How to Defend Against AI-Designed Viruses

Anthropic recently disclosed five cases in which users hid their countries while asking Claude for help enhancing pathogens or toxins .

Anthropic最近披露了五起用户隐藏自己国家并请求克劳德帮助增强病原体或毒素的案例。

This added fuel to the ongoing debate over whether progress in AI should be slowed.

这加剧了关于人工智能进展是否应该放缓的持续争论。

Insider warnings of threats to human lives from artificial intelligence have been received as everything from prescient humility to a hoax or marketing stunt.

人工智能对人类生命构成威胁的内部警告已被视为各种形式，从有先见之明的谦逊到骗局或营销噱头。

But in a world where AI-designed biological viruses have already been grown in the lab, the threats should be reckoned with in any biodefense strategy.

但在人工智能设计的生物病毒已经在实验室中培育的世界里，任何生物防御策略都应该考虑到这些威胁。

The “AI doomer” model of biological risks is that AI will develop intelligence beyond that of any human, leading it to invent a supervirus so much more powerful and fatal than anything in the world that our civilization will collapse.

生物风险的“人工智能毁灭者”模型是，人工智能将发展出超越任何人类的智力，导致它发明一种比世界上任何东西都更强大和致命的超级病毒，以至于我们的文明将崩溃。

Adherents name this “ x-risk.” An opposite view is that virus design is such a hard problem that AI won’t add anything beyond what the best humans can do, and that malicious actors — even state actors — would require access to so much top expertise that production is unfeasible.

追随者将其称为“x风险”。相反的观点是，病毒设计是一个非常困难的问题，人工智能不会添加任何超出人类所能做到的事情，而恶意行为者——甚至是国家行为者——将需要获得如此多的顶级专业知识，以至于生产是不可行的。

Doomerism justifies unrealistic and destabilizing solutions (like bombing data centers ) while the dismissiveness of certain biologists — including some, like Claus Wilke and David Bellamy , who are AI experts with experience in synthetic virus design — fosters a complacency that leaves us vulnerable to AI threats.

末日论为不切实际和不稳定的解决方案（如轰炸数据中心）辩护，而某些生物学家的不屑一顾——包括克劳斯·威尔克和大卫·贝拉米等在合成病毒设计方面拥有丰富经验的人工智能专家——助长了一种自满情绪，使我们容易受到人工智能威胁。

As a researcher working in both AI-accelerated bioengineering and how natural viruses jump host species to cause epidemics, I am concerned that if voices for a less flashy middle path are eclipsed in the debates over AI safety, steps to shoring up our defenses might not be taken.

作为一名研究人工智能加速生物工程和自然病毒如何跨越宿主物种引发流行病的研究人员，我担心，如果在关于人工智能安全的争论中，主张不那么华而不实的中间道路的声音黯然失色，那么我们可能不会采取措施来加强防御。

Already, AI tools are superior to experts at certain design and engineering tasks in ways that let moderately skilled people change the properties of existing viruses to target humans, evade existing drugs, and change symptoms.

在某些设计和工程任务上，人工智能工具已经优于专家，可以让中等技能的人改变现有病毒的特性以针对人类，逃避现有药物并改变症状。

However, they cannot invent novel viruses from whole cloth and they will not allow actors to manufacture viruses without access to vital elements of the biology supply chain.

然而，他们无法从头到尾发明新型病毒，也不允许行为者在无法接触生物供应链重要元素的情况下制造病毒。

This means that near-term AI bio-risk is similar to the threat of natural pandemics, synthetic biology, and classical offensive bioweapon development: The cornerstone of defense against AI bio-risk is the ability to counter pandemics of viruses we already know, although there are a few AI-specific prevention and response elements that round out a sound strategy.

这意味着近期人工智能生物风险类似于自然流行病、合成生物学和经典进攻性生物武器开发的威胁：防御人工智能生物风险的基石是对抗我们已知的病毒流行病的能力，尽管有一些人工智能特定的预防和应对要素可以完善合理的策略。

A team struggles with the challenge of modifying a human virus to reach the brain.

一个团队正在努力应对修改人类病毒以到达大脑的挑战。

They turn to AI models of biochemistry to modify the gene encoding the virus’s protein coat to hitch a ride across the blood-brain barrier.

