---
id: "lib-2026-10-26-pretraining-data-filtering-in-open-weight"
type: "library"
title: "Pretraining data filtering in open-weight biological models"
lang: "EN"
org: "UK AI Security Institute"
source_type: "Report"
date: "2026-10-26"
week: "2026-W44"
url: "https://nosov.ai/library/lib-2026-10-26-pretraining-data-filtering-in-open-weight/"
original_url: "https://www.aisi.gov.uk/blog/pretraining-data-filtering-in-open-weight-biological-models"
tier: "A"
tier_name: "Strong evidence"
tier_reason: "UK AI Security Institute experiment that pretrains ESM-2 protein models from scratch at several scales with defined filtering tiers and recovery tests; clear method, though one model family and imprecise cost measurement."
summary_basis: "full-text"
original_minutes: "7"
tags: ["ai technology", "biosecurity", "open weight models", "data filtering"]
---

# Pretraining data filtering in open-weight biological models

Tier A (Strong evidence): UK AI Security Institute experiment that pretrains ESM-2 protein models from scratch at several scales with defined filtering tiers and recovery tests; clear method, though one model family and imprecise cost measurement.

Summary based on the full text.

## In short

A UK AI Security Institute blog post (26 October 2026) testing whether removing viral proteins from pretraining data is a durable safeguard for open-weight protein models. Filtering worked as intended: viral-protein performance dropped while performance on other proteins held. But continued training on the withheld viral data, which is routinely public, restored the capability fully at low cost. Filtering raises the price of recovery; it does not remove the capability.

## Key numbers

- 8M to 3B: parameter range of the ESM-2 protein models pretrained from scratch with viral proteins filtered out
- about $80: H100 compute needed to fully restore viral-protein performance in the largest 3B model by continued training
- 3: tasks used to measure the targeted capability: masked language modelling, mutation-effect and contact prediction
- 150M / 650M: model sizes above which contact prediction and mutation-effect prediction were degraded by filtering

## What it reports

- Filtering reduced performance on viral proteins at every exclusion tier, from removing a single influenza strain to removing all viral proteins and close homologues, with non-viral performance largely preserved.
- Masked language modelling degraded at every model size; contact prediction only above 150M parameters; mutation-effect prediction only above 650M.
- The effect grew with model size, because filtering withholds gains that unfiltered models make as they scale.
- Fine-tuning on the excluded viral sequences completely restored performance at every size. Cost rose with scale but stayed small: about $80 of H100 compute for the 3B model.

## How they got it

ESM-2 models from 8M to 3B parameters were pretrained from scratch on datasets with nested exclusion tiers of viral proteins. Each filtered model was compared with an unfiltered one of the same size on held-out viral ("forget") and non-viral ("retain") proteins across three tasks, then fine-tuned on the withheld data while recovery compute was recorded.

## Limits

- One model family (ESM-2); generalisation to other protein models is uncertain.
- Models that retrieve data at inference time were not tested and may be less affected by filtering.
- Recovery-cost measurements are described by the authors as imprecise.
- Results are summarised in charts; exact performance deltas are not given in the text.

## Why it matters for companies

Developers that cite pretraining filtering to justify open release now have evidence that, for small specialised models, the safeguard is cheap to reverse when the removed data is public. The general lesson for anyone releasing open weights in a sensitive domain: a safeguard is only as strong as the cost and availability of the data needed to undo it, so access to that data matters as much as the model itself.

Original: https://www.aisi.gov.uk/blog/pretraining-data-filtering-in-open-weight-biological-models