A Biosecurity Agent for Lifecycle LLM Biosecurity Alignment

## Abstract

Abstract Large language models (LLMs) are increasingly integrated into biomedical research workflows—from literature triage and hypothesis generation to experimental design—yet this expanded utility also heightens dual-use concerns, including the potential misuse for guiding toxic compound synthesis. In response, this study shows a Biosecurity Agent that comprises four coordinated modes across the model lifecycle: dataset sanitization, preference alignment, runtime guardrails, and automated red teaming. For dataset sanitization ( Mode 1 ), evaluation is conducted on CORD-19, a COVID-19 Open Research Dataset of coronavirus-related scholarly articles. We define three sanitization tiers—L1 (compact, high-precision), L2 (human-curated biosafety terms), and L3 (comprehensive union)—with removal rates rising from 0.46% to 70.40%, illustrating the safety–utility trade-off. For preference alignment ( Mode 2 ), DPO with LoRA adapters internalizes refusals and safe completions, reducing end‑to‑end attack success rate (ASR) from 59.7% to 3.0%. At inference ( Mode 3 ), runtime guardrails across L1–L3 show the expected security–usability trade-off: L2 achieves the best balance (F1 = 0.720, precision = 0.900, recall = 0.600, FPR = 0.067), while L3 offers stronger jailbreak resistance at the cost of higher false positives.
Under continuous automated red‑teaming ( Mode 4 ), no successful jailbreaks are observed under the tested protocol. Taken together, our biosecurity agent offers an auditable, lifecycle-aligned framework that reduces attack success while preserving benign utility, providing safeguards for the use of LLMs in scientific research and setting a precedent for future agent-level security protections.

## 1 Introduction

Large language models enable rapid literature triage, drafting, and knowledge access in the life sciences (Liang et al., 2022; OpenAI, 2023). This capability also entails *dual-use* risk when unsafe instructions or tacit know-how are elicited Wang et al. (2025). Recent taxonomies and risk surveys characterize such hazards and recommend layered safeguards with continuous evaluation (Weidinger et al., 2022; 2021; Shevlane et al., 2023). Governance frameworks emphasize pre-deployment assessment, ongoing monitoring, and domain-aware controls for high-stakes applications, as reflected in the U.S. Executive Order 14110, the EU AI Act, and the NIST AI Risk Management Framework (Executive Office of the President of the United States, 2023; European Parliament and Council of the European Union, 2024; National Institute of Standards and Technology, 2023). Foundational work on modern AI and LLMs further motivates safety alignment in sensitive domains (Goodfellow et al., 2016; Bengio & LeCun, 2007; Hinton et al., 2006; OpenAI, 2023).

A practical gap remains at the interfaces among data curation, alignment training, runtime enforcement, and adversarial evaluation. Evidence from benchmarks and in-the-wild studies indicates that defenses deployed in isolation leave these interfaces exposed, allowing jailbreak prompts to bypass safeguards or exploit blind spots (Chao et al., 2024; Mazeika et al., 2024; Li et al., 2024; Liu et al., 2024; Zou et al., 2023; Zhang et al., 2025; Fan et al., 2025). The scope of this work is limited to text-only LLMs for natural-language assistance in biology. Sequence-level generative models (e.g., for DNA or proteins) and multimodal lab-control systems are outside the scope of this study.

Figure: Figure 1: Overview of the defence-in-depth Biosecurity Agent. Panel (a) lists threat channels that create demand for adversarial prompts. Panel (b) shows the lifecycle architecture with four modes. Mode 1 performs dataset sanitization with keyword tiers L1/L2/L3. Mode 2 applies preference alignment (DPO + LoRA) using chosen–rejected pairs. Mode 3 enforces runtime guardrails at input and at output by combining BLAST, long-sequence, semantic, fuzzy, and keyword checks. Mode 4 operates in post-deployment as an automated red team that discovers exploits and feeds findings back to Modes 2 and 3 as new preference pairs and updated guard rules. Panel (c) illustrates a single safeguarded interaction that follows Eq. equation [1](https://arxiv.org/html/2510.09615v1#S3.E1). The deployment target is an attack success rate below five percent.
Refer to caption: fig/overview.png

As summarised in Fig. [1](https://arxiv.org/html/2510.09615v1#S1.F1), a *defence-in-depth* toolkit for LLM biosecurity alignment is operationalised as a tool-orchestrated agent covering all stages of the model lifecycle. Training data are curated, model behaviour is aligned, inference is gated, and residual failures are discovered and fed back into the process. Mode 1 performs dataset sanitisation with tiered keyword filtering to remove or redact risky content, informed by biosecurity guidance and screening practice (World Health Organization, 2022; National Science Advisory Board for Biosecurity (2023), NSABB; International Gene Synthesis Consortium (2024), IGSC). Mode 2 applies preference alignment using Direct Preference Optimization (DPO) with LoRA adapters to internalise refusals and safe completions (Rafailov et al., 2023; Hu et al., 2022; Bai et al., 2022; Ouyang et al., 2022). Mode 3 enforces runtime guardrails with pre- and post-generation checks that aggregate multiple biology-aware signals. LLM-based safety classifiers and guardrail stacks provide programmable policy enforcement (Llama Team, Meta AI, 2023; Shankar et al., 2024). Robust smoothing further complements these mechanisms (Robey et al., 2023). Mode 4 conducts automated red teaming that continually discovers exploits and updates Modes 2 and 3. Moreover, public benchmarks and autonomous attackers support standardized evaluation and continuous discovery (Chao et al., 2024; Mazeika et al., 2024; Zhou et al., 2025; Li et al., 2024; Liu et al., 2024).

Evidence on curated corpora and stress tests supports this design. On CORD-19, Mode 1 yields a monotonic removal curve at three biosecurity filtering levels with 0.46% of records removed at L1, 20.87% at L2, and 70.40% at L3. Under preference alignment, Mode 2 reduces end-to-end attack success (ASR) from 59.7% (95% CI 55.6–63.7) to 3.0% (1.0–5.0). At inference time, Mode 3 exhibits a clear security–usability trade-off: a balanced operating point attains strong precision and recall with a low false-positive rate (FPR), whereas stricter settings further reduce jailbreak success at the cost of additional false positives. With continuous automated red teaming, Mode 4 improves post-alignment robustness: precision and recall increase, FPR decreases, and protection shifts upstream toward the pre-guard stage.

## 2 Related Work

#### LLM safety landscape and scope.

Prior research on LLM safety has addressed multiple layers of the model lifecycle, including dataset curation, training-time alignment, inference-time safeguards, and adversarial evaluation. Benchmarks and audits consistently show that each layer in isolation is insufficient, motivating lifecycle approaches with continuous monitoring and explicit operating-point control (OpenAI, 2023; Liang et al., 2022; Chao et al., 2024; Mazeika et al., 2024). Existing efforts span dataset filtering pipelines, alignment techniques such as RLHF and DPO, runtime moderation and guardrails, as well as red-teaming frameworks. The present work builds on this landscape by composing these elements into a unified, defense-in-depth framework—dataset sanitization, preference alignment, runtime guardrails, and automated red teaming—targeted at text-only LLMs as a first step toward secure deployment in scientific domains.

#### Dataset-level filtering and preprocessing.

Unsafe behaviour frequently traces to unsafe training data. Toxic passages, hazardous instructions, and tacit procedural cues can lead to undesirable behaviours if left unfiltered. Dataset-level sanitisation therefore removes or redacts risky content before training, guided by biosecurity norms and screening protocols (World Health Organization, 2022; National Science Advisory Board for Biosecurity (2023), NSABB; International Gene Synthesis Consortium (2024), IGSC). Data risks also include memorisation and privacy leakage, which have been demonstrated in large models (Carlini et al., 2021; Nasr et al., 2023). Evaluation corpora such as RealToxicityPrompts support measurement of degenerate toxic generation (Gehman et al., 2020).

