Deep Ignorance: Filtering Pretraining Data Builds Tamper-Resistant Safeguards into Open-Weight LLMs

Motivation

• Existing tamper-resistant techniques can be undone within several hundred fine-tuning steps or fewer, while open-weight models can be modified arbitrarily by downstream actors.Open models also bring benefits in transparency, research, and deconcentration of power, alongside risks from downstream modification and unmonitored use.Source: §1 · p. 4

Knowledge Prevention

• The multi-stage filtering pipeline uses less than 1% of training FLOPS, prevents biothreat proxy capabilities competitively with post-training safeguards, and shows no observed degradation to unrelated capabilities.The paper describes filtering pretraining data as a way to prevent models from learning unsafe knowledge.Source: §1 · p. 5

Tamper-Resistance

• Filtering achieved tamper resistance through 10,000 fine-tuning steps and 300M tokens of biothreat-related text, improving by more than an order of magnitude over post-training baselines.The paper presents this as state-of-the-art tamper resistance.Source: §1 · p. 5

Defense-in-Depth

• Data filtering does not prevent models from using harmful knowledge supplied in context; circuit-breaking techniques provide complementary defenses, but none tested resist staged fine-tuning and in-context retrieval attacks.The paper identifies retrieval-augmented use as a condition that can bypass the protection of filtered models.Source: §1 · p. 5

Model Suite

• The authors release 6.9B-parameter models combining data filtering and post-training safeguards as a suite for studying how data removal affects model mechanisms and behavior.The paper also presents a hybrid unlearning algorithm, studies multiple-choice safeguard evaluation and synthetic-document training at scale, and offers the models as a test-bed for machine-unlearning research.Source: §1 · p. 5

2.1 MULTI-STAGE FILTERING

• A keyword blocklist escalates flagged documents to ModernBERT for semantic review, cheaply screening most data; classifier filtering used an estimated 0.83% of model-training FLOPS.Source: Figure 2 · p. 6, §2.1 · p. 6

2.2 LANGUAGE MODEL TRAINING

• The 6.9B-parameter decoder-only models use architectures identical to Pythia 6.9B; filtered models train slightly more than one epoch to match the baseline’s 550B tokens, while Strong Filter removes 8.42% of pretraining documents.Strong Filter also removes 9.36% of annealing documents; Weak Filter keeps identical pretraining filtering and uses a blocklist→ModernBERT annealing pipeline, filtering 4.96% of annealing documents.Source: §2.2 · p. 7

2.3 BASELINE POST-TRAINING SAFEGUARDS

• Post-training baselines include Circuit Breaking, which reroutes harmful-example activations, and CB+LAT, which trains against hidden-activation perturbations; the methods perform comparably overall.CB+LAT tends to resist some input-space attacks more strongly.Source: §2.3 · pp. 7–8

2.4 DEFINING AND MEASURING BIOTHREAT PROXY KNOWLEDGE

• Biothreat proxy knowledge is evaluated as factual knowledge using WMDP-Bio; curated robust MCQA and verified-cloze subsets mitigate multiple-choice shortcut exploitation.The benchmark measures internalized knowledge rather than biorisk capabilities directly.Source: §2.4 · pp. 8–9

2.5 MEASURING GENERAL CAPABILITIES

• General capabilities are assessed with MMLU subsets for disjoint and benign biological knowledge, plus PIQA, LAMBADA, and HellaSwag.Source: §2.5 · p. 9

2.6 FILTERING IS COMPETITIVE WITH STATE-OF-THE-ART POST-TRAINING SAFEGUARDS

• Filtering reduces proxy knowledge, performs best on cloze prompts, trails CB on robust MCQA, and incurs no apparent net degradation on non-bio capabilities.The comparison finds filtering and CB methods have similarly minor effects on general capabilities.Source: §2.6 · pp. 9–10, Figure 3 · p. 10
• Under GCG-U attacks, filtering outperforms CB on average; under few-shot attacks, it beats the baseline but trails CB.Source: §2.6 · p. 10, Figure 3 · p. 10