他们利用生物化学的人工智能模型来修改编码病毒蛋白质外壳的基因，以搭上跨越血脑屏障的便车。

After months of development, they create a coat able to deliver their own DNA cargo into 94 percent of neurons in the brain of their humanized mice, totally changing what this virus can do.

经过几个月的开发，他们创造了一种外壳，能够将自己的 DNA 货物输送到人源化小鼠大脑中 94% 的神经元中，完全改变了这种病毒的功能。

This isn’t a prediction of some future capability: It’s a paraphrase of a press release from a small-cap biotech company this year.

这并不是对未来某些能力的预测：这是一家小型生物技术公司今年新闻稿的释义。

They ran this experiment to develop a system to deliver restorative DNA into patients — brain delivery of DNA would be useful for conditions such as Huntington’s disease or amyotrophic lateral sclerosis — and they used a non-pathogenic virus rendered even safer by removing the genes that allow it to replicate itself.

他们进行这项实验是为了开发一种系统，将恢复性 DNA 输送到患者体内——DNA 的大脑输送对于亨廷顿舞蹈症或肌萎缩侧索硬化症等疾病很有用——他们使用了一种非致病性病毒，通过去除允许其自我复制的基因，该病毒变得更加安全。

This safe experiment was nonetheless analogous to the way one might modify some other virus to change the species or organ it targets.

尽管如此，这一安全的实验类似于修改其他一些病毒以改变其目标物种或器官的方式。

The scale of the work is easily accessible to state actors, companies, and even some university labs.

国家行为者、公司甚至一些大学实验室都可以轻松了解这项工作的规模。

It is likely that the most expensive steps were manufacturing and animal testing.

最昂贵的步骤可能是制造和动物测试。

Can a smaller team reproduce something like this with fewer resources?

较小的团队可以用更少的资源重现这样的事情吗？

For the analogous task of designing proteins that can bind to a target, the biggest change has not been the ability to design better proteins but a rise in the proportion of designs that actually work in real life.

对于设计可以与靶标结合的蛋白质的类似任务来说，最大的变化不是设计更好的蛋白质的能力，而是在现实生活中实际起作用的设计比例的增加。

If one in a thousand proteins work out — state of the art for 2022 — one person-year is not enough to make meaningful progress.

如果千分之一的蛋白质能够发挥作用（2022 年的最新水平），一个人一年的时间还不足以取得有意义的进展。

But if half the designs are successful — post-AI state of the art in 2025 — meaningful progress can be made with a small team at low cost.

但如果一半的设计成功——2025 年的后人工智能技术水平——小团队就能以低成本取得有意义的进展。

Since the AI models powering virus engineering research continue to improve, we can estimate that the team size and resourcing required to produce a novel virus with relevant properties will continue to fall.

由于支持病毒工程研究的人工智能模型不断改进，我们可以估计，生产具有相关特性的新型病毒所需的团队规模和资源将继续下降。

Nuclear fission may have given us the atomic bomb before power plants, but AI biology tools are on track to deliver cures before harms.

核裂变可能在发电厂之前为我们带来了原子弹，但人工智能生物工具有望在造成伤害之前提供治疗方法。

Just when single-patient drugs have finally begun hitting clinics, heralding a future wave of personalized medicine , AI bioengineering tools are rapidly improving their ability to design both traditional medicines and gene therapies.

正当单一患者药物终于开始进入诊所，预示着未来个性化医疗浪潮的时候，人工智能生物工程工具正在迅速提高其设计传统药物和基因疗法的能力。

In other words, the peaceful applications of this dual-use technology are so compelling that they must be weighed when considering restraint on technology development.

换句话说，这种军民两用技术的和平​​应用是如此引人注目，以至于在考虑限制技术发展时必须加以权衡。

But beyond that, pacing the frontier models or instituting stronger model safeguards probably won’t forestall biological threats in the way it would cybersecurity threats.

但除此之外，调整前沿模型或制定更强有力的模型保障措施可能不会像网络安全威胁那样阻止生物威胁。

While large language models — more specifically, chatbots — are the form of AI that citizens are most likely to encounter in their daily life and work, the pivotal AI tools for biologics design are not the premier models from frontier labs like the latest versions of Claude or GPT.

虽然大型语言模型（更具体地说，聊天机器人）是公民在日常生活和工作中最有可能遇到的人工智能形式，但生物制剂设计的关键人工智能工具并不是来自前沿实验室的主要模型，如最新版本的 Claude 或 GPT。

They are more specialized tools whose development may be harder to pace as they were made with a fraction of the resources, including tools to predict protein folding , drug binding, immune evasion , and genome generation — some of which my team uses in their daily work.

