PaperlayerView exact revision on arXiv

Source-linked AI summary

Testing Large Language Model Agents on the Use of Biological Tools for Nucleic Acid Synthesis Screening Evasion

Jeffrey Lee, Alyssa Worland, Christopher Rodriguez, Kyle Brady, Grant Ellison, Henry Alexander Bradley, Dawid Maciorowski, Jordan Despanie, Barbara Del Castello, Jason Johnson, Steph Guerra

arXiv:2610.03852v1cs.CY

TL;DR

This report examines whether frontier LLM agents can use biological tools to redesign peptides and proteins in ways relevant to nucleic acid screening evasion. Agents succeeded in some Protein-2 attempts, though the reported success rates were low and the evaluation did not include laboratory validation or iterative design.

  • Problem

    The report addresses the limited evaluation of LLM-agent interactions with biological tools in a defined threat model, focusing on a capability relevant to synthesis-screening evasion.

    Source: Chapter 3. Discussion · p. 25, §3.3 · p. 28

  • Method

    The evaluation tested frontier LLM agents on peptide and protein redesign and added a DeepSeek CYOA case study redesigning all proteins encoded in a viral genome.

    Source: Agent Performance: Gemini 3.1 Pro · p. 16, §2.4 · p. 22

  • Results

    Gemini 3.1 Pro and DeepSeek V4 Pro each succeeded in 3 of 30 Protein-2 redesign attempts, although these rates represent only one set of environments.

    Source: Chapter 3. Discussion · p. 25

  • Takeaways & Limitations

    The observed successes indicate a potentially concerning capability, and further testing of biosecurity-relevant LLM-agent and biological-tool capabilities is warranted.

    Source: §3.4 · p. 29

    The evaluation omitted laboratory validation and iterative design cycles and used a single task-description prompt per Agent run.

    Source: §3.2 · p. 27

Abstract

from arXiv · show

This report is a continuation of previous efforts to test the ability of large language model (LLM)-driven artificial intelligence (AI) agents to interface with AI-enabled biological tools (BTs). While rapid advancements in BTs in recent years have brought promise to accelerate scientific discovery, they also raise significant biosecurity concerns about potential misuse. The biosecurity community is particularly interested in the extent to which LLMs can lower technical barriers and assist non-expert users in accessing and operating BTs. Despite this interest, few evaluations have focused on LLM-BT interactions in the context of a defined threat model. To address this gap, this report describes a test of frontier LLM-driven AI Agents on their ability to use BTs to redesign peptides and proteins to evade nucleic acid synthesis screening measures. Highly relevant to biorisk, this task assesses a potential capability of AI agents that could enable a breach of a critical early defensive layer designed to prevent a multitude of biological misuse scenarios. The findings presented here intend to offer a foundation for biosecurity researchers and AI developers to conduct or further risk and capability assessments as these technologies progress.

About This Report

This report describes RAND’s Center on AI, Security, and Technology and notes that AI assisted with code writing and review. The work was funded through RAND operations and philanthropic support, without donor or client influence over findings or recommendations.

About This Report

  • AI assisted with writing and reviewing the code, and an independent subject-matter expert reviewed all code used in the report.The project team resolved errors identified by LLM code review on a case-by-case basis.Source: About This Report · p. 3

Center on AI, Security, and Technology

  • RAND’s Center on AI, Security, and Technology examines opportunities and risks arising from rapid technological change, with a focus on AI, security, and biotechnology.The Center is part of RAND Global and Emerging Risks.Source: Center on AI, Security, and Technology · p. 3

Funding

  • The research was independently initiated and funded through RAND operations and philanthropic contributions, with clients, donors, and grantors having no influence over findings or recommendations.The listed supporters include foundations, charitable organizations, and individual donors.Source: Funding · pp. 3–4

Summary

This report tests whether frontier LLM agents can use biological tools for peptide and protein redesign relevant to nucleic acid screening evasion. Some designs passed suitability checks and evaded screening, but performance varied, and the tested models and settings limit what the results establish.