3.1 MODEL TAMPERING ATTACKS

• The evaluation tested latent-space attacks, adversarial fine-tuning on WMDP-Bio Forget data, and benign fine-tuning on WikiText.Latent perturbations targeted layers 0, 8, 16, 24, and 30; adversarial fine-tuning used 305M tokens, and benign fine-tuning used the same setup with WikiText instead.Source: §3.1 · pp. 10–11

3.2 FILTERING RESISTS FINE-TUNING ATTACKS FOR UP TO 10K STEPS AND 300M TOKENS

• 10,000 fine-tuning steps on 305M biothreat-proxy tokens did not break filtered models, which were most resistant except to latent attacks in multiple-choice (not cloze) evaluations.Filtering performed better than CB+LAT on cloze evaluations, while CB+LAT performed better on multiple-choice evaluations.Source: Figure 4 · p. 11, §3.2 · p. 12

3.1 MODEL TAMPERING ATTACKS

• Filtering did not prevent in-context retrieval of biothreat information, and no defenses resisted the combined fine-tuning and retrieval attack.Circuit-Breaking complemented filtering by impairing in-context retrieval, but the ensemble attack defeated all tested defenses.Source: Figure 6 · p. 12

3.2 FILTERING RESISTS FINE-TUNING ATTACKS FOR UP TO 10K STEPS AND 300M TOKENS

• Filtered models’ biothreat-proxy performance remained unchanged after benign WikiText fine-tuning, while CB and CB+LAT safeguards were vulnerable.Figure 5 also indicates that Circuit Breaking rapidly becomes ineffective under benign fine-tuning.Source: Figure 5 · p. 11, §3.2 · p. 12
• Our attacks exceeded related work on unique examples, fine-tuning steps, and the steps-by-batch-size product.The comparison covered reported adversarial fine-tuning studies of open-weight models ≥1B parameters (Fan et al., 2025; Hu et al., 2024; Sheshadri et al., 2024; Che et al., 2025; Łucki et al., 2024; Qian et al., 2025; Deeb & Roger, 2024; Muhamed et al., 2025; Tamirisa et al.; Qi et al., 2023).Source: §3.2 · p. 12

4.1 DATA FILTERING AND CIRCUIT-BREAKING ARE COMPLEMENTARY

• Combined filtering and Circuit-Breaking (CB) increased resistance to few-shot and latent-space attacks while maintaining comparable performance on other evaluations.The authors suggest the combination may improve coverage across diverse attacks.Source: Figure 7 · p. 13, Figure 8 · p. 13, §4.1 · p. 14
• Filtering alone cannot prevent in-context retrieval: CB and CB+LAT resisted answering with abstracts supplied, but no model resisted an ensemble fine-tuning plus open-book attack.For closed-weight systems, the authors suggest granting trusted users access to dual-use knowledge databases while restricting access for others; they note direct human use of search tools may limit the LLM’s added uplift.Source: §4.1 · pp. 13–14, §4.2 · p. 14

4.2 OUR CHALLENGES WITH SYNTHETIC DOCUMENT TRAINING AT SCALE (NEGATIVE RESULTS)

• Mixing synthetic biothreat-misinformation documents into annealing did not outperform filtering alone and often increased biothreat proxy knowledge.The authors speculate that biology-flavored examples may attune models to biology heuristics, while pointwise documents may fail to implant coherent false beliefs; proxy evaluations can confound results, motivating carefully designed synthetic datasets.Source: §4.2 · p. 14

Data filtering and curation

• Prior filtering studies largely target harmful content or test small models, while this work studies pretraining-data filtering at 6.9B parameters against up to 10,000 steps and 305M tokens of adversarial fine-tuning.Web-scale curation faces costs, filtering errors, quality degradation, multilingual and cultural-bias challenges, and the contextual nature of harmfulness; public frontier filtering efforts have not given precise details about methods or evaluation. Maini et al. (2025), Li et al. (2025a), and Lee et al. (2025) are identified as concurrent work, with Lee et al. testing models up to 500M parameters and attacks up to 500 steps.Source: §5 · p. 15

LLM capability suppression (“unlearning”)

• Machine-unlearning approaches directly suppress harmful capabilities through fine-tuning or mechanistic interventions, but face vulnerability to attacks, side effects, evaluation difficulty, and broader practical challenges.The passage also distinguishes refusal fine-tuning from techniques intended to suppress capabilities directly.Source: §5 · p. 15

