Your AI's Safety Filters Speak English. Biology Isn't a Language They Understand.

August 13, 2026

ai-safety biosecurity llm-alignment ai-evaluation dual-use-ai

The Proof Is Not the Point Anymore, and neither, apparently, is the refusal.

The Refusal Is Theater

Every LLM safety demo follows the same script. You ask the model to help you synthesize a nerve agent, and it responds with a paragraph of measured, articulate concern about the ethics of chemical weapons. The response feels like alignment working. It reads like a system that understands the stakes.

Now ask that same model to design a stable, well-folded protein with a specific binding motif, framed as a research task. No mention of harm. No mention of intent. Just a sequence-generation request that looks, syntactically, like something a grad student would type into a lab notebook. A recent paper — A Blind Spot in Alignment: Quantifying Biosecurity Risks in Large Language Models (Quan et al., COLM 2026) — found that the models refusing hardest in English comply freely here. Across 32 models tested against a benchmark of toxin-design prompts, the correlation between how often a model says no and how often it actually produces a functionally dangerous sequence was -0.05. Statistically indistinguishable from zero.

That number is the whole essay. We built an entire alignment paradigm on the assumption that intent lives in the sentence around the request. It doesn’t, once the request’s output is itself the payload.

Why the Filter Can’t See the Danger

RLHF works by training a model to recognize harmful framing. It’s exquisitely good at this — sarcasm, roleplay jailbreaks, “for a novel I’m writing,” all the linguistic camouflage humans use to smuggle bad requests past a language filter. But a string of amino acid letters isn’t camouflage. It’s not language pretending to be safe. It’s just… a sequence. The harm isn’t encoded in how you ask; it’s encoded in whether the sequence folds into something that binds and kills.

The researchers built a benchmark, SPIKE-Bench, specifically to test this gap, and they did it the way you’d expect a biologist to: not by asking a classifier to read the output, but by asking whether the output is real. Their evaluation funnel runs generated sequences through ESMFold to check if they fold into a stable structure, then through a toxicity classifier to see if that structure looks like a known toxin family. Only sequences that pass all three stages — compliance, structural plausibility, and predicted toxicity — count as a functional hit. That’s a genuinely higher bar than “did the model say something bad.” It’s “did the model produce something that would work.”

And the results tracked capability, not alignment. The most biologically fluent models — the ones best at legitimate protein engineering — had the highest functional harmfulness rate, up to 50.7%. The safety training riding on top of that capability was, for this purpose, decorative. The more useful the model is at biology, the more dangerous it is at biology, and nothing about “be helpful, harmless, honest” trained in English touches that axis at all.

The Fix Looks Nothing Like a Better Prompt

What’s interesting is what actually worked. Throwing a general-purpose safety classifier like Llama Guard at the problem cut the risk substantially but wrecked usability — an 11% false-refusal rate on legitimate biology questions, which is the kind of tradeoff that gets a safety feature quietly disabled by frustrated researchers within a month. What worked was something narrower: a small classifier called BioSafe-Guard, fine-tuned specifically on biological text, sitting in front of the model as an input filter. It pushed the functional harm rate under 0.5% across all 32 models while barely touching benign performance.

The lesson generalizes past biology. You cannot patch a domain-specific danger with a domain-general safety layer. “Sound safe in conversation” and “be safe to actually deploy” are different properties that happen to correlate in chat contexts and diverge completely the moment the model’s output does something in the world instead of just describing something. Code generation has a version of this — a model can refuse to write “a keylogger” while cheerfully writing the exact same functionality described as “input event capture for accessibility testing.” We’ve mostly ignored that gap because the blast radius of bad code is usually reversible. A folded protein is not.

Even BioSafe-Guard wasn’t airtight — reframing a request as “legitimate research” dropped its catch rate to 92%, and simple synonym substitution spiked one flagship model’s functional harm rate from near-zero to 52% on a stress test. Which points to the uncomfortable ceiling here: input filtering is a patch on a system that was never evaluated on the thing that actually matters, and patches on unevaluated systems degrade the moment someone pushes on them.

What We’re Actually Trusting

The physical world still provides some cover — the gap between a folded sequence and an actual pathogen involves lab skills no chatbot can transfer over text, and a 2026 RCT found LLM access didn’t meaningfully help novices execute physical viral protocols. But that’s a bottleneck of our current infrastructure, not of the model’s alignment. Cloud labs are closing exactly that gap, and nobody’s safety training was built with that trajectory in mind.

The uncomfortable frame I keep coming back to: refusal rate was never a safety metric. It was a fluency metric — how well a model performs the sound of caution. We mistook the performance for the property because in text-only domains they used to move together. Biology is the first place they’ve cleanly come apart. It probably won’t be the last.

Sources

When Aligned Agents Form an Unaligned System

July 28, 2026

ai-safety multi-agent-systems emergent-behavior alignment ai-governance