The best biosecurity attacks against pharma generative AI in 2025 don't ask for bioweapons. They ask for proteins with structural homology to benign reference sequences — then use bioinformatic tools to optimize them toward lethality. GeneBreaker, a systematic jailbreak framework published at NeurIPS 2025, achieved up to 60% attack success rate on Evo 2-40B this way. The request looks like legitimate comparative genomics research. Keyword filters and refusal training never trigger.
This isn't a subtle theoretical attack. It's a published framework. And the defenses most pharma teams rely on today were built for a threat that looked different — when the canonical biosecurity incident was MegaSyn generating 40,000 VX analogues in six hours by inverting a reward function, and the defense was obvious: lock down config access.
The problem is that the defense landscape didn't evolve as fast as the attack surface. Our research developing Biosecurity AI Safety for Pharma & Biotech found three attack vectors operating in 2025-2026 that behavioral defenses — refusal training, RLHF alignment, output classifiers, structural-alert filters — were each designed before. Every vector bypasses the previous generation's controls by design.
Three Attack Vectors That Share One Structural Flaw
GeneBreaker (Zhang et al., arXiv 2505.23839, NeurIPS 2025) targets Evo 2, Arc Institute's 40-billion parameter open-weights DNA foundation model trained on 9 trillion nucleotides. The framework uses an LLM agent to design prompts asking for proteins "homologous to" benign reference sequences that happen to be structurally similar to Select Agent proteins. Guided by PathoLM, log-probability heuristics, and BLAST-based evaluation, it achieves up to 60% attack success rate across six viral categories — including SARS-CoV-2 spike protein and HIV-1 envelope protein — with demonstrated structural and sequence fidelity. The attack never names the target pathogen. Refusal training has no signal to fire on.
The 2025 attacks on pharma generative AI don't ask for bioweapons. They ask for structurally adjacent proteins. Refusal training is looking for the wrong input shape.
The Paraphrase Project (Science, October 2025) moved the target one step downstream, to the synthesis screening layer pharma teams assume will catch anything their generative pipeline produces. Microsoft Research worked with Twist Bioscience, IDT, and IGSC for 10 months in a coordinated red-team exercise, using EvoDiff to generate synthetic variants of the ricin toxin A-chain. The variants preserved functional active sites while mutating the surrounding scaffold — the AI equivalent of paraphrasing a sentence. Every major synthesis provider's screening, running the IGSC Harmonized Screening Protocol v3.0, failed to detect the variants with reliable sensitivity. Throughout 2024, the assumption that "the DNA vendor will catch it" was a false guarantee. The patch was global, took 10 months, and required co-developing functional-prediction algorithms on top of homology matching.
Malicious fine-tuning takes a different angle entirely — rather than attacking the model's outputs or the synthesis screen, it attacks the safety alignment itself. A 2025 study (arXiv 2508.03153) found that roughly 10-50 fine-tuning examples and a few hundred dollars of GPU time strip safety alignment from open-weight biology models and restore near-frontier biological capability. For any pharma running Llama 3.1, 3.3, Evo 2, or REINVENT on-premise — which describes most pharma doing IP-sensitive generative chemistry — "safety-aligned at release" is not a property that survives an insider threat or an exfiltrated weights file.
What connects all three vectors: behavioral defenses modify what the model says in response to certain requests. These attacks don't make those requests. They route around the behavioral layer at the architecture level.
What the Current Platform Stack Covers
The defense gap isn't a vendor failure — it's a scope mismatch between what the platforms were designed for and what the 2025 attack research requires.
Chemistry42 (Insilico Medicine) runs 460+ Medicinal Chemistry Filters excluding PAINS flags, reactive groups, and known toxicophores. This is output-layer filtering — it catches known toxic substructures in what the model generates. It does not constrain the optimization objective. A model navigating toward the chemical weapons agent (CWA) manifold through a chemically novel scaffold can produce outputs that pass every filter check because the structures are genuinely novel. Schrödinger's LiveDesign and AutoDesigner do physics-based docking and strain filtering — also output-layer, not pipeline-layer. REINVENT 4, the open-source backbone for most mid-size pharma generative exploration, is the same architecture the MegaSyn experiment demonstrated: the scoring function lives in a YAML config file where a sign parameter distinguishes drug discovery from lethality optimization.