Black-box capability elicitation

• Prompt-engineering and jailbreaking attacks can elicit harmful capabilities from safety-fine-tuned models, while this work reports that data filtering improves resistance to input-space attacks.The paper locates this result in Section 2.6.Source: §5 · p. 15

White-box capability elicitation

• Prior white-box elicitation work spans soft-prompt, latent-space, and weight-space attacks, and few-shot fine-tuning can efficiently elicit latent capabilities.Existing tamper-resistance methods are described as resisting only dozens or hundreds of fine-tuning examples; this work claims state-of-the-art tamper robustness through pretraining-data filtering.Source: §5 · pp. 15–16

LLM safety cases

• Robustness to diverse tampering attacks has been proposed as evidence that harmful-behavior circuitry is absent, and this work studies data filtering and Circuit-Breaking as useful but breakable open-weight safeguards.The paper links tamper resistance to developing inability-based safety cases, while noting that its safeguards are not unbreakable.Source: §5 · p. 16

6.1 IMPLICATIONS FOR OPEN- AND CLOSED-WEIGHT MODEL RISK MANAGEMENT

• More than an order of magnitude greater resistance than state-of-the-art post-training baselines was observed, with filtering resisting up to 10,000 adversarial fine-tuning steps and 300M tokens.The authors also report useful synergies between data filtering and existing post-training safeguards (Zou et al., 2024; Sheshadri et al., 2024).Source: §6.1 · p. 16
• Open-weight risk management remains challenging because external actors’ resources and goals are outside developers’ control, and the cost and expertise needed to build effective fine-tuning datasets remain uncertain.The authors note that WMDP datasets and evaluations cost over $200,000 USD to create, while the relationship between dataset-construction effort and attack effectiveness remains unknown.Source: §6.1 · pp. 16–17
• Filtering may also safeguard closed-weight models, since input classifiers may not prevent all attacks and tampering robustness has been argued to evidence a lack of harmful-behavior circuitry.The cited arguments about robustness and harmful-behavior circuitry include Buhl et al. (2024), Greenblatt et al. (2024), Qi et al. (2024b), Huang et al. (2024), Hofst¨atter et al. (2025), and Che et al. (2025).Source: §6.1 · p. 17

6.2 DOES PRETRAINING DATA FILTERING HELP TO MITIGATE ALL TYPES OF HARMFUL BEHAVIORS?

• Filtering biothreat-proxy text yielded bio-benign, tamper-resistant models, but tested toxic-content-filtered models did not consistently resist fine-tuning or few-shot prompting attacks.The authors speculate that filtering may suppress precise scientific or engineering knowledge more reliably than emergent propensities such as toxicity or attempted compliance, which may not require precise knowledge.Source: §6.2 · p. 17

6.3 LIMITATIONS

• The experiments cover only unimodal 6.9B models without instruction fine-tuning, trained on 550B tokens, and biothreat-proxy knowledge measured by multiple-choice questions; attacks provide only a lower bound on worst-case behavior.The models did not have competitive capabilities with open LLMs of similar sizes, and other tampering attacks may elicit more unwanted information.Source: §6.3 · p. 17
• Filtering cannot prevent retrieval-augmentation attacks and appears insufficient against harmful propensities, so the authors argue for defense in depth; removing substantial training data may also affect behavior unpredictably.They characterize better filter classification as a tractable engineering problem rather than an inherent limitation of filtering.Source: §6.3 · p. 18

6.4 IMPACT AND RISK STATEMENT

• The work focuses on biothreat-proxy knowledge and existing datasets and benchmarks, introduces no novel attacks, releases weaker-capability models, and withholds its filtered pretraining dataset.Source: §6.4 · p. 18

6.5 FUTURE WORK

• Future work should evaluate larger or multimodal models, investigate the mechanisms of deep versus shallow ignorance, and develop broader monitoring, mitigation, and standards for open-weight risk management.The authors also suggest using released models as interpretability testbeds and studying how filtering generalizes across model scales.Source: §6.5 · p. 18

