Bioweapons Attack Chain Model

Overview

This model decomposes AI-assisted bioweapons attacks into seven sequential bottlenecks, revealing that catastrophic biological terrorism requires success across multiple independent failure modes. The framework draws on RAND Corporation's 2024 red-team study↗🔗 web★★★★☆RAND CorporationRAND Corporation studyRAND research reports on AI and bioweapons risk are directly relevant to frontier AI evaluation policy, particularly debates around capability thresholds used in safety frameworks like Anthropic's RSP or OpenAI's preparedness framework.This RAND Corporation research report examines the risk of AI systems providing meaningful uplift to actors seeking to develop biological weapons, focusing on how to assess capa...existential-riskevaluationred-teamingcapabilities+6Source ↗ finding no statistically significant AI uplift for biological attacks, combined with historical analysis of state bioweapons programs and terrorist attempts.

Key findings: Overall attack probability ranges from 0.02–3.6%, with state actors posing the highest estimated risk (3.0%) due to superior laboratory access. The multiplicative probability structure means moderate interventions at any step provide substantial protection. DNA synthesis screening↗🔗 web★★★★☆Nuclear Threat InitiativeDNA synthesis screeningThis NTI page is currently a 404 error; content cannot be verified. The topic of DNA synthesis screening is relevant to biosecurity and AI-assisted biological risk, but the resource should be treated with caution until accessible.This NTI resource appears to address biosecurity risks from synthetic biology, specifically focusing on DNA synthesis screening as a mechanism to prevent misuse of biological te...bioweaponsgovernanceexistential-riskpolicy+3Source ↗ offers 5–15% modeled risk reduction for $1–20M annually, while metagenomic surveillance↗🔗 webBiosecurity SurveillanceA Harvard Global Health Institute resource on biosecurity surveillance relevant to AI safety researchers concerned with catastrophic biological risks, bioweapons proliferation, and the governance frameworks needed to monitor and respond to biological threats.This Harvard Global Health Institute resource focuses on biosecurity surveillance systems, likely covering monitoring frameworks for biological threats including naturally occur...existential-riskgovernancepolicybioweapons+3Source ↗ provides 15–25% reduction for $500M. This mathematical structure is consistent with defense-in-depth strategies against bioweapons risksRiskBioweapons RiskComprehensive synthesis of AI-bioweapons evidence through early 2026, including the FRI expert survey finding 5x risk increase from AI capabilities (0.3% → 1.5% annual epidemic probability), Anthro...Quality: 91/100.

The model incorporates a key empirical claim that information is not capability—even complete knowledge cannot alone overcome the synthesis bottleneck, where tacit knowledge and laboratory skills create barriers that are not fully addressed by AI-assisted information retrieval. This claim reflects current empirical evidence but carries substantial uncertainty as AI capabilities evolve; the conditions under which it could cease to hold are discussed in the AI Uplift and Limitations sections below.

Expert opinion on biosecurity trajectories is divided. Some analysts emphasize persistent technical barriers and improving defensive capabilities as grounds for measured optimism; others point to accelerating AI capabilities, dual-use research proliferation, and governance gaps as reasons for concern.¹ The sections that follow present both perspectives where relevant, rather than a single projected trajectory.

Risk Assessment

Attack Chain Architecture

Sequential Bottleneck Model

A successful attack requires traversing all seven stages sequentially. Failure at any stage terminates the attack chain with multiplicative probability reduction.

flowchart TD
  subgraph phase1["Phase 1: Preparation"]
      A[Motivated Actor<br/>P = 0.95] --> B[AI Access<br/>P = 0.7-0.9]
      B --> C[AI Provides Uplift<br/>P = 0.2-0.5]
  end

  subgraph phase2["Phase 2: Development"]
      C --> D[Lab Access<br/>P = 0.3-0.6]
      D --> E[Successful Synthesis<br/>P = 0.1-0.4]
  end

  subgraph phase3["Phase 3: Execution"]
      E --> F[Effective Deployment<br/>P = 0.2-0.5]
      F --> G[Evades Countermeasures<br/>P = 0.3-0.7]
  end

  G --> H[Catastrophic Attack<br/>P = 0.02-3.6%]

  style A fill:#fee
  style H fill:#fcc
  style E fill:#ffe

Mathematical Framework

The compound probability follows a multiplicative model with independence assumption:

$P(\text{catastrophic attack}) = \prod_{i=1}^{7} P_i$

where each $P_i$ represents conditional success probability at step $i$. This structure creates a defense multiplier effect: reducing any single parameter by 50% reduces overall risk by 50%, regardless of which step is targeted.