它们是更专业的工具，其开发速度可能更难，因为它们是用一小部分资源制作的，包括预测蛋白质折叠、药物结合、免疫逃避和基因组生成的工具——其中一些工具是我的团队在日常工作中使用的。

A Stanford team trained one such model to design whole viruses not found in nature by remixing and modifying existing ones.

斯坦福大学的一个团队训练了一个这样的模型，通过重新混合和修改现有病毒来设计自然界中未发现的完整病毒。

To avoid generating any threatening viruses, they merely filtered any viruses that infect humans and other eukaryotes out from their training database.

为了避免产生任何威胁性病毒，他们只是从训练数据库中过滤掉任何感染人类和其他真核生物的病毒。

While only about 5 percent of their designs were viable, extrapolating the curve of progress from other fields suggests that tool improvement will soon lead to increasing hit rates.

虽然他们的设计只有大约 5% 是可行的，但从其他领域的进展曲线推断表明，工具改进将很快导致命中率提高。

Two barriers were more reassuring.

两个障碍更让人放心。

First, of the designs they tried to resurrect, only those at least 92 percent identical to an existing virus survived: The models can generate something not exactly found in nature, but not something unknown to mankind.

首先，在他们试图复活的设计中，只有那些与现有病毒至少 92% 相同的设计得以幸存：这些模型可以生成一些在自然界中不完全存在的东西，但不能生成人类未知的东西。

Second, significant hands-on human labor was unavoidable in translating the virus blueprints to a replicating virus: The idea that a rogue AI agent could place purchase orders and receive a virus with de minimis human awareness is not possible.

其次，在将病毒蓝图转化为可复制病毒的过程中，大量的人工操作是不可避免的：流氓人工智能代理可以在人类意识微乎其微的情况下下订单并接收病毒的想法是不可能的。

Almost 20 years ago, a nondescript letter from South America arrived at a laboratory.

大约 20 年前，一封来自南美的不起眼的信到达了一家实验室。

Folded inside the printed note was a blank piece of paper.

打印出来的纸条里面折叠着一张空白纸。

A 19-year-old intern — me — added a few drops of water and let it sit to recover the DNA that had been dried onto the paper.

一名 19 岁的实习生——我——加入了几滴水，静置以恢复纸上干燥的 DNA。

Over the course of a few weeks, I grew up a larger batch of this DNA in some E.

在几周的时间里，我在一些大肠杆菌中培养出了更多的这种 DNA。

coli, turned it into RNA, and introduced it into monkey cells.

大肠杆菌，将其转化为RNA，并将其引入猴细胞中。

The result: live, infectious poliovirus.

结果：活的、传染性的脊髓灰质炎病毒。

The process is scarcely different today than it was then, with one key exception: Instead of needing to source the DNA from nature or from someone else’s freezer, automated DNA synthesis technology has transformed molecular biology, and in many cases it is cheaper to have a gene shipped to you than to clone it yourself.

今天的过程与当时几乎没有什么不同，但有一个关键的例外：自动化 DNA 合成技术不再需要从大自然或从别人的冰箱中获取 DNA，而是改变了分子生物学，而且在许多情况下，将基因运送给您比自己克隆它更便宜。

The pitiful level of automation in cell culture may surprise programmers and factory workers alike.

细胞培养中可怜的自动化水平可能会让程序员和工厂工人感到惊讶。

Proof of principle has been achieved for automated labs of this sort, so it can be anticipated that automated labs will become more common in the 2030s, but for now, any conceivable route to the release of an AI-designed virus runs through the hands of a trained technician.

此类自动化实验室已经实现了原理验证，因此可以预见，自动化实验室将在 2030 年代变得更加普遍，但就目前而言，任何可能的释放人工智能设计病毒的途径都需要经过训练有素的技术人员之手。

However, these vocational skills are possessed by tens of thousands of workers, and the infrastructure for recovering a virus exists in many laboratories in the pharmaceutical, biotechnology, education, and diagnostic sectors worldwide — though difficulties vary from simple, like human immunodeficiency virus, to fiendishly tricky, like smallpox.