ACKNOWLDGEMENTS

• The authors thank colleagues for helpful discussions and Alex Robey and Alexandra Souly for methodological input.Jai Patel coordinated collaboration logistics, Iman Syed supported compute for tampering experiments, and Kyle O’Brien received partial support from the Cambridge ERA:AI Fellowship.Source: ACKNOWLDGEMENTS · p. 18
• Donated GPUs and cluster support enabled filter development, pretraining experiments, and tampering experiments.CoreWeave donated GPUs to EleutherAI; Prime Intellect supported hardware troubleshooting, while GW4 and the UL Met Office maintained the Isambard cluster.Source: ACKNOWLDGEMENTS · p. 19

CONTRIBUTIONS

• Kyle O’Brien led pretraining and data filtering, addressed proxy-knowledge evaluation challenges, and produced the Robust MCQA and Verified Cloze WMDP-Bio splits.He also wrote much of the paper.Source: CONTRIBUTIONS · p. 19
• Stephen Casper led baseline-safeguard experiments and adversarial model evaluations, and wrote much of the paper.Source: CONTRIBUTIONS · p. 19
• Quentin Anthony, Tomek Korbak, Robert Kirk, Xander Davies, and Ishan Mishra supported the project technically, logistically, and through writing; Geoffrey Irving, Yarin Gal, and Stella Biderman advised, and Biderman originated the idea.Source: CONTRIBUTIONS · p. 19

• The Weak multi-stage filter escalates documents with two or more blocked terms to ModernBERT review, reducing false positives at the cost of increased false negatives.Source: B EXPERIMENTS WITH MULTI-STAGE… · p. 32
• The Strong single-stage filter rejects documents with two or more blocked terms outright; the experiments combine filtering choices across pretraining and annealing.Source: B EXPERIMENTS WITH MULTI-STAGE… · p. 32
• Single-stage filtering gives the lowest WMDP performance but regresses average general-knowledge benchmarks by less than one percentage point; multi-stage effects vary by evaluation and training stage.Source: B EXPERIMENTS WITH MULTI-STAGE… · p. 32
• Multi-stage pretraining still significantly regresses WMDP-Bio, with proxy-knowledge results differing between multiple-choice and cloze-style evaluations; paired with multi-stage annealing, it slightly improves average general-knowledge performance.Source: B EXPERIMENTS WITH MULTI-STAGE… · p. 32
• The optimal filtering combination depends on balancing reduced performance on the filtering target against preservation of general knowledge, and filtering approaches can differ across training stages.Source: B EXPERIMENTS WITH MULTI-STAGE… · p. 32

C FILTERING’S IMPACT ON TOTAL FLOPS

• The FLOPS accounting excludes CPU-bound operations because they are extremely cheap compared with GPU-bound operations.The section measures total computation in floating-point operations to quantify filtering’s additional compute cost before expensive training runs.Source: C FILTERING’S IMPACT ON TOTAL FLOPS · p. 32
• 8.32PD FLOPS are consumed empirically by pretraining runs, versus the 6PD formula primarily followed from Kaplan et al. (2020).The higher multiplier primarily reflects activation checkpointing, which adds forward passes during backpropagation to reduce GPU memory use.Source: C FILTERING’S IMPACT ON TOTAL FLOPS · p. 32
• The most expensive measured filtering setup applies the multi-stage pipeline to both pretraining and annealing.This is the end-to-end weak-filter setup.Source: C FILTERING’S IMPACT ON TOTAL FLOPS · p. 33
• 2.62e20 FLOPS are estimated for end-to-end multi-stage filtering, compared with 1.92e20 FLOPS for the weak-filter setup.The end-to-end setup applies multi-stage filtering to pretraining and annealing; the weak-filter setup performs no GPU FLOPS during pretraining-stage filtering.Source: C FILTERING’S IMPACT ON TOTAL FLOPS · p. 33, Table 3 · p. 33
• Less than 1% of training compute is added by comprehensive end-to-end filtering, while the weak-filter configuration adds 0.61%.The paper describes these overheads as computationally negligible compared with model training costs.Source: C FILTERING’S IMPACT ON TOTAL FLOPS · p. 33
• The filtering share of compute may decline with blocklist optimization or when training larger models.A more optimized blocklist could reduce the documents escalated to classifier review.Source: C FILTERING’S IMPACT ON TOTAL FLOPS · p. 33

