to 3 billion parameters. It chose protein models deliberately, noting that frontier language models exceed even the largest of these by orders of magnitude, so the study is a controlled test bed and not a frontier result.

The "forget" domain was viral proteins. The "retain" domain was non-viral proteins. Three exclusion tiers ran from narrow to broad: a single influenza strain, then wider sets, then all viral proteins and close homologues, each a strict subset of the next. Models were scored on masked language modeling, mutation-effect prediction and contact prediction.

Then came the stress test. AISI fine-tuned the filtered models on the withheld viral data and measured how much compute it took to recover viral performance. That is the realistic threat for an open-weight model: anyone with the weights and a rented GPU can try it.

Finding one: it works, selectively

Viral performance dropped across all three tiers while non-viral performance was largely preserved. The effect showed up at different scales for different tasks. Masked language modeling was affected at every model size. Contact prediction was affected above 150 million parameters, and mutation-effect prediction above 650 million.

That selectivity is the useful part. A filter that damaged general capability would not be adopted; this one mostly did not.

Finding two: it does not last

Fine-tuning fully restored viral performance at every size. Recovery cost rose with scale, but the largest model, at 3 billion parameters, needed only about $80 of H100 compute. AISI's phrasing is plain: "filtering raises the cost of recovering a capability rather than removing it permanently."

Its verdict is equally plain: "it does not constitute a robust safeguard on its own." And its recommendation: "A durable approach is therefore likely to require additional measures alongside data filtering," such as access controls for scientific models or their training data.

How this fits with the earlier, more optimistic result

A 2025 arXiv paper, "Deep Ignorance" (O'Brien, Casper and colleagues, revised February 17, 2026), reported that language models of 6.9 billion parameters pretrained from scratch with a multi-stage filter resisted adversarial fine-tuning for up to 10,000 steps and 300 million tokens of biothreat-related text, with no observed loss in unrelated capabilities. It claimed an advantage of more than an order of magnitude over existing post-training baselines. It also warned that filtered models can still use dangerous information supplied in context, such as through search tools, so it argued for defense in depth.

The two studies are not contradictory, because they test different things. One is a language model filtered on biothreat proxy text; the other is a protein model filtered on viral sequences. Resistance "for up to 10,000 steps" is a finding about the attack budget tested, and AISI's $80 figure is a finding about what a full recovery costs. Both can be true: filtering buys real friction, and friction is not prevention. The practical gap between them is the attacker's budget, which neither study can set for the world.

Limits AISI states

Results cover only the ESM-2 family, so generalization is uncertain. Filtering may be less effective for models that retrieve data at inference time, which echoes the in-context caveat from the earlier paper. And the recovery-cost measurements are imprecise, so $80 is an order of magnitude, not a quote.

We would add one reading note. A cost of $80 is cheap for a motivated actor and trivial for a state, but it is also a cost, and a defender may reasonably want to know how much friction different filters buy per dollar. That comparison across filter designs is the next experiment worth asking for.

The companion paper

The same day AISI published ReproBAIT, an evaluation of whether coding agents can rebuild biological AI tools from a paper alone. Its authors conclude that controlling access to the underlying biological data "appears to be a more promising intervention" than controlling access to code. Read together, the two posts say the same thing from two directions: the choke point is data, and data filtering is a speed bump on its own.

What this means for builders and policymakers

For an open-weight developer, the message is to filter and not rely on it. For a funder or regulator, it is to pair filtering with controls on who can get the training data and the scientific models. Our coverage of the UK biosecurity lab announcement and the institute's nine priority areas for frontier AI best practice gives the policy frame this result slots into.

Our take

This is an honest negative result published by a government lab, and it is more useful than a positive one. The short version: data filtering works, it is selective, and it is undone for about $80 at the largest size tested. Do not cite it as proof that open-weight biology models are safe or unsafe. Watch for replication on other model families and for any filter design that raises the recovery price by orders of magnitude.