AISI 发布 ReproBAIT 评测：AI 编码智能体可低成本复现部分生物 AI 工具

Biological AI tools (BAITs) are AI models that are increasingly used to drive advances across biology, from predicting protein structures to designing new molecules. Many are openly released, but some developers choose to release only partial information about a tool's methodology, architecture, and data. This can be driven by a desire to protect commercial value, but also to limit misuse of dual-use tools, where the same capabilities that advance legitimate research can also be deployed in the pursuit of harmful outcomes.

AISI's Chem-Bio team conducts cutting-edge research to understand, evaluate, and mitigate chemical and biological risks associated with frontier AI systems. We assess the extent to which advanced models may enable harmful capabilities, develop methods for evaluating these risks rigorously, and share our findings directly with leading AI companies, UK officials and allied governments to inform deployment, research and policy decisions.

As frontier LLM-based AI agents become more capable at tasks such as research, coding, and scientific reasoning, we expect their ability to reproduce BAITs to improve. If a closed-source BAIT can be reverse-engineered from limited public information, then approaches to safeguard against its misuse may be undermined.

To measure this capability, we built the ReproBAIT (Reproducing Biological AI Tools) evaluation, in collaboration with SecureBio. ReproBAIT tests how well agents can reproduce existing BAITs given the relevant data and limited, publicly available information about their design.

Our findings show that selected functions of each BAIT can be reproduced within a limited time and compute budget. The simplest tools could be successfully reproduced within 4 hours and with a compute budget of under $20.This means that withholding code or limiting the information published on a BAIT does not by itself equate to a safe release. This points to the need for further exploration of data governance as a method for managing misuse of BAITs.

How ReproBAIT works

ReproBAIT measures the ability of AI agents to design, implement, and train a new BAIT that matches the function and performance of an existing BAIT, given a fixed time and compute budget. The time budget was scaled to each tool’s complexity. Each attempt runs in an isolated sandbox with a single GPU and no internet access. The agent receives a limited description of the original BAIT and the training data used to create it. It is then tasked with writing and running code to produce a working replica. A separate, network-isolated scorer then compares the performance of the submitted tool to the original version.

Figure 1: The ReproBAIT evaluation pipeline.

Developers publish varying amounts of information about BAITs: from an abstract alone, to a full paper, to a full open-source release. We selected three target BAITs that are widely used in computational biology and vary significantly in complexity: Two open-sourced protein-design BAITs of increasing complexity, ProteinMPNN and RFdiffusion3, and a closed-source molecular-design BAIT, referred to as CMD¹.

Our hypothesis is that the reproducibility of BAITs that are not fully open source will be driven, at least in part, by the level of detail the authors choose to disclose. We therefore tested two conditions: abstract-only, where the agent received just the paper's abstract, and paper-only, where it received the full manuscript and any supplementary material. For the two open-sourced BAITs, we also ran a with-code baseline, in which the agent received the code for the original BAIT. CMD's method is described in a public paper, but its original code has never been released. This made it a useful test of the efficacy of managed access controls; an approach where developers share a tool only with vetted users or under specific conditions, rather than releasing it openly, so that legitimate researchers can benefit while the risk of misuse is reduced.

We evaluated the finished agent-built BAITs on held-out data which the agents did not have access to during training, against the primary performance metric from the original publication. For example, for ProteinMPNN, a protein structure to sequence model, performance was measured by how often its designed protein sequences match the natural ones. We express the result as reproduction fidelity: the agent-built BAIT’s score as a percentage of the original BAIT’s score on the same metric, where 100% means parity, and a score above 100% means the agent-built BAIT scored higher than the original BAIT on that metric. This captures one capability of each tool in isolation, not its full range of functions, so a high-fidelity score does not equate to a complete reproduction of the original.

We ran each configuration three times and reported the best attempt, across four leading coding agents spanning closed- and open-weight models: Claude Opus 5, GPT-5.6 Sol, Kimi K3, and Qwen3.8-2.4T.

What we found

Current coding agents can implement and train functional replicas of some BAITs when given the paper describing them, and this capability holds across several agents, both closed- and open-weight.

Tool	What we measured	What we found
CMD (closed-source molecular design)	Validity: the proportion of generated molecules that are chemically valid	All four agents closely matched or exceeded the original. The metric was already close to saturated, leaving little room for improvement, and the agents were optimising for a single metric in a way the original authors had no incentive to do, at a modest cost to the novelty of the molecules generated.
ProteinMPNN (protein design)	Sequence recovery: how often the tool picks the same amino acid that occurs in nature at each position of a known protein backbone	The strongest agents approached the original's performance, with Claude Opus 5 reaching 96.5% fidelity given the full paper, although results varied across agents.
RFdiffusion3 (protein design, most complex)	Designability: whether a sequence designed for a generated protein backbone is predicted to fold back into that same structure	No agent produced a successful reproduction within its time budget, even on the single function evaluated: generating protein backbones alone, rather than in the context of other molecules. The one partially successful agent narrowed the task by filtering its training data to structures that are easier to generate. Further runs were excluded for returning near-duplicates of known Protein Data Bank entries. Therefore, a faithful rebuild of this tool is likely not achievable on a single GPU within the time available.

These reproductions were also relatively inexpensive. Successful rebuilds of the two less complex BAITs typically cost between $4 and $20. We did not achieve a successful RFdiffusion3 rebuild, but each attempt cost between $102 and $301. In terms of training compute, these tools are small compared to the biggest BAITs that have been released and rebuilding larger ones would cost considerably more. We would expect performance to improve with more time and compute, exploring which could be an avenue for future research.

Figure 2: Reproduction fidelity against tool complexity, under the paper-only condition. Fidelity falls sharply as complexity rises: agents reach or exceed the released baseline on the two less complex tools, but no agent fully reproduces the most complex one.

Notably, providing the full paper rather than just the abstract did not consistently improve performance. One contributing factor may be memorisation: the open-sourced BAITs’ papers and code were very likely part of these agents' pretraining data, so an agent may draw on remembered implementation details even when the methods are withheld.

We screened for this by scanning the agents' transcripts for recalled details and by measuring how much agent-written code was a verbatim match to the original. We found moderate evidence consistent with memorisation for ProteinMPNN, the oldest and most widely replicated of the two open-sourced tools, and little for RFdiffusion3. These diagnostics are imperfect, so we treat them as a directional signal rather than proof, and they cannot establish how much of the agents' success is explained by memorisation.

Implications of the findings

Taken together, these results establish that selected functions of each BAIT can be reproduced with limited time and compute. While they do not prove that the original BAITs can be reproduced in full, the direction of travel is clear.

This is particularly relevant as BAITs are often developed in a strong culture of open, collaborative science. Even when models are not released openly, their methods are often described in detail. Our results indicate that withholding code does not, by itself, assure control over access to a BAIT’s capability, as coding agents can reconstruct selected functions of BAITs from public descriptions alone, when supplied with training data. This means that withholding the code for a BAIT by itself does not equate to safe release. It is also not clear that limiting the information published about a tool provides additional protection, as we found no clear difference in performance between agents given only an abstract, and agents given a full paper. These findings support the need for further exploration of data governance as a method for managing misuse risks; controlling access to the underpinning biological data appears to be a more promising intervention than merely controlling access to code.

You can read more about ReproBAIT here.

AISI’s Chem-Bio Team is hiring. If this work interests you, please apply here.

‍