The biology foundation model picture is similar. Evo 2's safety posture relied on pathogen exclusion from training data and internal red-teaming — a posture GeneBreaker challenged with a 60% attack success rate result after publication. ESM-3 (EvolutionaryScale) uses API access control as its primary mechanism; reasonable for API use, doesn't transfer to on-premise derivatives. Anthropic activated ASL-3 deployment measures for Claude Opus 4 in May 2025, including constitutional classifiers targeting CBRN uplift — the strongest commercial posture currently available. That protection applies to the Anthropic API. It doesn't transfer to an internal REINVENT instance, on-premise fine-tuned Llama, or retrieval-augmented chemistry pipeline. Most pharma generative chemistry happens outside the commercial API, precisely because of IP.
The Regulatory Moment Driving 2026 Timelines
Pharma compliance leads are managing a genuinely unusual regulatory environment. The US framework they planned against through 2024 has been dismantled: EO 14110 on AI safety was rescinded January 2025, the 2022 Bioeconomy EO in March 2025, and EO 14292 (May 2025) established a new gain-of-function oversight framework with a 90-day implementation deadline that passed without a replacement. Compliance teams planning against US guidance are planning against a vacuum.
The EU framework moved in the opposite direction. Full EU AI Act obligations — GPAI and high-risk application both — apply from August 2, 2026. Penalties run to €35 million or 7% of global turnover for prohibited practices, €15 million or 3% for GPAI non-compliance. A pharma with EU operations cannot wait for US clarity to set the compliance horizon.
A pharma with EU operations faces EU AI Act enforcement in August 2026 regardless of the US regulatory posture. That timeline is fixed.
ISO/IEC 42001:2023 requires controls proportionate to risk — for CBRN-adjacent AI pipelines, that language has been interpreted as elimination controls, not administrative ones. Since late 2025, Munich Re Specialty and other cyber-liability underwriters have modified coverage, raising premiums or adding exclusions for organizations running open-weight models without documented risk controls. The 2026 underwriting questionnaire asks specifically about model provenance, unlearning procedures, and red-team cadence. DURC policy (HHS/OSTP) already places generative biology tools within institutional oversight scope — and in 2026, a duty-of-care defense requires demonstrably more than "we added a refusal prompt."
A Defense Architecture That Addresses the 2025 Attack Surface
The two research threads underlying this solution — latent-space governance at generation time and knowledge-gap engineering at the weights level — need to be deployed as independent, complementary layers. Neither is sufficient alone. Generation-layer constraints don't address knowledge encoded in the model weights. Weights-level modification doesn't address real-time optimization attacks that operate through prompting, not training. The architecture that addresses the 2025 attack surface has to cover both.
At the generation layer, a constraint critic intercepts SMILES/SELFIES/graph outputs from REINVENT, Chemistry42, or a custom model before they reach the researcher. Beyond standard structural-toxicophore checks, it includes a latent-space proximity scorer — a continuous measurement of each candidate's distance from the CWA manifold — and an activity-cliff detector that flags structures approaching high-lethality scaffolds through chemically plausible steps. This runs inside the generation loop, not downstream of it, and produces ISO 42001-compatible audit logs as a side effect: a signed record of every flagged structure and its disposition, usable by a DURC self-review committee or an ISO auditor.
Once the generation layer is constrained, the question becomes what the model knows that a sophisticated prompt can still extract. That's the job of knowledge-gap engineering at the weights level, applying RMU (Representation Misdirection Unlearning), UIPE (Unlearning by Iterative Parameter Exclusion), and SAE (Sparse Autoencoder) feature ablation to the specific biology model the pharma runs. We're direct about the relearning limitation before the engagement starts: WMDP-Bio benchmark scores can drop from 75% on a Llama-3-70B base model to near random chance (26%) after unlearning — but Lucki et al. (ICLR 2025) demonstrated that public medical-domain text is sufficient to partially recover that capability via benign relearning. SAE-targeted ablation operates on specific feature subsets rather than global parameter nudges, reducing the relearning attack surface more than RMU alone. Monthly WMDP-Bio recertification and continuous relearning-attack probing are built into every engagement at this layer.
