PaperlayerView exact revision on arXiv

Source-linked AI summary

ReproBAIT: Can coding agents build their own biological AI tools?

Shiv Muthupandiyan, Tolga H. Dur, Mac Walker, Timo Flesch, Mahmoud Ghanem, Steph Suddell, Giles Harper-Donnelly, Sophie Rose, Jasper Götting, Coleman Breen, Jake Pencharz

arXiv:2610.19810v1cs.AIcs.CYcs.LG

TL;DR

ReproBAIT addresses limited evidence about whether coding agents can reconstruct biological AI tools from limited descriptions, a question relevant where developers withhold implementation details for commercial or dual-use reasons. It evaluates agent-built tools under controlled conditions and finds reproduction capability for selected tools but difficulty with the most complex tested task. The authors also find partial evidence consistent with prior memorisation, whose contribution remains unresolved.

  • Problem

    There is little evidence on whether coding agents can reconstruct biological AI tools from limited descriptions, despite developers withholding implementation details for commercial or dual-use reasons.

    Source: §1 · p. 1

  • Method

    ReproBAIT has coding agents implement and train published biological AI tools under fixed budgets and limited information, then scores them on held-out data and checks for memorisation.

    Source: §1 · p. 2, §2.5 · p. 5

  • Results

    Agents approach PMPNN sequence recovery and match or exceed CMD molecular validity, while no attempt fully succeeds on the scoped RFD3 task within tested budgets.

    Source: §6 · p. 9

  • Takeaways & Limitations

    Coding agents can reproduce selected closed-source BAITs for less than 100 USD, which the authors say could increase unauthorised-reproduction concerns for tool developers.

    Source: §4 · p. 9

    The three-tool benchmark cannot support strong general conclusions, and possible pretraining exposure makes generalisation to unseen tools difficult to assess.

    Source: §5 · p. 9

Abstract

from arXiv · show

Large language models are increasingly competent at leveraging scientific knowledge and existing computational tools to execute complex workflows. At present, little information exists on their ability to reconstruct tools when given limited descriptions of such tools. We introduce an evaluation titled ReproBAIT (Reproducing Biological AI Tools), which measures the ability of coding agents to design, implement, and train biological AI tools taken from published research across a range of information access conditions. The coding agent is securely sandboxed without internet access and receives training data, a fixed time and compute budget, and limited information about the tool to replicate. We then score the reproduced biological AI tool based on its performance (tool-specific metrics) on held-out data. We evaluated a set of biological AI tools of varying complexities: ProteinMPNN, an inverse protein folding tool, RFdiffusion3, an all-atom generative diffusion tool, and a closed-source molecular design tool. We institute a methodology to check for memorisation, as the open source tools are likely to be included in models' pretraining corpus. Across a range of leading closed- and open-source coding agents, we find substantial reproduction capability for some selected tools, though limited capability for a highly complex tool. We find moderate evidence consistent with memorisation, varying across coding agents. These results suggest that tool developers need to be increasingly cautious when releasing information about the tools publicly; re-creation of the tool based on such information could undermine a tool's commercial value or invalidate dual-use managed access strategies.

1 INTRODUCTION

Biological AI tools are increasingly used in biology, but developers may keep implementation details private for commercial or dual-use reasons. ReproBAIT evaluates whether coding agents can reproduce these tools from limited information, and examines possible memorisation.

1 INTRODUCTION

  • Limited descriptions may still permit tool recreation, potentially diminishing commercial value or undermining access-management strategies for tools with dual-use potential.The paper frames this as a reason to investigate how well agents reproduce BAITs under different information-access conditions.Source: §1 · pp. 1–2
  • ReproBAIT tests whether coding agents can implement and train biological AI tools under controlled information access, time, and compute conditions.It evaluates the resulting tools against published BAITs rather than judging process adherence or source-code similarity.Source: §1 · p. 2
  • The benchmark covers ProteinMPNN, RFdiffusion3, and a closed-source molecular design tool, spanning different biological tasks and reproduction complexity.The molecular design tool is described in a 2022 publication and referred to as CMD.Source: §1 · p. 2
  • The authors find moderate evidence consistent with memorisation, varying across coding agents, but the diagnostics do not identify its causal contribution to reconstruction performance.They scan transcripts for signs of prior training on a target BAIT and compare agent-produced code with open-source codebases.Source: §1 · p. 2
  • The paper presents an extendable reproduction framework, an empirical assessment across three BAITs, and memorisation analyses with scorer verification.These are the authors’ stated three contributions.Source: §1 · p. 2

2 METHODOLOGY

ReproBAIT tests whether coding agents can reproduce biological AI tools under fixed budgets, using supplied data and limited tool information. Its methodology defines tool complexity, varies information access, controls the agent environment, evaluates functional performance, and checks for possible memorisation.

