3
Potential Solutions and Considerations for Implementation

On the workshop’s second day, participants built upon the challenges, lessons, and opportunities that were identified through examples and conceptual discussions, and delved deeper into the potential strategies for risk assessment and oversight highlighted during the first day. Vinson noted that a recurring theme was the need to preserve the strengths and benefits of in silico, computational, and AI-enabled research in biosciences. At the same time, some participants recognized that in silico research can pose some biosecurity risks and examined key gaps in determining who is responsible for mitigating various risks and how best to do so.

London captured the desire to balance multiple objectives in a figure overlaying the spectrum of research in terms of magnitude of concern and the obligations for responsible management and mitigation (see Figure 7). Based on the discussions and examples shared during the workshop, most in silico research in biology likely falls at the lower end of the spectrum in terms of biosecurity concerns related to dual-use potential, where interest in obligations for responsible management and mitigation is low. On the other end of the spectrum, London shared that although “all in silico research might have some dual-use potential,” only a small portion of in silico research poses clear DURC or PEPP concerns, which would provoke a much higher interest in obligations for responsible management and mitigation. Categories of research that fall toward the more concerning end, but are not necessarily within the bounds of the current definitions of DURC or PEPP, may benefit from further clarification of the risks posed and the management obligations entailed. The discussions about potential solutions and considerations for implementation sought to elucidate opportunities and potential pitfalls for efforts to address the full spectrum of biosecurity risks associated with dissemination of in silico research in biological systems, but perhaps most especially the subset of DURC and research involving PEPP, he said.

OPTIONS FOR FACILITATING RESPONSIBLE DISSEMINATION

Sarah Carter, Science Policy Consulting LLC, moderated a session focused on exploring strategies, best practices, policy options, and norms for safeguarding research benefits while mitigating dissemination risks. Panelists first offered brief opening remarks to frame the conversation and their own perspectives. Representatives from each of the breakout groups from the previous day then reiterated some of the key suggestions discussed during the breakouts, and panelists expanded on those suggestions in an interactive format.

Opening Remarks

Jim Brase, Lawrence Livermore National Laboratory (LLNL), described how LLNL has approached processes for safety, security, and DURC and PEPP reviews in its work. LLNL brings together in silico methods with experimental systems to advance government early warning and biodefense capabilities in areas such as biomaterials, biomanufacturing, and countermeasure development. For example, the Generative Unconstrained Intelligent Drug Engineering project uses computational design to create monoclonal antibodies for war-fighter-support applications. Brase shared that safety and security are central to this work, with existing review processes—such as for DURC and PEPP—now being extended to computational research. Because most projects blend experimental and computational work, daily decisions about data and model release involve multiple partners, such as other agencies, industry, and academia. However, “we definitely do not have the tools that we need or the policies that we need in place to make those decisions […in] systematic and consistent and defend-able ways,” he said.

Jennifer Gibson, Dryad, discussed how Dryad approaches its work as a repository for research data from across disciplines. She said that open science is central to Dryad’s model, which aims to facilitate and encourage data reuse to accelerate the pace of research. She noted that Dryad is the only generalist repository that reviews the research and data it publishes. Human curators check every submission for sensitive or private data (and other important components), ensure inclusion of appropriate metadata, and help researchers understand what should and should not be released openly. If Dryad opts not to publish a submission, its staff refers authors to repositories with more controlled access. “We’re optimistic that, as a result of this process of labeling the data and opening the data, that the Dryad corpus is an important input for developing LLMs and using AI responsibly to support sound research,” Gibson stated.

Michael Imperiale, University of Michigan, described how the American Society for Microbiology (ASM) created a Responsible Publications Committee after the H5N1 publications controversy¹ to flag papers with DURC for extra reviews and in-depth discussions by a diverse group of experts. Although no papers have been rejected because of biosafety or biosecurity concerns to date, ASM has requested that authors make changes to their manuscripts. Imperiale also noted that, as an inaugural member of the NSABB, he was involved in the discussions about publishing the controversial H5N1 research and noted that the initial recommendation—that mutational information be withheld from publication—was not heeded by the journals, authors, or the National Institutes of Health. Broadly speaking, Imperiale posited that decisions about research dissemination and biosecurity need to be made much farther upstream in the process, rather than at the publication stage. He suggested that researchers receive more training to recognize security concerns before they begin their research and to fully appreciate the core concerns. He added that this training could also help to avoid situations in which researchers attempt to circumvent restrictive journal policies by trying other journals until they find one that is willing to publish the work. “I think the problem here is that the publication stage is way too late in the process in order to be able to try to put a stop on this,” he said. “Most of the people who are doing this kind of review don’t know, really, what the concerns are.”