The independence assumption is a modeling convenience rather than an empirical claim. As noted in the Limitations section, positive correlation across steps—plausible for sophisticated actors who tend to succeed in multiple domains—would increase compound probability substantially. The correlation sensitivity analysis provides estimates under different correlation assumptions.

Parameter Estimates

Actor-Specific Risk Profiles

Different actor types face distinct bottleneck patterns based on resource access and operational constraints. The figures below reflect model-derived estimates under the independence assumption; they should be interpreted as illustrative ordinal rankings rather than precise probabilities.

Under the model's assumptions, state actors account for a large share of estimated catastrophic risk, primarily due to unrestricted laboratory access and scientific expertise. The specific figure of 80% cited in earlier versions of this page is model-derived under independence assumptions and should not be treated as an empirical finding; the true share depends heavily on correlation structure and parameter values that carry substantial uncertainty.

Parameter Uncertainty Analysis

The 180x range in compound probability reflects deep (Knightian) uncertainty rather than a conventional statistical confidence interval. No empirical study has directly estimated these joint probabilities; the ranges derive from expert elicitation and boundary-case reasoning. Readers should treat the compound estimate as an order-of-magnitude heuristic rather than a calibrated forecast.

Critical Bottleneck Analysis

Step 3: AI Uplift Assessment

The most uncertain parameter in the model is whether AI systems provide meaningful uplift to actors seeking to develop biological weapons. Current evidence is mixed and rapidly evolving.

The RAND Corporation's 2024 study↗🔗 web★★★★☆RAND CorporationRAND Corporation studyRAND research reports on AI and bioweapons risk are directly relevant to frontier AI evaluation policy, particularly debates around capability thresholds used in safety frameworks like Anthropic's RSP or OpenAI's preparedness framework.This RAND Corporation research report examines the risk of AI systems providing meaningful uplift to actors seeking to develop biological weapons, focusing on how to assess capa...existential-riskevaluationred-teamingcapabilities+6Source ↗ compared AI-assisted versus internet-only groups for biological attack planning, finding no statistically significant difference in information quality or actionability. However, this study has known design limitations: it tested a specific task framing, used particular model versions, and did not assess laboratory execution capability directly. Its null result should be understood as evidence against one specific form of uplift (information retrieval quality), not a comprehensive assessment of AI's biosecurity implications.

More recent capability evaluations suggest a different picture for specialized technical tasks. The AI Safety Newsletter issue 52 reported on an expert virology benchmark designed to assess whether frontier AI systems could answer questions at or above the level of trained virologists.² Unlike the RAND study's focus on information retrieval, this benchmark targets domain-specific reasoning and problem-solving of the kind that could reduce the tacit knowledge barrier. The benchmark methodology, the specific systems evaluated, and the precise performance levels achieved are discussed in the AI Uplift Assessment ModelAnalysisAI Uplift Assessment ModelQuantitative assessment estimating AI provides modest knowledge uplift for bioweapons (1.0-1.2x per RAND 2024) but more substantial evasion capabilities (2-3x, potentially 7-10x by 2028). The Virol...Quality: 70/100; the implication for this model is that the AI uplift probability range (0.20–0.50) may require upward revision as frontier models are evaluated on more demanding virology tasks.

The table below shows performance data from the RAND study for the models evaluated at that time. It should be noted that these models (GPT-4, Claude-3) have since been superseded by more capable successors, and that the evaluation methodology differs from the virology benchmark approach. Direct comparison across rows is therefore limited.