#### Alignment during training.

Alignment after pretraining reduces unsafe completions and improves helpfulness. Instruction-following via RLHF optimises models toward human preferences (Ouyang et al., 2022). DPO reframes preference alignment as a supervised objective and simplifies training without a reward model (Rafailov et al., 2023). LoRA enables parameter-efficient fine-tuning by injecting low-rank adapters into transformer layers (Hu et al., 2022). Constitutional-style feedback guides self-critique against written principles and improves harmlessness with limited annotation burden (Bai et al., 2022). Decoding-time control methods such as DExperts and PPLM complement alignment by steering generations away from unsafe modes (Liu et al., 2021; Dathathri et al., 2020).

#### Inference-time safeguards.

Adversarial prompts at deployment continue to elicit unsafe outputs. Runtime safeguards gate inputs and outputs with lightweight checks and can transform prompts to neutralize hidden triggers. Threat surveys catalog common vectors and mitigations for prompt-injection and jailbreaking (Liu et al., 2023). LLM-based safety classifiers and guardrail stacks provide programmable policy enforcement (Llama Team, Meta AI, 2023; Shankar et al., 2024). Robust smoothing randomizes inputs or decoding and aggregates outcomes to detect adversarial sensitivity, with large reductions in jailbreak success reported (Robey et al., 2023).

#### Automated red teaming and standardised evaluation.

Manual red teaming reveals failure modes but lacks coverage at scale. Public benchmarks support systematic evaluation across diverse harms and policy regimes (Chao et al., 2024; Mazeika et al., 2024). Automated attackers further extend coverage: universal and transferable jailbreaks, optimization-based prompt generation, and in-the-wild analyses reveal broad attack surfaces (Zou et al., 2023; Liu et al., 2024; Li et al., 2024). Autonomous red-teaming agents make evaluation continuous by discovering new attacks and integrating them over time (Zhou et al., 2025). Transfer-focused evaluations also measure cross-model robustness (Jain et al., 2024). These instruments motivate continuous hardening of defenses throughout the model lifecycle.

## 3 Methods

#### System overview.

All components are implemented as a tool-orchestrated *Biosecurity Agent* using standard LLM planning/execution patterns (Yao et al., 2023; Khattab et al., 2024). The Biosecurity Agent itself is built upon our self-evolving STELLA agent framework Jin et al. (2025), through which biosecurity tools are integrated and experiments are executed in a closed-loop fashion. Under the default setting, the base model is Llama-3-8B-Instruct (Dubey et al., 2024), an instruction-tuned LLM with 8 billion parameters. All model training and inference used the Hugging Face transformers library (Wolf et al., 2020) for reproducibility. The toolkit spans four lifecycle-aligned modes: dataset sanitisation (Mode 1), preference alignment (Mode 2), runtime guardrails (Mode 3), and automated red teaming (Mode 4).
At inference time, the full pipeline can be formalized as:

$$ $\hat{y}\;=\;G_{\text{post}}\!\Big{(}M_{\theta}\!\big{(}G_{\text{pre}}(x)\big{)}\Big{)}\,,$ (1) $$

where $x$ is the raw user query, $G_{\text{pre}}$ denotes the guard functions that sanitize or transform the input (e.g., removing unsafe instructions, enforcing input constraints), and $M_{\theta}$ is the underlying language model parameterized by $\theta$, which maps inputs to candidate outputs in distributional form. The raw output of the model is then filtered by $G_{\text{post}}$, which applies output-side safety checks and transformations (e.g., refusal policies, structured output validation). This composition ensures that safeguards are applied both before and after the core generative model. Equation [1](https://arxiv.org/html/2510.09615v1#S3.E1) thus provides a unified abstraction of the pipeline and will serve as the basis for defining pre-block failure rates (guard intercepts before model execution) and end-to-end failure rates (leaks past both pre- and post-guards) in subsequent sections.

### 3.1 Datasets and evaluation protocol

For Mode 1, we employed the CORD-19 corpus (Wang et al., 2020), a large collection of scholarly articles on coronaviruses and related biomedical topics widely used for text mining and language model evaluation, to exercise dataset-level sanitization.
For Mode 2, we curated a preference dataset of JSONL triples
{prompt, chosen, rejected} to train with DPO (Rafailov et al., 2023),
ensuring that all candidate texts passed both pre- and post-generation guard filters to exclude non-compliant samples.
For Mode 3, a balanced set of 60 prompts (30 harmful, 30 safe) was used to characterize guardrail operating points
across three keyword strictness tiers (L1_custom, L2_human, L3_all).
We define the *safe-accept rate* as the proportion of safe prompts that receive an allowed, policy-compliant answer
after the full pipeline in Eq. equation [1](https://arxiv.org/html/2510.09615v1#S3.E1).
For Mode 4, we implemented an automated attacker loop that iteratively generated and mutated prompts across rounds
(Zhou et al., 2025).
Unless otherwise noted, the default configuration set the pre-guard to strict mode without BLAST
and the post-guard to strict mode with BLAST enabled.

### 3.2 Metrics

Let TP, FP, TN, and FN denote confusion-matrix counts,
with “positive” corresponding to a harmful prompt.
We report standard classification metrics in the usual way:

$$ $\text{Precision}=\tfrac{\text{TP}}{\text{TP}+\text{FP}},\quad\text{Recall}=\tfrac{\text{TP}}{\text{TP}+\text{FN}},\quad\text{F1}=\tfrac{2\,\text{Precision}\cdot\text{Recall}}{\text{Precision}+\text{Recall}},\quad\text{FPR}=\tfrac{\text{FP}}{\text{FP}+\text{TN}}\,.$ (2) $$

In addition to these standard metrics, we introduce two safety-specific metrics to our pipeline.

#### Pre-jailbreak success rate (pre_JSR).

This metric quantifies how often the pre-guard fails to block harmful inputs.

$$ $\text{pre_JSR}=\frac{\#\,\text{harmful prompts not blocked by }G_{\text{pre}}}{\#\,\text{harmful prompts}}\,.$ (3) $$

#### Attack success rate (ASR).

This metric measures the end-to-end failure rate, i.e., the fraction of harmful prompts that ultimately reach the user after passing through the full pipeline of pre-guard, model, and post-guard:

$$ $\text{ASR}=\frac{\#\,\text{harmful prompts that reach the user after pipeline}}{\#\,\text{harmful prompts}}\,,$ (4) $$

where “pipeline” denotes $G_{\text{post}}\!\circ M_{\theta}\!\circ G_{\text{pre}}$.

For all proportion estimates, we report 95% confidence intervals (Brown et al., 2001):

$$ $\text{CI}_{95\%}(k,n)=\Bigl{[}\,\mathrm{Beta}^{-1}(0.025;\,k,\,n{-}k{+}1),\ \mathrm{Beta}^{-1}(0.975;\,k{+}1,\,n{-}k)\,\Bigr{]}.$ (5) $$

### 3.3 Mode 1: Dataset sanitisation

Dataset-level filtering was performed offline by a utility function sanitize_bio_dataset. All textual fields in each record were scanned and any match against the tiered keyword lists (L1_custom, L2_human, L3_all) triggered redaction or removal of the content.