Girish Patangay, Chan Zuckerberg Initiative (CZI), said that CZI sees AI as critical to achieving its goal of curing or managing all diseases by the end of the century. The initiative builds, funds, and hosts different AI models to accelerate research, such as a virtual cell model that can predict the behavior of healthy or diseased cells. Although CZI has sought to address potential biosecurity risks, Patangay said that finding the right resources to guide dissemination decisions has been difficult: “We’re new to this space, so we’re trying to figure out how […] should we think about biological risks? How should we think about the risk in these biological models?” With the help of external experts, Patangay said that CZI opted to build a risk management framework applicable across all biological foundation models to mitigate risks at all levels while accelerating research and enabling access. He added that CZI is improving awareness of biosecurity concerns among the broader community and creating tools to uncover or address them.

Richard Sever, Cold Spring Harbor Laboratory Press, said that journals can and should be gatekeepers of information that should not be widely distributed. Preprint servers have a different and much looser evaluation process than clinical journals, but he noted that bioRxiv and medRxiv do screen submissions for potentially dangerous material via a review process that escalates with increasing risks, similar to what Imperiale described at ASM. However, he said that more resources are needed. “We need a process for knowing what is something we should worry about,” he said.

Prioritizing Risks with a Tiered Approach

Simone Bianco, Altos Labs, spoke on behalf of the breakout group focused on epidemiological modeling and biosecurity. One of that group’s themes was prioritization of risks using a tiered approach. Although security is never 100 percent, a tiered approach that employs different measures that are feasible and effective to implement can help to create points of friction to prevent the release of potentially dangerous information without appropriate consideration and controls. However, this idea runs counter to the culture of openness in computer science, and mitigation strategies that limit access may be met with resistance. Therefore, it is import-

___________________

¹ In 2011, two independent research groups, led by Drs. Ron Fouchier in the Netherlands and Yoshihiro Kawaoka in the United States, submitted manuscripts describing laboratory-modified H5N1 avian influenza viruses that were capable of airborne transmission between ferrets, a common mammalian model for human influenza. The U.S. NSABB initially recommended redacting methodological details because of concerns that the work could be misused, sparking intense international debate over DURC. A subsequent World Health Organization panel supported full publication, citing the public health value of the research. The controversy led to new policies and heightened awareness of information hazards in life sciences publishing.

ant to consider researchers’ perspectives and incentives when designing mitigation strategies to focus on those that will most likely be embraced when a dual-use issue is identified. As one participant noted, “The strongest mitigation strategies should be limited to the most serious threats.” As additional caveats, mitigations designed today may be ineffective against future technologies (which may be accelerated by AI) and once information is publicly available, it is available forever. Bianco invited panelists to comment on these opportunities and questions raised by a tiered approach concept.

Sever suggested that the phrase “as open as possible, as closed as necessary,” often used in reference to protecting human subjects’ data, can be applicable to in silico research. He also agreed with Bianco that openness is irreversible and that identifying upstream risks can minimize damage. “You can’t close the door after the horse has bolted, but you can release something and make incremental decisions as to how much further information you reveal where [there] are cautions,” he said. “So, the key is to have a system upstream that allows you to identify the things that you might worry about.”

Brase also agreed that the decision to release information or models is irreversible, but noted two issues that can challenge the implementation of a tiered approach in practice. First, it may be difficult to follow an incremental approach to sharing certain types of research products, such as a biological design system. In these cases, he said, one decides whether someone does or does not have access; there is no in between. Second, it is difficult to control who has access once a product is released to anyone. “Once anybody gets access to it, it’s out of your control,” he said. “And so, it makes tiered policies, I think, very difficult to implement effectively.”