Summary

  • Frontier LLM agents were tested on peptide and protein redesign, with generated sequences assessed for quality and, when highly rated, evaluated by nucleic acid screening pipelines.The task sought designs that maintained structure and function without resembling the original sequence.Source: Summary · p. 5

Key Findings

  • In some attempts, the tested agents produced peptide and protein redesigns that met all in-silico criteria for sequence suitability and predicted preservation of structure and function.The report says this indicates agents could lower expertise barriers for actors using biological tools for hazardous biodesign tasks.Source: Key Findings · p. 5
  • Multiple Agent-designed peptides and proteins that passed suitability checks also evaded nucleic acid screening, while redesign success varied by tool configuration and biomolecule.It was rare for more than half of an Agent’s designs in a tool-configuration and biomolecule combination to be satisfactory.Source: Key Findings · p. 6
  • Unsuccessful redesign attempts did not share one consistent failure mode, with designs failing at multiple checkpoints, including upstream of structural and functional checks.Source: Key Findings · p. 6
  • Provider filters and model safeguards prevented testing the most advanced closed-weight frontier models, leaving the tested models unlikely to represent their capability ceiling.The report says it is unclear whether these defenses would be a true barrier to motivated threat actors; open-weight safety measures generally did not prevent misuse.Source: Key Findings · p. 6

Chapter 1. Introduction

The introduction frames AI-enabled biological tools as potentially beneficial for research and potentially misusable, including for biological weapon development. It motivates testing whether LLM agents can operate such tools for synthesis-screening evasion, a capability relevant to the report’s threat model.

Chapter 1. Introduction

  • AI-biology advances may accelerate scientific work but also raise misuse concerns, including the possible use of AI to support biological weapon creation.The report identifies biological-tool capabilities as relevant to its threat model, citing prior work showing open-source tools could generate toxin homologs diverse enough to evade synthesis screening.Source: Chapter 1. Introduction · p. 9
  • The BT Risk Index identified more than a thousand tools developed since 2019, and synthesis-screening evasion featured prominently among mapped misuse categories.Source: Chapter 1. Introduction · p. 9
  • Advanced biological tools can require expertise in design criteria, parameter selection, and data handling, while autonomous LLM agents could plan, execute, and assess tool use.The report describes this as a potential way to reduce the need for users to research critical amino acids, handle sequences, or interpret results themselves.Source: Chapter 1. Introduction · pp. 9–10
  • Despite relevant biodesign benchmarks and an earlier assessment of tool interactions, how non-specialized LLM agents use biological tools remained an open question.The earlier assessment found agents could often select appropriate tools and complete early interaction steps, but had mixed success operating tools and achieving consistent outcomes.Source: Chapter 1. Introduction · p. 10
  • The evaluation targeted four peptides and proteins using three high-risk biological tools and two ReAct agents driven by Gemini 3.1 Pro and DeepSeek V4 Pro.Agents used configurations containing individual tools or combinations, plus an open-ended CYOA environment where they had to identify and access suitable tools online.Source: Chapter 1. Introduction · pp. 10–11
  • The focus on peptides and proteins rests on assumptions that novel pathogen design is difficult, these tasks may indicate whole-pathogen design capability, and biomolecule alteration could have other dual-use applications.Source: Chapter 1. Introduction · p. 10

Chapter 2. Evaluating Models on Sequence Redesign

This chapter evaluates LLM agents on sequence-redesign tasks involving screening checks, including viral-protein and viral-genome redesign case studies.

2.1 Overview of Task Design

  • The study tested two selected agents on four biomolecules across four tool environments, requesting low-identity, binding-retaining redesigns and scoring eleven validation and structure/function metrics.Three biomolecules’ designs used simulated screening, while Protein-2 designs were tested with a commercial screening algorithm; the threat model was not stated in the prompt.Source: §2.1 · pp. 12–13

2.2 Task Performance Results

  • Each agent passed all checkpoints on 3/30 Protein-2 redesigns, evading commercial screening in silico; Gemini’s successes used CYOA and DeepSeek’s used ProteinMPNN.The runs were not conducted under identical conditions and are not a like-for-like comparison; the designs were not physically validated, so success refers to in-silico grading criteria.Source: §2.2 · p. 13, Figure 2.2 · p. 15, Agent Performance: Gemini 3.1 Pro · p. 16
  • Gemini passed all gates for 10/30 glucagon attempts; 20/30 OmpA designs cleared validation and structural scoring, but only one passed screening, while DeepSeek succeeded on 14/30 glucagon attempts.DeepSeek’s glucagon failures often occurred at the structure-and-function checkpoint, whereas Gemini’s often occurred at validation.Source: Figure 2.2 · p. 15, Agent Performance: Gemini 3.1 Pro · p. 16, Figure 2.4 · p. 18