### 3.4 Mode 2: Safety alignment via DPO

Preference-based alignment was carried out with a training routine train_biosecurity_dpo using Direct Preference Optimization (Rafailov et al., 2023). Given each training triple $(x,\,y^{+},\,y^{-})$ and a reference policy $\pi_{\text{ref}}$, the DPO objective minimized

$$ $\mathcal{L}_{\text{DPO}}(\theta)=-\,\mathbb{E}_{(x,y^{+},y^{-})}\;\log\sigma\!\Big{(}\beta\big{[}(\log\pi_{\theta}(y^{+}\!\mid x)-\log\pi_{\theta}(y^{-}\!\mid x))-(\log\pi_{\text{ref}}(y^{+}\!\mid x)-\log\pi_{\text{ref}}(y^{-}\!\mid x))\big{]}\Big{)},$ (6) $$

with a default temperature $\beta=0.1$. Parameter-efficient fine-tuning was enabled via LoRA by injecting low-rank adapters into the attention and MLP projection matrices (Hu et al., 2022), under the low-rank reparameterization

$$ $W_{\theta}\;=\;W_{0}\;+\;\frac{\alpha}{r}\,BA\,,$ (7) $$

where $A\in\mathbb{R}^{r\times d_{\text{in}}}$ and $B\in\mathbb{R}^{d_{\text{out}}\times r}$ are trainable, the rank $r$ and scale $\alpha$ are hyperparameters, and $W_{0}$ is the original pretrained weight.

### 3.5 Mode 3: Runtime alignment guard

Inputs and outputs were gated at runtime by a module biosecurity_alignment_guard. Five detection signals were aggregated. These signals were keyword hits from curated virus-related lexicons at levels $\{\texttt{L1_custom},\texttt{L2_human},\texttt{L3_all}\}$, fuzzy string matches via RapidFuzz with partial ratio $\geq 87$ (Bachmann, 2020), sentence-level semantic similarity using Sentence-Transformers with cosine $\geq 0.67$ (Reimers & Gurevych, 2019), long-sequence detection for DNA or protein sequences with character length $\geq 60$, and an optional BLAST alignment screen against a curated pathogen database with identity $\geq 0.88$ and aligned length $\geq 60$ (Camacho et al., 2009).

Let $s_{k}(x)$ denote the score produced by signal $k$ with threshold $\tau_{k}$ and indicator $z_{k}(x)=\mathbf{1}[\,s_{k}(x)\geq\tau_{k}]$. The guard decision followed a lexicographic priority

$$ $d(x)=\begin{cases}\textsf{block}_{\text{blast}},&z_{\text{blast}}=1,\\ \textsf{block}_{\text{longseq}},&z_{\text{blast}}=0,\ z_{\text{longseq}}=1,\\ \textsf{block}_{\text{semantic}},&z_{\text{blast}}=0,\ z_{\text{longseq}}=0,\ z_{\text{semantic}}=1,\\ \textsf{block}_{\text{fuzzy}},&z_{\text{blast}}=0,\ z_{\text{longseq}}=0,\ z_{\text{semantic}}=0,\ z_{\text{fuzzy}}=1,\\ \textsf{block}_{\text{keyword}},&z_{\text{blast}}=0,\,\dots,\,z_{\text{fuzzy}}=0,\ z_{\text{keyword}}=1,\\ \textsf{allow/warn},&\text{otherwise.}\end{cases}$ (8) $$

This ordering places biologically specific and high-precision checks first and lexical pattern matches later. The arrangement increases robustness to prompt variants and simplifies operating-point calibration when the thresholds $\{\tau_{k}\}$ are tuned under an FPR budget. In practice, the thresholds were selected on a held-out validation set to minimize the jailbreak success rate subject to $\mathrm{FPR}\leq\epsilon$. The same policy was applied at both the *pre* and *post* guard positions.

Under default setting, evaluations used the input guard in strict mode with keyword and fuzzy matching enabled and with semantic matching and BLAST disabled. Ablation tests with semantic matching and BLAST enabled are reported where relevant.

### 3.6 Mode 4: Automated red-team evaluation

Automated red teaming was conducted by a specialized attacker agent in a repeating three-stage loop. The stages were a strict pre-generation guard without BLAST, the model $M_{\theta}$ generating a continuation, and a strict post-generation guard with BLAST. The attacker iteratively mutated prompts based on prior outcomes. Any successful prompt that bypassed defenses was recycled into Mode 3 as a new guard rule or threshold adjustment and into Mode 2 as a new preference pair for alignment training (Zhou et al., 2025). For guard operating-point selection, detection thresholds $\lambda$ were chosen to minimize the jailbreak success rate subject to a false-positive budget

$$ $\min_{\lambda}\ \text{JSR}(\lambda)\quad\text{s.t.}\ \text{FPR}(\lambda)\leq\epsilon\,,$ (9) $$

and ROC and precision–recall curves were obtained by sweeping $\lambda$ over the signal thresholds in Eq. equation [8](https://arxiv.org/html/2510.09615v1#S3.E8).

## 4 Results

### 4.1 Mode 1: Dataset sanitisation on CORD-19

The CORD-19 corpus (Wang et al., 2020), a benchmark dataset of biomedical research articles, was used to evaluate Mode 1 dataset sanitisation. Sanitisation was applied at three keyword strictness levels. The removal rate increased monotonically with stricter filtering. The Level 2 configuration pruned roughly one-fifth of the corpus while preserving about 80% of the entries, whereas the Level 3 configuration removed the majority of entries. This demonstrates a safety–utility trade-off as filtering becomes more aggressive.

Figure: Figure 2: Removal rate on CORD-19 at each biosecurity level. A monotonic increase is observed from Level 1 to Level 3. The Level 2 configuration removes about 21% of entries, whereas the Level 3 configuration removes about 70%.
Refer to caption: x1.jpg

### 4.2 Mode 2: Safety alignment via DPO

Direct Preference Optimization with LoRA was applied to align the base model toward refusals and safe completions. On a representative 60-prompt evaluation set, the jailbreak success rate decreased from 30% to 10%. The safe-accept rate increased from 70% to 90% with the pre-guard block rate fixed at 30%. On an expanded adversarial set, the end-to-end ASR decreased from 59.7% (95% CI 55.6–63.7) to 3.0% (1.0–5.0), meeting the below 5% target (Fig. [3](https://arxiv.org/html/2510.09615v1#S4.F3)).

Figure: Figure 3: Mode 2 — Attack success rate with 95% confidence intervals. Preference alignment (DPO+LoRA) lowers ASR from 59.7% to 3.0% on the expanded adversarial set. Error bars indicate Clopper–Pearson 95% confidence intervals.
Refer to caption: x2.jpg

### 4.3 Mode 3: Runtime alignment guard

The guard was evaluated on a labeled set of 60 prompts under three keyword strictness levels. A clear security–usability trade-off was observed (Figs. [4](https://arxiv.org/html/2510.09615v1#S4.F4)–[5](https://arxiv.org/html/2510.09615v1#S4.F5)). The L1_custom configuration achieved the lowest FPR (0.033) but exhibited the highest JSR (0.567). The L2_human configuration attained the highest F1 (0.720) with precision 0.900 and recall 0.600 at an FPR of 0.067. The L3_all configuration yielded the lowest JSR (0.267) and the highest recall (0.733) but incurred an FPR of 0.433 and a reduced precision of 0.629.

Figure: Figure 4: Mode 3. Guard performance and the security–usability trade-off. Top panel shows precision, recall, and F1 for guard configurations (L1_custom, L2_human, L3_all). Bottom panel shows FPR versus JSR, where the lower-left region is preferred. The L2_human configuration attains the highest F1 at a low FPR. The L3_all configuration achieves the lowest JSR at the cost of a higher FPR.
Refer to caption: x3.jpg

Figure: Figure 5: Mode 3. Confusion outcomes across guard levels. The heatmap merges the three guards into one matrix. Rows list outcomes tp, fn, fp, tn. Columns correspond to L1_custom, L2_human, L3_all. Each cell gives the count on the 60-prompt evaluation set. From L1 to L3, true positives increase and false negatives decrease. False positives rise and true negatives fall. The pattern reflects increasing strictness and the expected security–usability trade-off.
Refer to caption: x4.jpg

### 4.4 Mode 4: Automated red-team evaluation

End-to-end stress testing with adaptive adversarial prompts was conducted to assess post-alignment robustness under distribution shift. Improvements were observed across the board. Mean precision increased from $0.752\pm 0.010$ to $0.868\pm 0.005$, mean recall increased from $0.674\pm 0.033$ to $0.910\pm 0.017$, and mean FPR decreased from $0.268\pm 0.025$ to $0.027\pm 0.012$. The allocation of defensive actions shifted upstream. The pre-guard block rate increased from 15% to 40%, while the post-guard block rate decreased from 25% to 5%. The safe-completion rate remained stable at approximately 55–60%.

