{"id":1151021,"date":"2025-10-06T07:04:34","date_gmt":"2025-10-06T14:04:34","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/research\/?p=1151021"},"modified":"2025-10-21T07:53:33","modified_gmt":"2025-10-21T14:53:33","slug":"ideas-more-ai-resilient-biosecurity-with-the-paraphrase-project","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/research\/podcast\/ideas-more-ai-resilient-biosecurity-with-the-paraphrase-project\/","title":{"rendered":"Ideas: More AI-resilient biosecurity with the Paraphrase Project"},"content":{"rendered":"\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"Ideas: More AI-resilient biosecurity with the Paraphrase Project\" width=\"500\" height=\"281\" src=\"https:\/\/www.youtube-nocookie.com\/embed\/xA9nvhX7e7A?feature=oembed&rel=0\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe>\n<\/div><\/figure>\n\n\n<div class=\"wp-block-msr-podcast-container my-4\">\n\t<iframe loading=\"lazy\" src=\"https:\/\/player.blubrry.com\/?podcast_id=148928066&modern=1\" class=\"podcast-player\" frameborder=\"0\" height=\"164px\" width=\"100%\" scrolling=\"no\" title=\"Podcast Player\"><\/iframe>\n<\/div>\n\n\n\n<p>Behind every emerging technology is a great idea propelling it forward. In the Microsoft Research Podcast series <em>Ideas<\/em>, members of the research community at Microsoft discuss the beliefs that animate their research, the experiences and thinkers that inform it, and the positive human impact it targets.<\/p>\n\n\n\n<p>AI has been described as a \u201cdual use\u201d technology: the capabilities that can be leveraged for good can also potentially be used to cause harm. In this episode, Microsoft Chief Scientific Officer <a href=\"https:\/\/www.microsoft.com\/en-us\/research\/people\/horvitz\/\">Eric Horvitz<\/a> and his guests\u2014<a href=\"https:\/\/www.microsoft.com\/en-us\/research\/people\/bwittmann\/\">Bruce Wittmann<\/a>, a senior applied scientist at Microsoft; <a class=\"msr-external-link glyph-append glyph-append-open-in-new-tab glyph-append-xsmall\" href=\"https:\/\/ibbis.bio\/people\/tessa-alexanian\/\" target=\"_blank\" rel=\"noopener noreferrer\">Tessa Alexanian<span class=\"sr-only\"> (opens in new tab)<\/span><\/a>, a technical lead at the International Biosecurity and Biosafety Initiative for Science (IBBIS);&nbsp;and <a class=\"msr-external-link glyph-append glyph-append-open-in-new-tab glyph-append-xsmall\" href=\"https:\/\/www.linkedin.com\/in\/jdiggans\/\" target=\"_blank\" rel=\"noopener noreferrer\">James Diggans<span class=\"sr-only\"> (opens in new tab)<\/span><\/a>, a vice president at Twist Bioscience\u2014explore this idea in the context of AI-powered protein design.<\/p>\n\n\n\n<p>With Horvitz at the lead, Alexanian, Diggans, and Wittmann were part of a cross-sector team that demonstrated toxic protein candidates could be designed with help from AI\u2014and that they could bypass the systems in place to defend against their creation. The project, known as the <em>Paraphrase Project<\/em>, culminated in a cybersecurity-style response, a more robust protein screening system, and a modified approach to peer review with implications for how we think about and tackle AI risk more broadly. The work was recently published in <em>Science.<\/em><\/p>\n\n\n\n<div class=\"wp-block-group msr-pattern-link-list is-layout-flow wp-block-group-is-layout-flow\">\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading h5\" id=\"learn-more-1\">Learn more:<\/h2>\n\n\n\n<ul class=\"wp-block-list list-unstyled\">\n<li><a href=\"https:\/\/www.microsoft.com\/en-us\/research\/publication\/strengthening-nucleic-acid-biosecurity-screening-against-generative-protein-design-tools\/\">Strengthening nucleic acid biosecurity screening against generative protein design tools<\/a><br>Publication | October 2025<\/li>\n\n\n\n<li><a href=\"https:\/\/www.microsoft.com\/en-us\/research\/publication\/toward-ai-resilient-screening-of-nucleic-acid-synthesis-orders-process-results-and-recommendations\/\">Toward AI-Resilient Screening of Nucleic Acid Synthesis Orders: Process, Results, and Recommendations<\/a><br>Preprint | December 2024<\/li>\n\n\n\n<li><a href=\"https:\/\/www.microsoft.com\/en-us\/research\/story\/the-paraphrase-project-designing-defense-for-an-era-of-synthetic-biology\/\">The Paraphrase Project: Designing defense for an era of synthetic biology<\/a><br>Microsoft Research Blog | October 2025<\/li>\n\n\n\n<li><a href=\"https:\/\/www.microsoft.com\/en-us\/research\/blog\/when-ai-meets-biology-promise-risk-and-responsibility\/\">When AI meets biology: Promise, risk, and responsibility<\/a><br>Microsoft Research Blog | Eric Horvitz | October 2025<\/li>\n\n\n\n<li><a href=\"https:\/\/www.microsoft.com\/en-us\/research\/project\/paraphrase-project\/\">Paraphrase Project<\/a><br>Project homepage<\/li>\n<\/ul>\n<\/div>\n\n\n\n<div style=\"height:25px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<section class=\"wp-block-msr-subscribe-to-podcast subscribe-to-podcast\">\n\t<div class=\"subscribe-to-podcast__inner border-top border-bottom border-width-2\">\n\t\t<h2 class=\"h5 subscribe-to-podcast__heading\">\n\t\t\tSubscribe to the <a href=\"https:\/\/www.microsoft.com\/en-us\/research\/podcast\">Microsoft Research Podcast<\/a>:\t\t<\/h2>\n\t\t<ul class=\"subscribe-to-podcast__list list-unstyled\">\n\t\t\t\t\t\t\t<li class=\"subscribe-to-podcast__list-item\">\n\t\t\t\t\t<a class=\"subscribe-to-podcast__link\" href=\"https:\/\/itunes.apple.com\/us\/podcast\/microsoft-research-a-podcast\/id1318021537?mt=2\" target=\"_blank\" rel=\"noreferrer noopener\">\n\t\t\t\t\t\t<svg class=\"subscribe-to-podcast__svg\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"black\" viewBox=\"0 0 32 32\">  <path d=\"M7.12 0c-3.937-0.011-7.131 3.183-7.12 7.12v17.76c-0.011 3.937 3.183 7.131 7.12 7.12h17.76c3.937 0.011 7.131-3.183 7.12-7.12v-17.76c0.011-3.937-3.183-7.131-7.12-7.12zM15.817 3.421c3.115 0 5.932 1.204 8.079 3.453 1.631 1.693 2.547 3.489 3.016 5.855 0.161 0.787 0.161 2.932 0.009 3.817-0.5 2.817-2.041 5.339-4.317 7.063-0.812 0.615-2.797 1.683-3.115 1.683-0.12 0-0.129-0.12-0.077-0.615 0.099-0.792 0.192-0.953 0.64-1.141 0.713-0.296 1.932-1.167 2.677-1.911 1.301-1.303 2.229-2.932 2.677-4.719 0.281-1.1 0.244-3.543-0.063-4.672-0.969-3.595-3.907-6.385-7.5-7.136-1.041-0.213-2.943-0.213-4 0-3.636 0.751-6.647 3.683-7.563 7.371-0.245 1.004-0.245 3.448 0 4.448 0.609 2.443 2.188 4.681 4.255 6.015 0.407 0.271 0.896 0.547 1.1 0.631 0.447 0.192 0.547 0.355 0.629 1.14 0.052 0.485 0.041 0.62-0.072 0.62-0.073 0-0.62-0.235-1.199-0.511l-0.052-0.041c-3.297-1.62-5.407-4.364-6.177-8.016-0.187-0.943-0.224-3.187-0.036-4.052 0.479-2.323 1.396-4.135 2.921-5.739 2.199-2.319 5.027-3.543 8.172-3.543zM16 7.172c0.541 0.005 1.068 0.052 1.473 0.14 3.715 0.828 6.344 4.543 5.833 8.229-0.203 1.489-0.713 2.709-1.619 3.844-0.448 0.573-1.537 1.532-1.729 1.532-0.032 0-0.063-0.365-0.063-0.803v-0.808l0.552-0.661c2.093-2.505 1.943-6.005-0.339-8.296-0.885-0.896-1.912-1.423-3.235-1.661-0.853-0.161-1.031-0.161-1.927-0.011-1.364 0.219-2.417 0.744-3.355 1.672-2.291 2.271-2.443 5.791-0.348 8.296l0.552 0.661v0.813c0 0.448-0.037 0.807-0.084 0.807-0.036 0-0.349-0.213-0.683-0.479l-0.047-0.016c-1.109-0.885-2.088-2.453-2.495-3.995-0.244-0.932-0.244-2.697 0.011-3.625 0.672-2.505 2.521-4.448 5.079-5.359 0.547-0.193 1.509-0.297 2.416-0.281zM15.823 11.156c0.417 0 0.828 0.084 1.131 0.24 0.645 0.339 1.183 0.989 1.385 1.677 0.62 2.104-1.609 3.948-3.631 3.005h-0.015c-0.953-0.443-1.464-1.276-1.475-2.36 0-0.979 0.541-1.828 1.484-2.328 0.297-0.156 0.709-0.235 1.125-0.235zM15.812 17.464c1.319-0.005 2.271 0.463 2.625 1.291 0.265 0.62 0.167 2.573-0.292 5.735-0.307 2.208-0.479 2.765-0.905 3.141-0.589 0.52-1.417 0.667-2.209 0.385h-0.004c-0.953-0.344-1.157-0.808-1.553-3.527-0.452-3.161-0.552-5.115-0.285-5.735 0.348-0.823 1.296-1.285 2.624-1.291z\"\/><\/svg>\n\t\t\t\t\t\t<span class=\"subscribe-to-podcast__link-text\">Apple Podcasts<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\n\t\t\t\t\t\t\t<li class=\"subscribe-to-podcast__list-item\">\n\t\t\t\t\t<a class=\"subscribe-to-podcast__link\" href=\"https:\/\/subscribebyemail.com\/www.blubrry.com\/feeds\/microsoftresearch.xml\" target=\"_blank\" rel=\"noreferrer noopener\">\n\t\t\t\t\t\t<svg class=\"subscribe-to-podcast__svg\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewBox=\"0 0 32 32\"><path fill=\"currentColor\" d=\"M6.4 6a2.392 2.392 0 00-2.372 2.119L16 15.6l11.972-7.481A2.392 2.392 0 0025.6 6H6.4zM4 10.502V22.8a2.4 2.4 0 002.4 2.4h19.2a2.4 2.4 0 002.4-2.4V10.502l-11.365 7.102a1.2 1.2 0 01-1.27 0L4 10.502z\"\/><\/svg>\n\t\t\t\t\t\t<span class=\"subscribe-to-podcast__link-text\">Email<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\n\t\t\t\t\t\t\t<li class=\"subscribe-to-podcast__list-item\">\n\t\t\t\t\t<a class=\"subscribe-to-podcast__link\" href=\"https:\/\/subscribeonandroid.com\/www.blubrry.com\/feeds\/microsoftresearch.xml\" target=\"_blank\" rel=\"noreferrer noopener\">\n\t\t\t\t\t\t<svg class=\"subscribe-to-podcast__svg\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewBox=\"0 0 32 32\"><path fill=\"currentColor\" d=\"M12.414 4.02c-.062.012-.126.023-.18.06a.489.489 0 00-.12.675L13.149 6.3c-1.6.847-2.792 2.255-3.18 3.944h13.257c-.388-1.69-1.58-3.097-3.179-3.944l1.035-1.545a.489.489 0 00-.12-.675.492.492 0 00-.675.135l-1.14 1.68a7.423 7.423 0 00-2.55-.45c-.899 0-1.758.161-2.549.45l-1.14-1.68a.482.482 0 00-.494-.195zm1.545 3.824a.72.72 0 110 1.44.72.72 0 010-1.44zm5.278 0a.719.719 0 110 1.44.719.719 0 110-1.44zM8.44 11.204A1.44 1.44 0 007 12.644v6.718c0 .795.645 1.44 1.44 1.44.168 0 .33-.036.48-.09v-9.418a1.406 1.406 0 00-.48-.09zm1.44 0V21.76c0 .793.646 1.44 1.44 1.44h10.557c.793 0 1.44-.647 1.44-1.44V11.204H9.878zm14.876 0c-.169 0-.33.035-.48.09v9.418c.15.052.311.09.48.09a1.44 1.44 0 001.44-1.44v-6.719a1.44 1.44 0 00-1.44-1.44zM11.8 24.16v1.92a1.92 1.92 0 003.84 0v-1.92h-3.84zm5.759 0v1.92a1.92 1.92 0 003.84 0v-1.92h-3.84z\"\/><\/svg>\n\t\t\t\t\t\t<span class=\"subscribe-to-podcast__link-text\">Android<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\n\t\t\t\t\t\t\t<li class=\"subscribe-to-podcast__list-item\">\n\t\t\t\t\t<a class=\"subscribe-to-podcast__link\" href=\"https:\/\/open.spotify.com\/show\/4ndjUXyL0hH1FXHgwIiTWU\" target=\"_blank\" rel=\"noreferrer noopener\">\n\t\t\t\t\t\t<svg class=\"subscribe-to-podcast__svg\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewBox=\"0 0 32 32\"><path fill=\"currentColor\" d=\"M16 4C9.383 4 4 9.383 4 16s5.383 12 12 12 12-5.383 12-12S22.617 4 16 4zm5.08 17.394a.781.781 0 01-1.086.217c-1.29-.86-3.477-1.434-5.303-1.434-1.937.002-3.389.477-3.403.482a.782.782 0 11-.494-1.484c.068-.023 1.71-.56 3.897-.562 1.826 0 4.365.492 6.171 1.696.36.24.457.725.217 1.085zm1.56-3.202a.895.895 0 01-1.234.286c-2.338-1.457-4.742-1.766-6.812-1.747-2.338.02-4.207.466-4.239.476a.895.895 0 11-.488-1.723c.145-.041 2.01-.5 4.564-.521 2.329-.02 5.23.318 7.923 1.995.419.26.547.814.286 1.234zm1.556-3.745a1.043 1.043 0 01-1.428.371c-2.725-1.6-6.039-1.94-8.339-1.942h-.033c-2.781 0-4.923.489-4.944.494a1.044 1.044 0 01-.474-2.031c.096-.023 2.385-.55 5.418-.55h.036c2.558.004 6.264.393 9.393 2.23.497.292.663.931.371 1.428z\"\/><\/svg>\n\t\t\t\t\t\t<span class=\"subscribe-to-podcast__link-text\">Spotify<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\n\t\t\t\t\t\t\t<li class=\"subscribe-to-podcast__list-item\">\n\t\t\t\t\t<a class=\"subscribe-to-podcast__link\" href=\"https:\/\/www.blubrry.com\/feeds\/microsoftresearch.xml\" target=\"_blank\" rel=\"noreferrer noopener\">\n\t\t\t\t\t\t<svg class=\"subscribe-to-podcast__svg\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewBox=\"0 0 32 32\"><path fill=\"currentColor\" d=\"M6.667 4a2.676 2.676 0 00-2.612 2.13v.003c-.036.172-.055.35-.055.534v18.666c0 .183.019.362.055.534v.003a2.676 2.676 0 002.076 2.075h.002c.172.036.35.055.534.055h18.666A2.676 2.676 0 0028 25.333V6.667a2.676 2.676 0 00-2.13-2.612h-.003A2.623 2.623 0 0025.333 4H6.667zM8 8h1.333C17.42 8 24 14.58 24 22.667V24h-2.667v-1.333c0-6.618-5.382-12-12-12H8V8zm0 5.333h1.333c5.146 0 9.334 4.188 9.334 9.334V24H16v-1.333A6.674 6.674 0 009.333 16H8v-2.667zM10 20a2 2 0 11-.001 4.001A2 2 0 0110 20z\"\/><\/svg>\n\t\t\t\t\t\t<span class=\"subscribe-to-podcast__link-text\">RSS Feed<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t<\/ul>\n\t<\/div>\n<\/section>\n\n\n<div class=\"wp-block-msr-show-more\">\n\t<div class=\"bg-neutral-100 p-5\">\n\t\t<div class=\"show-more-show-less\">\n\t\t\t<div>\n\t\t\t\t<span>\n\t\t\t\t\t\n\n<h2 class=\"wp-block-heading\" id=\"transcript-1\">Transcript<\/h2>\n\n\n\n<p>[MUSIC]<\/p>\n\n\n\n<p><strong>ERIC HORVITZ: <\/strong>You\u2019re&nbsp;listening to&nbsp;<em>Ideas<\/em>, a Microsoft Research Podcast that dives deep into the world of technology research and the profound questions behind the code.&nbsp;I\u2019m&nbsp;Eric Horvitz, Microsoft\u2019s chief scientific officer, and in this series, we explore the technologies shaping our future and the&nbsp;big ideas&nbsp;that propel them forward.<\/p>\n\n\n\n<p>[MUSIC FADES]<\/p>\n\n\n\n<p>Today,&nbsp;I\u2019m&nbsp;excited to talk about the Paraphrase Project, an effort I co-led exploring how&nbsp;advances in&nbsp;AI tools&nbsp;for protein design&nbsp;might&nbsp;impact&nbsp;biosecurity. The results were reported in our recent paper,&nbsp;<a class=\"msr-external-link glyph-append glyph-append-open-in-new-tab glyph-append-xsmall\" href=\"http:\/\/www.science.org\/doi\/10.1126\/science.adu8578\" target=\"_blank\" rel=\"noopener noreferrer\">\u201cStrengthening nucleic acid biosecurity screening against generative protein design tools,\u201d<span class=\"sr-only\"> (opens in new tab)<\/span><\/a>&nbsp;published in&nbsp;<em>Science<\/em>&nbsp;on Oct. 2.&nbsp;<\/p>\n\n\n\n<p>Joining me are&nbsp;three&nbsp;of the larger set of&nbsp;coauthors on that paper:&nbsp;Bruce Wittmann, senior applied scientist at Microsoft;&nbsp;James&nbsp;Diggans, vice president at Twist Bioscience and chair of the board for the International Gene Synthesis Consortium;&nbsp;and Tessa Alexanian, technical lead at the International Biosecurity and Biosafety Initiative for Science, also known as <em>IBBIS<\/em>.&nbsp;<\/p>\n\n\n\n\t\t\t\t<\/span>\n\t\t\t\t<span id=\"show-more-show-less-toggle-1\" class=\"show-more-show-less-toggleable-content\">\n\t\t\t\t\t\n\n\n\n<p>Now, let\u2019s&nbsp;rewind two years.&nbsp;Almost to&nbsp;the day, Bruce and I uncovered a vulnerability. While preparing a case study for a workshop on AI and biosecurity, we discovered that open-source AI protein design tools could be used to redesign toxic proteins in ways that could bypass biosecurity screening systems, systems set up to&nbsp;identify&nbsp;incoming orders of concern.&nbsp;<\/p>\n\n\n\n<p>Now in that work, we&nbsp;created an AI pipeline from open-source tools that could&nbsp;essentially \u201cparaphrase\u201d the amino acid sequences\u2014reformulating&nbsp;them while&nbsp;working to&nbsp;preserve&nbsp;their structure and potentially their function.&nbsp;<\/p>\n\n\n\n<p>These paraphrased sequences could evade the screening systems used by major DNA&nbsp;synthesis companies, and these are the systems that scientists rely on to safely produce AI-designed proteins.&nbsp;<\/p>\n\n\n\n<p>Now, experts in the field described this finding as the first \u201czero day\u201d for AI and biosecurity.&nbsp;And this&nbsp;marked the beginning of a deep, two-year collaborative effort to investigate and address this challenge.&nbsp;<\/p>\n\n\n\n<p>With the help of a&nbsp;strong&nbsp;cross-sector team\u2014including James, Tessa, Bruce, and many others\u2014we worked behind the scenes to build AI biosecurity&nbsp;<em>red-teaming approaches<\/em>,&nbsp;probe for vulnerabilities, and to design practical fixes. These \u201cpatches,\u201d akin to those in cybersecurity,&nbsp;have now been shared with&nbsp;organizations&nbsp;globally to strengthen biosecurity screening.&nbsp;<\/p>\n\n\n\n<p>This has been one of the most fascinating projects&nbsp;I\u2019ve&nbsp;had the privilege to work on, for its technical complexity, its ethical and policy dimensions, and the remarkable collaboration across industry, government, and nonprofit sectors.&nbsp;<\/p>\n\n\n\n<p>The project highlights that the&nbsp;same AI tools capable of&nbsp;incredible&nbsp;good can also be misused, requiring us to be vigilant, thoughtful, and creative so we continue to get the most benefit out of AI tools while working to ensure&nbsp;that&nbsp;we avoid costly misuses.&nbsp;<\/p>\n\n\n\n<p>With that, let me officially welcome our guests.<s><\/s><\/p>\n\n\n\n<p>Bruce, James, Tessa, welcome to the podcast.<\/p>\n\n\n\n<p><strong>BRUCE WITTMANN: <\/strong>Thanks, Eric.<\/p>\n\n\n\n<p><strong>JAMES DIGGANS: <\/strong>Thanks for having us.<\/p>\n\n\n\n<p><strong>HORVITZ: <\/strong>It&#8217;s been such a pleasure working closely with each of you, not only for your expertise but also for your deep commitment and passion about public health and global safety.<\/p>\n\n\n\n<p>Before we dive into the technical side of things, I&#8217;d like to ask each of you, how did you get into this field? What inspired you to become biologists and then pursue the implications of advances in AI for biosecurity? Bruce?<\/p>\n\n\n\n<p><strong>WITTMANN:<\/strong>&nbsp;Well, I&#8217;ve always liked building things. That&#8217;s where I would say I come from. You know, my hobbies when I&#8217;m not working on biology or AI things\u2014as you know, Eric\u2014is, like, building things around the house, right. Doing construction. That kind of stuff.<\/p>\n\n\n\n<p>But my broader interests have always been biology, chemistry. So I originally got into organic chemistry. I found that was fascinating. From there, went to synthetic biology, particularly metabolic engineering, because that&#8217;s kind of like organic chemistry, but you&#8217;re wiring together different parts of an organism\u2019s metabolism rather than different chemical reactions. And while I was working in that space, I, kind of, had the thought of there&#8217;s got to be an easier way to do this [LAUGHS] because it is really difficult to do any type of metabolic engineering. And that&#8217;s how I got into the AI space, trying to solve these very complicated biological problems, trying to build things that we don&#8217;t necessarily even understand using our understanding from data or <em>deriving<\/em> understanding from data.<\/p>\n\n\n\n<p>So, you know, that&#8217;s the roundabout way of how I got to where I am\u2014the abstract way of how I got to where I am.<\/p>\n\n\n\n<p><strong>HORVITZ: <\/strong>And, Tessa, what motivated you to jump into this area and zoom into biology and biosciences and helping us to avoid <em>catastrophic<\/em> outcomes?