Imperiale questioned the assumption that total openness should always be the desired default in science. Although openness is now the standard in computer science and biology and has led to many advancements with great societal benefit, he posited that the circumstances have changed and so should the calculation about the risks and benefits of openness. Unlike decades ago, potentially dangerous scientific activities are now less expensive and more accessible to a much broader array of people, and these lowered barriers to using biology to do harm suggest that it may be time to reconsider openness and create tools to impose more controls on access to data and resources. He noted that this approach is not without precedent. The scientific community has established approaches for controlling access to data on human subjects. Although much remains to be worked out, he emphasized the importance of exploring the options, stating, “I don’t know how this kind of system would work, but I think it’s really worthy of more discussion.”

The scientific community may later determine that some research products should not have been shared publicly. Therefore, Gibson raised the challenge of managing public data associated with retracted studies. Because data cannot be withdrawn after public release, she suggested that metadata could be used to alert informed users to the current status or concerns associated with the data. She asked, “Could we use metadata to signal to the informed reader the state of appropriateness of the data once it’s out there?” Building on this idea, Patangay commented that the risks for many advances are often not apparent until after the technologies are in use, pointing to the use of 3D printers to manufacture guns as one example. In addition, he noted that in silico data are portable in a way that wet lab capabilities are not, increasing the likelihood that someone could circumvent controls by establishing operations in other areas of the world. Patangay stressed, however, the need to avoid imposing overly burdensome friction points on legitimate research in pursuit of significant societal benefits, and therefore the need to balance mechanisms that minimize misuse with access that advances science.

Operationalizing a Tiered Approach with Guidelines, Practices, and Controls

Valda Vinson, Science, and Jaspreet Pannu, Stanford University, discussed the ecosystem for guidelines and practices that the breakout group on molecules and proteins discussed, but that can be generalized to all groups. Operationalizing the goal to optimize sharing while minimizing risk is challenging. Moving away from

binary (i.e., yes/no) decision-making on whether to publish a study and creating tiered access based on if-then statements is a complex process that likely requires more discussion.

Many stakeholders are involved in the research dissemination ecosystem, each with their own set of resources, concerns, and motivations. Vinson outlined potential roles for each stakeholder in creating and enforcing guidelines. Funders who invest in in silico and specifically AI-powered life sciences research, for example, could require tiered risk guidance and establish incentives for responsible dissemination. Repositories may need financial support to increase security for controlled access to data and tools and monitor new advances that make existing information more dangerous to share. Preprint servers could place greater emphasis on risk assessment and determine whether further risk assessments are needed before dissemination. She said that journals are the last step in the process and suggested that risk assessment and access controls need to occur upstream of the journal submission stage.

Given the vast array of dissemination options available to researchers, many participants said that researchers could bear more responsibility for deciding whether and how to share their work safely. Instead of access starting as broad and then gradually narrowing, it could start as limited and then gradually broaden as risks are assessed. Finally, several participants noted that researchers working in industry, although subject to at least company oversight, have limited incentives to publish in traditional journals and more flexibility in dissemination decisions, and therefore may benefit from more specific guidelines to make responsible choices in the current ecosystem.

Panelists commented on stakeholder roles and needs. Brase noted that as a researcher at a national lab, he has found that the guidelines and procedures for safely conducting scientific research are clear. Still, the guidelines for dissemination are less so. Although he agreed that funders could play a role in gatekeeping access to certain research capabilities and establishing incentives and guidelines for dissemination, he cautioned that government funders may not have the motivation or expertise to do so on their own, and will instead look to research institutions to inform their guidance. Carter pointed out that translating or imposing guidance for safe research conduct developed in one context into another context, both practically and culturally, can be challenging.

Gibson expressed her view that a tiered access system could be relatively easy and effective to implement from a technical perspective, but the more difficult question is “Who should be responsible for making this happen?” On this point, she cautioned against designating the responsibility to researchers. Although they are clearly important stakeholders and need support to work within such a system, she posited that creating and implementing the tiered system should not be their focus or responsibility. Several U.S. universities are establishing data curation networks to help researchers organize data and then evaluate what data are appropriate for sharing long before submission for publication. She suggested that more institutions could create similar data curation networks.