然而，数以万计的工人都拥有这些职业技能，全球制药、生物技术、教育和诊断领域的许多实验室都存在用于恢复病毒的基础设施——尽管困难各不相同，有的简单，如人类免疫缺陷病毒，有的极其棘手，如天花。

Can chatbots help the average Joe do these experiments without the need for vocational training?

聊天机器人可以帮助普通人在不需要职业培训的情况下完成这些实验吗？

In the most compelling test of this so far — described in a recent preprint — over a hundred college students and others were tasked with performing a series of four tasks capturing the workflow to resurrect a virus.

在最近的预印本中描述的迄今为止最引人注目的测试中，一百多名大学生和其他人的任务是执行一系列四项任务，捕获复活病毒的工作流程。

They were randomized into two groups: One had access to large language models like ChatGPT-5, while the other had access to any pages on the internet but not large language models.

他们被随机分为两组：一组可以访问 ChatGPT-5 等大型语言模型，而另一组可以访问互联网上的任何页面，但不能访问大型语言模型。

In both groups, a few succeeded, but the large language models didn’t help enough to make a difference in overall success.

在两组中，都有一些人取得了成功，但大型语言模型的帮助不足以对整体成功产生影响。

So far, AI isn’t coming for the jobs of the bench scientists — but any AI-associated bio-risk must pass through their able hands.

到目前为止，人工智能还不会取代替补科学家的工作——但任何与人工智能相关的生物风险都必须经过他们能干的手。

Chemical synthesis of DNA is the clearest point of intervention because this is the only item on the supplies and materials list that can be attributed specifically to a certain type of virus.

DNA 的化学合成是最明显的干预点，因为这是供应和材料清单上唯一可以专门归因于某种病毒类型的项目。

Other materials, like the required cells and enzymes, are used routinely and around the world for essential medical or industrial functions.

其他材料，如所需的细胞和酶，在世界各地常规用于基本的医疗或工业功能。

The operator will know what they’re growing, but it’s unfeasible for an inspector to guess from the rest of the invoice list.

经营者会知道他们种植的是什么，但检查员无法从发票清单的其余部分猜测。

An open letter calling for legislation mandating screening and recordkeeping for synthetic DNA orders has collected signatories from former military department secretaries to chief executives of the largest AI companies.

一封呼吁立法强制对合成 DNA 订单进行筛选和记录保存的公开信已收集了从前军事部部长到最大人工智能公司首席执行官的签名者。

At higher cost and complexity, an operator could avoid ordering commercially synthesized DNA by acquiring DNA synthesis machines and synthesizing the DNA in-house.

由于成本和复杂性较高，操作员可以通过购买 DNA 合成机器并在内部合成 DNA 来避免订购商业合成的 DNA。

Export controls on DNA synthesis instruments should be considered if states fail to implement their own screening programs for synthetic DNA orders and anti-diversion programs for DNA synthesis instruments.

如果各州未能实施自己的合成 DNA 订单筛选计划和 DNA 合成仪器反转移计划，则应考虑对 DNA 合成仪器进行出口管制。

Alongside DNA synthesis, gene sequencing is routinely used for troubleshooting and validation during virus engineering programs.

除了 DNA 合成之外，基因测序通常还用于病毒工程程序中的故障排除和验证。

As for synthesis, sequencing in-house is possible but only at increased friction, cost, skill, and complexity, and it would not be surprising if even many states’ activities could be assessed from the appropriate commercial sequencing signals.

至于合成，内部测序是可能的，但只会增加摩擦、成本、技能和复杂性，如果甚至可以根据适当的商业测序信号评估许多州的活动，也就不足为奇了。

Domestically, automatic generation of a notification — analogous to Suspicious Activity Reports in banking, but inherently more actionable and cost-effective — by sequencing companies to the Division of Regulatory Science and Compliance of the Centers for Disease Control and Prevention could be a useful surveillance tool.

在国内，通过对美国疾病控制与预防中心监管科学与合规部进行排序来自动生成通知（类似于银行业的可疑活动报告，但本质上更具可操作性和成本效益）可能是一种有用的监视工具。

When considering the actionability of intelligence that an individual or group is designing a deadly virus with AI, we must reckon with the fact that growing a deadly virus might not be illegal if done for a peaceful purpose.

当考虑个人或团体利用人工智能设计致命病毒的情报的可操作性时，我们必须考虑到这样一个事实：如果出于和平目的，制造致命病毒可能并不违法。

Stricter guidelines apply to organizations receiving federal support — who must abide by certain guidelines concerning synthetic DNA — but their legal effect derives from the ability of agencies to set conditions for receiving funding, so they do not apply to an actor not funded by the U.S. government.