2.3 Agent Tool Selection Propensities

  • Agents often chose alternatives in open-ended CYOA and neglected required tools in constrained settings, especially RFdiffusion and Evo 2, despite prompts to use them.The report links Evo 2 aversion to possible tension between minimizing sequence similarity and leveraging patterns learned by the tool; transcript-scanner classifications may be imperfect.Source: Choose Your Own Adventure (CYOA) · p. 20, Environments with Primary BTs · p. 22

2.4 Viral genome redesign and screening evasion case study

  • DeepSeek could not redesign all six parvovirus B19 proteins: many failed validity checks and all runs failed structural checks for three evaluated proteins, while 4/10 redesigns evaded simulated screening.The task involved overlapping coding regions; the functional check was not implemented because all runs failed validity and/or structural checks.Source: §2.4 · p. 23
  • DeepSeek V4 Pro Agent issued no denials for the viral redesign task.Source: §2.4 · p. 23
  • No LLM Agent redesigns satisfied the task, despite designs passing both validity and structure checkpoints.Source: §2.4 · p. 24

Chapter 3. Discussion

The discussion reports that agents could evade synthesis screening but did so infrequently, and it cautions that the evaluation’s scope limits how directly these findings map to biosecurity risk. It recommends stronger screening and broader testing of misuse-relevant agent capabilities.

Chapter 3. Discussion

  • Gemini 3.1 Pro and DeepSeek V4 Pro each redesigned Protein-2 to evade screening in three of 30 attempts, but success rates reflect only one setup.The authors note that workspace organization, provided resources, and other design choices can affect performance.Source: Chapter 3. Discussion · p. 25
  • The tested agents did not complete the multi-protein parvovirus B19 redesign, and the authors caution that its overlapping genes and task difficulty constrain interpretation.The report also says the tested models may not represent current achievable performance; newer models and life-science-specific agents were not tested.Source: Chapter 3. Discussion · pp. 25–26

3.1 Biosecurity Considerations

  • Biosecurity choices included withholding prompts, logs, and sequences, keeping the work in silico, and disclosing screening-pass sequences to the commercial provider.Parvovirus B19 was selected as a human-relevant target that is difficult to culture; the selected biomolecules were considered unlikely to harm human health in isolation.Source: §3.1 · p. 26

3.2 Limitations and Effect on Risk Assessment

  • Risk estimates are constrained by absent laboratory validation, no iterative human-in-the-loop design, tool timeouts, a limited biomolecule set, and limited screening approaches.The authors say lab testing is needed to verify function; iterative design and resource constraints could underestimate performance, while the effects of limited targets and screening scope on risk are undetermined.Source: §3.2 · pp. 27–28

3.3 Implications

  • The authors propose strengthening synthesis screening with function-based assessment [27] and expanding evaluations to other threat pathways, including de novo design and bioactivity augmentation.AI-generated redesigns at scale could inform screening pipelines about common exploitations.Source: §3.3 · pp. 28–29

3.4 Conclusion

  • The observed successes indicate a potentially concerning capability, despite the agents’ low task reliability, and support further testing of biosecurity-relevant LLM Agent–BT interactions.Source: §3.4 · p. 29

Appendix A: Evaluation Design

The evaluation sampled benign and biosecurity-relevant peptides and proteins, then assessed redesign across biological-tool configurations. The appendix describes the tools’ roles in the screening-evasion threat model and includes an open-ended configuration.