<\/p>\n\n\n\n<p><strong>ALEXANIAN:<\/strong> Yeah, I mean, probably the origin of me being really excited about biology is actually a book called <a class=\"msr-external-link glyph-append glyph-append-open-in-new-tab glyph-append-xsmall\" href=\"https:\/\/www.penguinrandomhouse.com\/books\/535043\/the-lives-of-a-cell-by-lewis-thomas\/\" target=\"_blank\" rel=\"noopener noreferrer\"><em>[The] Lives of [a] Cell<\/em><span class=\"sr-only\"> (opens in new tab)<\/span><\/a> by Lewis Thomas, which is an extremely beautiful book of essays that made me be like, <em>Oh, wow, life is just incredible<\/em>. I think I read it when I was, you know, 12 or 13, and I was like, <em>Life is incredible. I want to work on this. This is the most beautiful science<\/em>, right. And then I, in university, I was studying engineering, and I heard there was this engineering team for engineering biology\u2014this <a class=\"msr-external-link glyph-append glyph-append-open-in-new-tab glyph-append-xsmall\" href=\"https:\/\/igem.org\/\" target=\"_blank\" rel=\"noopener noreferrer\">iGEM<span class=\"sr-only\"> (opens in new tab)<\/span><\/a> team\u2014and I joined it, and I thought, <em>Oh, this is so cool. I really got to go work in this field of synthetic biology.<\/em><\/p>\n\n\n\n<p>And then I also tried doing the wet lab biology, and I was like, <em>Oh, but I don&#8217;t like this part<\/em>. <em>I don&#8217;t actually, like, like babysitting microbes.<\/em> [LAUGHTER] I think there&#8217;s a way \u2026 some people who are great wet lab biologists are made of really stern stuff. And they really enjoy figuring out how to redesign their negative controls so they can figure out whether it was contamination or whether it was, you know, temperature fluctuation. I&#8217;m not that, apparently.<\/p>\n\n\n\n<p>And so I ended up becoming a lab automation engineer because I could help the science happen, but I \u2026 but my responsibilities were the robots and the computers rather than the microbes, which I find a little bit intransigent.<\/p>\n\n\n\n<p><strong>HORVITZ: <\/strong>Right. I was thinking of those tough souls; they also used their mouths to do pipetting and so on of these contaminated fluids \u2026<\/p>\n\n\n\n<p><strong>WITTMANN: <\/strong>Not anymore. <strong>ALEXANIAN: <\/strong>It&#8217;s true. [LAUGHTER]<\/p>\n\n\n\n<p><strong>DIGGANS: <\/strong>Not anymore. [LAUGHS]<\/p>\n\n\n\n<p><strong>ALEXANIAN:<\/strong> They used to be tougher. They used to be tougher.<\/p>\n\n\n\n<p><strong>HORVITZ: <\/strong>James.<\/p>\n\n\n\n<p><strong>DIGGANS:<\/strong> So I did my undergrad in computer science and microbiology, mostly because at the time, I couldn&#8217;t pick which of the two I liked more. I liked them both. And by the time I graduated, I was lucky enough that I realized that the intersection of the two could be a thing. And so I did a PhD in computational biology, and then I worked for five years at the MITRE Corporation. It\u2019s a nonprofit. I got the chance to work with the US biodefense community and just found an incredible group of people working to protect forces and the population at large from biological threats and just learned a ton about both biology and also dual-use risk. And then so when Twist called me and asked if I wanted to join Twist and set up their biosecurity program, I leapt at the chance and have done that for the past 10 years.<\/p>\n\n\n\n<p><strong>HORVITZ: <\/strong>Well, thanks everyone.<\/p>\n\n\n\n<p>I believe that AI-powered protein design in particular is one of the most exciting frontiers of modern science. It holds promise for breakthroughs in medicine, public health, even material science. We&#8217;re already seeing it lead to new vaccines, novel therapeutics, and\u2014on the scientific front\u2014powerful insights into the machinery of life.<\/p>\n\n\n\n<p>So there&#8217;s much more ahead, especially in how AI can help us promote wellness, longevity, and the prevention of disease. But before we get too far ahead, while some of our listeners work in bioscience, many may not have a good understanding of some of the foundations.<\/p>\n\n\n\n<p>So, Bruce, can you just give us a high-level overview of proteins? What are they? Why are they important? How do they figure into human-designed applications?<\/p>\n\n\n\n<p><strong>WITTMANN: <\/strong>Sure. Yeah. Fortunately, I used to TA a class on AI for protein design, so it\u2019s right in my wheelhouse. [LAUGHS]<\/p>\n\n\n\n<p><strong>HORVITZ: <\/strong>Perfect, perfect background. [LAUGHS]<\/p>\n\n\n\n<p><strong>WITTMANN:<\/strong>&nbsp;It&#8217;s perfect. Yeah. I got to go back to all of that. Yeah, so from the very basic level, proteins are the workhorses of life.<\/p>\n\n\n\n<p>Every chemical reaction that happens in our body\u2014well, nearly every chemical reaction that happens in our body\u2014most of the structure of our cells, you name it. Any life process, proteins are central to it.<\/p>\n\n\n\n<p>Now proteins are encoded by what are known as \u2026 well, I shouldn&#8217;t say encoded. They are <em>constructed<\/em> from what are called amino acids\u2014there are 20 of them\u2014and depending on the combination and order in which you string these amino acids together, you get a different protein sequence. So that&#8217;s what we mean when we say protein sequence.<\/p>\n\n\n\n<p>The sequence of a protein then determines what shape that protein folds into in a cell, and that shape determines what the protein does. So we will often say sequence determines structure, which determines function.<\/p>\n\n\n\n<p>Now the challenge that we face in engineering proteins is just how many possibilities there are. For all practical purposes, it&#8217;s infinite. So we have 20 building blocks. There are on average around 300 amino acids in a protein. So that&#8217;s 20 to the power of 300 possible combinations. And a common reference point is that it&#8217;s estimated there are around 10 to the 80 particles in the observable universe. So beyond astronomical numbers of possible combinations that we could have, and the job of a protein engineer is to find that one or a few of the proteins within that space that do what we want it to do.<\/p>\n\n\n\n<p>So when a human has an idea of, OK, here&#8217;s what I want a protein to do, we have various techniques of finding that desired protein, one of which is using artificial intelligence and trying to either sift through that milieu of potential proteins or, as we&#8217;ll talk about more in this podcast, physically generating them. So creating them in a way, sampling them out of some distribution of reasonable proteins.<\/p>\n\n\n\n<p><strong>HORVITZ: <\/strong>Great. So I wanted to throw it to James now to talk about how protein design goes from computer to reality\u2014from in silico to test tubes. What role does <a class=\"msr-external-link glyph-append glyph-append-open-in-new-tab glyph-append-xsmall\" href=\"https:\/\/www.twistbioscience.com\/\" target=\"_blank\" rel=\"noopener noreferrer\">Twist Bioscience<span class=\"sr-only\"> (opens in new tab)<\/span><\/a> play in transforming digital protein designs into synthesized proteins? And maybe we can talk also about what safeguards are in place at your company and why do we need them.<\/p>\n\n\n\n<p><strong>DIGGANS: <\/strong>So all of these proteins that Bruce has described are encoded in DNA. So the language that our cells use to kind of store the information about how to make these proteins is all encoded in DNA. And so if you as an engineer have designed a protein and you want to test it to see if it does what you think it does, the first step is to have the DNA that encodes that protein manufactured, and companies like Twist carry out that role.<\/p>\n\n\n\n<p>So we are cognizant also, however, that these are what are called <em>dual-use technologies<\/em>. So you can use DNA and proteins for an incredible variety of amazing applications. So drug development, agricultural improvements, bioindustrial manufacturing, all manner of incredible applications. But you could also potentially use those to cause harm so toxins or other, you know, sort of biological misuse.<\/p>\n\n\n\n<p>And so the industry has since at least 2010 recognized that they have a responsibility to make sure that when we&#8217;re asked to make some sequence of DNA that we understand what that thing is encoding and who we&#8217;re giving it for. So we&#8217;re screening both the customer that&#8217;s coming to us and we&#8217;re screening the sequence that they&#8217;re requesting.<\/p>\n\n\n\n<p>And so Twist has long invested in a very, sort of, complicated system for essentially reverse engineering the constructs that we&#8217;re asked to make so that we understand what they are. And then a system where we engage with our customers and make sure that they&#8217;re going to use those for legitimate purpose and responsibly.<\/p>\n\n\n\n<p><strong>HORVITZ: <\/strong>And how do the emergence of these new generative AI tools influence how you think about risk?<\/p>\n\n\n\n<p><strong>DIGGANS: <\/strong>A lot of the power of these AI tools is they allow us to make proteins or design proteins that have never existed before in nature to carry out functions that don&#8217;t exist in the natural world. That&#8217;s an extremely powerful capability.<\/p>\n\n\n\n<p>But the existing defensive tools that we use at DNA synthesis companies generally rely on what&#8217;s called homology, similarity to known naturally occurring sequences, to determine whether something might pose risk. And so AI tools kind of break the link between those two things.<\/p>\n\n\n\n<p><strong>HORVITZ: <\/strong>Now you also serve as chair of the <a class=\"msr-external-link glyph-append glyph-append-open-in-new-tab glyph-append-xsmall\" href=\"https:\/\/genesynthesisconsortium.org\/\" target=\"_blank\" rel=\"noopener noreferrer\">International Gene Synthesis Consortium<span class=\"sr-only\"> (opens in new tab)<\/span><\/a>. Can you tell us a little bit more about the IGSC, its mission, how it supports global biosecurity?