Can AI coding agents rebuild biological AI tools from a paper? (ReproBAIT)
A · Strong evidence UK AI Security Institute and SecureBio evaluation with a sandboxed, held-out scoring protocol across four closed and open agents; method and costs are shown, though only three tools and best-of-three runs are reported.
Summary based on the full text·Original: about 8 minutes to read
In short
A UK AI Security Institute blog post (26 October 2026) presenting ReproBAIT, built with SecureBio. Coding agents were given a short description of a published biological AI tool plus its training data and asked to build and train a working replica on one GPU with no internet. Simple tools were rebuilt in hours for a few dollars; the most complex one was not. Giving the full paper instead of only the abstract made no consistent difference, which suggests withholding code or method detail does not by itself control who can use a capability.
Key numbers
- 96.5%reproduction fidelity of Claude Opus 5's ProteinMPNN rebuild given the full paper
- $4 to $20typical compute cost of a successful rebuild of the two simpler tools
- $102 to $301cost per failed RFdiffusion3 rebuild attempt; no agent succeeded
- 4 hourstime within which the simplest tools were reproduced
- 3runs per configuration, best attempt reported, across four coding agents
As reported by the source.
English·Web page·opens aisi.gov.uk
What it reports
- Targets: ProteinMPNN and RFdiffusion3 (open-source protein design) and a closed-source molecular-design tool called CMD whose code was never released.
- Conditions: abstract-only, paper-only, and for the open tools a with-code baseline.
- Agents: Claude Opus 5, GPT-5.6 Sol, Kimi K3 and Qwen3.8-2.4T.
- CMD (validity of generated molecules): all four agents matched or exceeded the original, on a metric already near saturation and at a modest cost to novelty.
- ProteinMPNN (sequence recovery): Claude Opus 5 reached 96.5% fidelity with the full paper; results varied by agent.
- RFdiffusion3 (designability): no successful rebuild within the time budget; one partial attempt narrowed its training data, and other runs were excluded for returning near-duplicates of known structures.
- Successful rebuilds of the two simpler tools typically cost $4 to $20; each RFdiffusion3 attempt cost $102 to $301.
- Memorisation screening found moderate evidence of recalled details for ProteinMPNN and little for RFdiffusion3.
How they got it
Each attempt ran in an isolated single-GPU sandbox with a time budget scaled to tool complexity. A separate, network-isolated scorer compared the replica with the original on held-out data, using the original paper's main metric, expressed as fidelity (replica score as a share of the original's). Three runs per configuration; the best is reported.
Limits
- Fidelity covers one function per tool, not full reproduction.
- Best-of-three reporting overstates typical results.
- Training data was supplied to the agent, which is the main reason the authors point to data governance.
- Memorisation tests are imperfect and cannot say how much success came from recall.
- Only three tools, all small relative to the largest biological models.
Why it matters for companies
Any firm that relies on keeping model code private while publishing method papers should assume a coding agent with the training data can rebuild core functions cheaply. The finding generalises beyond biology: in a world of capable coding agents, control over proprietary data is a stronger protection than control over code or documentation. For life-science and chemical firms it also shows what a credible capability evaluation looks like: sandboxed runs, held-out scoring and published costs.
Summary based on the full text. Read the original for the full argument and data.Read the original on aisi.gov.uk
- Tags
- Coding agents, AI safety