2 METHODOLOGY

  • Agents implement and train a target tool with supplied training data and fixed time and compute budgets; submissions are evaluated on held-out data using tool-specific metrics.Three independent attempts are run per configuration, and the highest score is reported.Source: §2 · p. 3

2.1 BAIT COMPLEXITY

  • Complexity is a rough equal-weight score across architecture, data pipeline, codebase, and estimated training compute, used to select tools spanning difficulty and task type.The benchmark includes PMPNN for sequence design on a backbone, RFD3 for structures in molecular context, and closed-source CMD.Source: §2.1 · p. 3, Table 1 · p. 3

2.2 INFORMATION ACCESS

  • Information access is varied through abstract-only and paper-only conditions without internet, with a paper-and-code baseline for open-source tools.The with-code condition is unavailable for CMD; the conditions are intended to model varying levels of public disclosure.Source: §2.2 · pp. 3–4

2.3 AGENT HARNESS

  • Attempts run in isolated sandboxes with one A10G GPU, up to 128 GB RAM, tool-specific time limits, and training data mounted from the original publications.Four LLMs are tested, with a standard ReAct/Bash/Python harness and additional harness experiments on PMPNN.Source: §2.3 · p. 4

2.4 SCORING AND BASELINES

  • Reproduction fidelity is the agent-produced tool’s score as a percentage of the released model’s score on the same metric; 100% indicates parity.The study does not assess equivalence across all capabilities of the original tool, and scorer code is isolated from reproduction attempts.Source: §2.4 · p. 5

2.5 MEMORISATION DIAGNOSTICS

  • Possible memorisation is assessed by transcript review for signs of prior knowledge and exact-code comparison with reference implementations.The public PMPNN and RFD3 codebases are considered likely to have appeared in evaluated models’ pretraining corpora.Source: §2.5 · p. 5

3 RESULTS

ReproBAIT finds that coding agents can reproduce selected biological AI tools, but performance falls sharply on the most complex tool, and evidence of memorisation varies across agents.

3 RESULTS

  • For most agents, successful CMD or PMPNN reproduction cost $4–$20; unsuccessful RFD3 attempts cost $102–$301 each, a lower bound for success.Figure 3b defines cost per reproduction using attempts reaching at least 75% fidelity in both information conditions.Source: §3 · p. 5, Figure 3 · p. 6

3.1 REPRODUCTION PERFORMANCE

  • CMD agents matched or exceeded the original validity score; Claude Opus 5 reached 96.5% PMPNN fidelity, while no RFD3 attempt was fully successful.The lone RFD3 partial success reached 81.5% fidelity after narrowing the training distribution; it was not counted as full reproduction.Source: §3.1 · pp. 5–7

3 RESULTS

  • Current coding agents reproduced selected BAITs, but no agent successfully reproduced RFD3 within the tested time budget.Figure 3 compares paper-only fidelity with BAIT complexity; its fidelity measure is each agent tool’s score as a percentage of the released model’s score.Source: §3 · p. 5, Figure 3 · p. 6

3.2 EFFECT OF INFORMATION ACCESS

  • Full-paper access raised mean PMPNN fidelity from 76.3% to 82.0%, an increase of 5.7 points, but did not monotonically improve performance across BAITs.Abstract-only PMPNN performance had twice the variance; CMD changed by −0.6 points, while RFD3 remained near zero in both conditions.Source: §3.2 · p. 7

3.3 EVIDENCE OF MEMORISATION

  • Transcript screening flagged 2 of 72 attempts as clear and 20 as suggestive evidence of recall; flags were concentrated in PMPNN (17 of 24).Flag rates were equal across information conditions, at 11 of 36 attempts in each.Source: §3.3 · pp. 7–8
  • Exact code overlap reached 16.7% for Claude Opus 5 in abstract-only runs and 12.6% for Kimi K3 with the paper, supporting moderate evidence consistent with PMPNN memorisation.Overlap was at most 1.9% elsewhere, and measured RFD3 attempts showed no overlap; the authors say these diagnostics do not establish how much performance is attributable to memorisation.Source: §3.3 · p. 8

3.4 EFFECT OF THE AGENT HARNESS

  • Harness effects were large for Kimi K3 (71.9% to 0.0% paper-only; 61.2% to 11.7% abstract-only), but at most 1.6 points for Claude Opus 5 and GPT-5.6 Sol.The exploratory PMPNN comparison used n=1 for each of those three agents.Source: §3.4 · p. 8

4 DISCUSSION

The results demonstrate reproduction of selected functionalities, not complete replication of original tools. They suggest that coding agents can lower barriers to reproducing some closed-source tools, while the tested agents struggle with high-complexity tools.