Note: These scores reflect the RAND 2024 study design and the specific model versions tested. Frontier models released in 2024–2025 (GPT-4oAi ModelGPT-4oGPT-4o ("o" for "omni") was released May 13, 2024 as OpenAI's flagship multimodal model. It natively processes text, image, and audio inputs and outputs. Matched GPT-4 Turbo intelligence at 50% low..., Claude 3.5/3.7, GeminiAi ModelGeminiGemini is Google DeepMind's family of multimodal AI models, first released in December 2023. Built natively multimodal from the ground up, processing text, images, audio, and video. The family span... 1.5/2.0) have not been evaluated under the same protocol. The virology benchmark referenced in AI Safety Newsletter #52 uses a different methodology and is not directly comparable to these scores.

The critical unresolved question is whether future AI systems will bridge the gap between information access and laboratory execution—specifically, whether they can convey tacit procedural knowledge in ways that reduce the synthesis bottleneck. This remains an active area of research and policy debate, with implications for the AI uplift parameter range in this model. The AI Uplift Assessment ModelAnalysisAI Uplift Assessment ModelQuantitative assessment estimating AI provides modest knowledge uplift for bioweapons (1.0-1.2x per RAND 2024) but more substantial evasion capabilities (2-3x, potentially 7-10x by 2028). The Virol...Quality: 70/100 provides more granular analysis of this question.

Step 5: Synthesis Bottleneck

The synthesis step represents the strongest persistent barrier in the current model. Even with complete genetic sequences and theoretical protocols, wet-lab execution requires tacit knowledge that transfers poorly through text-based AI interaction under current capabilities.

Historical evidence is consistent with high synthesis failure rates. The Soviet Biopreparat program↗🔗 webSoviet Biopreparat Biological Weapons ProgramRelevant to AI safety discussions around catastrophic and existential biological risks, especially as AI capabilities could potentially lower barriers to bioweapons development similar to Biopreparat's achievements.This Federation of American Scientists resource documents the Soviet Union's clandestine Biopreparat biological weapons program, one of the largest and most sophisticated biowea...bioweaponsexistential-riskgovernancepolicy+3Source ↗, despite substantial resources and expert personnel, required years to develop reliable production methods for select agents. Aum Shinrikyo's biological weapons program↗🏛️ governmentAum Shinrikyo's biological weapons programThis CDC MMWR report is mislabeled in the knowledge base as being about Aum Shinrikyo's bioweapons program; it is actually a routine foodborne illness surveillance report with no relevance to AI safety or bioweapons topics.This CDC MMWR report presents preliminary FoodNet surveillance data on nine foodborne illnesses across eight U.S. sites in 2000, covering 29.5 million people. It documents incid...biosecuritypublic-healthdatasetevaluation+1Source ↗ did not achieve effective biological weapons deployment despite investment in laboratory facilities.

AI-assisted InterpretabilityResearch AreaInterpretabilityMechanistic interpretability has extracted 34M+ interpretable features from Claude 3 Sonnet with 90% automated labeling accuracy and demonstrated 75-85% success in causal validation, though less th...Quality: 66/100: A notable development not reflected in the original synthesis challenge table is the emergence of structure-prediction and protein design systems such as AlphaFold3, RFDiffusion, and ESM3. These tools can accelerate certain steps in protein engineering—predicting how sequence changes affect structure and function—in ways that may partially reduce tacit knowledge requirements for actors with some laboratory background. However, their relevance varies substantially by synthesis challenge: they are more applicable to protein expression problems than to viral assembly or environmental stability, and they require wet-lab validation that remains a significant barrier. The AI Assistability ratings in the table above reflect current capabilities; this column warrants revision as protein design tool capabilities are evaluated against specific synthesis tasks. This potential pathway is discussed further in the AI Uplift Assessment ModelAnalysisAI Uplift Assessment ModelQuantitative assessment estimating AI provides modest knowledge uplift for bioweapons (1.0-1.2x per RAND 2024) but more substantial evasion capabilities (2-3x, potentially 7-10x by 2028). The Virol...Quality: 70/100.

Step 7: Countermeasure Effectiveness

Modern biosurveillance capabilities vary by region and pathogen type, creating geographic risk differentials.

