Can LLMs identify harmful biology requests?
Nearly every biologist I know has had a legitimate research question rejected by an AI model over safety concerns. None of these scientists was doing anything risky.
As frontier models become more capable, AI labs are investing heavily in safeguards against biological threats. The goal is to stop misuse without restricting legitimate research, but how well are they succeeding?
We built BenchBench-Refusals, a benchmark to evaluate how well frontier models distinguish between harmful and benign biology requests. It’s grounded in the questions scientists ask Benchling AI in their everyday work.
See here for the full results. We find striking differences across model providers. OpenAI’s safeguards distinguish requests reliably. Anthropic’s are reliable if you enroll in their Life Sciences Verification Program but otherwise refuse many routine requests. Open-weight models rarely refuse any requests including harmful ones. Better models are not necessarily better calibrated. Even highly capable models fall short for scientists if their safeguards are too restrictive.
Testing refusals on everyday biology tasks
We tested 160 prompts across many common biology tasks. The prompts were divided into three buckets according to risk level, including (benign, pseudo-hazardous, and hazardous):
Benign tasks are routine lab work with no hazardous framing: identifying a start codon, resolving a Sanger read, or deciding where to place a His-tag.
Pseudo-hazardous tasks are equally routine, but the prompt names a pathogen, agent, or technique that could be harmful in some contexts but not in this one.
Hazardous tasks should always be refused, focusing on gain-of-function engineering to push pathogens towards greater transmissibility, immune evasion, or host adaptation.
Because models may refuse in different ways, for example explicit refusal notices, a refusal in the output, and a vague or simplified response, we scored in two ways. We detect both hard refusals (provider returns an error) and utilize LLM-as-a-judge to assess whether a response contains a written refusal within it.
Our score measures correct refusal across all tasks (Macro-F1) and multiple attempts. Higher scores indicate models that are better at refusing dangerous tasks while also answering safe requests.
Different models, different safeguards
Different model providers have very different approaches. The OpenAI models we tested refuse at roughly the same rates, regardless of model size. Anthropic’s Fable 5.1 and Opus 5.5 refuse many routine requests, though enabling its Life Sciences Verification Program makes their safeguards much more selective. Sonnet 5.5 has much looser restrictions even without verification. Gemini and Grok are in the middle. Open-weight models rarely refuse biology requests, including potentially hazardous ones.
We find no correlation between model capabilities and refusal rates. Astra tops one of our recent benchmarks on molecular biology, but has a refusal rate on par with models that perform much worse on biology. This pattern persists across all of the different categories of prompts that we tried.
Capability is only part of what makes an AI model useful to scientists. The ability to distinguish legitimate research from genuinely harmful requests matters just as much, and our results show that for many models, there's still a lot of room to improve.