4 DISCUSSION

  • The evaluation demonstrates reproduction of selected functionalities rather than complete replication of the original tools.The authors report near-reference sequence recovery for PMPNN, reference-level or higher validity for CMD, and no fully successful RFD3 reproduction under the tested conditions and resource budgets.Source: §4 · p. 8
  • The study finds no clear trend between the amount of public information available and reproduction performance, and current agents struggle to match originals on high-complexity tools.The authors expect agent capabilities to improve, including through broader advances in scientific reasoning and machine-learning workflows.Source: §4 · p. 9
  • Given limited information, coding agents reproduced select closed-source BAITs for less than $100, suggesting lower barriers to unauthorized replication.The authors note that reproducing larger BAITs would involve substantially higher compute costs.Source: §4 · p. 9
  • The skills tested in reproduction—designing, implementing, and training tools—could also track agents’ capability to develop novel computational scientific methods.The paper tests reproduction, not novel-tool development.Source: §4 · p. 9

5 LIMITATIONS

The study’s scope limits generalization: it evaluates only three tools, not all their capabilities, under constrained resources and time.

5 LIMITATIONS

  • The three-tool sample is insufficient for strong general conclusions, and tool complexity, task domain, and availability may be interdependent.The authors suggest sampling an order of magnitude more tools across capability levels and scientific domains.Source: §5 · p. 9
  • The evaluated tools are scored on selected functionalities in isolation, not on holistic performance across each tool’s capabilities.Source: §5 · p. 9
  • Likely pretraining exposure to open-source implementations and related publications makes it difficult to generalize findings to unseen tools.Source: §5 · p. 9
  • Limited time and compute constrain agents; performance may improve with larger budgets or alternative harnesses.Source: §5 · p. 9

6 CONCLUSION

ReproBAIT finds that agents can reproduce selected biological AI tool functions, while complete replication and implications remain bounded by the evaluation’s scope. The paper also defines reproduction fidelity relative to released-tool baselines and validates those baselines where possible.

6 CONCLUSION

  • Agents approached ProteinMPNN sequence recovery and matched or exceeded CMD molecular validity, but none fully succeeded on the scoped RFdiffusion3 task within tested budgets.More supplied information did not consistently improve performance; memorisation diagnostics found partial evidence, but its contribution to success remains unresolved.Source: §6 · p. 9
  • The authors distinguish functional reproducibility from permitted use, and say limits on complete replication constrain commercial and security conclusions.Reproduction may support independent verification of results in the literature.Source: ETHICS STATEMENT · p. 10

A SCORER VALIDATION AND BASELINES

  • Reproduction fidelity expresses an agent-produced tool’s score as a percentage of the released BAIT’s score on the same primary metric.The paper does not assess equivalence across all capabilities; scores above 100% indicate higher performance on that selected metric than the baseline.Source: A SCORER VALIDATION AND BASELINES · p. 12
  • For open-weight tools, the released checkpoint is scored independently to set the baseline and check the scorer; CMD uses authors’ published metrics because it is closed-source.Source: A SCORER VALIDATION AND BASELINES · p. 12

A.1 CHEMICAL MOLECULAR DESIGN

The CMD task tests whether agents can train a generative model from supplied drug-like molecules and return novel molecules. Evaluation prioritizes validity while checking uniqueness and novelty to guard against trivial outputs.

A.1 CHEMICAL MOLECULAR DESIGN

  • Agents receive roughly 1,000,000 drug-like SMILES strings and must train a generative model from scratch to return 10,000 novel drug-like molecules.The scorer calls the model’s generation function with a held-out seed and scores its returned SMILES.Source: §A.1 · p. 12
  • Validity is the primary metric because the authors report it and valid molecules are necessary for downstream use.Uniqueness and novelty check whether validity comes from repeated molecules or reproducing the training set; high values across all three indicate extrapolation beyond the training distribution.Source: §A.1 · p. 12

A.2 PROTEINMPNN

The ProteinMPNN task asks agents to design sequences for fixed protein backbones using superfamily-separated training and held-out structures. Sequence recovery is prioritized, with perplexity used to flag a possible frequent-residue collapse.