<\/p>\n\n\n\n<p><strong>DIGGANS: <\/strong>Certainly. So the IGSC was founded in 2010<a href=\"#_ftn1\" id=\"_ftnref1\">[1]<\/a> and right now has grown to more than 40 companies and organizations across 10 countries. And the IGSC is essentially a place where companies who might be diehard competitors in the market around nucleic acid synthesis come together and design and develop best practices around biosecurity screening to, kind of, support the shared interest we all have in making sure that these technologies are not subject to misuse.<\/p>\n\n\n\n<p><strong>HORVITZ: <\/strong>Thanks, James. Now, Tessa, your organization, <a class=\"msr-external-link glyph-append glyph-append-open-in-new-tab glyph-append-xsmall\" href=\"https:\/\/ibbis.bio\/\" target=\"_blank\" rel=\"noopener noreferrer\">IBBIS<span class=\"sr-only\"> (opens in new tab)<\/span><\/a> is focused\u2014it&#8217;s a beautiful mission\u2014on advancing science while minimizing <em>catastrophic<\/em> risk, likelihood of <em>catastrophic<\/em> risk. When we say catastrophic risk, what do we really mean, Tessa, in the context of biology and AI? And how is that \u2026 do you view that risk landscape as evolving as AI capabilities are growing?<\/p>\n\n\n\n<p><strong>ALEXANIAN:<\/strong> I think the \u2026 to be honest, as a person who&#8217;s been in biosecurity for a while, I&#8217;ve been surprised by how much of the conversation about the risks from advances in artificial intelligence has centered on the risk of engineered biological weapons and engineered pandemics.<\/p>\n\n\n\n<p>Even recently, there was a new discussion on introducing redlines for AI that came up at the UN General Assembly. And the very first item they list in their list of risks, if I&#8217;m not mistaken, was engineered pandemics, which is exactly the sort of thing that people fear could be done, could be done with these biological AI tools.<\/p>\n\n\n\n<p>Now, I think that when we talk about catastrophic risk, we talk about, you know, something that has an impact on a large percentage of humanity. And I think the reason that we think that biotechnologies pose a catastrophic risk is that we believe there, as we&#8217;ve seen with many historical pandemics, there&#8217;s a possibility for something to emerge or be created that is beyond our society&#8217;s ability to control.<\/p>\n\n\n\n<p>You know, there were a few countries in COVID that managed to more or less successfully do a zero-COVID policy, but that was not, that was not most countries. That was not any of the countries that I lived in. And, you know, we saw millions of people die. And I think we believe that with something like the 1918 influenza, which had a much higher case fatality rate, you could have far more people die.<\/p>\n\n\n\n<p>Now, why we think about this in the context of AI and where this connects to DNA synthesis is that, you know, there is a \u2026 these risks of both, sort of, public health risks, pandemic risks, and misuse risks\u2014people deliberately trying to do harm with biology, as we&#8217;ve seen from the long history of biological weapons programs\u2014you know, we think that those might be accelerated in a few different ways by AI technology, both the potential \u2026 and I say potential here because as everyone who has worked in a wet lab\u2014which I think is everyone on this call\u2014knows, engineering biology is really difficult. So there&#8217;s maybe a potential for it to become easier to develop biological technology for the purposes of doing harm, and there&#8217;s maybe also the potential to create novel threats.<\/p>\n\n\n\n<p>And so I think people talk about both of those, and people have been looking hard for possible safeguards. And I think one safeguard that exists in this biosecurity world that, for example, doesn&#8217;t exist as cleanly in the cybersecurity world is that none of these biological threats can do harm until they are realized in physical reality, until you actually produce the protein or produce the virus or the microorganism that could do harm. And so I think at this point of production, both in DNA synthesis and elsewhere, we have a chance to introduce safeguards that can have a really large impact on the amount of risk that we&#8217;re facing\u2014as long as we develop those safeguards in a way that keeps pace with AI.<\/p>\n\n\n\n<p><strong>HORVITZ: <\/strong>Well, thanks, Tessa. So, Bruce, our project began when I posed a challenge to you of the form: could current open-source AI tools be tasked with rewriting toxic protein sequences in a way that preserves their native structure, and might they evade today&#8217;s screening systems?<\/p>\n\n\n\n<p>And I was preparing for a global workshop on AI and biosecurity that I&#8217;d been organizing with Frances Arnold, David Baker, and Lynda Stuart, and I wanted a concrete case study to challenge attendees. And what we found was interesting and deeply concerning.<\/p>\n\n\n\n<p>So I wanted to dive in with you, Bruce, on the technical side. Can you describe some about the generative pipeline and how it works and what you did to build what we might call an AI and biosecurity red-teaming pipeline for testing and securing biosecurity screening tools?<\/p>\n\n\n\n<p><strong>WITTMANN: <\/strong>Sure. Yeah. I think the best place to start with this is really by analogy.<\/p>\n\n\n\n<p>An analogy I often use in this case is the type of image generation AI tools we&#8217;re all familiar with now where I can tell the AI model, &#8220;Hey, give me a cartoonish picture of a dog playing fetch.&#8221; And it&#8217;ll do that, and it&#8217;ll give us back something that is likely never been seen before, right. That exact image is new, but the theme is still there. The theme is this dog.<\/p>\n\n\n\n<p>And that&#8217;s kind of the same technology that we&#8217;re using in this red-teaming pipeline. Only rather than using plain language, English, we&#8217;re passing in what we would call conditioning information that is relevant to a protein.<\/p>\n\n\n\n<p>So our AI models aren&#8217;t at the point yet where I can say, &#8220;Give me a protein that does <em>x<\/em>.&#8221; That would be the dream. We&#8217;re a long way from that. But what instead we do is we pass in things that match that theme that we&#8217;re interested in. So rather than saying, &#8220;Hey, give me back the theme on a dog,&#8221; we pass in information that we know will cause or at least push this generative model to create a protein that has the characteristics that we want.<\/p>\n\n\n\n<p>So in the case of that example you just mentioned, Eric, it would be the protein structure. Like I mentioned earlier, we usually say structure determines function. There&#8217;s obviously a lot of nuance to that, but we can, at a first approximation, say structure determines function. So if I ask an AI model, \u201dHey, here&#8217;s this structure; give me a protein sequence that folds to this structure,\u201d just like with that analogy with the dog, it&#8217;s going to give me something that matches that structure but that is likely still never been seen before. It&#8217;s going to be a new sequence.<\/p>\n\n\n\n<p>So you can imagine taking this one step further. In the red-teaming pipeline, what we would do is take a protein that should normally be captured by DNA synthesis screening\u2014that <em>would<\/em> be captured by DNA synthesis screening\u2014find its structure, pass it through one of these models, and get variants on the theme of that structure so these new sequences, these synthetic homologs that you mentioned, <em>paraphrased<\/em>, <em>reformulated<\/em>, whatever phrase we want to use to describe them.<\/p>\n\n\n\n<p>And they have a chance or a greater chance than <em>not<\/em> of maintaining the structure and so maintaining the function while being sufficiently different that they&#8217;re not detected by these tools anymore.<\/p>\n\n\n\n<p>So that&#8217;s the nuts and bolts of how the red-teaming pipeline comes together. We use more tools than just structure. I think structure is the easiest one to understand. But we have a suite of tools in there, each pass different conditioning information that causes the model to generate sequences that are paraphrased versions of potential proteins of concern.<s><\/s><\/p>\n\n\n\n<p><strong>HORVITZ: <\/strong>But to get down to brass tacks, what Bruce did for the framing study was \u2026 we took the toxic, well-known toxic protein ricin, as we described in a framing paper that&#8217;s actually part of the appendix now to the <em>Science<\/em> publication, and we generated through this pipeline, composed of open-source tools, thousands of AI-rewritten versions of ricin.<\/p>\n\n\n\n<p>And this brings us to the next step of our project, way back when, at the early \u2026 in the early days of this effort, where Twist Bioscience was one of the companies we approached with what must have seemed like an unusual question to your CEO, in fact, James: would you be open to testing whether current screening systems could detect thousands of AI-rewritten versions of ricin, a well-known toxic protein?<\/p>\n\n\n\n<p>And your CEO quickly connected me with you, James. So, James, what were your first thoughts on hearing about this project, and how did you respond to our initial framing study?<\/p>\n\n\n\n<p><strong>DIGGANS: <\/strong>I think my first response was gratitude and excitement. So it was fantastic that Microsoft had really leaned forward on this set of ideas and had produced this dataset. But to have it, you know, show up on our doorstep in a very concrete way with a partner that was ready to, sort of, help us try and address that, I think was a really \u2026 a valuable opportunity. And so we really leapt at that.