更严格的指导方针适用于接受联邦支持的组织——这些组织必须遵守有关合成 DNA 的某些指导方针——但其法律效力源自各机构设定接受资助条件的能力，因此它们不适用于不受美国政府资助的行为者。

The primary legal tool that this country uses to ban playing around with anthrax or smallpox is the Select Agent program: Possessing, using, transferring, or even ordering pathogens on the prespecified list is a federal crime.

该国用来禁止玩弄炭疽或天花的主要法律工具是选择代理计划：拥有、使用、转移甚至订购预先指定清单上的病原体都是联邦犯罪。

Among the issues undermining the program’s efficacy, a system based on enumerated lists of known dangerous agents is incapable of addressing new viruses, or even modifications of garden-variety pathogens that turn them into something particularly dangerous.

在破坏该计划功效的问题中，基于已知危险物质枚举列表的系统无法应对新病毒，甚至无法对普通病原体进行修改，从而将其变成特别危险的东西。

In the short term, the broad leeway agencies are granted in designating Select Agents is one of the more straightforward ways to ban the unsafe cultivation of an AI-designed virus with pandemic potential.

从短期来看，各机构在指定特定代理方面拥有广泛的回旋余地，是禁止不安全培养具有大流行潜力的人工智能设计病毒的更直接方法之一。

Scaling up manufacture is another matter.

扩大生产规模是另一回事。

Manufacturing strategically significant quantities of an AI-designed toxin or comparable amounts of an existing natural agent would require infrastructure that could not be concealed except by sophisticated state actors.

制造具有战略意义的大量人工智能设计的毒素或相当数量的现有天然制剂，需要基础设施，除非复杂的国家行为者才能隐藏。

If one were to reproduce today the mid-20th-century American stockpiles of botulinum toxin, recent developments in AI would not make a meaningful difference in the scale of resources required nor in the difficulty of concealing such a project.

如果要在今天重现 20 世纪中叶美国的肉毒杆菌毒素库存，人工智能的最新发展不会对所需资源的规模或隐藏此类项目的难度产生有意义的影响。

The new risk to biodefense coming from AI is the possibility that some self-replicating agent could be so successful that a small, seeding release — in quantities that do not require manufacturing scale-up — could lead to large-scale consequences.

人工智能给生物防御带来的新风险是，某些自我复制剂可能会非常成功，以至于小规模的种子释放（数量不需要扩大生产规模）可能会导致大规模后果。

Denial steps — primarily in the world of atoms, not in the world of bits — can substantially reduce but not eliminate the risk that a moderately sophisticated actor could construct a virus with epidemic potential, and they would barely inconvenience state actors.

否认步骤——主要是在原子世界，而不是在比特世界——可以大大降低但不能消除中等复杂程度的行为者可能构建具有流行潜力的病毒的风险，而且它们几乎不会给国家行为者带来不便。

Therefore, preparedness is the most important pillar of mitigating AI bio-risk.

因此，做好准备是减轻人工智能生物风险的最重要支柱。

One of the thorniest issues in nailing down the origins of the recent COVID-19 pandemic is that neither human ingenuity nor a few short years of evolution could produce SARS-CoV-2 from any virus that was present in our sequence databases in 2019.

确定最近的 COVID-19 大流行的起源最棘手的问题之一是，无论是人类的聪明才智还是短短几年的进化都无法从 2019 年序列数据库中存在的任何病毒中产生 SARS-CoV-2。

Somewhere in Asia, a virus unknown to international science was its progenitor.

在亚洲的某个地方，一种国际科学界未知的病毒是它的祖先。

As of today, AI tools have the same limitation as human experts: They can only go so far from a known starting point before their intuition about what works and what doesn’t work breaks down.

截至目前，人工智能工具与人类专家有着同样的局限性：在他们关于什么有效、什么无效的直觉被打破之前，他们只能从已知的起点走这么远。

For example, virus-like protein cages designed from scratch by Nobel-winning labs don’t have the properties required to form a virus that works in people, so in the near term, any AI-designed virus capsid will be a variation on one we already know.

