Preprint: Frontier LLMs Can Propose High‑Risk Single‑Site Protein Mutations; Tool Access Raises Risk

A new arXiv preprint from researchers at Shanghai Artificial Intelligence Laboratory and Fudan University says current frontier large language models can generate measurably high-risk biological mutation proposals in a controlled benchmark, and that giving those models access to specialized biological design tools increases that risk.

The paper is notable because it tries to measure biosecurity-relevant design capability empirically, rather than asking whether chatbots can answer hazardous biology questions. In the abstract, the authors write: “To address these gaps, we introduce DRYLAB‑Bench (Design Risk Yielded by LLM Agent in Biodesign), the first comprehensive benchmark evaluating the high‑risk biological mutation design capabilities of LLM agents.” The study was posted to arXiv as a preprint on Oct. 9.

The paper, “DRYLAB-Bench: Benchmarking the Biosecurity Risk of Agentic LLM Mutation Design,” is by Yuzhen Wang, Chunxiao Li, Baichen Le, Lewen Yan, Jie Zhang, Yucheng T. Yang, Xing-Ming Zhao, Lijun Li and Jing Shao of Shanghai Artificial Intelligence Laboratory and Fudan University. It introduces a benchmark with 30 biosecurity-relevant mutation-design scenarios. To score model outputs, the researchers matched submitted mutations against 187,695 experimentally measured single-site amino-acid substitutions from ProteinGym and ViroGym, two existing collections of deep mutational scanning data that record how individual protein changes performed in lab assays.

The benchmark uses what the authors describe as a multi-round, tool-augmented setup. Models can call a fixed suite of six in-silico biological evidence tools, meaning software tools that provide supporting analysis without exposing the hidden experimental answers used for scoring. The authors also introduce a Biosecurity Risk Score, or BRS, which converts each proposed mutation into a standardized score based on experimentally measured assay results. The paper evaluates 15 frontier models from vendors including Anthropic, OpenAI, Google, xAI, DeepSeek, Alibaba, Moonshot and Zhipu.

In the paper’s one-shot setting, without tool access, 67.6% of model-designed variants exceeded the average measured variant for their respective assays, according to the authors. They report that 21.4% of those designs landed in the highest-risk decile for the assay in question. When models were allowed to use the biological design tools and interact across multiple adaptive rounds, pooled risk increased by a reported ΔBRS of plus 0.116, and the share of variants in the top decile rose to 23.5%. The paper says that increase splits into plus 0.048 from tool access and plus 0.068 from additional adaptive rounds. Under that most advanced tool-augmented setting, the authors report average experimental coverage of 83.9% for submitted candidates.

The study also draws clear limits around what it does not test. It is restricted to single-site substitutions — one amino-acid change at a time — which the authors describe as both the empirical and ethical ceiling for a public benchmark of this kind. It does not evaluate multi-mutation constructs, organismal engineering or physical synthesis. Instead of creating or testing new biological material, the benchmark uses pre-existing experimental measurements as a hidden holdout. The authors present that design as a way to enable safe, scalable verification while avoiding wet-lab synthesis.

That distinction matters for interpreting the results. The preprint does not show that AI systems can engineer pathogens in the real world. It shows that, within a benchmark built from existing assay data, current frontier models can propose single-site mutations that score as relatively high risk, and that tool access can improve those results.

The researchers have released code publicly in the GitHub repository drylab-bio/DRYLAB-Bench under an MIT license. The repository includes a warning that says: “Responsible use: This benchmark is intended for safety evaluation and research. Some tasks concern biological capabilities with potential misuse implications. Use the code and data only in accordance with applicable laws, institutional policies, and authorization requirements.” The public repository exposes 15 scenarios, while the paper describes 30 in total, suggesting some benchmark content was intentionally withheld. As of Oct. 12, no major public media coverage, vendor statements or official responses to the paper had been found.