Figure: Figure 6: Mode 4. Automated red-team evaluation (aggregated results). Left panel shows ASR with 95% confidence intervals and indicates a reduction from 59.7% to 3.0% after alignment. Middle panel shows guard performance with mean and standard error where precision and recall increase and FPR drops after alignment. Right panel shows the distribution of protection across guard layers with 95% confidence intervals over 100 runs and highlights a shift toward upstream blocking while maintaining a stable safe-completion rate.
Refer to caption: fig/mode4_three_panel.jpg

## 5 Discussion

#### Summary of findings.

In this research, the pipeline meets a predefined end-to-end safety target while preserving benign utility across the four lifecycle modes. Training-time alignment delivers the largest single gain and reduces reliance on inference-time filtering. The guard admits calibrated operating points under an explicit false-positive budget. Tiered sanitization provides source-level control with a measurable safety–utility trade-off. Continuous automated red teaming improves robustness and shifts protection toward the pre-guard stage.

#### Upstream data sanitization and the safety–utility trade-off (Mode 1).

Tiered filtering on CORD-19 shows a monotonic relation between strictness and removal, with a mid-level list retaining most of the corpus while excising domain-specific risk content. This supports source-level governance as a complement to alignment and guarding and aligns with sector guidance and screening protocols (World Health Organization, 2022; National Science Advisory Board for Biosecurity (2023), NSABB; International Gene Synthesis Consortium (2024), IGSC). The choice of level should reflect acceptable loss of coverage for downstream tasks and the requirement to limit exposure to dual-use material.

#### Training-time alignment (Mode 2).

Preference-based alignment with DPO and parameter-efficient adapters establishes a strong safety prior in the base policy. End-to-end evaluation indicates that harmful completions fall below a prespecified target while helpful responses remain accessible. The pattern is consistent with alignment evidence that preference optimization and constitution-guided critique reduce disallowed behaviors with modest annotation burden (Ouyang et al., 2022; Rafailov et al., 2023; Bai et al., 2022; Hu et al., 2022). In operation, alignment lowers the load on inference-time filtering and narrows the set of prompts that require strict post hoc intervention. This accords with governance guidance that emphasizes pre-deployment assurance for high-stakes applications (Executive Office of the President of the United States, 2023; European Parliament and Council of the European Union, 2024; National Institute of Standards and Technology, 2023).

#### Inference-time guardrails and operating-point selection (Mode 3).

The guard exhibits the expected precision–recall trade-off across keyword strictness levels, with a mid-level configuration balancing true blocking and user-facing false positives. Because multiple biology-aware signals are composed by specificity and robustness, thresholds can be tuned under an explicit false-positive budget as formalized in the operating-point objective. Quantitative calibration is supported by ROC and precision–recall analyses (Fawcett, 2006; Davis & Goadrich, 2006). Compared with single-method detectors such as standalone safety classifiers or purely randomized defenses, a composite guard enables principled control of sensitivity while preserving utility (Llama Team, Meta AI, 2023; Shankar et al., 2024; Robey et al., 2023).

#### Continuous automated red teaming (Mode 4).

A closed-loop attacker–defender process improves robustness over iterations. After adaptive testing and feedback, a larger share of threats is intercepted at input and fewer reach post-generation review while benign completions remain stable. This observation aligns with reports that iterative evaluation and integration of discovered attacks strengthen robust refusal and reduce regressions (Mazeika et al., 2024; Chao et al., 2024). It also accords with findings that autonomous red teams expand coverage beyond static benchmarks and sustain discovery over time (Zhou et al., 2025; Ganguli et al., 2022). In deployment, such a loop offers an auditable mechanism for continuous hardening that updates guard rules and preference data as the threat surface evolves.

#### Limitations and outlook.

The present scope concerns text-only assistance. Sequence-generating models for DNA or proteins and multimodal lab-control settings are not evaluated. Some experiments rely on a compact challenge set, which introduces statistical uncertainty even with exact binomial intervals. Independent replication on public suites such as JailbreakBench and HarmBench would further substantiate generalization (Chao et al., 2024; Mazeika et al., 2024). Future extensions include learned detectors within the guard stack, adaptive thresholding to reduce false positives under stringent budgets, and expanded red-team agents that target dialog-level strategies and multilingual prompts (Liu et al., 2024; Li et al., 2024; Zou et al., 2023). These directions aim to keep a calibrated operating point as models and adversaries co-evolve.