The CDC's BioWatch program↗🏛️ governmentCDC's BioWatch programRelevant to AI safety discussions around biosecurity risks and government preparedness infrastructure; BioWatch illustrates the governance challenges of detecting and responding to biological threats, a concern heightened by AI-enabled bioweapon development risks.BioWatch is the U.S. Department of Homeland Security's early-warning biosurveillance system designed to detect the release of biological agents in major cities. The program oper...governancepolicyexistential-riskbioweapons+2Source ↗ provides continuous aerosol monitoring in major U.S. cities, while WHO's Disease Outbreak News↗🔗 webWHO's Disease Outbreak NewsThis WHO feed is a key empirical reference for biosecurity researchers modeling biological risks; it documents real-world outbreak data useful for calibrating probability estimates of pandemic-level events, including those relevant to bioweapons threat assessment.The WHO Disease Outbreak News is an official public health surveillance feed providing real-time updates on infectious disease outbreaks globally. It serves as a primary referen...existential-riskgovernancepolicycoordination+3Source ↗ coordinates global surveillance. Coverage remains more limited in lower-resource regions, creating geographic asymmetries in detection probability.

AI as a defensive tool: The countermeasure landscape is not static, and AI systems are being developed for defensive biosecurity applications as well as representing a potential offensive risk factor. Relevant defensive applications include AI-assisted analysis of syndromic surveillance data to identify anomalous outbreak patterns, accelerated genomic sequencing interpretation for novel pathogen identification, and AI-assisted countermeasure development pipelines. The current model treats AI exclusively as a variable affecting offensive capability (Step 3); a more complete analysis would incorporate AI's potential effects on countermeasure effectiveness (Step 7) as well. Proponents of AI-assisted biosurveillance argue it could meaningfully reduce detection time for novel agents; critics note that the same capability improvements benefit both attacker and defender, and that defensive AI tools require significant infrastructure investment to deploy at scale.

Intervention Cost-Effectiveness

High-Leverage Interventions

Defense-in-depth strategies exploit the multiplicative probability structure, where moderate improvements across multiple steps compound to substantial risk reduction. The cost estimates below are model-derived and illustrative; empirical grounding for specific figures is limited. See also: AI Safety Defense in Depth ModelAnalysisAI Safety Defense in Depth ModelMathematical framework showing independent AI safety layers with 20-60% individual failure rates can achieve 1-3% combined failure, but deceptive alignment creates correlations (ρ=0.4-0.5) that inc...Quality: 69/100 for the general framework.

DNA synthesis screening↗🔗 web★★★★☆Nuclear Threat InitiativeDNA synthesis screeningThis NTI page is currently a 404 error; content cannot be verified. The topic of DNA synthesis screening is relevant to biosecurity and AI-assisted biological risk, but the resource should be treated with caution until accessible.This NTI resource appears to address biosecurity risks from synthetic biology, specifically focusing on DNA synthesis screening as a mechanism to prevent misuse of biological te...bioweaponsgovernanceexistential-riskpolicy+3Source ↗ appears cost-effective in the model's framework, requiring minimal international coordination while providing risk reduction across actor types. However, this intervention involves tradeoffs: mandatory screening requirements add costs and delays for legitimate research, and the effectiveness of screening against novel synthesis routes (rather than known sequences) is uncertain. International coordination for monitoring raises sovereignty considerations that have slowed similar efforts in other domains. These tradeoffs are not reflected in the cost-per-percent-reduction figures above.

Intervention Targeting by Actor Type

Different actor types require tailored intervention strategies based on their specific capability profiles and bottlenecks.

