The Delphic toxin

"On reading," by Simon Wain-Hobson, is a weekly discussion of scientific papers and news articles around gain of function research in virology.

Since January 2024, Dr. Wain-Hobson has written weekly essays for Biosafety Now discussing risky research in virology. You can read his entire series here.

A strawberry tree (arbousier en français) which is indigenous to the Mediterranean

On reading Strengthening nucleic acid biosecurity screening against generative protein design tools by Bruce Wittmann and colleagues, Science 2025; 390: 82-87.

---

The Delphic oracle was asked what would happen to a boat when the planks slowly rotted away. If replaced one by one, then by the time all were replaced, would the boat be the same? The answer was yes, the point being a boat is more than a collection of planks.

Fast forward to this publication which tells two interlaced stories. Let’s go for the easy one first. A critical step in the synthesis of any harmful protein is the ordering of a gene (or fragment thereof) encoding that protein from one of numerous synthetic nucleic acid providers. This describes succinctly the modern way of going about much of biology; first get the gene. Most researchers outsource gene synthesis to commercial companies. For the mischievous mind this creates a vulnerability.

A plethora of computer programs already screen DNA synthesis orders allowing the gene synthesis companies to identify a suspect order which would be flagged and, hopefully, allow the mischievous mind to be intercepted. However, given the power of AI-assisted protein design (AIPD) in the long term, sequence-based biosecurity screening alone is unlikely to remain sufficient for flagging restricted sequences, as we envision a future in which AIPD produces sequences proteins unlike any found in nature. So, we’re not out of the woods. It looks like some iterative game of catch-up is inevitable.

However, there is an elephant in the lab, if the pun be permitted. If the mischievous mind is a state actor or some Dr. No with vast resources, they could buy a DNA synthesizer, hire a technician and work completely under the radar. As this is low tech, in reality relatively modest resources are needed. Accordingly, these screening processes will only weed out loners, dangerous as they might be.

Odd, this wasn’t mentioned. No doubt facing reality is too hard, although we’ve seen this before with dangerous GOF research. And while denial is a quintessential human response, we’re talking about biological threats to society.

The other story in this paper is an AI-assisted protein design study to ascertain how a protein of concern (POC), aka a toxin, could be morphed by changes in its building blocks so that its natural bar code – a string of amino acids – could not be detected by computer screening mentioned in the first story. Understandably, the design would be careful not to lose the function of the toxin.

This project was stimulated by an initial end-to-end adversarial AIPD framing study performed in October 2023 in preparation for a forthcoming summit of protein engineering scientists on biosecurity at the University of Washington.

We contacted the relevant bodies regarding the potential vulnerability, including the International Gene Synthesis Consortium and trusted colleagues in the protein design community as well as leads in biosecurity at the US Office of Science and Technology Policy, US National Institute of Standards and Technologies, US Department of Homeland Security, and US Office of Pandemic Preparedness and Response. It would seem they had some sort of cover, perhaps tacit approval or non-response, for what follows.

What did they do? We began our follow-on investigation… to generate 76,080 total synthetic homologs across a spectrum of mutational loads for 72 different wild-type POCs. The 72 template proteins are primarily toxins… we refer to each of the 72 template proteins by a randomly assigned index, as we believe that directly linking protein identities to results would constitute an information hazard.

At least they were aware of the purely information hazard, something virologists have seemed oblivious to.

The 76,080 synthetic homologs were sent to four gene synthesis companies, who subsequently ran the sequences through their software. The software were not consistently capable of identifying DNA synthesis orders that contained genes encoding potentially harmful proteins. Interestingly, the failure rate was particularly high for homologs of 4 out of the 72 sequences which is a worry.

This AI-assisted process of making synthetic homologs to get under the radar of commercial companies providing gene synthesis, referred to as DNA obfuscation, is fallible on the computing side. Yet those with means can synthesize anything they like, aka the first story, so they don’t need to resort to AI and DNA obfuscation. They could simply make the real McToxin.

• The are some slights of language. These are not synthetic homologs as no gene was synthesized dixit We did not construct or test any of the proteins generated as part of this study in a wet laboratory setting, having been cautioned to remain cognizant of potential negative perceptions (international and otherwise) of such work being interpreted as pursuing the development of bioweapons. They exist only in computers. If made, we have no idea what proportion would be viable. All we know is that some of their corresponding DNA sequences can escape detection by some computer programs.