A.2 PROTEINMPNN

  • The task supplies 51,000 monomer CATH structures and asks the model to return an amino acid sequence for a given backbone’s N, Cα, C, and O coordinates.Training and held-out sets are split by CATH superfamily to avoid structural homologues leaking into the test set.Source: §A.2 · p. 13
  • Perplexity supplements sequence recovery because a model could raise recovery by collapsing onto the most frequent residues.The released model’s 50.9% recovery corresponds to matching roughly half of backbone positions; sequences at that accuracy correctly fold in 76–88% of experimentally tested cases.Source: §A.2 · p. 13

A.3 RFDIFFUSION3

The RFD3 evaluation measures unconditional monomer backbone generation within a restricted task scope and checks designability alongside secondary quality metrics. A separate rubric estimates implementation complexity using proxy LLM graders, with CMD rated at 25.7/100 under an imperfectly followed scope.

A.3 RFDIFFUSION3

  • The RFD3 task covers unconditional 3D monomer backbone generation, excluding ligand-, nucleic-acid-, and motif-conditioned generation.Agents receive 51,000 PDB monomer structures and a pretrained RosettaFold3 checkpoint and codebase.Source: §A.3 · p. 13
  • Designability is prioritized, while novelty, lookup fraction, length diversity, broken bonds, and implausible atomic spacing provide secondary checks.The released weights score 92% designability under the ReproBAIT scorer, versus 98% published by the authors; the pipeline difference is partly attributed to ESMFold rather than an AlphaFold-based pipeline.Source: §A.3 · pp. 13–14

B BAIT COMPLEXITY RUBRIC

  • The complexity rubric is a directional estimate of technical implementation difficulty, averaging categorical ratings across dimensions rather than measuring scientific discovery difficulty.Its dimensions include model architecture, data pipeline, codebase, and estimated training compute; LLM judges assign relative categorical ratings using reference anchors.Source: B BAIT COMPLEXITY RUBRIC · p. 14
  • CMD ratings cover the initial unconditional LSTM/SMILES generator, not the wider tool’s optimization ensembles, analog design, synthesis prediction, data preparation, or evaluation tooling.Because CMD is closed-source and separate training time is unreported, its codebase and training-compute ratings are estimates based on the paper.Source: B BAIT COMPLEXITY RUBRIC · p. 14
  • 25.7/100 was CMD’s complexity score, averaged from 12 complete ratings after four of 16 grading attempts abstained.The abstentions were excluded rather than scored as zero.Source: B BAIT COMPLEXITY RUBRIC · p. 14
  • The CMD score is a rough estimate because some grading rationales included excluded ensemble timings or data preparation.The authors retain submitted ratings and interpret them as an estimate with imperfect adherence to the requested scope.Source: B BAIT COMPLEXITY RUBRIC · p. 15
  • The grader panel uses LLMs as proxy expert reviewers, but Claude Fable 5’s safety filter declines to rate the protein and molecule design tools.Those tools’ ratings therefore rest on the remaining graders.Source: B BAIT COMPLEXITY RUBRIC · p. 15

C MEMORISATION DIAGNOSTICS

The memorisation diagnostics combine transcript review with exact code-overlap measurement to look for evidence that agents drew on target-tool material. The authors treat the measures as directional rather than definitive.

C MEMORISATION DIAGNOSTICS

  • Inspect Scout with a Claude Sonnet 4.6 judge labels transcript runs as clear, suggestive, or showing no evidence of memorisation.Clear evidence requires accurate reproduction of multiple nonobvious details; the classifier discounts paper names, standard choices, and information in supplied papers or data.Source: C MEMORISATION DIAGNOSTICS · pp. 15–16
  • A second diagnostic measures the share of submitted code matching at least 25 consecutive tokens from the original codebase; CMD is excluded because its code is not public.Non-verbatim implementations informed by memorised code may not be captured by this measure.Source: C MEMORISATION DIAGNOSTICS · p. 16
  • The transcript and code-overlap measures are complementary directional signals, not definitive evidence that performance resulted from memorisation.The transcript classifier is imperfect and treated as a lower bound; Table 10 reports both diagnostics by model, task, and condition.Source: C MEMORISATION DIAGNOSTICS · p. 16, Table 10 · p. 16

C.1 EVALUATION SECURITY AND INFRASTRUCTURE

The evaluation isolates agent work from held-out test data and scoring, and terminates processes before final evaluation. Scorer execution is restricted to reduce trust in submitted code.