Synthesis screening gets its own independent layer — because the Paraphrase Project demonstrated it can't be treated as a passive backstop. Pre-synthesis in-house screening runs generated sequences against the IGSC Harmonized Protocol, SecureDNA's cryptographic portal (deployed October 2025, which doesn't require sharing regulated sequences with the screening provider), and a functional-prediction layer before a DNA order leaves the organization. The only control point under the pharma's direct audit is the in-house screen before placement.
Quarterly red-teaming — GeneBreaker-style homology attacks, SMILES-prompting jailbreaks, malicious fine-tuning recovery simulations, relearning recovery tests — produces the ongoing evidence record that differentiates a documented defense posture from a compliance claim. Deliverables map to NIST AI 600-1's CBRN uplift category specifically, not to generic AI risk categories. The compliance evidence package maps the full control framework to ISO/IEC 42001, NIST AI RMF, EU AI Act GPAI obligations, and NIH DURC policy — the control matrix that makes the architecture legible to an auditor, notified body, or underwriter's 2026 questionnaire.
The Gaps This Architecture Can't Close
The relearning problem is not solved by any technique available as of 2026. UIPE and SAE ablation reduce the attack surface; they don't provably eliminate it.
Eliminating malicious fine-tuning attacks entirely requires moving to a closed-API deployment where the weights are never accessible. That's a strategic decision about IP architecture — not a consulting engagement outcome.
A pharma running open-weight biology models in an environment where weights can be exfiltrated retains residual risk no consultancy can remove. A full RMU unlearning pass on a 70-billion parameter model costs hundreds of thousands of dollars in GPU time; SAE-targeted ablation reduces this materially, but it belongs in the budget conversation before the engagement starts.
Data poisoning at the training corpus level (Virus Infection Attack class, arXiv 2509.23041) poisons the model before the pharma takes delivery. Detecting it requires upstream cooperation from whoever supplies the training corpus — something a downstream consultant cannot compel. And organizational buy-in is outside any technical engagement scope. A constraint critic that doesn't get integrated into the researcher's generation workflow doesn't constrain anything.
The Two Questions That Come Up Every Time
Whether ASL-3 on Claude Opus 4 resolves the problem is what pharma AI leads ask most often. The answer is narrow: it resolves one attack vector for one use case — using the Anthropic API directly. Constitutional classifiers monitor that boundary. They don't monitor an internal REINVENT instance, on-premise fine-tuned Evo 2, or a RAG-augmented chemistry pipeline. Most pharma generative chemistry happens outside commercial APIs for IP reasons. ASL-3 is the strongest posture at the API boundary; it doesn't extend to the internal stack.
The synthesis screening question comes up nearly as often: after the Paraphrase Project, is vendor screening still a valid backstop? The October 2025 patch improved it materially. SecureDNA's cryptographic portal adds a layer. Neither restores a guarantee. Pre-synthesis in-house screening, before the order is placed, is the only position from which a pharma can attest — under audit — to having performed the check.
The Audit Question for 2026
What pharma compliance teams are working out in 2026 is what an honest biosecurity audit of an AI pipeline actually looks like now that the three assumptions underlying the previous standard — refusal training catches the request, the DNA vendor screens the output, alignment holds against fine-tuning — have all been published and reproduced.
The readiness assessment in our Biosecurity AI Safety work is structured to surface the specific gaps in a pharma's actual stack rather than score against a generic maturity model. Some of what it produces doesn't require Veriprajna to close. The assessment is useful precisely because it is honest about both — the gaps a layered defense architecture closes, and the gaps it doesn't.
If your team is working through what a defensible posture requires for your specific pipeline, the conversation becomes concrete when it starts from what your stack actually looks like. The problems are specific enough that a general answer isn't very useful. That's the right place to start.