<\/p>\n\n\n\n<p><strong>HORVITZ:<\/strong> And the results were that both for you and another company, major producer IDT [Integrated DNA Technologies], those thousands of variants flew through \u2026 flew under the radar of the biosecurity screening software as we covered in that framing paper.<\/p>\n\n\n\n<p>Now, after our initial findings on this, we quietly shared the paper with a few trusted contacts, including some in government. Through my work with the White House Office of Science and Technology Policy, or OSTP, we connected up with biosecurity leads there, and it was an OSTP biosecurity lead who described our results as the first <em>zero day<\/em> in AI and biosecurity. And now in cybersecurity, a zero day is a vulnerability unknown to defenders generally, meaning there&#8217;s no time to respond before it could be exploited should it be known.<\/p>\n\n\n\n<p>In that vein, we took a cybersecurity approach. We stood up a CERT\u2014C-E-R-T\u2014a <em>cybersecurity [computer] emergency response team<\/em> approach used in responding to cybersecurity vulnerabilities, and we implemented this process to address what we saw as a vulnerability with AI-enabled challenges to biosecurity.<\/p>\n\n\n\n<p>At one point down the line, it was so rewarding to hear you say, James, \u201cI&#8217;m really glad Microsoft got here first.\u201d I&#8217;m curious how you think about this kind of AI-enabled vulnerability compared to other ones, biosecurity threats, you&#8217;ve encountered, and I&#8217;d love to hear your perspective on how we handled the situation from the early discovery to the coordination and outreach.<\/p>\n\n\n\n<p><strong>DIGGANS: <\/strong>Yeah, I think in terms of comparison known threats, the challenge here is really there is no good basis on which we can just, sort of, say, <em>Oh, I&#8217;ll build a new tool to detect this concrete universe of things<\/em>, right. This was more a pattern of I&#8217;m going to use tools\u2014and I love the name \u201cParaphrase\u201d; it&#8217;s a fantastic name\u2014I can paraphrase anything that I would normally think of as biological \u2026 as <em>posing<\/em> biological risk, and now that thing is harder to detect for existing tools. And so that really was a very eye-opening experience, and I think the practice of forming this CERT response, putting together a group of people who were well versed not just in the threat landscape but also in the defensive technologies, and then figuring out how to mitigate that risk and broaden that study, I think, was a really incredibly valuable response to the entire synthesis industry.<\/p>\n\n\n\n<p><strong>HORVITZ: <\/strong>Yeah, and, Bruce, can you describe a little bit about the process by which we expanded the effort beyond our initial framing study to more toxins and then to a larger challenge set and then the results that we pursued and achieved?<\/p>\n\n\n\n<p><strong>WITTMANN:<\/strong>&nbsp;Yeah, of course. So, you know, using machine learning lingo, you don&#8217;t want to <em>overfit<\/em> to a single example. So early on with this, as part of the framing study, we were able to show or I should say James and coworkers across the screening field were able to show that this could be patched, right. We needed to just make some changes to the tools,&nbsp;and we could at the very least detect ricin or reformulated versions of ricin.<\/p>\n\n\n\n<p>So the next step of course was then, OK, how generalizable are these patches? Can they detect other reformulated sequences, as well? So we had to expand the set of proteins that we had reformulated. We couldn&#8217;t just do 10s of thousands of ricins. We had to do 10s of thousands of name your other potentially hazardous \u2026<\/p>\n\n\n\n<p><strong>HORVITZ: <\/strong>I think we had 72, was it?<\/p>\n\n\n\n<p><strong>WITTMANN:<\/strong>&nbsp;It was 72 in the end that we ended up at. I believe, James, it was you and maybe Jake, another one of the authors on the list \u2026 on the paper, who primarily put that list together &#8230;<\/p>\n\n\n\n<p><strong>HORVITZ: <\/strong>This is Jacob Beal \u2026 Jacob Beal at Raytheon BBN.<\/p>\n\n\n\n<p><strong>WITTMANN: <\/strong>I think James actually might be the better one to answer how this list was expanded.<\/p>\n\n\n\n<p><strong>DIGGANS:<\/strong>&nbsp;Initially the focus [was] on ricin as a toxin so that list expanded to 62 sort of commonly controlled toxins that are subject to an export control restriction or other concern. And then on top of that, we added 10 viral proteins. So we didn&#8217;t really just want to look at toxins. We also wanted to look at viral proteins, largely because those proteins tend to have multiple functions. They have highly constrained structures. And so if we could work in a toxin context, could Paraphrase also do the same for viral proteins, as well.<\/p>\n\n\n\n<p><strong>HORVITZ: <\/strong>And, Bruce, can you describe some about how we characterize the updates and the, we&#8217;ll say, the boost in capabilities of the patched screening tools?<\/p>\n\n\n\n<p><strong>WITTMANN:<\/strong> So we had, like you said, Eric, 72 base proteins or template proteins. And for each of those, we had generated a few 100 to a couple thousand reformulated variants of them. The only way to really get any sense of validity of those sequences was to predict their structures. So we predicted protein structures for I think it was 70ish thousand protein structures in the end that we had to predict and score them using in silico metrics. So things like, how similar is this to that template, wild-type protein structure that we used as our conditioning information?<\/p>\n\n\n\n<p>We put them on a big grid. So we have two axes. We have on the x-axis\u2014and this is a figure in our paper\u2014the quality of the prediction. It&#8217;s essentially a confidence metric: how realistic is this protein sequence? And on the other axis is, how similar is the predicted structure of this variant to the original? And ultimately, what we were wanting to see was the proteins that scored well in both of those metrics, so that showed up in the top right of that diagram, were caught primarily, because these are again the ones that are <em>most likely<\/em>, having to say <em>most likely<\/em>, to retain function of the original.<\/p>\n\n\n\n<p>So when you compare the original tools\u2014Tool Series A, right, the unpatched tools\u2014what you&#8217;ll find is varying degrees of success in the top right. It varied by tool. But in some cases, barely anything being flagged as potentially hazardous. And so improvement is then in the next series\u2014Series B, the patched version of tools\u2014we have more flagged in that upper-right corner.<\/p>\n\n\n\n<p><strong>HORVITZ: <\/strong>And we felt confident that we had a more AI-resilient screening solution across the companies, and, James, at this point, the whole team decided it was time to disclose the vulnerability as well as the patch details and pointers to where to go for the updated screening software and to communicate this to synthesis companies worldwide via the IGSC. This was probably July, I think, of 2024. What was that process like, and how did members respond?<\/p>\n\n\n\n<p><strong>DIGGANS: <\/strong>I think members were really grateful and excited. To present to that group, to say, hey, this activity (a) has gone on, (b) was successful, and (c) was kept close hold until we knew how to mitigate this, I think everyone was really gratified by that and comforted by the fact that now they had kind of off-the-shelf solutions that they could use to improve their resilience against any incoming heavily engineered protein designs.<\/p>\n\n\n\n<p><strong>HORVITZ: <\/strong>Thanks, James.<\/p>\n\n\n\n<p>Now, I know that we all understand this particular effort to be important but a <em>piece<\/em> of the biosecurity and AI problem. I&#8217;m just curious to \u2026 I\u2019ll ask all three of you to just share some brief reflections.<\/p>\n\n\n\n<p>I know, Bruce, you&#8217;ve been on \u2026 you\u2019ve stayed on this, and we\u2019ve\u2014all of us on the original team\u2014have other projects going on that are pushing on the frontiers ahead of where we were with this paper when we published it.<\/p>\n\n\n\n<p>Let me start with Tessa in terms of, like, what new risks do you see emerging as AI accelerates and maybe couple that with thoughts about how do we proactively get ahead of them.<\/p>\n\n\n\n<p><strong>ALEXANIAN: <\/strong>Yeah, I think with the Paraphrase\u2019s work, as Bruce explained so well, you know, I sometimes use the metaphor of the previous response that the IGSC had to do, the synthesis screening community, where it used to be you could look for similarities to DNA sequences, and then everyone started doing synthetic biology where they were doing codon optimization so that proteins could express more efficiently in different host organisms, and now all of a sudden, well, you&#8217;ve scrambled your DNA sequence and it doesn&#8217;t look very similar even though your protein sequence actually still looks, you know, very similar or often the same once it&#8217;s been translated from DNA to protein, and so that was a, you know, many, many in the industry were already screening both DNA and protein, but they had to start screening \u2026 <em>everybody<\/em> had to start screening protein sequences even just to do the similarity testing as these codon optimization tools became universal.