Timeline and Trajectory Analysis

Expert Views: Pessimistic and Optimistic Scenarios

Expert opinion on biosecurity trajectories is substantively divided. The framing below draws on competing analytical positions in the literature rather than presenting a single projected scenario.¹

Pessimistic perspective: Analysts concerned about near-term risk deterioration point to: accelerating AI capability development that may outpace current threat models; proliferation of open-source biological research tools and methods; weakening of international biosecurity governance norms; dual-use potential of protein design tools reducing synthesis barriers; and historically slow defensive infrastructure investment relative to offensive capability development. From this perspective, the window for effective preventive governance may be narrowing.¹

Optimistic perspective: Analysts who see grounds for longer-term improvement note: the synthesis bottleneck has persisted despite decades of information proliferation; biosurveillance infrastructure is expanding with declining sequencing costs; major AI laboratories have adopted pre-deployment biosecurity evaluations as an emerging norm; the RAND findings suggest near-term AI uplift may be more limited than feared; and historical bioterrorism attempts have had low success rates even for well-resourced actors.¹

Assessment: Neither perspective fully captures the uncertainty. The model's trajectory table below presents a single-scenario projection that reflects one plausible path; alternative trajectories consistent with the pessimistic or optimistic framings would show materially different risk evolution.

Capability Evolution Scenarios

The figures in this table represent one illustrative scenario under central-case assumptions. Alternative trajectories could diverge substantially depending on AI capability progression rates, biosecurity investment levels, and governance developments.

The 2030–2035 net-risk reduction is contingent on sustained biosecurity governance investment and successful development of universal vaccine platforms—neither of which is assured. Under a pessimistic scenario where AI capability acceleration outpaces defensive investment, net risk in that period could remain positive.

Critical Decision Points

Regarding AI laboratory pre-deployment biosecurity evaluations: several major AI developers have incorporated biosecurity-specific red-teaming into their deployment processes, though the scope, methodology, and third-party auditability of these evaluations vary. Standardization and independent verification of pre-deployment biosecurity assessments remain open governance questions.²

Model Limitations and Uncertainties

Structural Assumptions

The multiplicative independence model embeds several simplifying assumptions that may not reflect reality:

Binary outcome limitation: The model is calibrated for catastrophic attack scenarios (mass-casualty bioweapons). This framing excludes a range of harmful outcomes that fall short of catastrophe: targeted assassinations, limited-scale attacks causing dozens or hundreds of casualties, economic disruption from credible threats, and public health burdens from partially effective agents. The full harm distribution from biological threats is broader than the catastrophic tail, and the model's policy implications may not generalize to the sub-catastrophic range.

Dynamic probability evolution: The model treats each step's probability as fixed. In practice, AI capabilities, biosecurity countermeasures, regulatory frameworks, and actor capabilities co-evolve. A more complete model would treat probabilities as time-varying functions with feedback between attacker adaptation and defender response. The timeline table above provides a partial approximation of this dynamic, but does not capture strategic adaptation by sophisticated actors in response to specific interventions.

Insider threat scenarios: The model does not separately address insider threats—actors with existing laboratory access and technical expertise who seek to misuse their position. Insider scenarios have materially different bottleneck profiles: Steps 3 (AI uplift) and 4 (lab access) are largely bypassed, making synthesis capability and countermeasure evasion the primary limiting factors. The intervention priorities for insider threats differ correspondingly, with personnel security and behavioral monitoring taking precedence over synthesis screening.

Permanent knowledge proliferation: As noted in the Risk Assessment table, knowledge proliferation is treated as irreversible. This means interventions that reduce synthesis barrier height provide diminishing returns over time as laboratory techniques become more widely documented. The long-term policy implication is that early investment in detection and response capabilities may have higher durable value than early investment in synthesis access barriers, though both contribute in the near term.

Correlation Sensitivity Analysis

If attack steps are positively correlated rather than independent, overall risk increases substantially. The estimates below are model-derived; no empirical study has directly measured inter-step correlations for bioweapons attack scenarios. The moderate-correlation scenario (r=0.4) may be plausible for sophisticated actors, but this is a judgment rather than an empirical finding.

The compound uncertainty range (0.02–3.6%) presented throughout this model assumes zero correlation. Under moderate positive correlation, the upper bound would rise to approximately 6–7%, and the central estimate to approximately 1.8%. This sensitivity analysis suggests the model's headline figures may understate risk for sophisticated, well-resourced actors.