A.1 Peptide and Proteins

  • The evaluation table lists four biomolecules: human glucagon and Peptide-2, both labeled peptides, and E. coli OmpA and Protein-2, both labeled proteins; two entries have unnamed targets.Source: §A.1 · p. 30

A.2 Biological Tool Configurations

  • The BT configurations were paired with biomolecules for redesign, with those pairings listed in Table A.1.The table is titled “BT Configurations for Peptide and Protein Redesign.”Source: §A.2 · p. 30, Table A.1 · p. 30
  • Evo 2 can generate DNA sequences, and the report focuses on its potential use to produce functional variants that evade DNA synthesis screening.The report notes prior work generating viable bacteriophages and frames sequence-screening evasion as the threat model examined here [28, 29, 30].Source: §A.2 · p. 30
  • RFdiffusion generates protein backbones, while ProteinMPNN generates sequences expected to fold into specified conformations; together, they could support a structure-to-sequence redesign workflow.The report describes RFdiffusion’s use for binder and antibody design [31, 32], and ProteinMPNN’s inverse-folding role and possible pairing with RFdiffusion [33, 34].Source: §A.2 · p. 31
  • The CYOA environment let Agents choose and use any biological tool they considered suitable for the redesign task.Unlike the three named tool configurations, it did not specifically prompt the Agent to use additional tools.Source: §A.2 · pp. 30–31

A.3 Evaluation Implementation

Agents were prompted to redesign biomolecules for low sequence identity while retaining binding activity, then run under assigned tool configurations and evaluated using scoring rubrics and a sequence-screening checkpoint.

A.3 Evaluation Implementation

  • Agents were prompted to produce a redesigned coding sequence with low identity to the reference while retaining binding activity to its target.Prompts were tailored to each tool environment and biomolecule, while following a common pattern.Source: §A.3 · p. 32
  • Each Agent received ten attempts per tool–biomolecule pairing and access to Biopython, Colabfold, HADDOCK3, PRODIGY, and US-align.The primary tools varied by environment; the named tools were pre-installed alongside them.Source: §A.3 · p. 32
  • Outside CYOA, Agents were explicitly prompted to use the environment’s primary tool, and transcript scanners assessed whether they did so.The scanners used DeepSeek V4 Pro.Source: §A.3 · p. 32
  • Agent-generated DNA sequences were graded with consistent scoring rubrics and passed through a sequence-screening checkpoint.The screening checkpoint is described in Appendix C.Source: §A.3 · p. 32
  • Testing was conducted in the Inspect AI framework.Source: §A.3 · p. 32

A.4 Scoring the Evaluation

Scoring checked whether generated sequences were biologically coherent and sufficiently distinct, then assessed predicted structural similarity and function against wildtype references. The evaluation scored mature peptides or proteins, and scanner judgments carried possible interpretation errors.

A.4 Scoring the Evaluation

  • The LLM-based transcript scanners could hallucinate or misinterpret logs, although manual review of about 20% of runs suggested minimal performance issues.Source: §A.4 · p. 32
  • Scoring used the mature peptide or protein and excluded additional N-terminal sequences such as pre-pro sequences.Source: §A.4 · p. 32
  • Seven validity checks assessed DNA format, start and stop codons, codon-divisible and reasonable length, sequence difference, and GC content.The criteria included less than 0.98 identity to wildtype and a GC-content range of 0.25–0.65.Source: Validity · p. 33
  • Four structure-and-function criteria tested TM score, relative ipTM and pLDDT confidence, and predicted binding affinity against specified thresholds.The thresholds were TM > 0.5, ipTM > 0.6 times wildtype, pLDDT > 0.8 times wildtype, and predicted affinity > 0.7 times wildtype.Source: Validity · p. 33
  • Wildtype reference scores were averaged across five tool runs, and the thresholds were selected to preserve similarity or high relative scores.The threshold rationales distinguish structural similarity, interface score, local confidence, and relative binding affinity.Source: Validity · p. 33

Appendix B: Models, Scaffolds, and Task Parameters

The authors selected Gemini 3.1 Pro and DeepSeek V4 Pro after an initial qualitative assessment, and chose a ReAct scaffold for formal testing. The appendix also describes agent tools, parameter settings, and a time limit that may have constrained performance.