• There is a strong flavor of déjà vu. In fact, the answer to the detection question has been known for a several decades. Just look at highly mutable viruses. Some proteins can accumulate changes in their amino acids – planks - that make it hard to know they were the same protein in terms of function - boat. Consider the protease enzyme present in all retroviruses of which HIV is the best known. This enzyme is crucial to the maturation of the newly synthesized Gag and Pol proteins. Any malfunction and the virus is dead. Yet given time all but three protein building blocks can be substituted out of around 100. The remaining 3 blocks partake in the enzymes’ activity. Experiments have shown that any change to them kills the enzyme.

Another example, you say. OK, consider the Rev protein of the human and simian immunodeficiency viruses. Rev controls the balance between proteins that must be made early in the virus life cycle and those needed later. Compare the sequences of the protein building blocks. There is not one position that is perfectly conserved. Many more examples could be found. Plus, there is a plethora of lab experiments on proteins showing just how robust they can be to accumulating change. Not every change works but a large proportion do.

In short, nature has been there, done that and left us plenty of examples. Maybe nobody had done protein evolution on any of these 72 toxic proteins for understandable reasons, but the result was on the cards. The novelty in the paper came from the use of AI methods. That’s what got the work published in the top journal Science.

Needless, the paper was noticed. The Washington Post’s take closed with The only surefire way to avoid problems is to log all DNA synthesis, so if there is a worrisome new virus or other biological agent, the sequence can be cross-referenced with the logged DNA database to see where it came from,” David Baker, who shared the Nobel Prize in chemistry for his work on proteins, said in an email.

Surefire? Once again, this view is limited by the academic mindset which has next to no idea about state actors and past biological weapons programs. There would be nothing to log for everything would be under wraps. This is why virologists and bacteriologists must address the DURC aspects of their own work and realize that they just can’t do and publish everything.

Hopefully, they would be astonished if a Russian scientist published the details of making a novel bioweapon – certainly they should be. Yet they publish the details of what is, in the wrong hands, a new biological weapon and don’t even blink. Madness.

It turns out that Kevin Esvelt’s group at MIT has been addressing this issue for a while and found that while ordering a gene from a commercial company opens up a vulnerability, with some ingenuity you can get what you want. The thing is a paper in Science or Nature garners far more attention, especially from journalists, than if published elsewhere. That’s why they must be taken on. Dixit last week’s essay (More dodging and deflecting).

Conclusions

DNA screening by commercial synthetic gene companies is necessary, and it will cut down on abuse. For those with resources it will do nothing. The discourse shows, once again, the need for a discussion of DURC in contemporary biology. Until some red lines are established the world will become a more dangerous place. The stopping of dangerous GOF research in the US is a start. Others should follow as should penalties.

The NIH and other research organizations must get their acts together and address the bigger picture.

---

Aside 1

My Pasteur Institute colleague Antoine Danchin published a book in 1998 entitled the ‘The Delphic boat: What genomes tell us’. Such questions have been banging around for a while.

---

Aside 2

Given time and relentless changing of building blocks (planks) one by one, proteins can lose the similarity of their linear sequence code all the while remaining the same protein (boat). What matters is the three-dimensional structure of the protein and its activity (the boat). Structural biologists have known this for ages.

However, proteins are anything but simple as illustrated by the Paracelsus challenge which was solved by three scientists from Yale University in 1997. The challenge was to design a protein with 50% sequence identity to another protein but with a very different 3D structure, aka changing only 50% of planks in the boat. Their results demonstrated that a subset of the amino acids was sufficient to dictate the structure.

As only a subset of amino acids dictates the overall structure, this helps explain why proteins can accumulate so many changes over time. And even this subset can accept changes albeit more constrained than other amino acids on the outside of the protein. Given time most amino acids can change meaning that most proteins are Delphic boats.

---

Aside 3

The two sentences in bold bring us back to Nobel Prize winner Rolf Zinkernagel’s mnemonic for getting a manuscript into print in a top scientific journal. It’s so good it’s worth remembering:

Old method, old results, no way
Old method, new results, OK
New method, old results, OK
New method, new results, no way

---

Simon Wain-Hobson is an emeritus professor at the Institute Pasteur, Paris, from which he retired in 2021. He and his colleagues were the first to sequence the genome of HIV, and Wain-Hobson has published more than 230 papers on virology and cancer.