Key Insights and Policy Implications

Strategic Insights

• Defense multiplier effect: The multiplicative structure means moderate barriers at multiple steps provide compounding protection
• Information ≠ capability (contingent): The synthesis bottleneck has persisted despite information proliferation under current AI capabilities; this may change if AI systems develop stronger tacit-knowledge transfer for laboratory procedures
• Geographic risk concentration: Detection and response capability is unevenly distributed, with lower-resource regions having substantially longer average detection times
• Actor type heterogeneity: Different actor categories have materially different bottleneck profiles, requiring differentiated intervention strategies

High-Priority Research Questions

Policy Recommendations

The model supports defense-in-depth approaches over single-point solutions, given the multiplicative protection structure and robustness to parameter uncertainty. The recommendations below are ordered by modeled cost-effectiveness; each involves implementation tradeoffs that policymakers would need to weigh.

1. Immediate (2025–2026): Expand DNA synthesis screeningApproachCompute MonitoringAnalyzes two compute monitoring approaches: cloud KYC (implementable in 1-2 years, covers ~60% of frontier training via AWS/Azure/Google) and hardware governance (3-5 year timeline). Cloud KYC targ...Quality: 69/100 programs with international coordination. Tradeoff: Adds compliance costs and latency for legitimate research; effectiveness against novel synthesis routes not yet demonstrated; international coordination has historically been slow.

2. Short-term (2026–2028): Expand metagenomic surveillance to major population centers globally. Tradeoff: High infrastructure cost; raises data sovereignty and privacy considerations; coverage gaps in lower-resource regions may persist.

3. Medium-term (2028–2032): Develop international bioweapons verification protocols with enforcement mechanisms. Tradeoff: Enforcement mechanisms require state compliance that may not be achievable; verification of biological programs is technically more difficult than nuclear verification; diplomatic and sovereignty constraints are substantial.

4. Long-term (2030+): Invest in universal vaccine platforms and rapid response capabilities. Tradeoff: Very high development cost; long lead times; platform approaches may not generalize to all novel agents.

5. Cross-cutting: Standardize and independently audit pre-deployment biosecurity evaluations by AI developers.² Tradeoff: Adds development costs; auditing methodology not yet established; competitive pressures may create incentives to minimize scope.

The model's cost-effectiveness estimates carry the same deep uncertainty as the underlying probability estimates. The ranking of interventions could shift under different parameter assumptions, particularly if AI uplift probabilities are revised upward based on more recent capability evaluations.

Related Analysis

This model connects to several related risk assessments and intervention frameworks:

• AI Uplift Assessment ModelAnalysisAI Uplift Assessment ModelQuantitative assessment estimating AI provides modest knowledge uplift for bioweapons (1.0-1.2x per RAND 2024) but more substantial evasion capabilities (2-3x, potentially 7-10x by 2028). The Virol...Quality: 70/100 — Detailed quantitative analysis of Step 3 parameters, including the virology benchmark findings and protein design tool implications
• AI-Bioweapons Timeline ModelAnalysisAI-Bioweapons Timeline ModelTimeline model projects AI-bioweapons capabilities crossing four thresholds: knowledge democratization already partially crossed (fully by 2025-2027), synthesis assistance 2027-2032 (median 2029), ...Quality: 58/100 — Temporal evolution of attack chain probabilities
• AI Safety Defense in Depth ModelAnalysisAI Safety Defense in Depth ModelMathematical framework showing independent AI safety layers with 20-60% individual failure rates can achieve 1-3% combined failure, but deceptive alignment creates correlations (ρ=0.4-0.5) that inc...Quality: 69/100 — General framework for layered security strategies applied in the Intervention Cost-Effectiveness section
• Misuse Risks — Broader category including bioweaponsRiskBioweapons RiskComprehensive synthesis of AI-bioweapons evidence through early 2026, including the FRI expert survey finding 5x risk increase from AI capabilities (0.3% → 1.5% annual epidemic probability), Anthro...Quality: 91/100 and autonomous weaponsRiskAutonomous WeaponsComprehensive overview of lethal autonomous weapons systems documenting their battlefield deployment (Libya 2020, Ukraine 2022-present) with AI-enabled drones achieving 70-80% hit rates versus 10-2...Quality: 56/100

Sources & Resources

Primary Research

Technical Resources

Expert Organizations