Safety First: Input Screening for Protein Design Tools

Abstract

As biological AI models become more powerful, practical biosecurity approaches are needed to support beneficial applications while reducing misuse risks. Sequence-similarity-based screening approaches are no longer adequate to safeguard biological AI models because these models can design molecules with novel sequences and structures. Therefore, a screening approach that takes function into account is needed. To address this need, we propose a new screening method for AI-enabled protein binder design tools. Our framework screens protein binding targets, with a focus on the human proteome, as opposed to the binder molecule itself. We constructed a database of 14,541 potentially harmful proteoform targets from the human proteome (7.1% of all human protein proteoforms) classified by biosecurity risk level. To discern structural and functional features, we evaluated constructs with an embedding-based screening method using the ESM-C protein language model. ESM-C achieved high accuracy for detecting variants of known targets (F1 scores >97%), with performance similar to BLASTP. However, ESM-C proved to be more effective at capturing functional relationships, distinguishing benign mutations from damaging ones where BLASTP did not. To characterize how screening would affect bioscience research, we measured flagging rates across diverse protein datasets. Flagging rates were significant for mammalian proteins weighted by publication frequency (23% for human, 20% for mouse), and rates for organisms distantly related to humans were minimal (<1.1% for bacteria, fungi, plants, and viruses). Among commercially relevant targets, 63% of antibody patent targets were classified as dual-use, reflecting that therapeutically important proteins often perform critical biological functions. To identify and flag risky user requests from protein binder design tools without placing an undue burden on scientific research and innovation, it will be essential to deploy this screening approach in a way that addresses the overlap our analysis showed between targets of concern and therapeutic targets-possibly in concert with tiered trusted access frameworks. This new method provides a foundation for proportionate safeguards for biological AI models that reduce misuse risks while preserving their benefits for legitimate research and demonstrates a concrete proof of principle that can be generalized to other protein design tools and biological AI models.