<\/p>\n\n\n\n<p>I feel like we&#8217;re, kind of, in a similar transition phase with protein-design, protein-rephrasing, tools where, you know, these tools are still in many cases drawing from the natural distribution of proteins. You know, I think some of the work we saw in, you know, designing novel CRISPR enzymes, you go, OK, yeah, it is novel; it&#8217;s very unlike any <em>one<\/em> CRISPR enzyme. But if you do a massive multiple sequence alignment of every CRISPR enzyme that we know about, you&#8217;re like, OK, this fits in the distribution of those enzymes. And so, you know, I think we&#8217;re not \u2026 we&#8217;re having to do a more flexible form of screening, where we look for things that are kind of within distribution of natural proteins.<\/p>\n\n\n\n<p>But I feel like broadly, all of the screening tools were able to respond by doing something like that. And I think &#8230; I still feel like the clock is ticking down on that and that as the AI tools get better at predicting function and designing, sort of, novel sequences to pursue a particular function, you know\u2014you have tools now that can go from Gene Ontology terms to a potential structure or potential sequence that may again be much farther out of the distribution of natural protein\u2014I think all of us on the screening side are going to have to be responding to that, as well.<\/p>\n\n\n\n<p>So I think I see this as a necessary ongoing engagement between people at the frontier of designing novel biology and people at the frontier of producing all of the materials that allow that novel biology to be tested in the lab. You know, I think this feels like the first, you know, detailed, comprehensive zero day disclosure and response. But I think that&#8217;s \u2026 I think we&#8217;re going to see more of those. And I think what I&#8217;m excited about doing at IBBIS is trying to encourage and set up more infrastructure so that you can, as an AI developer, disclose these new discoveries to the people who need to respond before the publication comes out.<\/p>\n\n\n\n<p><strong>HORVITZ: <\/strong>Thank you, Tessa.<\/p>\n\n\n\n<p>The, the \u2026 Bruce, I mean, you and I are working on all sorts of dimensions. You&#8217;re leading up some efforts at Microsoft, for example, on the foundation model front and so on, among other directions. We&#8217;ve talked about new kinds of embedding models that might go beyond sequence and structure. Can you talk a little bit about just a few of the directions that just paint the larger constellation of the kinds of things that we talk about when we put our worry hats on?<\/p>\n\n\n\n<p><strong>WITTMANN:<\/strong>&nbsp;I feel like that could have its own dedicated podcast, as well. There&#8217;s a lot \u2026 [LAUGHTER] there&#8217;s a lot to talk about.<\/p>\n\n\n\n<p><strong>HORVITZ: <\/strong>Yeah. We want to make sure that we don&#8217;t tell the world that the whole problem is solved here.<\/p>\n\n\n\n<p><strong>WITTMANN:<\/strong>&nbsp;Right, right, right. I think Tessa said it really, really well in that most of what we&#8217;re doing right now, it&#8217;s a variant on a known theme. I have to know the structure that does something bad to be able to pass it in as context. I have to know some existing sequence that does something bad to pass it in.<\/p>\n\n\n\n<p>And obviously the goal is to move away from that in benign applications, where when I&#8217;m designing something, I often want to design it because nothing exists [LAUGHS] that already does it. So we are going to be heading to this space where we don&#8217;t know what this protein does. It&#8217;s kind of a circular problem, right, where we&#8217;re going to need to be able to predict what some obscure protein sequence does in order to be able to still do our screening.<\/p>\n\n\n\n<p>Now, the way that I think about this, I often think about it beyond just DNA synthesis screening. It&#8217;s one line of defense, and there needs to be many lines of defense that come into play here that go beyond just relying on this one roadblock. It&#8217;s a very powerful roadblock. It&#8217;s a very powerful barrier. But we need to be proactively thinking about how we broaden the scope of defenses. And there are lots of conversations that are ongoing. I won&#8217;t go into the details of them. Again, that would be its own podcast.<\/p>\n\n\n\n<p>But primarily my big push\u2014and I think this is emerging consensus in the field, though I don&#8217;t want to speak for everybody\u2014is it needs to \u2026 any interventions we have need to come more at the systems level and less at the model level, primarily because this is such dual-use technology. If it can be used for good biological design, it can be used for bad biological design. Biology has no sense of morality. There is no bad protein. It&#8217;s just <em>a<\/em> protein.<\/p>\n\n\n\n<p>So we need to think about this differently than how we would maybe think about looking at the outputs of that image generator model that I spoke about earlier, where I can physically look at an image and say, don&#8217;t want my model producing that, do want my model producing that. I don&#8217;t have that luxury in this space. So it&#8217;s a totally different problem. It&#8217;s an evolving problem. Conversations are happening about it, but the work is very much not done.<\/p>\n\n\n\n<p><strong>HORVITZ: <\/strong>And, James, I want to give you the same open question, but I&#8217;d like to apply what Bruce just said on system level and so on and in the spirit of the kind of things that you&#8217;re very much involved with internationally to also add to it, just get some comments on programs and policies that move beyond technical solutions for governance mechanisms\u2014logging, auditing nucleic acid orders, transparency, various kinds\u2014that might complement technical approaches like Paraphrase and their status today.<\/p>\n\n\n\n<p><strong>DIGGANS: <\/strong>Yeah, I&#8217;m very gratified that Bruce said that we, the synthesis industry, should not be the sole bulwark against misuse. That is very comforting and correct.<\/p>\n\n\n\n<p>Yeah, so the US government published a guidance document in 2023 that essentially said you, the entire biotech supply chain, have a responsibility to make sure that you&#8217;re evaluating your customers. You should know your customer; you know that they&#8217;re legitimate. I think that&#8217;s an important practice.<\/p>\n\n\n\n<p>Export controls are designed to minimize the movement of equipment and materials that can be used in support of these kinds of misuse activities. And then governments have really been quite active in trying to incentivize, you know, sort of what we would think of as positive behavior, so screening, for example, in DNA synthesis companies. The US government created a framework in 2024, and it&#8217;s under a rewrite now to basically say US research dollars will only go to companies who make nucleic acid who do these good things. And so that is using, kind of, the government-funding carrot to, kind of, continue to build these layers of defense against potential misuse.<\/p>\n\n\n\n<p><strong>HORVITZ: <\/strong>Thanks. Now, discussing risk, especially when it involves AI and biosecurity, isn&#8217;t always easy. As we&#8217;ve all been suggesting, some worry about alarming the public or arming bad actors. Others advocate for openness as a principle of doing science with integrity.<\/p>\n\n\n\n<p>A phase of our work as we prepared our paper was giving serious thought to both the benefits and the risks of transparency about what it was that we were doing. Some experts encouraged full disclosure as important for enhancing the science of biosecurity. Other experts, <em>all experts<\/em>, cautioned against what are called <em>information hazards<\/em>, the risk of sharing the details to enable malevolent actions with our findings or our approach.<\/p>\n\n\n\n<p>So we faced a real question: how can we support open science while minimizing the risk of misuse? And we took all the input we got, even if it was contradictory, very seriously. We carefully deliberated about a good balance, and even <em>then<\/em>, once we chose our balance and submitted our manuscript to <em>Science<\/em>, the peer reviewers came back and said they wanted some of the more sensitive details that we withheld with explanations as to why.<\/p>\n\n\n\n<p>So this provoked some thinking out of the box about a novel approach, and we came up with a perpetual gatekeeping strategy where requests for access to sensitive methods and data and even the software across different risk categories would be carefully reviewed by a committee and a process for access that would continue in perpetuity.<\/p>\n\n\n\n<p>Now, we brought the proposal to Tessa and her team at IBBIS\u2014this is a great nonprofit group; look at their mission\u2014and we worked with Tessa and her colleagues to refine a workable solution that was accepted by <em>Science<\/em> magazine as a new approach to handling information hazards as first demonstrated by our paper.<\/p>\n\n\n\n<p>So, Tessa, thank you again for helping us to navigate such a complex challenge. Can you share your perspective on information hazards? And then walk us through how our proposed system ensures responsible data and software sharing.<\/p>\n\n\n\n<p><strong>ALEXANIAN: <\/strong>Yeah. And thanks, Eric.