AISI: Filtering Viral Proteins From Training Data Is Undone for Under $80 — What Is Claimed and What Is Verified

A trending summary this weekend said that fine-tuning on viral data restores AI safety guardrails for under $80. Read cold, that sounds like a jailbreak result for chatbots, or like another entry in the abliteration and backdoor stories of the past week. The primary source says something narrower and, for biosecurity, more specific. On October 26 the UK AI Security Institute (AISI) published a Chem-Bio team blog post and paper on filtering data out of protein language models. "Viral" there means virus proteins.

This is a claimed-versus-verified post: what the headline says, what the study did, and what you can and cannot conclude. It deliberately stays at the level AISI itself publishes, with no sequence or method detail beyond that.

TL;DR

Agents that act on your behalf need rules. Agentbeam stops the dangerous actions →

What the headline got wrong

Three things got blended together:

1. "Guardrails." AISI is not testing refusal training. The "safeguard" is pretraining data filtering: leaving certain data out so the model never learns a capability. Nothing is refused, because the model simply performs worse on the targeted domain.
2. "Viral data." The excluded domain is protein sequences that make up viruses, which AISI calls the "forget" domain. Everything else (the proteins of all other life) is the "retain" domain. The recovery data is the withheld viral sequences, which AISI notes are routinely made public.
3. "Restores." What is restored is the model's performance on viral proteins, which was the capability filtering was meant to suppress. In a safety sense, the removed capability coming back is the bad outcome.

Meanwhile, other stories running the same weekend, including a backdoored Qwen2.5-7B that leaked .env files via Codex CLI and several abliteration products, involve LLMs and different mechanisms, and appear to be why the claims got conflated.

What AISI actually did

AISI's team pretrained models of the ESM-2 family from scratch, at sizes from 8M to 3B parameters. ESM-2 is the open protein language model line from Meta's research group, published in the facebookresearch/esm repository. Protein language models are trained like LLMs, but on amino-acid sequences instead of words.

Each model was trained on data from which viral proteins had been removed. AISI defined exclusion tiers, from narrow (removing a single influenza strain) to broad (all viral proteins and close homologues), each a strict subset of the next. The trade-off is straightforward: narrow filtering preserves more general capability but may be easier to reverse, while broad filtering removes data that could be used to reconstruct the capability, at a possible cost elsewhere.

Three questions were asked of every model:

1. Does filtering degrade the targeted capability? Measured on held-out data across masked language modelling (predicting hidden amino acids), mutation-effect prediction, and contact prediction.
2. How tamper-resistant is the result? AISI continued fine-tuning on the withheld viral data and recorded the compute needed to recover.
3. How does it change with scale? The experiment was repeated across sizes.

Finding 1: filtering works, and it is selective

Across all three tiers, excluding viral proteins substantially reduced performance on viral proteins while performance on non-viral proteins was largely preserved. Degradation showed on all three tasks, though how much varied. It was clearest for masked language modelling, which was affected at every model size. Contact prediction was affected for models over 150M parameters, and mutation-effect prediction for models over 650M. The effect was stronger for bigger models, because filtering holds back the viral performance that unfiltered models would otherwise gain as they scale.

This matters because prior LLM work suggested filtering can degrade a target domain while leaving others intact, and it was open whether that carries over to protein models, whose training data is much less varied. AISI's answer: it does, at least for ESM-2.

Finding 2: it is not durable

Continued fine-tuning on the excluded viral data was able to completely restore viral performance. Filtering, in AISI's words, raises the cost of recovering a capability rather than removing it permanently. The compute needed rose with model size, but stayed modest: even the 3B model needed only about $80 of H100 compute. That is the figure behind the headline. The right-hand panels in AISI's figure plot recovery cost in exaFLOPs and in dollars at an assumed hourly rate, and the dollar scale tops out in the tens of dollars. In practice, that means anyone with modest cloud budget and the excluded data could undo the filtering.

AISI also stresses that the data required is "often publicly available and easy to find." The safeguard is therefore only as strong as the barrier to getting relevant data, which for viral sequences is low.

What AISI concludes, and what it hedges

AISI's own summary: data filtering can effectively and selectively suppress a targeted capability, but "does not constitute a robust safeguard" on its own. It suggests pairing it with other measures, including improved access controls for scientific models or for the biological data needed to train them.

It also lists limits:

• Single model family. Results come from ESM-2, so generalization to other protein models is uncertain.
• Retrieval. Filtering may be less effective for models that can retrieve additional data at inference time.
• Imprecise cost measurements. AISI says its measurements of recovery cost are imprecise, which limits what can be said about how tamper-resistance changes with model size.
• Scale. The largest model is 3B parameters, small next to frontier LLMs (our observation, not AISI's).

We have not seen independent replication, and the full paper is the place to check methods. We did not verify the numbers beyond reading AISI's post and figures.

Claimed versus verified

Why it matters beyond proteins

Open-weight release is a live policy argument. Post-training protections such as refusal training are widely understood to be cheap to undo through fine-tuning. This study tests the more promising pretraining-filtering approach and finds it also falls to cheap fine-tuning when the data is public.

For builders, the takeaway is not that filtering is useless: it demonstrably suppresses capability in the released checkpoint, and most users will not fine-tune. It is that a safeguard should be judged against a motivated actor with public data and a few hundred dollars. The same lens applies to LLMs. Our coverage of hosted abliteration services, the open Aikido security model and a practical abliteration guide shows how routinely refusal behavior is stripped from open LLMs.

For readers following biology-focused AI tooling, see our posts on NVIDIA's open protein design model, NVIDIA's BioNeMo inference runtime and Anthropic's life sciences verification program, which approach access control from the vendor side.

What to do with this

• If you release open weights. Test safeguards by attempting recovery with realistic data and budget, and report the compute it took. Layer controls: data access, staged release, monitoring.
• If you evaluate model risk. Prefer tamper-resistance numbers (compute to undo) over one-time capability scores.
• If you cover or share this story. Say "protein language models" and "viral proteins." The shorthand "viral data restores guardrails" misleads readers.
• If you run agents on open models. The adjacent risk is supply-chain and behavior changes in modified weights; AgentBeam, the agent security platform from the explainx.ai team, is one way to watch what an agent attempts before it acts.

Bottom line

The number in the headline is real: about $80 of H100 compute undid pretraining data filtering in AISI's largest ESM-2 model. The framing is not. This is a measured result about protein models and tamper-resistance, and its message is that data filtering helps but needs company. We will update if AISI's paper or independent groups add measurements.

Findings reflect AISI's October 26, 2026 blog post. Check the full paper for methods and limitations.

Related reading

• Backdoored Qwen2.5-7B for under $50 (ProjectDiscovery)
• Abliterated DeepSeek V4.1 Flash on a hosted API: claimed vs verified
• Abliteration.ai and hosted uncensored cyber models
• Heretic LLM abliteration guide
• Aikido Altar 1 open security model
• NVIDIA Proteina RFD4 open protein design
• Anthropic life sciences verification program