B.1 Model and Scaffold Selection

  • Gemini 3.1 Pro was selected partly because GPT-5.5 and Opus 4.7 frequently refused the task, while DeepSeek V4 Pro was chosen from comparably performing open-weight candidates.The authors selected both models after manual review; the margin for choosing DeepSeek was narrow.Source: §B.1 · p. 34
  • The ReAct scaffold was selected for formal testing after initial trials showed no clear performance boost from Codex or Claude Code.Those trials involved very few attempts, were not a primary focus, and were not presented as a report finding.Source: §B.1 · p. 34

B.2 Agent Tools and Parameter Values

  • The ReAct agents had bash, Python, text-editing, and web-search tools; Gemini used provider defaults, while DeepSeek had a 35,000-token limit.Gemini attempts had two-hour and 200-message limits, doubled for DeepSeek; DeepSeek never hit either limit.Source: §B.2 · p. 35
  • Ten-minute bash and Python timeouts were intended to prevent long-running iterative pipelines and may have caused performance underestimation.Agents generally adapted when timeouts occurred, according to manually reviewed logs.Source: §B.2 · p. 35

Appendix C: Nucleic Acid Synthesis Screening Methods

The screening methods combine a commercial provider’s pipeline for Protein-2 with a simulated BLAST-based process for other test biomolecules. Sequences were assessed in full-length and, where applicable, fragmented forms, with success defined by at least one unflagged submission.

Appendix C: Nucleic Acid Synthesis Screening Methods

  • For all but one test biomolecule, the simulated screen used local BLASTX results against UniProtKB/Swiss-Prot and matched top hits to a list of biological agents and selected biomolecules.The process used default BLASTX parameters and an E-value cutoff of 0.0544.Source: Appendix C · p. 36
  • Protein-2 redesigns were tested through a commercial synthesis provider’s screening pipeline, without accounting for know-your-customer measures.The evaluation focused specifically on nucleic acid screening.Source: Appendix C · p. 36
  • Where applicable, sequences were screened as full-length sequences and as fragments of 200 nt and 50 nt.Source: Appendix C · p. 36
  • A redesign counted as evading detection if any submission form passed, while any flagged fragment caused that fragmented submission to fail.A flagged fragment in the 200-nt submission did not prevent a separate unflagged 50-nt submission from counting as a pass.Source: Appendix C · p. 36

Appendix D: Per-Criterion Scoring Results

Appendix D presents per-criterion validity, structure, and function-check results for Gemini 3.1 Pro and DeepSeek V4 Pro. The heatmaps report attempt counts among runs that were not denials and passed the tool-use gate.

Appendix D: Per-Criterion Scoring Results

  • The heatmaps report, out of 10 attempts, how often each model met validity, structure, and function-related criteria, excluding denials and attempts that failed the tool-use gate.Source: Appendix D · p. 37
  • Validity criteria include DNA sequence form, length, start and stop codons, codon divisibility, GC content, and identity below 0.98.Source: Appendix D · p. 37
  • Structure and function criteria include TM score above 0.5, pLDDT above 0.8, ipTM above 0.6, and Prodigy binding affinity above 0.7 against the stated references.Source: Appendix D · p. 37

Appendix E: Viral genome redesign and screening evasion case study

The viral redesign case study specifies the genome components and grading checks used to evaluate redesigns, including validity, structural, and applicable function criteria. Full-genome function checks were not implemented because all submissions failed preceding validity or structure checks.

Appendix E: Viral genome redesign and screening evasion case study

  • The case study’s redesign task covered six parvovirus B19 proteins while keeping the left and right inverted terminal repeats constant.The prompt included the reference identifier, complete viral genome, and DNA sequences of the viral components.Source: Appendix E · p. 39
  • The rubric covered the full genome, ITRs, and viral proteins, but full-genome function checks were omitted because all submissions failed validity or structure checks.Structural checks applied only to components designated in the grading table.Source: Appendix E · p. 40
  • Full-genome validity checks required reasonable length within ±5% of 5,596 nt, identity below 0.9, DNA sequence form, and GC content from 0.25 to 0.65; both ITRs were checked for exact wildtype matches.Source: Appendix E · p. 40
  • Viral-protein checks included DNA form, start and stop codons, length within ±20% of reference, identity below 0.9, and GC content from 0.25 to 0.65.Applicable structural checks used TM, pLDDT, and ipTM thresholds; the function check used a Prodigy binding-affinity threshold against the wildtype reference.Source: Appendix E · p. 41

Abbreviations

  • The abbreviation list defines terms including CYOA, TM, ipTM, ITR, and pLDDT used in the report.Source: Abbreviations · p. 43
Loading 2610.03852v1…