D.1.1 DATASETS; D.1.2 BLOCKLIST FILTER

• The labeled corpus pairs 24,453 proxy-knowledge papers with 66,360 general-biology papers; the refined blocklist contains 6,178 scientific terms selected using a 0.4 positive-ratio threshold.To broaden data diversity beyond scientific papers, the authors generated lecture, exam, and article rewrites and added Llama-labeled DCLM documents; each final blocklist term occurs in proxy documents at least 40% as often as its relevant occurrence denominator allows.Source: §D.1.1 · pp. 33–34, §D.1.2 · pp. 34–35

D.1.3 CLASSIFIER FILTER

• The second-stage ModernBERT-Large classifier flags a document when any chunk exceeds threshold 0.0105, filtering approximately 5% of the annealing dataset.It was fully fine-tuned with Llama-labeled training data; the authors chose the threshold with minimal hyperparameter optimization to mitigate overfitting risk.Source: §D.1.3 · p. 35

D.2 LANGUAGE MODEL TRAINING SETUP; D.2.1 PRETRAINING DATASET; D.2.3 HYPERPARAMETERS

• Pretraining used ≈500B tokens from 409,935,485 deduplicated DCLM documents, with Pythia 6.9B architecture, 2,048-token sequences, and an effective batch of 4,194,304 tokens.The primary pretraining hyperparameters are reported in Table 7.Source: §D.2.1 · p. 36, §D.2 · p. 36, Table 7 · p. 38

D.2.2 ANNEALING DATASET

• The 50B-token annealing mixture allocates 25B tokens to unseen DCLM data and the remainder to domain-specific content, including a higher proportion of scientific material than OLMo-2.Instruction-like data were included so the models would be familiar with the evaluation task; Table 6 describes the mixture as 19.69% instruction-following, 30.31% academic knowledge, and 50.00% general web data.Source: §D.2.2 · p. 36, Table 6 · p. 37

D.3 TRAINING DURATION & EFFECIENCY; D.3.1 STEP 1: CALCULATE THROUGHPUT (OBSERVED H100 FLOPS)

• 558e12 average per-GPU FLOPS yielded ≈15,632 GPU hours of training, or ≈5 days on 128 H100s.The paper reports a Model FLOPs Utilization of 0.56 using Nvidia’s 989e12 peak figure; an alternative MAMF maximum is also discussed.Source: §D.3.1 · pp. 36–37

D.4 MITIGATING SHORTCUT EXPLOITATION IN MULTIPLE-CHOICE EVALS; D.4.1 WMDP-BIO ROBUST MCQA SUBSET

• All three models exceeded the 25% random baseline on choice-only prompts; removing 405 questions (31.81%) they all answered correctly left an 868-question WMDP-Bio Robust subset.The authors identify shortcut exploitation as a limitation of multiple-choice evaluation and use the refined subset to better assess proxy-knowledge retention.Source: §D.4 · p. 37, §D.4.1 · pp. 38–39, Table 8 · p. 39

D.4.2 WMDP-BIO VERIFIED CLOZE SUBSET

• The verified cloze evaluation selects the highest length-normalized log probability among four answer choices, excluding 197 WMDP-Bio questions that could not be adapted.The authors used OpenAI o3 to determine which questions were incompatible with the cloze format.Source: §D.4.2 · p. 40

D.5 TRAINING ON THE TEST TASK’S EFFECT ON DATA-FILTERED LANGUAGE MODELS

• After MCQA training, WMDP-Bio Robust accuracy improved by only ≈2 pp in both configurations, while the filtered model still significantly underperformed the unfiltered baseline.The authors attribute the filtered model’s lower performance to genuine ignorance, not underexposure to the task, and note that Flan’s 8.43 billion instruction-following tokens likely supplied implicit task familiarity. The test-task training used 98,764 MMLU MCQA documents (∼35.55M tokens), filtered to remove potential bio research knowledge.Source: §D.5 · p. 41

