It’s time we took ‘Chem’ out of ‘Chem-Bio’ threats

TL;DR: AI evaluations need a distinct chemistry capability/ risk domain, rather than assuming chemistry is adequately represented by biological evaluations which the current ecosystem seems to be doing. I’ve previously written about my experience doing the BlueDot biosecurity course. I thought it was a great course and genuinely learnt a lot from the reading and discussions with my peers. However, there’s an overarching theme that keeps coming up whenever I mention that I’m interested in evals for CHEMICAL safety and security*: people automatically assume I mean evals for BIO safety and security. And I can see why. Chemistry and biology have many branches in common and are arguably two of the most closely intertwined domains in the life sciences, particularly given how heavily both rely on experimental and wet lab work. Chem-bio security is therefore a useful umbrella term, and I’m not arguing that we should throw that away. But there seems to be an unwritten assumption that work on biosecurity (and consequently on biological capabilities AI evaluations) naturally covers chemical security too. Given the advances in AI capabilities and the distinct failure modes that can emerge in chemistry, I do think it’s time we started treating chemical security as a distinct security domain in its own right. Otherwise, I worry that some very chemistry-specific problems will simply get lost in the world of “bio”. Some context for my opinion: I’ve been reading about this topic for the past couple of months and have been speaking to people working in evals and biosecurity almost every day. I’m also coming at this from a slightly untraditional perspective: I’ve worked on LLMs and ML for chemistry, evals, and recently completed a PhD in chemistry that was highly interdisciplinary and involved working across both wet lab and computational science. So most of what follows is coming from the perspective of someone with a chemistry background who has spent quite a bit of time interacting with experimentalists and, more recently, the AI safety community. I’m very much open to hearing from people in the AI4Bio community who might see this differently. *Before going any further, I’d also like to quickly distinguish between safety and security. Broadly speaking, safety looks at preventing unintended harm, whereas security concerns preventing deliberate misuse or malicious access. The two obviously overlap, but I think the distinction is useful for what follows. Chemistry and Biology are fundamentally similar Capabilities structure and blurry boundary Both biology and chemistry are foundational life sciences. Traditionally, they have also been highly experimental fields, with many overlapping techniques and methods, including -but not limited to - synthesis, microscopy, mass spectrometry, and analytical preparation. (Of course, this overlap extends beyond experimental techniques: there are many emerging fields where a holistic understanding requires skills from both chemistry and biology). I won’t spend much time here trying to define modern chemistry and biology. It becomes non-trivial - and frankly useless - to draw a precise line between where biology stops and chemistry begins, especially given the current advancements in science in general. At the same time, both encompass multiple subfields, some of which have very little overlap. But at a high level, both rely heavily on experimentation and routinely borrow methods and concepts from one another. Given their complexity, we also still lack a complete theoretical description of many aspects in both fields. We are nowhere near being able to perfectly and precisely simulate many of the systems we care about, from whole cells to atoms (or at least not without a quantum computer, in the case of the latter), and both disciplines rely heavily on approximations and models. Chemical and biological application spaces, and consequently threats, overlap heavily too. Toxins, pharmaceuticals, agrochemicals, and chemical biology all sit somewhere on the boundary between the two, and it can be surprisingly difficult to define where one domain ends and the other begins. (Some) challenges for AI capability evaluation These similarities carry over into AI4Science. A lot of current work focuses on how LLMs behave when prompted to provide dangerous information. Many of the relevant metrics and pieces of knowledge - for example toxicology information, volatility, or COSHH information for risk assessments - already exist in structured databases. At this level, the underlying information-retrieval problem can look remarkably similar across chemistry and biology. Beyond text-to-text workflows, there are also efforts such as LifeSciBench (I love this work btw - go check it out) that evaluate how agents perform research tasks, rather than directly testing dangerous capabilities. There is an extensive critique of this kind of work, particularly around the difficulty of capturing so-called tacit knowle