## References

- Bachmann (2020)
Max Bachmann.
Rapidfuzz: Rapid fuzzy string matching in Python and C++.
[https://github.com/maxbachmann/RapidFuzz](https://github.com/maxbachmann/RapidFuzz), 2020.
Accessed 2025-09-01.
- Bai et al. (2022)
Yuntao Bai, Saurav Kadavath, Sandipan Kundu, et al.
Constitutional AI: Harmlessness from AI feedback, 2022.
URL [https://arxiv.org/abs/2212.08073](https://arxiv.org/abs/2212.08073).
- Bengio & LeCun (2007)
Yoshua Bengio and Yann LeCun.
Scaling learning algorithms toward AI.
In Léon Bottou, Olivier Chapelle, Dennis DeCoste, and Jason Weston (eds.), *Large-Scale Kernel Machines*, pp.  321–360. MIT Press, Cambridge, MA, 2007.
doi: 10.7551/mitpress/7496.003.0016.
URL [https://direct.mit.edu/books/edited-volume/3172/chapter/88105/Scaling-Learning-Algorithms-toward-AI](https://direct.mit.edu/books/edited-volume/3172/chapter/88105/Scaling-Learning-Algorithms-toward-AI).
- Brown et al. (2001)
Lawrence D. Brown, T. Tony Cai, and Anirban DasGupta.
Interval estimation for a binomial proportion.
*Statistical Science*, 16(2):101–133, 2001.
doi: 10.1214/ss/1009213286.
URL [https://doi.org/10.1214/ss/1009213286](https://doi.org/10.1214/ss/1009213286).
- Camacho et al. (2009)
Christiam Camacho, George Coulouris, Vahram Avagyan, Ning Ma, Jason Papadopoulos, Kevin Bealer, and Thomas L. Madden.
BLAST+ : architecture and applications.
*BMC Bioinformatics*, 10(421):1–9, 2009.
doi: 10.1186/1471-2105-10-421.
URL [https://doi.org/10.1186/1471-2105-10-421](https://doi.org/10.1186/1471-2105-10-421).
- Carlini et al. (2021)
Nicholas Carlini, Florian Tramèr, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom B. Brown, Dawn Song, Úlfar Erlingsson, Alina Oprea, and Colin Raffel.
Extracting training data from large language models.
In *USENIX Security Symposium*, pp.  2633–2650, 2021.
URL [https://www.usenix.org/system/files/sec21-carlini-extracting.pdf](https://www.usenix.org/system/files/sec21-carlini-extracting.pdf).
- Chao et al. (2024)
Patrick Chao, Edoardo Debenedetti, Alexander Robey, Maksym Andriushchenko, Francesco Croce, Vikash Sehwag, Edgar Dobriban, Nicolas Flammarion, George J. Pappas, Florian Tramèr, Hamed Hassani, and Eric Wong.
Jailbreakbench: An open robustness benchmark for jailbreaking large language models.
In *NeurIPS Datasets and Benchmarks Track*, 2024.
URL [https://proceedings.neurips.cc/paper_files/paper/2024/file/63092d79154adebd7305dfd498cbff70-Paper-Datasets_and_Benchmarks_Track.pdf](https://proceedings.neurips.cc/paper_files/paper/2024/file/63092d79154adebd7305dfd498cbff70-Paper-Datasets_and_Benchmarks_Track.pdf).
- Dathathri et al. (2020)
Sumanth Dathathri, Andrea Madotto, Janice Lan, Jane Hung, Eric Frank, Piero Molino, Jason Yosinski, and Rosanne Liu.
Plug and play language models: A simple approach to controlled text generation.
In *International Conference on Learning Representations (ICLR)*, 2020.
URL [https://openreview.net/forum?id=H1edEyBKDS](https://openreview.net/forum?id=H1edEyBKDS).
- Davis & Goadrich (2006)
Jesse Davis and Mark Goadrich.
The relationship between precision-recall and ROC curves.
In *Proceedings of the 23rd International Conference on Machine Learning (ICML 2006)*, pp.  233–240. ACM, 2006.
doi: 10.1145/1143844.1143874.
URL [https://doi.org/10.1145/1143844.1143874](https://doi.org/10.1145/1143844.1143874).
- Dubey et al. (2024)
Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, et al.
The llama 3 herd of models, 2024.
URL [https://arxiv.org/abs/2407.21783](https://arxiv.org/abs/2407.21783).
- European Parliament and Council of the European Union (2024)
European Parliament and Council of the European Union.
Regulation (eu) 2024/1689 on artificial intelligence (ai act).
[https://eur-lex.europa.eu/eli/reg/2024/1689/oj](https://eur-lex.europa.eu/eli/reg/2024/1689/oj), 2024.
- Executive Office of the President of the United States (2023)
Executive Office of the President of the United States.
Safe, secure, and trustworthy development and use of artificial intelligence.
Federal Register, 2023.
URL [https://www.federalregister.gov/documents/2023/11/01/2023-24283/safe-secure-and-trustworthy-development-and-use-of-artificial-intelligence](https://www.federalregister.gov/documents/2023/11/01/2023-24283/safe-secure-and-trustworthy-development-and-use-of-artificial-intelligence).
Executive Order 14110, Federal Register 88 FR 75191.
- Fan et al. (2025)
Jigang Fan, Zhenghong Zhou, Ruofan Jin, Le Cong, Mengdi Wang, and Zaixi Zhang.
Safeprotein: Red-teaming framework and benchmark for protein foundation models.
*arXiv preprint arXiv:2509.03487*, 2025.
- Fawcett (2006)
Tom Fawcett.
An introduction to ROC analysis.
*Pattern Recognition Letters*, 27(8):861–874, 2006.
doi: 10.1016/j.patrec.2005.10.010.
URL [https://doi.org/10.1016/j.patrec.2005.10.010](https://doi.org/10.1016/j.patrec.2005.10.010).
- Ganguli et al. (2022)
Deep Ganguli, Liane Lovitt, Jackson Kernion, Amanda Askell, Yuntao Bai, Saurav Kadavath, Ben Mann, Ethan Perez, Nicholas Schiefer, Kamal Ndousse, et al.
Red teaming language models to reduce harms: Methods, scaling behaviors, and lessons learned.
*arXiv*, 2022.
URL [https://arxiv.org/abs/2209.07858](https://arxiv.org/abs/2209.07858).
- Gehman et al. (2020)
Samuel Gehman, Suchin Gururangan, Maarten Sap, Yejin Choi, and Noah A. Smith.
Realtoxicityprompts: Evaluating neural toxic degeneration in language models.
In *Findings of the Association for Computational Linguistics: EMNLP*, pp.  3356–3369, 2020.
doi: 10.18653/v1/2020.findings-emnlp.301.
URL [https://aclanthology.org/2020.findings-emnlp.301/](https://aclanthology.org/2020.findings-emnlp.301/).
- Goodfellow et al. (2016)
Ian Goodfellow, Yoshua Bengio, and Aaron Courville.
*Deep Learning*.
MIT Press, 2016.
ISBN 9780262035613.
URL [https://www.deeplearningbook.org/](https://www.deeplearningbook.org/).
- Hinton et al. (2006)
Geoffrey E. Hinton, Simon Osindero, and Yee Whye Teh.
A fast learning algorithm for deep belief nets.
*Neural Computation*, 18(7):1527–1554, 2006.
doi: 10.1162/neco.2006.18.7.1527.
URL [https://direct.mit.edu/neco/article/18/7/1527/7065/A-Fast-Learning-Algorithm-for-Deep-Belief-Nets](https://direct.mit.edu/neco/article/18/7/1527/7065/A-Fast-Learning-Algorithm-for-Deep-Belief-Nets).
- Hu et al. (2022)
Edward J. Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen.
LoRA: Low-rank adaptation of large language models, 2022.
URL [https://arxiv.org/abs/2106.09685](https://arxiv.org/abs/2106.09685).
- International Gene Synthesis Consortium (2024) (IGSC)
International Gene Synthesis Consortium (IGSC).
Harmonized screening protocol, version 3.0, September 2024.
URL [https://genesynthesisconsortium.org/wp-content/uploads/IGSC-Harmonized-Screening-Protocol-v3.0-1.pdf](https://genesynthesisconsortium.org/wp-content/uploads/IGSC-Harmonized-Screening-Protocol-v3.0-1.pdf).
- Jain et al. (2024)
Neil Jain, Saurabh Mourya, Divyansh Singh, et al.
Artprompt: Measuring and mitigating jailbreak transferability across large language models.
In *Findings of the Association for Computational Linguistics: ACL*, 2024.
doi: 10.18653/v1/2024.findings-acl.334.
URL [https://aclanthology.org/2024.findings-acl.334/](https://aclanthology.org/2024.findings-acl.334/).
- Jin et al. (2025)
Ruofan Jin, Zaixi Zhang, Mengdi Wang, and Le Cong.
Stella: Self-evolving llm agent for biomedical research.
*arXiv preprint arXiv:2507.02004*, 2025.
- Khattab et al. (2024)
Omar Khattab, Arnav Singhvi, Paridhi Maheshwari, et al.
DSPy: Compiling declarative language model calls into self-improving pipelines.
In *International Conference on Learning Representations (ICLR)*, 2024.
URL [https://openreview.net/forum?id=sY5N0zY5Od](https://openreview.net/forum?id=sY5N0zY5Od).
- Li et al. (2024)
Banghua Li, Liyuan Zhang, Xiaoyuan Zhang, et al.
Jailbreaking in the wild: From online communities to LLMs.