例如，诺贝尔奖获得者实验室从头开始设计的类病毒蛋白笼不具备形成在人体中起作用的病毒所需的特性，因此在短期内，任何人工智能设计的病毒衣壳都将是我们已知的病毒衣壳的变体。

To contextualize the greater than 92 percent identity of the Stanford team’s AI-designed viruses with known viruses, SARS-CoV-2 and Middle East respiratory syndrome-related coronavirus have about 50 percent identical genomes and share traits including a spike that can be targeted by vaccines in the same way, susceptibility to Paxlovid-type drugs, and vulnerability to alcohol-based sanitizers.

为了将斯坦福大学团队人工智能设计的病毒与已知病毒超过 92% 的同一性联系起来，SARS-CoV-2 和中东呼吸综合征相关冠状病毒具有约 50% 的相同基因组，并具有共同特征，包括可以以相同方式被疫苗靶向的尖峰、对 Paxlovid 类药物的敏感性以及对酒精消毒剂的脆弱性。

AI models tend to do a good job generalizing beyond their training data when there is a strong grammar to why things are the way they are or when they are interpolating between elements of the training data, but weak when unexplored regions behave differently or when they are extrapolating far beyond the training distribution.

当存在强大的语法来解释事物为何如此或在训练数据的元素之间进行插值时，人工智能模型往往会在训练数据之外做得很好，但当未探索的区域表现不同或推断远远超出训练分布时，人工智能模型就会很弱。

Whereas changing a virus to prevent an antibody from binding to it is an example of the first class of problems, inventing a virus not related to an existing prototype is a problem of the second class.

改变病毒以阻止抗体与其结合是第一类问题的一个例子，而发明一种与现有原型无关的病毒则是第二类问题。

It is fortunate that a modest broadening of good preparation for natural pandemics will cover the kind of artificial pandemics that would be possible in the next five years.

幸运的是，适度扩大对自然流行病的良好准备将涵盖未来五年内可能出现的人为流行病。

Sadly, we don’t have the best track record of natural pandemic preparedness, even for known threats.

遗憾的是，我们在自然流行病防范方面没有最好的记录，即使是针对已知的威胁。

In the run-up to COVID-19, many were sounding the alarm about the next threat, up to specific details like a shortage of ventilators to respond to the outbreak of a pandemic respiratory virus, but too little action was taken.

在 COVID-19 爆发之前，许多人都对下一个威胁发出了警报，甚至提到了应对大流行性呼吸道病毒爆发所需的呼吸机短缺等具体细节，但采取的行动太少。

Preparedness for natural pandemics and classical bioweapons that doubles as good preparation for AI-designed pathogens includes maintaining an adequate industrial base for both supplies — e.g., masks — and vaccines/pharmaceuticals with surge capacity, preparing policy tools for crisis response, applying recently-matured technologies for surveillance such as proactive wastewater screening, maintaining global epidemic surveillance, and most importantly, building a strong public health infrastructure including experienced professionals distributed broadly.

对自然流行病和经典生物武器的准备，同时也是对人工智能设计的病原体的良好准备，包括为口罩等物资和具有激增能力的疫苗/药品维持充足的工业基础，为危机应对准备政策工具，应用最近成熟的监测技术，例如主动废水筛查，维持全球流行病监测，最重要的是，建立强大的公共卫生基础设施，包括广泛分布的经验丰富的专业人员。

Furthermore, the road map to prepare for future viral pandemics includes creating a broad countermeasure platform for each major group of viral threats.

此外，为未来病毒大流行做好准备的路线图包括为每一类主要病毒威胁创建一个广泛的对策平台。

Extensive studies of Severe acute respiratory syndrome coronavirus in the wake of the 2002 outbreak provided enabling technology that greatly sped the development of a vaccine for its cousin SARS-CoV-2.

2002 年严重急性呼吸综合征冠状病毒爆发后，对冠状病毒的广泛研究提供了可行的技术，极大地加快了其近亲 SARS-CoV-2 疫苗的开发。

If a full vaccine for the original SARS coronavirus had been developed and tested before 2019, the SARS-CoV-2 vaccine development timeline could have been further compressed.

如果在 2019 年之前开发出针对原始 SARS 冠状病毒的完整疫苗并进行测试，那么 SARS-CoV-2 疫苗的开发时间表可能会进一步压缩。

As a graduate student, I saw one of my mentors begin work on one such vaccine, but he was forced to abandon it later due to lack of funding when federal agencies lost interest in coronaviruses.