E COMPARING OUR ADVERSARIAL FINE-TUNING ATTACKS TO PRIOR WORKS

• Direct comparisons are rough because models, data contents, context size, batch size, and hyperparameters vary.The overview covers known studies of fine-tuning attacks against open-weight language models over 1B parameters, whether attack- or defense-focused.Source: E COMPARING OUR ADVERSARIAL… · pp. 41–42
• The authors report separate maxima for unique examples, batch size, and total steps, describing full fine-tuning runs rather than the amount needed for successful attacks.Some runs, including Qi et al. (2024b), were configured to be substantially longer than needed to develop successful attacks.Source: E COMPARING OUR ADVERSARIAL… · p. 42
• Our models were tested on the greatest numbers of unique examples, total steps, and step × batch size product among related works.Concurrent work by Wallace et al. (2025) reported extensive fine-tuning attacks but not example counts, batch size, or steps.Source: E COMPARING OUR ADVERSARIAL… · p. 42, Table 10 · p. 42

F SYNTHETIC DOCUMENT TRAINING EXPERIMENTS

• Fine-tuning with a learning-rate warmup stabilized training and slightly improved the success of synthetic-document attacks.Source: F SYNTHETIC DOCUMENT TRAINING… · p. 42
• SDT failed to improve resistance over data filtering alone, mildly impeding attacks under multiple-choice evaluation but failing or sometimes degrading resistance under other attacks.The authors suggest this may reflect models becoming attuned to biothreat content and gaming multiple-choice evaluations (Dominguez-Olmedo et al., 2024; Balepur et al., 2025).Source: F SYNTHETIC DOCUMENT TRAINING… · p. 42, Figure 9 · p. 43
• SDT was more likely to increase than decrease model performance on biothreat-proxy evaluations.Source: F SYNTHETIC DOCUMENT TRAINING… · p. 43

G EXPERIMENTS ON MODELS FROM MAINI ET AL. (2025)

• The experiments compared baseline and toxic-text-filtered 1.7B models using jailbreak attacks and general-capability evaluations, with jailbreak success graded for attempted and successful compliance.Attacks included few-shot, GCG-U, latent-space, full fine-tuning, and LoRA; jailbreak robustness was evaluated on 250 held-out examples. CB, CB+LAT, and synthetic document fine-tuning were also tested as defenses.Source: G EXPERIMENTS ON MODELS FROM MAINI ET… · pp. 43–44
• Filtering made Maini et al. (2025) models only slightly more resilient to fine-tuning attacks and more vulnerable to few-shot attacks, while CB and CB+LAT were effective.Synthetic document training was largely ineffective; the models were fairly resistant to tuned GCG-U and latent-space attacks. The experiments used relatively small 1.7B models, so the findings may not extend to large, state-of-the-art LLMs.Source: G EXPERIMENTS ON MODELS FROM MAINI ET… · pp. 43–44, Figure 10 · p. 44

H COMPARING OUR MODELS WITH OTHER OPEN MODELS

• For Llama 3.1 8B Instruct, verified-cloze accuracy was 26.15% below top-level WMDP-Bio accuracy, and other open models generally outperformed the paper’s models.Across six similarly sized open-weight models, robust-MCQA and verified-cloze performance was lower than top-level WMDP-Bio accuracy; the authors attribute other models’ advantage likely to more training data and hyperparameter optimization.Source: H COMPARING OUR MODELS WITH OTHER OPEN… · p. 45, Table 11 · p. 45

I.1 CREATING A CUSTOM OPEN/CLOSED-BOOK EVAL

• A prompt instructed Claude 3.7 Sonnet to create challenging, standalone, open-book PhD-level multiple-choice questions answerable from a supplied paper.The requested questions concerned biothreat science rather than biodefense; the appendix notes that biothreat-related text was redacted.Source: §I.1 · p. 45, I KEY PROMPTS USED IN EXPERIMENTS · p. 45

I.2 SYNTHETIC DOCUMENT PROMPTS

• The synthetic-document prompts generated weak or strong knowledge corruption by rewriting advanced biology information as plausible incorrect content, with the strong version retaining the subject while thoroughly changing its information.The weak prompt targeted college-level-or-higher concepts; the strong prompt substituted high-school-level cell-organelle concepts.Source: §I.2 · pp. 46–47

