Research using open-weight ESM-2 models found that removing viral protein data during training reduced targeted capabilities, but further fine-tuning restored them at relatively low cost
Research by the UK AI Security Institute found that filtering viral protein data during AI model training reduced targeted capabilities, but subsequent fine-tuning could restore them for approximately $80 in computing costs.
The UK AI Security Institute (AISI) has found that filtering biological data during AI model training can suppress targeted capabilities without significantly affecting other functions, but the protection can be reversed for approximately $80 in computing costs.
The research examined whether removing viral protein sequences from training datasets could provide a durable safeguard for open-weight biological AI models, which can be downloaded, modified and retrained by other users.
The findings raise questions about relying on pretraining data filtering as a standalone safety measure for scientific AI systems. Although the approach successfully reduced model performance on excluded viral proteins, subsequent fine-tuning restored the lost capabilities across every model size tested.
AISI's Chemical and Biological (Chem-Bio) team conducted the experiments using the ESM-2 family of protein language models, training systems ranging from eight million to three billion parameters.
Removing viral data reduces targeted AI capabilities
Protein language models learn from amino acid sequences, identifying patterns that can help researchers predict protein structures and assess how mutations may affect their functions.
Unlike general-purpose large language models, these systems are trained predominantly on biological information and are typically smaller, making them easier to train and distribute.
The researchers tested whether removing viral protein sequences before training could prevent models from developing capabilities associated with those proteins while preserving their ability to analyze non-viral sequences.
They examined three levels of data exclusion, ranging from removing sequences associated with a single influenza strain to excluding all viral proteins and closely related sequences.
The team then measured performance across three tasks: predicting masked amino acids within protein sequences, estimating the effects of mutations and identifying contacts between amino acids within three-dimensional protein structures.
Filtering reduced performance on viral proteins while largely preserving performance on non-viral proteins.
The effect was strongest in larger models. Masked language modeling performance declined at every model size, while contact prediction was affected in models above 150 million parameters and mutation-effect prediction in those above 650 million parameters.
The results indicate that researchers can selectively reduce particular capabilities during training without substantially damaging the model's performance across unrelated biological tasks.
Fine-tuning restores excluded capabilities at relatively low cost
The more significant finding emerged when researchers attempted to reverse the filtering.
By continuing to train the filtered models using the viral sequences that had originally been excluded, the team was able to restore performance on viral proteins completely.
The computing cost increased as models became larger, but remained comparatively low. Even for the largest model tested, containing three billion parameters, recovering the excluded capability required approximately $80 in NVIDIA H100 GPU compute.
The result demonstrates that filtering increases the resources needed to recover a capability rather than permanently removing it.
An additional complication is that the biological information needed for retraining is often publicly available, even when developers exclude it from their original training datasets.
The researchers also examined the trade-off between narrower and broader filtering. Removing more biological information may make targeted capabilities harder to reconstruct, but can also increase the risk of reducing performance on other scientific tasks.
Researchers call for stronger protection of biological AI models
AISI cautions that the findings come from a single model family, ESM-2, meaning they cannot automatically be generalized to other biological AI systems.
The team also acknowledges uncertainty in its recovery cost measurements, limiting conclusions about how resistance to fine-tuning changes as models become larger.
Filtering could prove less effective in models capable of retrieving additional information during inference, since they may access data excluded from their original training.
The findings are particularly relevant to the development of open-weight scientific AI systems, where model weights and inference code are released for others to use and modify.
Unlike safeguards controlled by a model provider, restrictions built into openly distributed systems can be challenged through further training or modification.
Pretraining data filtering has been considered a promising approach because it removes selected information before a model learns from it, rather than attempting to restrict behavior after training.
However, the AISI experiments show that the resulting protection is not necessarily durable, even when filtering successfully suppresses the intended capabilities during initial testing.
The researchers conclude that data filtering will need to be combined with additional safeguards, including stronger controls over access to scientific models and the biological datasets used to train them.
The full findings are available in the research paper, Pretraining data filtering in open-weight biological models, published on October 26, 2026.
ETIH Innovation Awards 2027 open for entries
The ETIH Innovation Awards 2027 are now open for entries, with 26 categories recognising companies, institutions, projects and individuals making a measurable impact across education technology. The global awards span AI in education, digital learning, higher education, skills and workforce, inclusion, education operations, evidence and impact, with entries managed through ETIH’s new online awards platform.
Entries are open worldwide, with the early-bird deadline on Friday 18 December 2026 and the final entry deadline on Friday 26 February 2027 at 23:59 UK time.
Explore the 2027 categories and judging criteria, read the How to Enter guide or start an entry through the ETIH Innovation Awards 2027 platform.