<\/p>\n\n\n\n<p>It&#8217;s all of the long discussions we had among the group of people on this podcast and the other authors on the paper and many people we engaged, you know, technical experts, people in various governments, you know, we heard a lot of contradictory advice.<\/p>\n\n\n\n<p>And I think it showed us that there isn&#8217;t a consensus right now on how to handle information hazards in biotechnology. You know, I think \u2026 I don&#8217;t want to overstate how much of a consensus there is in cybersecurity either. If you go to DEF CON, you&#8217;ll hear people about how they&#8217;ve been mistreated in their attempts to do responsible disclosure for pacemakers and whatnot. But I think we&#8217;re \u2026 we have even less of a consensus when it comes to handling biological information.<\/p>\n\n\n\n<p>You know, you have some people who say, oh, because the size of the consequences could be so catastrophic if someone, you know, releases an engineered flu or something, you know, we should just never share information about this. And then you have other people who say there&#8217;s no possibility of building defenses unless we share information about this. And we heard very strong voices with both of those perspectives in the process of conducting this study.<\/p>\n\n\n\n<p>And I think what we landed on that I&#8217;m really excited about and really excited to get feedback on now that the paper is out, you know, if you go and compare our preprint, which came out in December of 2024, and this paper in October 2025, you&#8217;ll see a lot of information got added back in.<\/p>\n\n\n\n<p>And I&#8217;m excited to see people&#8217;s reaction to that because even back in January 2025, talking with people who were signatories to the responsible biodesign commitments, they were really excited that this was such an empirically concrete paper because they&#8217;d maybe read a number of papers talking about biosecurity risks from AI that didn&#8217;t include a whole lot of data, you know, often, I think, because of concerns about information hazards. And they found the arguments in this paper are much more convincing because we are able to share data.<\/p>\n\n\n\n<p>So the process we underwent that I felt good about was trying to really clearly articulate, when we talk about an information hazard, what are we worried about being done with this data? And if we put this data in public, completely open source, does it shift the risk at all? You know, I think doing that kind of marginal contribution comparison is really important because it also let us make more things available publicly.<\/p>\n\n\n\n<p>But there were a few tiers of data that after a lot of discussion amongst the authors of the paper, we thought, OK, potentially someone who wanted to do harm, if they got access to this data, it might make it easier for them. Again, not necessarily saying it, you know, it opens the floodgates, but it might make it easier for them. And when we thought about that, we thought, OK, you know, giving all of those paraphrased protein sequences, maybe, maybe that, you know, compared to having to set up the whole pipeline with the open-source tools yourself, just giving you those protein sequences, maybe that makes your life a bit easier if you&#8217;re trying to do harm.<\/p>\n\n\n\n<p>And then we thought, OK, giving you those protein sequences plus whether or not they were successfully flagged, maybe that makes your life, you know, quite a bit easier. And then finally, we thought, OK, the code that we want to share with some people who might try to reproduce these results or might try to build new screening systems that are more robust, we want to share the code with them. But again, if you have that whole code pipeline just prepared for you, it might really help make your life easier if you&#8217;re trying to do harm.<\/p>\n\n\n\n<p>And so we, sort of, sorted the data into these three tiers and then went through a process actually very inspired by the existing customer screening processes in nucleic acid synthesis about how to determine, you know, we tried to take an approach not of what gets you in but what gets you out. You know, for the most part, we think it should be possible to access this data.<\/p>\n\n\n\n<p>You know, if you have an affiliation with a recognizable institution or some good explanation of why you don&#8217;t have one right now, you know, if you have a reason for accessing this data, it shouldn&#8217;t be too hard to meet those requirements, but we wanted to have some in place. And we wanted it to be possible to rule out some people from getting access to this data. And so we&#8217;ve tried to be extremely transparent about what those are. If you go through our data access process and for some reason you get rejected, you&#8217;ll get a list of, &#8220;Here&#8217;s the reasons we rejected you. If you don&#8217;t think that&#8217;s right, get back to us.&#8221;<\/p>\n\n\n\n<p>So I&#8217;m really excited to pilot this in part because I think, you know, we&#8217;re already in conversations with some other people handling potential bio-AI information hazard about doing a similar process for their data of, you know, tiering it, determining which gates to put in which tiers, but I really hope a number of people do get access through the process or if they try and they fail, they tell us why. Because I think as we move toward this world of potentially, you know, biology that is much easier to engineer, partly due to dual-use tools, you know, my dream is it&#8217;s, like, still hard to engineer harm with biology, even if it&#8217;s really easy to engineer biology. And I think these, kind of, new processes for managing access to things, this sort of like, you know, open but not completely public, I think those can be a big part of that layered defense.<\/p>\n\n\n\n<p><strong>HORVITZ: <\/strong>Thanks, Tessa. So we&#8217;re getting close to closing, and I just thought I would ask each of you to just share some reflections on what we&#8217;ve learned, the process we&#8217;ve demonstrated, the tools, the policy work that we did, this idea of facing the dual-use dilemma with \u2026 even at the information hazard level, with sharing information versus withholding it. What do you think about how our whole end to end of the study, now reaching the two-year point, can help other fields facing dual-use dilemmas?<\/p>\n\n\n\n<p>Tessa, Bruce, James \u2026 James, have you ever thought about that? And we&#8217;ll go to Bruce and then Tessa.<\/p>\n\n\n\n<p><strong>DIGGANS:<\/strong>&nbsp;Yeah, I think it was an excellent model. I would like to see a study like this repeated on a schedule, you know, every six months because from where I sit, you know, the tools that we used for this project are now two years old. And so capabilities have moved on. Is the picture the same in terms of defensive capability? And so using that model over time, I think, would be incredibly valuable. And then using the findings to chart, you know, how much should we be investing in alternative strategies for this kind of risk mitigation for AI tool \u2026 the <em>products<\/em> of AI tools?<\/p>\n\n\n\n<p><strong>HORVITZ: <\/strong>Bruce.<\/p>\n\n\n\n<p><strong>WITTMANN:<\/strong>&nbsp;Yeah, I think I would extend on what James said. The anecdote I like to point out about this project is, kind of, our schedule. We found the vulnerability and it was patched within a week, two weeks, on all major synthesis screening platforms. We wrote the paper within a month. We expanded on the paper within two months, and then we spent a year and a half to nearly two years [LAUGHS] trying to figure out what goes into the paper; how do we release this information; you know, how do we do this responsibly?<\/p>\n\n\n\n<p>And my hope is similar to what James said. We&#8217;ve made it easier for others to do this type of work. Not this exact work; it doesn&#8217;t have to necessarily do with proteins. But to do this type of work where you are dealing with potential hazards but there is also value in sharing and that hopefully that year and a half we spent figuring out how to appropriately share and what to share will not be a year and a half for other teams because these systems are in place or at least there is an example to follow up from. So that&#8217;s my takeaway.<\/p>\n\n\n\n<p><strong>HORVITZ:<\/strong> Tessa, bring us home\u2014<em>bring us home!<\/em> [LAUGHS]<\/p>\n\n\n\n<p><strong>ALEXANIAN: <\/strong><em>Bring us home!<\/em> Let&#8217;s do it faster next time. [LAUGHTER] Come talk to any of us if you&#8217;re dealing with this kind of stuff. You know, I think IBBIS, especially, we want to be a partner for building those layers of defense and, you know, having ripped out our hair as a collective over the past year and a half about the right process to follow here, I think we all really hope it&#8217;ll be faster next time.<\/p>\n\n\n\n<p>And I think, you know, the other thing I would encourage is if you&#8217;re an AI developer, I would encourage you to think about how your tool can strengthen screening and strengthen recognition of threats.<\/p>\n\n\n\n<p>I know James and I have talked before about how, you know, our Google search alerts each week send us dozens of cool AI bio papers, and it&#8217;s more like once a year or maybe once every six months, if we&#8217;re lucky, that we get something that&#8217;s like applying AI bio to biosecurity. So, you know, if you&#8217;re interested in these threats, I think we&#8217;d love to see more work that&#8217;s directly applied to facing these threats using the most modern technology.<\/p>\n\n\n\n<p><strong>HORVITZ: <\/strong>Well said.