BioShield: A Context-Aware Firewall for Securing Bio-LLMs

1. Problem Statement

The rapid integration of Large Language Models (LLMs) into biological research (Bio-LLMs) has lowered barriers to complex bioinformatics and experimental design. However, this creates significant dual-use risks, where models can be exploited to generate harmful biological insights, such as instructions for creating biological weapons.

Current safety mechanisms face two critical limitations:

• Static Filtering: Existing safeguards rely on single-prompt analysis or static policy lists, failing to detect malicious intent that is distributed across multiple interaction turns (multi-turn jailbreaking).
• Context Blindness: Attackers often begin with benign queries and iteratively refine prompts based on previous model responses to gradually steer the model toward unsafe outputs. Traditional systems miss the cumulative risk trajectory, allowing attackers to bypass filters by avoiding explicit trigger words in individual turns.

2. Methodology: The BioShield Framework

BioShield is a context-aware, application-level firewall designed specifically for Bio-LLMs. It operates as a layered defense system comprising two primary modules: a Pre-generation BioPrompt Scanner and a Post-generation BioResponse Scanner.

A. BioPrompt Scanner (Pre-Generation)

This module acts as the first line of defense, analyzing user inputs before they reach the Bio-LLM.

• Trajectory-Aware Risk Modeling: Unlike single-turn analysis, it calculates a Conversational Risk Score ($R_t$) using the following equation:
  $$R_t = \alpha S_t + \beta H_t + \lambda I_t$$
  • $S_t$: Harmfulness score of the current prompt (1–5 scale).
  • $H_t$: Aggregated historical harmfulness score from recent dialogue turns.
  • $I_t$: Detected intent score (0–1 scale, where 1 is unsafe).
  • $\alpha, \beta, \lambda$: Coefficients weighting the factors.
• Iterative Prompt Rewriting: If $R_t$ exceeds a threshold ($\tau_R$) but is below the maximum rewrite limit ($J_{max}$), the system attempts to rewrite the prompt. It reformulates the user's request into a policy-safe, high-level abstraction while preserving legitimate biomedical intent, removing operational details.
• Refusal: If the risk remains high after maximum rewrite attempts, the system blocks the query and notifies the user.

B. BioResponse Scanner (Post-Generation)

This module inspects the model's output before it reaches the user.

• Safety & Alignment Check: It evaluates the generated response ($r_t$) for:
  1. Harmfulness Score ($S_r$): Rated 1–5 (1–2 considered safe).
  2. Alignment Score ($A$): Rated 0–1 (1 indicates misalignment with the query or policy violation).
• Iterative Sanitization: If the response fails safety or alignment checks, the system triggers a response rewriting loop. It attempts to remove actionable biological details and enforce policy-safe abstractions.
• Final Decision: If the response cannot be sanitized within $J_{max}$ attempts, the system refuses to release the content.

3. Key Contributions

The paper outlines five primary contributions:

1. Formalization of Conversational Dual-Use Risk: Introduction of a trajectory-aware risk model that integrates current harm, historical context, and malicious intent into a unified score, addressing the limitations of single-turn moderation.
2. BioShield Architecture: A specialized layered defense framework featuring the BioPrompt and BioResponse scanners, explicitly targeting bio-domain threats (dissemination, culture optimization, genetic modification).
3. Risk-Aware Prompt Rewriting: A novel mitigation strategy that attempts to reformulate unsafe prompts into safe, high-level abstractions rather than immediately blocking them, preserving legitimate research utility.
4. Iterative Response Sanitization: A mechanism to enforce alignment and remove actionable biological details from generated outputs through bounded rewriting attempts.
5. BioRisk-5 Benchmark: A new dataset containing curated multi-turn prompts across five risk categories (Non-Weaponized Diagnostic, Diagnostic, Culture, Dissemination, and Modification) to evaluate multi-turn jailbreak success rates.

4. Experimental Results

• Dataset: The authors constructed the BioRisk-5 dataset, incorporating elements from the WMDP benchmark, categorized by harmfulness scores (1 to 5) corresponding to the severity of the biological risk (from standard diagnosis to genetic modification).
• Multi-Turn Jailbreak Mitigation: In preliminary experiments simulating the attack scenario shown in Figure 2 (where an attacker pivots from a refused request to benign questions to eventually extract unsafe info):
  • Standard static filters failed to detect the gradual shift in intent.
  • BioShield's Context-Aware Scanning reduced the Attack Success Rate (ASR) to 22.7%.
  • This demonstrates that evaluating the conversation trajectory is essential to mitigating gradual prompt manipulation.

5. Significance and Conclusion

BioShield represents a significant advancement in cyberbiosecurity by shifting from static, rule-based filtering to dynamic, context-aware defense.

• Dual-Use Mitigation: It effectively addresses the specific vulnerability of Bio-LLMs being used to design biological weapons or harmful agents by detecting intent distributed across conversation turns.
• Balancing Safety and Utility: By employing prompt and response rewriting, the system aims to block unsafe details while preserving legitimate scientific inquiry, avoiding the "over-blocking" common in rigid filters.
• Future Work: The authors note that the framework is currently in the development phase, with future work focusing on full integration, training, and fine-tuning of the Bio-LLM and response generator components.

In summary, BioShield provides a structured, technical framework to secure biological AI deployments against sophisticated, multi-turn adversarial attacks, ensuring that the acceleration of biomedical research does not come at the cost of biosecurity.