AISI Filtered Viral Proteins Out of ESM-2. Fine-Tuning Put Them Back for $80.

TL;DR

AISI’s Chem-Bio team pretrained ESM-2 protein language models from scratch at 8M to 3B parameters with viral protein sequences held out of the data, and found the filtering both effective and selective: viral-protein performance dropped, non-viral performance did not. Fine-tuning on the excluded sequences restored the suppressed capability for roughly $80 of H100 compute, at every model size tested. That contradicts AISI’s own 2025 result on general-purpose LLMs, where the same technique survived 10,000 adversarial fine-tuning steps. The paper’s explanation is data diversity: protein corpora are narrow enough that what’s left behind still teaches the model most of what was removed. Treat data filtering as a release-time speed bump for open-weight bio models, not a tamper-resistant control.

A safeguard that costs thousands of GPU-hours to build and $80 to remove is a strange kind of safeguard. That’s the headline number in AISI’s new write-up, published yesterday, on whether you can make an open-weight protein model durably bad at viral proteins by never showing it any.

The experiment is the clean version of the question. Rather than fine-tuning an existing model to forget, the team pretrained ESM-2 architectures from scratch, 8M up to 3B parameters, with viral protein sequences excluded from the training data. The Effectiveness and Durability of Pretraining Data Filtering in Protein Language Models, submitted to arXiv eight days ago, measures the result on three tasks: masked language modelling, mutation-effect prediction, and long-range contact prediction.

Filtering Worked at Release, Then Stopped Working

Two results, and the first is good news. Filtering “meaningfully degrades” viral-protein performance, and it does so selectively, non-viral protein performance survives intact. That selectivity matters because the usual objection to data filtering is collateral damage: a bio model crippled on everything is not a bio model anyone ships. This one isn’t.

The second result is the problem. Fine-tuning on the excluded viral sequences recovered the suppressed capability fully, for about $80 of H100 time, and the 3B model was no harder to restore than the 8M one. Scale did not buy durability. Anyone who can download the weights can also rent the GPU.

Note

The $80 is AISI’s figure, taken from its own blog and the paper. Neither surfaced an hours-times-rate breakdown, so the derivation isn’t something to lean on, only the order of magnitude.

The Same Institute Found the Opposite in General LLMs

In August 2025, AISI and EleutherAI published Deep Ignorance (arXiv:2508.06601), which filtered biothreat-proxy text out of a 6.9B-parameter LLM’s 550B-token pretraining corpus and reported the reverse conclusion. Those models were “substantially more resistant to adversarial fine-tuning… than models protected by post-training safeguards,” holding up through 10,000 fine-tuning steps on 300M tokens of biothreat text. Same technique, same institute, opposite durability finding.

The protein paper offers a mechanism instead of a retraction. Protein pretraining corpora are “much less varied” than text corpora, so viral proteins are harder to cleanly separate from what remains. Evolutionary structure is shared across the sequence space; remove the viral examples and the non-viral ones still carry a great deal of the signal. Filtering, on this reading, buys durability in proportion to how genuinely distinct the removed domain is from everything you keep. Protein models sit at the fragile end.

That’s a narrower claim than “filtering doesn’t work,” and a more useful one. It also means you cannot read a durability result in one domain as evidence about another, which is roughly what the field has been doing with Deep Ignorance for the past year. EleutherAI keeps its wider work on the technique collected on an open-weight safety page if you want the lineage.

Fine-Tuning Isn’t the Only Recovery Path

An independent group reached a similar conclusion from a different angle. Best Practices for Biorisk Evaluations on Open-Weight Bio-Foundation Models, submitted in October 2025, found filtered knowledge could be “rapidly recovered… via fine-tuning,” and went further: dual-use capability can be extracted by linear probing on the unmodified model, no fine-tuning required. AISI’s paper treats fine-tuning as the tamper vector of interest. If probing works, the $80 is an upper bound on an already-cheap attack.

The honest counterweight is that $80 buys back a benchmark score. Work like OpenAI’s worst-case frontier-risk estimates for open-weight models has argued that converting a recovered capability into real-world biological harm still demands wet-lab skill, materials and tacit knowledge that no amount of H100 time supplies. Read the compute figure as a measure of how easily the safeguard comes off, and leave the question of downstream uplift to the people who study the wet lab.

Both can be true, and the policy reading barely changes. If you’re deciding whether to release protein model weights, the relevant question is what the filtering buys you after release, and the answer from AISI’s own experiment is: in this domain, not much. Filtering still has a job, it reduces what the shipped artifact does by default and it costs the attacker a step. Treating it as the control that makes open release safe is the error.

Which pushes the burden onto access controls for the excluded data itself, since a filter that’s reversible given the filtered sequences is only as strong as the sequences’ availability. That’s a harder institutional problem than a data-pipeline change, and the published viral sequence databases that make the $80 fine-tune possible are not going anywhere.

Sources: Pretraining data filtering in open-weight biological models • The Effectiveness and Durability of Pretraining Data Filtering in Protein Language Models • Deep Ignorance • Best Practices for Biorisk Evaluations on Open-Weight Bio-Foundation Models