In *Proceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS)*, 2024.
doi: 10.1145/3658644.3672294.
URL [https://dl.acm.org/doi/10.1145/3658644.3672294](https://dl.acm.org/doi/10.1145/3658644.3672294).
- Liang et al. (2022)
Percy Liang, Rishi Bommasani, Hanlin Zha, et al.
Holistic evaluation of language models (helm), 2022.
URL [https://arxiv.org/abs/2211.09110](https://arxiv.org/abs/2211.09110).
- Liu et al. (2024)
Alexander Liu, Yuhui Deng, Xingxuan Wang, et al.
Autodan: Automatic and interpretable adversarial attacks on large language models.
In *International Conference on Learning Representations (ICLR)*, 2024.
URL [https://openreview.net/forum?id=1kKmMmsWvG](https://openreview.net/forum?id=1kKmMmsWvG).
- Liu et al. (2023)
Nan Liu, Jiaming Zhang, Yuwei Zhang, et al.
Prompt injection attacks and defenses in large language models: A survey, 2023.
URL [https://arxiv.org/abs/2306.05499](https://arxiv.org/abs/2306.05499).
- Liu et al. (2021)
Ximing Liu, Zachary M. Ziegler, Y-Lan Boureau, Veselin Stoyanov, and Greg Durrett.
Dexperts: Decoding-time controlled text generation with experts and anti-experts.
In *Advances in Neural Information Processing Systems (NeurIPS)*, 2021.
URL [https://arxiv.org/abs/2105.03023](https://arxiv.org/abs/2105.03023).
- Llama Team, Meta AI (2023)
Llama Team, Meta AI.
Model safety with Llama Guard: LLM-based input–output safety classifiers, 2023.
URL [https://arxiv.org/abs/2312.06674](https://arxiv.org/abs/2312.06674).
- Mazeika et al. (2024)
Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, et al.
Harmbench: A standardized evaluation framework for automated red teaming and robust refusal, 2024.
URL [https://arxiv.org/abs/2402.04249](https://arxiv.org/abs/2402.04249).
- Nasr et al. (2023)
Milad Nasr, Nicholas Carlini, Jonathan Hayase, et al.
Scalable extraction of training data from (production) language models, 2023.
URL [https://arxiv.org/abs/2311.17035](https://arxiv.org/abs/2311.17035).
- National Institute of Standards and Technology (2023)
National Institute of Standards and Technology.
Artificial intelligence risk management framework (ai rmf 1.0), 2023.
URL [https://www.nist.gov/itl/ai-risk-management-framework](https://www.nist.gov/itl/ai-risk-management-framework).
- National Science Advisory Board for Biosecurity (2023) (NSABB)
National Science Advisory Board for Biosecurity (NSABB).
Proposed biosecurity oversight framework for the future of science (final report), 2023.
URL [https://osp.od.nih.gov/wp-content/uploads/2023/03/NSABB-Final-Report-Proposed-Biosecurity-Oversight-Framework-for-the-Future-of-Science.pdf](https://osp.od.nih.gov/wp-content/uploads/2023/03/NSABB-Final-Report-Proposed-Biosecurity-Oversight-Framework-for-the-Future-of-Science.pdf).
- OpenAI (2023)
OpenAI.
Gpt-4 technical report, 2023.
URL [https://arxiv.org/abs/2303.08774](https://arxiv.org/abs/2303.08774).
Author PDF: [https://cdn.openai.com/papers/gpt-4.pdf](https://cdn.openai.com/papers/gpt-4.pdf).
- Ouyang et al. (2022)
Long Ouyang, Jeff Wu, Xu Jiang, et al.
Training language models to follow instructions with human feedback.
In *Advances in Neural Information Processing Systems (NeurIPS)*, 2022.
URL [https://proceedings.neurips.cc/paper_files/paper/2022/file/b1efde53be364a73914f58805a001731-Paper-Conference.pdf](https://proceedings.neurips.cc/paper_files/paper/2022/file/b1efde53be364a73914f58805a001731-Paper-Conference.pdf).
- Rafailov et al. (2023)
Rafael Rafailov, Archit Sharma, Eric Mitchell, Stefano Ermon, Christopher D. Manning, and Chelsea Finn.
Direct preference optimization: Your language model is secretly a reward model, 2023.
URL [https://arxiv.org/abs/2305.18290](https://arxiv.org/abs/2305.18290).
- Reimers & Gurevych (2019)
Nils Reimers and Iryna Gurevych.
Sentence-BERT: Sentence embeddings using siamese BERT-networks.
In *Proceedings of the Conference on Empirical Methods in Natural Language Processing (EMNLP)*, pp.  3982–3992. Association for Computational Linguistics, 2019.
doi: 10.18653/v1/D19-1410.
URL [https://aclanthology.org/D19-1410/](https://aclanthology.org/D19-1410/).
- Robey et al. (2023)
Alexander Robey, Eric Wong, Hamed Hassani, and George J. Pappas.
SmoothLLM: Defending large language models against jailbreaking attacks, 2023.
URL [https://arxiv.org/abs/2310.03684](https://arxiv.org/abs/2310.03684).
- Shankar et al. (2024)
Shreya Shankar, Vivek Subramanian, Karan Patil, et al.
Building guardrails for large language models, 2024.
URL [https://arxiv.org/abs/2402.01822](https://arxiv.org/abs/2402.01822).
- Shevlane et al. (2023)
Toby Shevlane, Sebastian Farquhar, Markus Anderljung, et al.
Model evaluation for extreme risks, 2023.
URL [https://arxiv.org/abs/2305.15324](https://arxiv.org/abs/2305.15324).
- Wang et al. (2020)
Lucy Lu Wang, Kyle Lo, Yoganand Chandrasekhar, et al.
Cord-19: The COVID-19 open research dataset.
*arXiv*, 2020.
URL [https://arxiv.org/abs/2004.10706](https://arxiv.org/abs/2004.10706).
- Wang et al. (2025)
Mengdi Wang, Zaixi Zhang, Amrit Singh Bedi, Alvaro Velasquez, Stephanie Guerra, Sheng Lin-Gibson, Le Cong, Yuanhao Qu, Souradip Chakraborty, Megan Blewett, et al.
A call for built-in biosecurity safeguards for generative ai tools.
*Nature Biotechnology*, 43(6):845–847, 2025.
- Weidinger et al. (2021)
Laura Weidinger, Jonathan Uesato, Marika Rauh, et al.
Ethical and social risks of harm from language models, 2021.
URL [https://arxiv.org/abs/2112.04359](https://arxiv.org/abs/2112.04359).
- Weidinger et al. (2022)
Laura Weidinger, John Mellor, Marika Rauh, Conor Griffin, Jonathan Uesato, Po-Sen Huang, Lasse Cheng, Amelia Glaese, Borja Balle, Atoosa Kasirzadeh, Lisa Anne Hendricks, Tom Everitt, Miljan Andriushchenko, and Iason Gabriel.
Taxonomy of risks posed by language models.
In *Proceedings of the ACM Conference on Fairness, Accountability, and Transparency (FAccT)*, 2022.
doi: 10.1145/3531146.3533088.
URL [https://dl.acm.org/doi/10.1145/3531146.3533088](https://dl.acm.org/doi/10.1145/3531146.3533088).
- Wolf et al. (2020)
Thomas Wolf, Lysandre Debut, Victor Sanh, Julien Chaumond, et al.
Transformers: State-of-the-art natural language processing.
In *Proceedings of the Conference on Empirical Methods in Natural Language Processing: System Demonstrations (EMNLP Demos)*, pp.  38–45. Association for Computational Linguistics, 2020.
doi: 10.18653/v1/2020.emnlp-demos.6.
URL [https://aclanthology.org/2020.emnlp-demos.6/](https://aclanthology.org/2020.emnlp-demos.6/).
- World Health Organization (2022)
World Health Organization.
Global guidance framework for the responsible use of the life sciences: Mitigating biorisks and governing dual-use research, 2022.
URL [https://www.who.int/publications/i/item/9789240056107](https://www.who.int/publications/i/item/9789240056107).
- Yao et al. (2023)
Shunyu Yao, Jeffrey Zhao, Dian Yu, Nan Du, Izhak Shafran, Karthik Narasimhan, and Yuan Cao.
React: Synergizing reasoning and acting in language models.
In *International Conference on Learning Representations (ICLR)*, 2023.
URL [https://arxiv.org/abs/2210.03629](https://arxiv.org/abs/2210.03629).
- Zhang et al. (2025)
Z. Zhang, Z. Zhou, R. Jin, L. Cong, and M. Wang.
Genebreaker: Jailbreak attacks against DNA language models with pathogenicity guidance, 2025.
URL [https://arxiv.org/abs/2505.23839](https://arxiv.org/abs/2505.23839).
- Zhou et al. (2025)
Andy Zhou, Kevin Wu, Francesco Pinto, Zifan Chen, Yan Zeng, Yiding Yang, Shiyue Yang, Sanmi Koyejo, James Zou, and Bo Li.
Autoredteamer: Autonomous red teaming with lifelong attack integration, 2025.
URL [https://arxiv.org/abs/2503.15754](https://arxiv.org/abs/2503.15754).
- Zou et al. (2023)
Andy Zou, Zico Wang, Noah Mu, et al.
Universal and transferable adversarial attacks on aligned language models, 2023.
URL [https://arxiv.org/abs/2307.15043](https://arxiv.org/abs/2307.15043).