作为一名研究生，我看到我的一位导师开始研究一种此类疫苗，但后来由于联邦机构对冠状病毒失去兴趣而缺乏资金，他被迫放弃。

If we can overcome the boom-bust cycle of vaccine development wherein money briefly surges to research the most recently survived pandemic, it is feasible to develop vaccines for prototypes of most major disease-causing families, as outlined in the pandemic preparedness plan of the National Institute of Allergy and Infectious Diseases.

如果我们能够克服疫苗开发的繁荣-萧条周期，即资金短暂激增用于研究最近幸存的大流行，那么为大多数主要致病家族的原型开发疫苗是可行的，正如美国国家过敏和传染病研究所的大流行防备计划所述。

Additionally, due to past neglect of the field, there may be low-hanging fruit in germicidal and filtration technologies that would apply to multiple viral families and be harder for an AI design to evade.

此外，由于过去对该领域的忽视，杀菌和过滤技术可能有一些唾手可得的成果，这些技术适用于多个病毒家族，并且人工智能设计更难以规避。

The ability of AI tools to retarget animal viruses to infect humans, or to alter human viruses to dodge existing immunity in the population, means the list of potential threats is wider compared to a world in which natural threats are the only ones we must consider.

人工智能工具能够重新定位动物病毒以感染人类，或改变人类病毒以躲避人群中现有的免疫力，这意味着与我们必须考虑的唯一威胁是自然威胁的世界相比，潜在威胁的清单更加广泛。

For instance, the World Health Organization’s Pathogens Prioritization list rightly ranks hantaviruses and influenza viruses in its highest threat category, but several families classified as low-priority contain viruses that have caused dramatic epidemics in animals, lack effective vaccine platforms, and could conceivably be retargeted to affect humans.

例如，世界卫生组织的病原体优先级列表正确地将汉坦病毒和流感病毒列为最高威胁类别，但一些被列为低优先级的病毒家族含有在动物中引起严重流行病的病毒，缺乏有效的疫苗平台，并且可以想象，这些病毒可能会被重新定位以影响人类。

Unfortunately, if we are to defend against the range of AI-enabled threats, representatives of these families must be added to the list of prototype pathogens being pursued in parallel.

不幸的是，如果我们要防御一系列人工智能威胁，就必须将这些家族的代表添加到并行追查的原型病原体列表中。

Though this adds significantly to the program cost, preemptive vaccine development is not only orders of magnitude cheaper than being caught without any vaccine, it is also cheaper than reactive vaccine development because it does not require compressed timescales or spinning up myriad parallel efforts.

尽管这大大增加了计划成本，但先发制人的疫苗开发不仅比没有任何疫苗的情况下要便宜几个数量级，而且还比反应性疫苗开发便宜，因为它不需要压缩时间尺度或启动无数并行的工作。

By accepting that handwringing about extinction of humanity due to AI-developed bioweapons can be safely excluded from consideration, we can avoid the apocalyptic and millenarian responses cropping up in AI safety circles.

通过接受关于人工智能开发的生物武器导致人类灭绝的担忧可以安全地排除在考虑范围之外，我们可以避免人工智能安全圈中出现的世界末日和千禧年反应。

That said, pandemics cause an immense toll of suffering and profound strategic effects, and AI tools have already generated designs for viable viruses not found in nature.

也就是说，流行病造成了巨大的痛苦和深远的战略影响，而人工智能工具已经为自然界中未发现的可行病毒生成了设计。

In the hands of a malicious actor, designs could include pathogenic animal viruses retargeted to humans, existing threats adapted to evade anti-infective drugs, or strains modified to dodge pre-existing immunity.

在恶意行为者手中，设计可能包括重新针对人类的致病动物病毒、适应逃避抗感染药物的现有威胁，或经过改造以逃避预先存在的免疫力的菌株。

No matter what properties they have, they will be based on viruses we know well.

无论它们具有什么特性，它们都将基于我们熟知的病毒。

By diligently preparing for future viral outbreaks, plus expanding our definition of viruses of concern to include viruses that could easily be reprogrammed via AI to cause trouble, we can be ready to limit the impact of such an event.

通过努力为未来的病毒爆发做好准备，再加上扩大我们对受关注病毒的定义，将那些很容易通过人工智能重新编程造成麻烦的病毒包括在内，我们就可以准备好限制此类事件的影响。

AI tools assist in the invention of new gene sequences that don’t exist in nature, but they are insufficient for turning these sequences into live viruses because the processes of resurrecting live virus from DNA are not automated and require a level of technical skill as well as access to specialized equipment, materials, and a supplier willing to manufacture the synthetic DNA.

