Pretraining data filtering in open-weight biological models

The UK AISI Chem-Bio team pretrained ESM-2 protein language models from scratch with 8M to 3B parameters, removing viral protein sequences from the training data to test the protective effect of pretraining data filtering on specialized scientific models. The experiment set multiple exclusion scopes, from removing only a single influenza strain to removing all viral proteins and their close homologs; results showed that filtering reduced viral protein performance on all three tasks—masked language modeling, mutation effect prediction, and contact prediction—with larger models showing greater reductions, while non-viral protein performance was largely unaffected. However, the removed capabilities could be fully recovered by continued fine-tuning on the excluded viral data, requiring about $80 of H100 compute for the largest 3B-parameter model, and the required viral data is usually publicly available. The study therefore concludes that data filtering alone does not constitute a robust defense and needs to be paired with additional measures such as data access controls; the results are based on a single ESM-2 model family, and the measurement of recovery cost is not sufficiently precise.