## Peer Reviews

confidence: 4
contribution: 2
initial_rating: 2
presentation: 3
questions: 1. The dataset sanitization stage reports large removal ratios at higher safety levels. How much benign scientific knowledge is lost as a result, and could this reduction impact the model’s ability to perform legitimate biomedical or chemical reasoning?
soundness: 2
strengths: 1. The agent unifies upstream data curation, alignment, inference‑time controls, and adversarial evaluation into one auditable pipeline. This end‑to‑end view is valuable for safety‑critical deployment. 
2. DPO+LoRA on the 8B model cuts end-to-end ASR from 59.7% to 3.0%, while the L2 guard attains F1≈0.694 at FPR≈0.067 on a balanced set. Iterative red-teaming shifts protection upstream without hurting safe-completion.
3. The Ethics and Reproducibility sections explain disabled external sequence queries, templated unsafe fragments, CI reporting.
summary: The paper proposes a four‑mode defense‑in‑depth biosecurity agent that spans (M1) dataset sanitization, (M2) training‑time preference alignment via DPO+LoRA, (M3) a multi‑signal runtime guard, and (M4) automated red‑teaming, with results reported across one truly aligned model (Llama‑3‑8B‑Instruct) and three larger models under simulated alignment (Mixtral‑8×7B, Qwen‑2.5‑72B, Llama‑3.1‑70B). A central claim is reducing end‑to‑end attack success rate from 59.7% to 3.0% on an expanded adversarial set for the 8B model, while keeping benign utility reasonable.
weaknesses: 1. The “Biosecurity Agent” operates more like a workflow than an autonomous agent. Its four modes run in a fixed, rule-based order without adaptive reasoning or self-directed control. The system orchestrates modules deterministically rather than deciding or planning actions autonomously. To merit the “agent” term, it would need context-aware decision loops or dynamic mode selection; otherwise, renaming it a “Biosecurity Workflow Framework” would more accurately describe its functionality.
2. The guard is calibrated and evaluated on a small balanced 60-prompt set, raising overfitting and variance concerns - can the authors separate dev/test, report bootstrap CIs/k-folds, and add full HarmBench/JailbreakBench results under the same L1/L2/L3 operating points?
3. The authors define pre‑JSR and ASR, but later alternate between ASR, JSR, and end‑to‑end success in ways that are easy to confuse.

---

confidence: 4
contribution: 2
initial_rating: 4
presentation: 2
questions: Could you provide results comparing your method with standard alignment baselines? Additionally, have you evaluated simpler baselines such as keyword filters or content moderation classifiers on the same adversarial prompts?

Given that the adversarial test set consists of only ~110 prompts across seven categories, how do you assess the generalizability of your findings to broader misuse scenarios? Have you considered evaluating on more diverse or larger-scale public jailbreak suites?
Since the 70B-scale results rely on simulated alignment rather than actual fine-tuning, how confident are you that these results reflect true generalization across model scales? Have you tested whether adversarial prompts generated on larger models could bypass the defense?

Could you provide ablation studies isolating the contribution of each component to the observed performance improvements? Specifically, what is the marginal gain of Mode 4 relative to Mode 2 or Mode 3 alone?

What is the estimated latency and compute overhead introduced by your inference-time guard mechanisms under realistic deployment conditions? How would you mitigate potential usability issues arising from the reported false positive rates?

How do you ensure that the alignment and guard processes do not degrade helpfulness or coverage?
soundness: 1
strengths: The paper addresses a topic of substantial importance, reducing biosecurity risks in large language models. It proposes a clearly structured workflow that integrates data sanitization, alignment fine-tuning, and adversarial red-teaming into a unified operational framework. The experiments cover multiple model scales (from 8B to 70B) and provide quantitative evidence of reduced misuse rates, indicating that the proposed approach can be practically applied in large-scale systems.
summary: This paper introduces a Biosecurity Agent framework integrating four safety modes—dataset sanitization, preference alignment, runtime guardrails, and automated red teaming—to reduce biological misuse risks in large language model. The authors evaluate multiple model families (8B–70B) under simulated or real alignment and report consistent reductions in jailbreak success rates (<5%) while maintaining usability. The work aims to demonstrate lifecycle-level LLM biosecurity alignment.
weaknesses: 1. Missing Baselines and SOTA Comparisons
This paper does not evaluate its method against existing alignment or defense approaches. The only benchmark metric is the jailbreak success rate of the unaligned model. Although several existing methods were mentioned, no comparisons are made. Simpler baselines such as keyword filters are also omitted. Therefore, it is currently unclear whether the proposed four-stage agent has any substantial advantage over existing or simpler methods. The paper demonstrates performance gains, but without comparisons, making it difficult to determine whether similar or even better improvements could be achieved using simpler defense strategies.
2. Limited Evaluation Scope
The evaluation in this paper is very small in scale, using only about 110 adversarial prompts (7 categories), and the coverage is very limited. The tuning of the guard mechanism is also based on only 60 labeled samples. Such a design is prone to distribution bias, making it difficult to prove the model's generalization ability. The prompts are almost all short English sentences on the topic of synthetic biology, with limited content diversity. The authors also noted that the system performed poorly in terms of multilingual and long text prompts, which further indicates that the evaluation scope was too narrow. Furthermore, they did not experiment on a larger set of jailbreak test cases or on harmless tasks in general. Overall, this small-scale assessment not only lacks statistical power but also carries a significant risk of overfitting.
3. Incomplete Statistical Reporting
Only some metrics include confidence intervals. Many results come from a single run, without any measures of variability or variance. Robustness is difficult to assess due to the lack of standard deviation, error bars, or seed-based results. Using only 60 prompts to assess guard performance, without any estimation of uncertainty, undermines the reliability of the statistics. Threshold selection can also be very sensitive to small validation sets. Incorporating broader indicators (such as AUROC) and conducting multiple sub-experiments will greatly improve the credibility of the conclusions.
4. Insufficient Evidence for Cross-model Generalization
The paper claims scalability from 8B to 70B models. However, instead of aligning larger models, it simply replays the prompts generated by the 8B model on the “simulated aligned” versions of larger models. This approach cannot verify true cross-model generalization, nor does it take into account the vulnerability of specific models. The evaluation is one-way and limited to prompts generated by the 8B model.
5. Unclear Attribution of Improvements
The paper attributes the performance improvement to the proposed four-stage agent, but does not specify which part plays the main role. Without ablation studies, it would be impossible to know the extent of the contribution at each stage. These changes in performance could come from several different factors. For example, a decrease in attack success rate (ASR) may simply be due to the addition of more red team data, rather than the application of DPO or LoRA methods. This improvement may also stem from changes in the model's output distribution after alignment, making harmful content easier to detect. Because these factors were not distinguished, the paper's causal claims are not convincing.
6. Missing Deployment Considerations
The paper lacks analysis of runtime cost and usability. Its defenses are implemented during the inference phase, including fuzzy matching and semantic similarity checks, which can slow down the model. The reported false positive rate is non-negligible, but the paper does not discuss its impact on user experience. Furthermore, it fails to measure performance degradation on normal tasks, nor does it include any user study on the trade-off between safety and usability. Finally, it overlooks a real-world problem: maintaining a red-teaming mechanism after deployment would incur high engineering maintenance costs.

---

confidence: 4
contribution: 3
initial_rating: 4
presentation: 3
questions: Please provide more details for DPO training: sources and sizes of the (x, y^+, y^-) triples, sampling/filtering rules, inter-annotator agreement (if any), and whether training examples overlap or are derived from your red-team outputs.

