Primary document

Publisher: UK AI Security Institute (AISI), Chem-Bio team.
Title: Pretraining data filtering in open-weight biological models.
URL: https://www.aisi.gov.uk/blog/pretraining-data-filtering-in-open-weight-biological-models
Publication date: 26 October 2026, read on the page.
Retrieval: page opened and read in full on 2026-10-31. HTTP 200 observed.
Document type: official research blog announcing an accompanying paper.

Quotations relied on

Each span below was copied verbatim from the retrieved page and re-tested against that page’s text on 2026-10-31. All three resolved exactly.

  1. “Data filtering can suppress a targeted capability in protein language models, without significantly impacting adjacent capabilities. However, it does not constitute a robust safeguard on its own, since the lost capability can be recovered at relatively low cost (under $80 of compute even for our largest model), and the data required to do so is often publicly available and easy to find.”
  2. “Therefore, for this to be an effective safeguard, it needs to come alongside other interventions, such as data access controls.”
  3. “Of the safeguards developed to date, one of the most promising is stringent filtering of the pre-training data”

Two further facts are stated plainly in the page and paraphrased, not quoted, in the report: that the team pretrained ESM-2 protein language models from scratch, and that training ran at several scales from 8M to 3B parameters.

Verification record

  • Verified by direct quotation: the suppression result; the recovery cost of under $80 of compute for the largest model; the availability and findability of the recovery data; the authors’ own statement that filtering is not a robust safeguard alone; the call for data access controls; the ESM-2 pretraining; the 8M to 3B parameter range; the “one of the most promising” characterisation.
  • Verified from the page’s own notice: the 26 October 2026 publication date.
  • Inference, disclosed in the report: that the largest model of the study corresponds to the top of the stated 8M to 3B range. The page refers to “our largest model” without naming its parameter count in the same sentence, and separately says frontier LLMs exceed even that model by orders of magnitude. The report states this link rather than asserting it as quoted text.
  • Reported, not independently confirmed: all figures and characterisations beyond the quoted passages rest on the blog’s summary of its accompanying paper. That paper was not opened in this run.
  • Not verified: no independent replication of the result was found or sought; no third-party assessment of the recovery cost was read.

Stated limits carried into the report

  • These are protein language models, not frontier general-purpose language models. The report does not extend the finding to LLMs.
  • The recovery method is fine-tuning on publicly available data, as described by the authors.
  • Single institutional source. The institute is both the researcher and the publisher of the summary used here.
  • The report makes no claim about whether filtering should be adopted; it reports what the institute found and what the authors concluded.

Duplication check

No published article on the live site covers AISI’s biological-model filtering research. The nearest published item is the AISI cyber-testing evaluation involving Claude Mythos 5, which is a separate finding from the same institute and is not referenced in the body of this report.

Provenance of this package

Candidate discovery, source verification, drafting and the mechanical editorial gate were each performed as separate stages. The stage that drafted the package received the verification record inline and was not permitted to research beyond it. The mechanical gate re-fetches the primary source and re-tests every quotation at run time; its output is the publication blocker, and this file records the same evidence for the reader. Nothing in this package was committed, pushed or deployed.