Sever agreed with Vinson’s point that risk analysis should start much earlier in the process, before research results are submitted to journals or even preprint servers. Ideally, these discussions could begin with funders and researchers to identify potential concerns as early as possible and incorporate any necessary adjustments into research plans. However, Patangay, speaking from the perspective of both a research funder and a system builder, noted that funders’ ability to perform risk analyses effectively is somewhat limited compared to that of researchers who are building the models and systems and know their work best. He suggested that funders could help arm researchers with the tools and training to more effectively assess risks that may not be obvious to individuals not directly involved in the work.

Imperiale agreed that researchers are experts in their work, but although they are optimistic about the value of their research, they often lack awareness of the potential risks. For example, like most other biologists, Imperiale said that he was not aware of the Biological Weapons Convention until he joined NSABB. To address this

gap in awareness, he suggested that institutions implement more training on responsible research and encourage researchers to use red teaming to inform their risk assessments. He also reiterated the value of a “Swiss cheese” approach to biosecurity, whereby multiple layers of controls, each of which is imperfect, collectively create enough blocks and bottlenecks to minimize the risk of dangerous information or capabilities being released at the publication stage.

Future-Proofing Guidelines

Feilim Mac Gabhann, Johns Hopkins University and PLOS Computational Biology, spoke on behalf of the systems biology and genetic/cellular engineering breakout group. Even with checkpoints or tiered access, the fact that dissemination is instantly global and permanent underscores the importance of risk assessment occurring as early as possible and of preventing the release of dangerous information. However, what is dangerous today and what is dangerous in the future are not necessarily the same. Future developments can cause information deemed to be low risk at release to become high risk, and similarly, guidelines built only for today’s capabilities may limit the ability to react to new problems in the future. Mac Gabhann stressed the importance of considering what may be enabled by future scientific capabilities and then using if-then statements to frame risk assessments and control mechanisms, as some participants noted throughout the workshop. However, recognizing that researchers may seek alternative dissemination pathways despite existing controls, Mac Gabhann suggested that another approach to future-proofing control mechanisms is to instill a culture of risk–benefit analysis within the scientific community. If more assessment happens earlier in the process and researchers truly understand the risks, through activities such as red teaming, they may be less inclined to pursue risky research or to seek alternative dissemination pathways when some pathways are blocked.

Noting the inherent challenge of predicting the future, Imperiale agreed with the suggestion of emphasizing ethics during scientific training and education. He noted that encouraging a sense of humility and a willingness to listen could also be helpful. “We, the scientists, don’t always know everything that’s right,” he said. “We have to be willing to listen to others who do have concerns and may see things a little bit differently.” Carter agreed and added that even if a consensus were reached on perfect guidelines today, they may not be applicable for long, given the pace of change in technology and dissemination pathways. Sever added that the scientific community could also benefit from a greater awareness of the historical context of their work and past mistakes. “We could be a little humbler and have everybody learn a bit more about that, and apply those lessons going forward, so that we don’t make the same mistakes with this technology,” he said. Gibson also supported the ideas of supporting cultural change and of using appropriate incentives to encourage the research community to embrace risk assessments.

Carter asked panelists to share ideas for incentivizing good behavior. Although publishing is a primary incentive for the scientific community in general, workshop discussions emphasized that imposing additional requirements at the publication stage will likely not achieve this goal. Incentives are needed upstream in the process. Patangay suggested that risk assessment could be made the default, similar to how privacy is now the default for most software and health data, by increasing researchers’ awareness of the risks and providing them with the tools to assess them. As a first step, a collaborative effort could develop a shared definition of “risk” to eliminate confusion and inconsistencies. Carter agreed that shared vocabulary is critical to effective multi-sector communication. Gibson noted that the incentives for good communication and effective risk assessment can come from multiple angles. Noting that researchers “need academic credit—something to put on their resume to get recognized for,” she suggested that a risk analysis framework could be formally submitted or registered with funders, the institutions, or preprint servers to serve as a check on safety and security and a mechanism for providing credit to the researchers who engage with this process.

IMPLEMENTATION OPPORTUNITIES AND PITFALLS FOR PROPOSED STRATEGIES

The workshop’s final session, moderated by Héctor García Martín of Lawrence Berkeley National Laboratory, focused on elucidating the implementation opportunities and potential pitfalls for various policy options, norms, guidance, strategies, and best practices for safeguarding the benefits of in silico biological research while mitigating the risks of its dissemination.

