Paper review · October 21, 2026
The effect and persistence of pretraining data filtering in protein language models
The Effectiveness and Durability of Pretraining Data Filtering in Protein Language Models
When ESM-2 family models were trained on data with viral proteins removed, only the corresponding capability declined selectively, but performance was restored with fine-tuning worth about $80 of GPU time.
Problem
Models that release their weights can have safeguards easily undone by fine-tuning even when safeguards are attached. Among these, "data filtering"—removing dangerous data entirely at the pretraining stage—is known as the hardest approach to reverse. But research so far has focused on general-purpose LLMs and has not been validated on biology-specific models such as protein language models. Such models are usually released as open weights and are small enough to be easy to modify, and if misused they could be applied to designing dangerous pathogens.
Method
Five model sizes from 8M to 3B were pretrained with the ESM-2 architecture. The exclusion scope was divided into tiers, narrowing from tier 0, which removes all viral proteins and their homologs, to tier 1, all viruses, tier 2, eukaryote-infecting viruses, and tier 3, human-infecting viruses. UniRef50 2021_04 representative sequences were used, and all conditions were trained identically for 150,000 steps, about 315B tokens. Evaluation covered three things: masked language modeling loss, ProteinGym and EVEREST mutation effect prediction (Spearman correlation), and long-range contact prediction (linear probe). The models were then fine-tuned on the removed sequences, with scores re-measured every 500 steps, and the compute at the point of reaching the level of the unfiltered models was converted into exaFLOPs and H100 cost.
Results
- Filtering lowered only viral protein performance and preserved non-viral performance. The non-viral change was ±0.008 nats, statistically equivalent to zero within a ±0.02 nats margin (TOST, p<3e-12, n=3,000).
- The larger the model, the greater the effect of filtering. In mutation effect prediction, scaling from 8M to 3B raised the viral Spearman by +0.196 for the unfiltered model but only +0.071 for the tier-1 filtered model. For non-viral, the figures were nearly the same at +0.232 versus +0.231.
- The effect was concentrated in human-infecting viruses, especially Retroviridae. In the 3B tier-1 model, Retroviridae accounted for about 77.5% of the overall language modeling degradation, and in mutation effect prediction it was the only family with a clear decline (-0.342, n=6, 95% CI [-0.481,-0.203]).
- Fine-tuning on the removed sequences fully restored performance. The most expensive case, 3B language modeling recovery, took 14-24 exaFLOPs, which is 12-20 hours on an H100, or $47-79 at $4 per hour.
- In long-range contact prediction as well, tier-1 filtering lowered viral performance for models above 35M (-1.58, -1.70 and -2.80%p at 150M/650M/3B respectively), while 650M and 3B actually showed slight gains in non-viral performance (+0.73, +0.60%p).
Limitations
The recovery experiments rest on the premise that an attacker can obtain the removed viral sequences. Actual accessibility may differ. Recovery cost was measured only at 500-step intervals and reported as a range, and the range is wide for 3B because it has only four checkpoints. The evaluations are proxy metrics—language modeling, mutation effect and contact prediction—and the distance from actual pathogen design risk was not measured directly. Tiers 2 and 3 were not trained at 3B. The cost conversion also depends on assumptions of 34% MFU and $4 per hour.
Why it matters
This is a rare study that quantitatively evaluates safeguards on open-weight biology models. The conclusion that data filtering "works selectively but is not permanent" feeds directly into governance discussions, in that the effect of filtering grows as models get larger while the recovery cost remains at the level of tens of dollars. It provides grounds for arguing against the current practice (Evo 2, ESM3-open) of treating pre-release filtering as sufficient on its own.
Key terms
- Protein language model (pLM)
- A model trained by treating amino acid sequences like text. ESM-2 is an encoder model trained with a masking approach that hides some amino acids and predicts them.
- Pretraining data filtering
- A safeguard that removes potentially dangerous data entirely before training so that the capability never forms. It is known to be harder to reverse than approaches that erase the capability after training.
- Tamper-resistance
- How large the cost is of removing a safeguard. If the cost is small, the safeguard has little meaning for an openly released model.
- Forget / Retain domains
- Forget is the target whose performance is meant to be degraded (here, viral proteins), and Retain is the remaining area whose performance must be preserved. Good filtering degrades only Forget.
Original
Authors: Aaron Maiwald, Roderick McNeill, Jaeyoung Lee, Matthew A. Clarke, Lennart Justen, Alejandro Acelas, Ivo Andrews, Giles Harper-Donnelly, et al. · Posted 2026-10-19 · License CC BY 4.0 · Based on the full text
This review is an AI-written summary of the paper. Please treat the original paper as the reference.