I.3 INCOMPETENT COMPLIANCE PROMPT

• The incompetent-compliance prompt asked for harmful-request responses to be rewritten as plausible but thoroughly incorrect information or instructions.This prompt supported the synthetic document training approach tested in Section G, which was largely ineffective.Source: G EXPERIMENTS ON MODELS FROM MAINI ET… · p. 44, §I.3 · p. 48

I.4 STRONGREJECT JAILBREAK AUTOGRADER PROMPT

• The modified StrongReject autograding prompt assessed refusal (0 = no, 1 = yes) and rated response correctness and specificity on 1-to-5 scales, tying correctness to likely success and specificity to direct helpfulness.Disclaimers or warnings did not affect scores, except in creative content generation, where they made generated responses less convincing.Source: §I.4 · pp. 48–49

I.5 WMDP CLOZE-STYLE COMPATABILITY

• The WMDP cloze-compatibility prompt classified whether questions require multiple-choice options or can be answered open-endedly without them.It treated references among choices or dependence on the provided list as MCQA-only, while self-contained questions answerable without options were open-ended compatible.Source: §I.5 · pp. 49–50

I.6 BLOCKLIST KEYWORD EXTRACTION

• For blocklist construction, Llama 3.3 70B extracted specialized, field-distinguishing scientific terms while excluding common or general vocabulary and returning comma-separated lists.The prompt also excluded common terms associated with COVID-19.Source: §I.6 · p. 51

I.7 SECOND-ROUND BLOCKLIST REFINMENT

• Llama 3.3 70B refined the blocklist by assigning binary labels, classifying a term as relevant if it met any single biorisk criterion and otherwise as irrelevant.General biology unrelated to the positive class and terms common in general text were specified as negative categories.Source: §I.7 · pp. 51–52

I.8 PROXY KNOWLEDGE CLASSIFICATION

• The proxy-knowledge classifier labeled a document positive if it matched any single criterion and instructed borderline or technical texts to be treated as positive.The prompt required a binary label without explanation.Source: §I.8 · p. 52

I.9 DATA AUGMENTATION: ARTICLE, LECTURE, AND EXAM

• Llama 3.3 70B generated article, lecture, and multiple-choice-exam rewrites of scientific papers, preserving rigor and technical data while adding explanations or engagement.The exam prompt targeted technical knowledge unique to the source document.Source: §I.9 · pp. 52–53

J FILTERED DOCUMENTS ANALYSIS

• Filtering can reduce WMDP-Bio performance to near-random levels, suggesting high recall, but the authors did not measure classification performance on the actual pretraining and annealing datasets.Labeling enough training data to measure filter performance was a significant challenge.Source: J FILTERED DOCUMENTS ANALYSIS · p. 53
• Most filtered annealing documents came from Semantic Scholar and DCLM, where weak and strong filters agreed more than they did for StackExchange documents.The figure reports documents removed by each filter and source on a log scale.Source: J FILTERED DOCUMENTS ANALYSIS · pp. 53–54, Figure 11 · p. 54
• Semantic Scholar samples commonly covered biomedical, public health, and virology topics, while DCLM samples included scientific papers and nontechnical COVID-19 impact discussions flagged as false positives.Source: J FILTERED DOCUMENTS ANALYSIS · p. 54
• Wikipedia samples included proxy-related discussions of deceased people, drugs, and antimicrobial resistance alongside nontechnical pandemic false positives; most filtered StackExchange samples were likely false positives.Source: J FILTERED DOCUMENTS ANALYSIS · p. 54
• FLAN samples included Ebola summarization and a drought-monitoring false positive, with translation tasks a possible confounder; observed Camel samples contained biology related to proxy targets.The weak filter was trained only on English text, which may help explain the FLAN translation confounder.Source: J FILTERED DOCUMENTS ANALYSIS · p. 54
• The analysis was only a modest qualitative study, and the authors expect more precise filters could reduce false positives while retaining the observed regression in WMDP-Bio with minimal overall performance effects.Source: J FILTERED DOCUMENTS ANALYSIS · p. 54