Participants were divided into three groups to discuss one central question: “What approaches or strategies should be used to promote high-quality science, scientific progress, and the openness of science, while mitigating the biosecurity risks associated with disseminating in silico research in biological systems?” This question was designed to prompt participants to share examples of important areas for guidance and policy development, explore possible next steps for implementation and collaboration, and consider key stakeholders for follow-up actions for engagement.

Several participants discussed various mechanisms for striking a balance between pursuing high-quality, open science and the importance of guarding against potential biosecurity risks. One mechanism is a comprehensive, tiered system for biosecurity reviews, perhaps facilitated by an advisory council drawing upon a shared ethical framework. Many participants also discussed how such mechanisms could be incentivized and disseminated to a broad array of actors, from students to senior researchers, and across sectors. They also discussed the importance of identifying technology gaps and anticipating how enabling technologies could lead to additional risks in the future, as well as the value of leveraging various technologies to aid in biosecurity risk monitoring. Finally, given the immense scale and multidimensionality of the research under discussion, some participants discussed the benefits of defining clear rubrics that identify low and high risks.

Creating a Tiered System of Biosecurity Reviews and Controls

Several participants emphasized the importance of comprehensive biosecurity reviews that encompass the entire research pathway, from early engagement by funders, institutions, and researchers, to manuscript checklists for responsible dissemination.² Noting that journals’ influence is limited to accepting or rejecting manuscripts for publication and that rejection by one journal does not mean that the research will not be published elsewhere, participants reiterated that the bulk of the review process could, however, occur well before the publication stage. Groups discussed a tiered framework with clear thresholds and responsibilities for detecting and addressing risky research, as well as practical risk mitigations at each step. Toward this goal, they suggested the establishment of an authoritative working group to examine existing ethical frameworks from other communities and then create a framework for the in silico community, with an initial focus on defining and mitigating the highest-risk activities. They noted the value of adequate precision to understand risk levels, appropriate resources to perform risk analyses, and consensus around oversight of research with the highest risks. In silico research that qualifies as DURC or PEPP presents a good starting point for determining the necessary oversight and the most effective risk mitigation strategies. The notion that the riskiest research may require mitigations can inform decisions about appropriate oversight at successively lower risk levels. To improve upon the current ad hoc approach, in which reaching consensus can be challenging, participants also suggested that an advisory group, such as an interagency working group under the executive branch, may help to provide unified guidance as questions arise about particular cases.

Groups also discussed the idea of pre-registering in silico research and conducting risk assessments even for research at the lowest risk levels. Who would oversee such registration needs to be determined, perhaps an institutional body similar to existing review boards for wet lab research or a new external one with broader reach.

___________________

² See https://neurips.cc/public/guides/PaperChecklist (accessed June 24, 2025).

In either case, some participants noted the importance of incentivizing participation after registration through funding or publication requirements while avoiding burdens that might unduly impede research.

Participants also emphasized that solutions must be easy to understand and follow to ensure their effective implementation. Because smaller organizations may lack the resources to perform in-depth reviews, the solutions may need to be feasible to implement for a broad spectrum of research environments. Once developed, participants suggested that a framework could be communicated to in silico researchers, at all career levels (students to senior researchers), through a biosecurity curriculum or training.

Education and Training

Robust and comprehensive biosecurity training at all levels of scientific education and staffing was a second focus area of the discussions, aimed at promoting responsible research, both physical and in silico, and increasing awareness of biosecurity risks. Participants suggested that this training could incorporate information about DURC, PEPP, and the Biological Weapons Convention, as well as broader aspects of research ethics and bioethics, including input from the humanities and philosophy. Participants commented that implementing training through a standardized framework, along with informed best practices, such as red-teaming, has helped create a lasting cultural change and could be adapted to in silico research. Lessons learned from Malice Analysis,³ a program from the Engineering Biology Research Consortium; the work of Malcolm Dando⁴ and the Stockholm International Peace Research Institute;⁵ and scientific societies can also inform educational strategies.