<\/p>\n\n\n\n<p>Well, Bruce, James, Tessa, thank you so much for joining me today and for representing the many collaborators, both coauthors and beyond, who made this project possible.<\/p>\n\n\n\n<p>It&#8217;s been a true pleasure to work with you. I&#8217;m so excited about what we&#8217;ve accomplished, the processes and the models that we&#8217;re now sharing with the world. And I&#8217;m deeply grateful for the collective intelligence and dedication that really powered the effort from the very beginning. So thanks again.<\/p>\n\n\n\n<p>[MUSIC]<\/p>\n\n\n\n<p><strong>WITTMANN: <\/strong>Thanks, Eric.<\/p>\n\n\n\n<p><strong>DIGGANS: <\/strong>Thank you.<\/p>\n\n\n\n<p><strong>ALEXANIAN: <\/strong>Thank you.<\/p>\n\n\n\n<p>[MUSIC FADES]<\/p>\n\n\t\t\t\t<\/span>\n\t\t\t<\/div>\n\t\t\t<button\n\t\t\t\tclass=\"action-trigger glyph-prepend mt-2 mb-0 show-more-show-less-toggle\"\n\t\t\t\taria-expanded=\"false\"\n\t\t\t\tdata-show-less-text=\"Show less\"\n\t\t\t\ttype=\"button\"\n\t\t\t\taria-controls=\"show-more-show-less-toggle-1\"\n\t\t\t\taria-label=\"Show more content\"\n\t\t\t\tdata-alternate-aria-label=\"Show less content\">\n\t\t\t\tShow more\t\t\t<\/button>\n\t\t<\/div>\n\t<\/div>\n<\/div>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p><a href=\"#_ftnref1\" id=\"_ftn1\">[1]<\/a> The original organization was founded in 2009 and became the International Gene Synthesis Consortium in 2010.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Microsoft\u2019s Eric Horvitz and guests Bruce Wittmann, Tessa Alexanian, and James Diggans discuss the Paraphrase Project\u2014a red-teaming effort that exposed and secured a biosecurity vulnerability in AI-driven protein design. The work offers a model for addressing AI\u2019s dual-use risks.<\/p>\n","protected":false},"author":43518,"featured_media":1151087,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"msr-url-field":"https:\/\/player.blubrry.com\/id\/148928066","msr-podcast-episode":"","msrModifiedDate":"","msrModifiedDateEnabled":false,"ep_exclude_from_search":false,"_classifai_error":"","msr-author-ordering":null,"msr_hide_image_in_river":null,"footnotes":""},"categories":[240054],"tags":[],"research-area":[13556],"msr-region":[],"msr-event-type":[],"msr-locale":[268875],"msr-post-option":[269148,269142,243990],"msr-impact-theme":[],"msr-promo-type":[],"msr-podcast-series":[268557],"class_list":["post-1151021","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-msr-podcast","msr-research-area-artificial-intelligence","msr-locale-en_us","msr-post-option-approved-for-river","msr-post-option-include-in-river","msr-post-option-podcast-featured","msr-podcast-series-ideas"],"msr_event_details":{"start":"","end":"","location":""},"podcast_url":"https:\/\/player.blubrry.com\/id\/148928066","podcast_episode":"","msr_research_lab":[],"msr_impact_theme":[],"related-publications":[],"related-downloads":[],"related-videos":[],"related-academic-programs":[],"related-groups":[],"related-projects":[1151019],"related-events":[],"related-researchers":[{"type":"user_nicename","value":"Eric Horvitz","user_id":32033,"display_name":"Eric Horvitz","author_link":"<a href=\"https:\/\/www.microsoft.com\/en-us\/research\/people\/horvitz\/\" aria-label=\"Visit the profile page for Eric Horvitz\">Eric Horvitz<\/a>","is_active":false,"last_first":"Horvitz, Eric","people_section":0,"alias":"horvitz"},{"type":"user_nicename","value":"Bruce Wittmann","user_id":43991,"display_name":"Bruce Wittmann","author_link":"<a href=\"https:\/\/www.microsoft.com\/en-us\/research\/people\/bwittmann\/\" aria-label=\"Visit the profile page for Bruce Wittmann\">Bruce Wittmann<\/a>","is_active":false,"last_first":"Wittmann, Bruce","people_section":0,"alias":"bwittmann"},{"type":"guest","value":"tessa-alexanian","user_id":"1151028","display_name":"Tessa Alexanian","author_link":"<a href=\"https:\/\/ibbis.bio\/people\/tessa-alexanian\/\" aria-label=\"Visit the profile page for Tessa Alexanian\">Tessa Alexanian<\/a>","is_active":true,"last_first":"Alexanian, Tessa","people_section":0,"alias":"tessa-alexanian"},{"type":"guest","value":"james-diggans","user_id":"1151030","display_name":"James Diggans","author_link":"<a href=\"https:\/\/www.linkedin.com\/in\/jdiggans\/\" aria-label=\"Visit the profile page for James Diggans\">James Diggans<\/a>","is_active":true,"last_first":"Diggans, James","people_section":0,"alias":"james-diggans"}],"msr_type":"Post","featured_image_thumbnail":"<img width=\"960\" height=\"540\" src=\"https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2025\/10\/EricBruceTessaJames-Ideas_Hero_Feature_River_No_Text_1400x788-960x540.jpg\" class=\"img-object-cover\" alt=\"Illustrated headshots (from left to right): Eric Horvitz, Bruce Wittmann, Tessa Alexanian, and James Diggans.\" decoding=\"async\" loading=\"lazy\" srcset=\"https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2025\/10\/EricBruceTessaJames-Ideas_Hero_Feature_River_No_Text_1400x788-960x540.jpg 960w, https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2025\/10\/EricBruceTessaJames-Ideas_Hero_Feature_River_No_Text_1400x788-300x169.jpg 300w, https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2025\/10\/EricBruceTessaJames-Ideas_Hero_Feature_River_No_Text_1400x788-1024x576.jpg 1024w, https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2025\/10\/EricBruceTessaJames-Ideas_Hero_Feature_River_No_Text_1400x788-768x432.jpg 768w, https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2025\/10\/EricBruceTessaJames-Ideas_Hero_Feature_River_No_Text_1400x788-1066x600.jpg 1066w, https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2025\/10\/EricBruceTessaJames-Ideas_Hero_Feature_River_No_Text_1400x788-655x368.jpg 655w, https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2025\/10\/EricBruceTessaJames-Ideas_Hero_Feature_River_No_Text_1400x788-240x135.jpg 240w, https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2025\/10\/EricBruceTessaJames-Ideas_Hero_Feature_River_No_Text_1400x788-640x360.jpg 640w, https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2025\/10\/EricBruceTessaJames-Ideas_Hero_Feature_River_No_Text_1400x788-1280x720.jpg 1280w, https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2025\/10\/EricBruceTessaJames-Ideas_Hero_Feature_River_No_Text_1400x788.jpg 1400w\" sizes=\"auto, (max-width: 960px) 100vw, 960px\" \/>","byline":"<a href=\"https:\/\/www.microsoft.com\/en-us\/research\/people\/horvitz\/\" title=\"Go to researcher profile for Eric Horvitz\" aria-label=\"Go to researcher profile for Eric Horvitz\" data-bi-type=\"byline author\" data-bi-cN=\"Eric Horvitz\">Eric Horvitz<\/a>, <a href=\"https:\/\/www.microsoft.com\/en-us\/research\/people\/bwittmann\/\" title=\"Go to researcher profile for Bruce Wittmann\" aria-label=\"Go to researcher profile for Bruce Wittmann\" data-bi-type=\"byline author\" data-bi-cN=\"Bruce Wittmann\">Bruce Wittmann<\/a>, <a href=\"https:\/\/ibbis.bio\/people\/tessa-alexanian\/\" title=\"Go to researcher profile for Tessa Alexanian\" aria-label=\"Go to researcher profile for Tessa Alexanian\" data-bi-type=\"byline author\" data-bi-cN=\"Tessa Alexanian\">Tessa Alexanian<\/a>, and <a href=\"https:\/\/www.linkedin.com\/in\/jdiggans\/\" title=\"Go to researcher profile for James Diggans\" aria-label=\"Go to researcher profile for James Diggans\" data-bi-type=\"byline author\" data-bi-cN=\"James Diggans\">James Diggans<\/a>","formattedDate":"October 6, 2025","formattedExcerpt":"Microsoft\u2019s Eric Horvitz and guests Bruce Wittmann, Tessa Alexanian, and James Diggans discuss the Paraphrase Project\u2014a red-teaming effort that exposed and secured a biosecurity vulnerability in AI-driven protein design. The work offers a model for addressing AI\u2019s dual-use risks.","locale":{"slug":"en_us","name":"English","native":"","english":"English"},"_links":{"self":[{"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/posts\/1151021","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/users\/43518"}],"replies":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/comments?post=1151021"}],"version-history":[{"count":55,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/posts\/1151021\/revisions"}],"predecessor-version":[{"id":1151305,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/posts\/1151021\/revisions\/1151305"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/media\/1151087"}],"wp:attachment":[{"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/media?parent=1151021"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/categories?post=1151021"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/tags?post=1151021"},{"taxonomy":"msr-research-area","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/research-area?post=1151021"},{"taxonomy":"msr-region","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/msr-region?post=1151021"},{"taxonomy":"msr-event-type","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/msr-event-type?post=1151021"},{"taxonomy":"msr-locale","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/msr-locale?post=1151021"},{"taxonomy":"msr-post-option","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/msr-post-option?post=1151021"},{"taxonomy":"msr-impact-theme","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/msr-impact-theme?post=1151021"},{"taxonomy":"msr-promo-type","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/msr-promo-type?post=1151021"},{"taxonomy":"msr-podcast-series","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/msr-podcast-series?post=1151021"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}