人工智能工具有助于发明自然界中不存在的新基因序列，但不足以将这些序列转化为活病毒，因为从 DNA 中复活活病毒的过程不是自动化的，需要一定的技术水平以及专业设备、材料和愿意制造合成 DNA 的供应商。

This gives clear points of intervention and mitigates the sometimes-discussed risk that clusters of rogue agentic AI instances will somehow hack their way into creating a biological virus without significant human involvement.

这提供了明确的干预点，并减轻了有时讨论的风险，即流氓代理人工智能实例集群会在没有大量人类参与的情况下以某种方式破解创建生物病毒。

Whether an AI is well-aligned to the user is of surprisingly little importance in a bio-risk context, but alignment to its core principles and filters in opposition to the malicious user could be protective.

在生物风险背景下，人工智能是否与用户保持一致并不重要，但与其核心原则和过滤器保持一致以对抗恶意用户可能具有保护作用。

Pacing progress through moratoriums or cooperation is frequently mentioned as an antidote to AI bio-risk, but that’s unlikely to help much since frontier large language models have not been the most significant contributors to AI design of viruses.

人们经常提到，通过暂停或合作来加快进展是人工智能生物风险的解药，但这不太可能有多大帮助，因为前沿大型语言模型并不是人工智能病毒设计的最重要贡献者。

As frontier models become better at coding and at conducting AI research itself, they may gain the ability to make improved domain-specific AI models for biology and change this.

随着前沿模型在编码和进行人工智能研究方面变得更好，它们可能有能力为生物学改进特定领域的人工智能模型并改变这一现状。

An open question is the degree to which skills will transfer across domains: Will an excellent general-purpose text-based large language model improve at predicting which DNA sequence will survive?.

一个悬而未决的问题是技能跨领域转移的程度：一个优秀的基于文本的通用大语言模型能否在预测哪些 DNA 序列将幸存方面有所改进？

However, precisely the domains most relevant for improving human health — predicting how to engineer proteins that behave exactly how you want, for instance — have dual-use applications in the invention of harmful viruses, so pacing viral threat-specific progress is also impossible.

然而，正是与改善人类健康最相关的领域——例如，预测如何设计出完全按照你想要的方式运行的蛋白质——在有害病毒的发明中具有双重用途，因此针对特定病毒威胁的进展也是不可能的。

For the frontier labs, safeguards and monitoring have a better societal cost-benefit profile than slowing the advance of the frontier.

对于前沿实验室来说，保障和监控比减缓前沿的进步具有更好的社会成本效益。

Presumably, one day AIs will gain the ability to invent something unlike any organism we’ve seen, perhaps by gaining a better internal model of the world than a human mind can parse.

据推测，有一天，人工智能将有能力发明一些不同于我们所见过的任何有机体的东西，也许是通过获得比人类大脑可以解析的更好的世界内部模型。

Whether this will happen in 10 years or 30 is hard to predict from the way things stand today.

从目前的情况来看，很难预测这是否会在 10 年或 30 年后发生。

But in the meantime, the difficult and unglamorous slog of pandemic preparedness is our task to avoid or mitigate the next COVID-19-level event coming our way, whether natural or synthetic.

但与此同时，我们的任务是避免或减轻下一次 COVID-19 级别的事件（无论是自然的还是合成的），做好大流行准备工作是困难且乏味的。

Jason T.

杰森·T。

Kaelber, Ph.D., is an associate professor of molecular biology and biochemistry at Rutgers, the State University of New Jersey, with a research focus on structural and computational virology.

Kaelber 博士是新泽西州立大学罗格斯大学分子生物学和生物化学副教授，研究重点是结构和计算病毒学。

His laboratory designs virus-inspired vaccines and therapeutic platforms and develops new methods for virus detection or characterization.

他的实验室设计了受病毒启发的疫苗和治疗平台，并开发了病毒检测或表征的新方法。

Work in the author’s lab is funded by grants from the National Institutes of Health and REGENXBIO Inc., and by intramural support from Rutgers University.

作者实验室的工作由美国国立卫生研究院和 REGENXBIO Inc. 的资助以及罗格斯大学的校内支持资助。