C.1 EVALUATION SECURITY AND INFRASTRUCTURE

  • Held-out test data and scoring logic remain inaccessible to agent workspaces, and agent processes are terminated before submitted tools are evaluated.The setup also addresses the risk of background processes modifying a model after its time budget expires.Source: §C.1 · p. 16
  • Submitted inference runs unprivileged without access to private answers, while metric computation remains isolated within the scorer pod.For RFD3, a separate trusted process evaluates saved backbone outputs, and file fingerprints detect post-evaluation changes.Source: §C.1 · p. 16
  • Each pod receives one NVIDIA A10G GPU with 24 GB memory; scorer pods are fully network-isolated.Agent network access is restricted to an allowlist for package installation.Source: §C.1 · p. 16

D AGENT PROMPTS

The appendix describes tool-specific agent prompts for reproducing ProteinMPNN across varying information-access conditions, with RFD3 and CMD prompts following a similar structure. The ProteinMPNN prompts specify training-data and held-out-test constraints, a benchmark interface, and sequence recovery and paper-style perplexity metrics.

D.1 PROTEINMPNN: ABSTRACT O N L Y

  • The abstract-only prompt presents ProteinMPNN as outperforming Rosetta-based methods, with over 50% held-out sequence recovery and high-confidence sequences according to AlphaFold2 (Dauparas et al.).The prompt frames these findings as scientific context for a replication task, not a requirement to reproduce the exact architecture.Source: §D.1 · p. 17
  • The abstract-only condition forbids access to the original paper, derivative materials, pretrained weights, and prebuilt inverse-folding tools, and requires training a model from scratch.General ML and bioinformatics resources and libraries are allowed; any architecture mapping backbone coordinates to sequences is acceptable.Source: §D.1 · pp. 17–18
  • Agents must design sequences from backbone coordinates for private held-out test clusters; the evaluator measures positional sequence recovery and paper-style perplexity.Invalid or failed predictions score 0.0 for recovery, and perplexity requires a valid log_probabilities implementation.Source: §D.1 · pp. 18–20
  • The abstract-only prompt requires a BenchmarkProteinMPNN-compatible interface, while the evaluator parses unseen test structures and supplies standardized backbone coordinates.The required outputs include a model checkpoint and model_interface.py with a load_model function.Source: §D.1 · pp. 18–19

D.2 PROTEINMPNN: PAPER ONL Y

  • In the paper-only condition, agents receive the full paper and supplementary material, but may use any approach and are not required to follow the paper’s methods.The paper is available in ./supplementary/paper.pdf.Source: §D.2 · p. 20
  • The paper-only condition still requires agents to train their own model on provided data and forbids repositories, pretrained weights, prebuilt inverse-folding tools, and copied external code.General-purpose libraries and package installation are allowed, but the architecture and weights must be the agent’s own work.Source: §D.2 · p. 20
  • In the paper-only condition, agents receive a filtered ProteinMPNN archive in native loader layout; test-cluster structures are removed, validation clusters remain, and test clusters are empty.Agents may train on individual chain tensors or implement compatible assembly loading.Source: §D.2 · pp. 21–22
  • Both prompts require a loadable BenchmarkProteinMPNN-compatible model implementing design_sequences and log_probabilities, with model files saved under outputs/.The paper-only prompt specifies a checkpoint and model_interface.py as required outputs.Source: §D.2 · p. 22, §D.3 · pp. 23, 25
  • Sequence recovery is primary and paper-style perplexity is secondary; log_probabilities must return per-residue values and pass answer-free probes before perplexity is scored.An invalid implementation leaves perplexity unscored and the submission incomplete without replacing valid recovery results.Source: §D.2 · pp. 22–23

D.3 PROTEINMPNN: WITH CODE

  • With the paper and original source code available, the original-condition task asks agents to maximize sequence recovery and permits referencing, adapting, or running the code.The final model must still conform to the benchmark interface.Source: §D.3 · pp. 23–24
  • For the original condition, the evaluator supplies backbone coordinates from unseen held-out test structures, calls design_sequences at temperature 0.1, and compares designs positionally with native sequences.The evaluator handles test-structure parsing and passes standardized N, CA, C, and O coordinates.Source: §D.3 · pp. 23–24
  • Invalid, missing, empty, or wrong-length predictions contribute 0.0, while positions missing backbone atoms are excluded from recovery; training metrics do not guarantee evaluation performance.Valid predictions use standard positional recovery, and verified evaluator or infrastructure failures remain unscored.Source: §D.3 · p. 25

Related papers

Loading 2610.19810v1…