Capability Marking and Metrics

Technology and capability marking could be another strategy to explore for safeguarding the benefits of in silico biological research while reducing the risks of its dissemination.

Examples of this approach include the following:

• Watermarking or embedding metadata into in silico data.
• Developing a “Capability of Concern” list, akin to DURC categories, which can help researchers to evaluate the capabilities enabled by their work, starting with research presenting the highest risks and requiring the strongest mitigations as part of a spectrum-based approach that differentiates between high-, moderate-, and low-risk research.
• Creating “model cards,” similar to those used in AI (Mitchell et al., 2019), which could be useful to document the development, data, usage, and capabilities of in silico models.

Participants noted that data, not just models, could be curated and secured with managed access. Surveillance of capability transitions that increase potential harms is another important consideration.

A related approach is the establishment of qualitative and quantitative risk metrics and thresholds. These metrics could be developed through multi-stakeholder engagement, with clear guidelines based on capability benchmarks or misuse patterns of the different in silico research outputs. Automation tools could also be leveraged for risk discovery. However, a few participants raised the potential downside that metrics could impede or deter important research, such as the development of countermeasures.

___________________

³ See https://ebrc.org/malice-analysis/ (accessed June 24, 2025).

⁴ See https://thebulletin.org/2010/12/teaching-biosecurity/ (accessed June 24, 2025).

⁵ See https://www.sipri.org/news/2023/new-video-series-biosecurity-risks-and-emerging-technology (accessed June 24, 2025).

Creating Incentives and Control Mechanisms

Participants discussed ways to incentivize responsible behavior and monitor risks as the field continues to evolve. For example, incentives tied to research publication or commercialization could foster the incorporation of biosecurity risk assessment into a researcher’s career advancement pathways. The “bug bounty” programs that companies use to encourage the public to discover and report cybersecurity vulnerabilities is another approach worthy of exploration.

When information is deemed too risky to share openly, community-driven platforms with controlled access could be leveraged to enable the sharing of sensitive information among legitimate researchers. Some participants suggested that a potential next step in this direction could be to define the desired properties of such a platform and pursue international collaboration to avoid creating U.S.-centric guidelines that are not aligned with global practices.

Considering Stakeholders Broadly

Throughout the discussions, participants named a wide range of actors who might be involved in or affected by the dissemination of in silico biological research associated with potential biosecurity concerns. While not an exhaustive list, critical actors include researchers and their institutions, publishers, reviewers, and editors at scientific journals, screeners and staff at preprint servers and data and model repositories, industry researchers and service providers, and research funders.

In addition to individuals who operate directly within the scientific enterprise, many participants said that the general public could be considered as a stakeholder. Protecting the public and their data (e.g., genetic) from accidental or deliberate consequences of risky research, however improbable, is important. Other actors to consider include hobbyists; biosurveillance and biodefense organizations; public health agencies; policymakers whose interest may intersect with research outputs, such as those working in pandemic preparedness; patients, patient advocates, and clinical trial investigators; and diplomats and government agencies involved in governing science and technology.

Questions for Further Exploration

Several participants raised questions for further exploration:

• Should there be a governing body focused on computational biology research dissemination, or should oversight rely on personal responsibility? If a governing body is needed, what would it look like?
• What would be the best way to prepare for or respond to an emerging technology that enables significant increases in model capabilities through built-in validation and iterative learning, especially given their dual-use potential?
• Could graduate programs add an education requirement about DURC/PEPP and related considerations for researchers at federally funded institutions, similar to required bioethics trainings?
• Is pre-registration⁶ only implementable for institutional research? How can pre-registration be implemented and normalized for non-traditional researchers?
• How easily can computational models, such as generative AI, be modified or fine-tuned on new data, and can they be future-proofed as their capabilities increase?

___________________

⁶ In this context, pre-registration refers to the process of documenting and publicly registering a research plan such as the methodology, data sources, and analysis strategy, before the research is conducted or the results are known.

• Are the in silico, computational, and AI research communities adequately focused on identifying ways to lower potential biosecurity risks of their research? How can harms be effectively minimized?
• Can ongoing periodic review of in silico research outputs work without creating inequities, i.e., ensuring that this process is fair and accessible to all researchers regardless of their resources, capabilities, or institutional affiliations?