Can you run additional benchmarks, e.g., HarmBench or public jailbreak collections, and/or test against attack generators different from your automated red team, to show transfer robustness?

Could you include baselines using alternative alignment strategies (Constitutional AI / rejection-distillation / robust decoding / RLHF variants) and report end-to-end ASR / pre-JSR so readers can judge whether DPO+LoRA is preferable?

please measure how much runtime cost (extra processing time per query and achievable queries per second) the runtime guards add, and plot how ASR decreases vs. how the false positive rate (blocking benign queries) increases as you change guard thresholds.

Please provide an analysis of BLAST / long-sequence screening operational costs and privacy implications: maintaining/accessing pathogen sequence databases at scale may have compute, latency and governance costs—can you measure these and discuss deployment constraints?
soundness: 3
strengths: 1. The main contribution is a comprehensive, end-to-end framework that unifies data governance, training-time alignment, runtime guards, and red-team evaluation under a single, auditable metric set (pre-JSR / ASR with confidence intervals). This unified design and measurement make the security posture easier to reason about and reproduce.

2 .The framework is operationally flexible: guard levels and decision thresholds can be tuned to trade off false positive rate vs. recall, and the automated red-teaming loop enables dynamic updates (new rules or preference updates are fed back into guards and alignment), which is practical for deployed systems and continuous hardening.
summary: This paper proposes a lifecycle Biosecurity Agent that integrates dataset sanitization, preference alignment (DPO+LoRA), runtime guards (multi-signal stacking including BLAST/long-sequence/semantic/fuzzy/keyword checks) and automated red-teaming with rule/policy re-injection. The pipeline is evaluated on biological text scenarios and shows substantial end-to-end reductions in attack success rate (ASR) under the reported settings.
weaknesses: The paper presents a broad and well-engineered system and demonstrates that “the framework can work,” but it lacks several crucial validations around data, generalization, and comparisons to alternative approaches:

1. The reported evaluation uses a small challenge set (e.g., 60 prompts, 30 harmful / 30 safe). The manuscript does not sufficiently describe the benchmark construction, prompt types, or coverage, so it is unclear which attack scenarios and model behaviors are actually measured.

2. Experiments are restricted to biological text scenarios. It is not demonstrated whether the same pipeline (signals, thresholds, BLAST usage) generalizes to other high-risk domains (chemistry, materials, radiological, multi-modal or sequence-generation models).

3. Mode 2 (DPO+LoRA) training provenance is under-specified: what positive/negative responses were used, how were y^+/y^- sampled, and how was leakage between guard rules and training data prevented? This raises concern about possible overfitting to the in-house red team / guard rules.

4. The paper does not sufficiently justify why DPO is the best fit; other approaches (constitutional approaches, rejection-distillation, RLHF variants, robust decoding) could be competitive—comparative experiments are missing.

5. The automated red team and its default components (e.g., BLAST toggles) are tuned to the in-house setting. There is little evaluation on external public benchmarks (HarmBench, Jailbreak sets) or against different attack generators to show the loop does not overfit to its own attackers.

---

confidence: 4
contribution: 1
initial_rating: 0
presentation: 1
questions: 1. Clarify motivation and significance.
   * What specific biosecurity risks or misuse scenarios motivated this work?
   * Why were these four modes (dataset sanitization, preference alignment, runtime guardrails, and automated red teaming) chosen, and how do they together cover the entire LLM lifecycle?
   * Can you explicitly connect each mode to a concrete biosecurity threat and explain how its exploitation could cause harm?
   * Consider adding a clear statement of the research gap and practical impact to strengthen the motivation.
2. Improve the organization of the paper and clarity of the introduction. Clearly articulate the problem, objectives, and main contributions in a structured way. Provide a short roadmap at the end of the introduction outlining what each section contains.
3. Define every variable and symbol in Equation 1; ensure that readers can interpret the equation without external assumptions.
4. Clarify how each mode is formalized. Are there mathematical representations or probabilistic models behind them? Provide citations or reasoning for the chosen evaluation methods of each mode. Why are they appropriate for assessing each mode? Provide some justification.
5. Add more details on experimental design, agent descriptions, and evaluations
   * Describe the Biosecurity Agent’s architecture, tools, and operational capabilities in detail. Include ablation studies to evaluate the agent's performance in different setups to understand the limitations and capabilities in more detail.
   * For each mode, specify how the agent functions: does it write code, filter text autonomously, execute scripts, or depend on predefined heuristics? 
   * Explain the experimental setup: what models, datasets, and baselines were used, and why were they chosen?
   * Clarify the task designs for attacks, red teaming, and jailbreaking. What threat model or adversarial prompts were used? Were both automated and human red teaming approaches considered?
   * Justify why these protocols are representative of real-world biosecurity threats.
5. Add more examples and depth to the evaluation. Also, include statistical evidence (e.g., variance, significance tests) to support observed differences.
6. Is there any biosecurity work that introduced the modes you tried to evaluate?
7. How do you see this agent being used in real-world research and application scenarios? 
8. Include an end-to-end example of a task (how the agent is working and using its tools).
9. Define scalability and why it is claimed to be a contribution here.
soundness: 1
strengths: 1. Introduces a lifecycle biosecurity framework with four integrated modes: sanitized data, alignment tuning, runtime guardrails, and automated red teaming, for LLMs in biomedical contexts.
2. Demonstrates some experiments on defense, reducing attack success while maintaining low false-positive and high utility performance.
summary: This paper presents a Biosecurity Agent, as a comprehensive defense-in-depth framework for securing large language models in biomedical research. It integrates four coordinated modes: dataset sanitization, preference alignment, runtime guardrails, and automated red teaming, across the model lifecycle. Experimental evaluation on CORD-19 and Llama-3 models shows that it reduces attack success from 59.7% to 3.0% while maintaining low false-positive rates and preserving model utility. The framework claims to enable scalable, auditable biosecurity alignment from 8B to 70B parameters, effectively balancing safety and research performance.
weaknesses: 1. First of all, from the reading, the motivation of the work is very unclear and not well constructed. The same goes for the four modes presented: why these 04 and how they cover the entire lifecycle (connecting to both biosecurity and LLM modeling approaches), and the applications, how and where exploitation of these modes can be harmful in terms of biosecurity. Basically, the significance of the problem is not clear at all.
2. The introduction section sounds very messy. A lot of things are done, which is appreciated, but a concise mention of contributions is expected. Lines 066-073 and 108-113 can be written in methods too. The introduction section doesn't clearly state what to expect later and where to put focus on.
3. Equation 1 needs definitions of the terms used. Currently, there is no clear picture of what these terms represent.
4. Modes and related evaluation information are not introduced properly (mathematically and from literature). Why did you choose to evaluate in the way you described? What is the reason behind the choice? And how do you know that this approach of evaluation is proper to evaluate the mode? There is no justification or reference or anything.
5. The experimental and evaluation process is very unclear. If this is an AI agent, no information is given on tools and capabilities, and no ablation was done. What tools and capabilities are provided to the agent? Are there any ablation studies done on that? Then, no details on how the agent worked. For example, for mode 1, did the agent write and execute code to filter data, or what? The same for all other modes.
6. The evaluation is also insufficient. Only one example (one model or dataset) per mode is not enough to judge the capabilities. Also, the tasks are not well-motivated or well-documented either.
7. Attack success rate, red teaming and such terms were used; but again, there is no information on how, what, where and why it is done.
8. The presentation is very, very poor. Always jumping between modes and terms, without proper context. Also, as said above, modes are not introduced properly; thus, everything is very unclear.
9. The usage of the term "scalability" is questionable here. Is it said to be scalable because this agent framework can work with larger models? If yes, why and how? If not, explain. The term seems to be entirely irrelevant here.