arXiv:2606.10080: VFUSE — Sparse autoencoders reveal virulent proteins in AI design models

What is a feature-level virulence audit?

A feature-level virulence audit is a systematic check of which internal representations of an AI model respond to dangerous biomolecular designs. Unlike black-box approaches that assess only output sequences, VFUSE goes deeper — into the diffusion-transformer activations inside RoseTTAFold3 and RFDiffusion3. On those activations, researchers Michael Yu and Matthew Olson (arXiv:2606.10080, June 8, 2026) train Sparse Autoencoders (SAE) — sparse autoencoder networks that compress high-dimensional activations into monosemantic features.

Monosemanticity means that each learned feature activates exclusively on one type of sample. Virulent proteins and legitimate therapeutic candidates activate different sets of features, making the SAE latent space a natural terrain for biosecurity auditing.

AUROC 0.84 and comparison with direct probes

Linear probes trained in the SAE latent space achieve AUROC 0.84 (q < 10⁻¹³) for distinguishing dangerous protein designs from safe ones. This is a statistically highly robust result: a q-value far below 10⁻¹³ excludes chance as an explanation.

The key comparison: the same linear probes trained directly on the model’s raw representations — without the SAE layer — achieve a significantly lower AUROC. The SAE latent space provides better linear separability of virulent samples than the original hidden states of the network. This finding confirms the core hypothesis: mechanistic interpretability is not merely a theoretical tool but has a measurable practical advantage in detecting biosecurity threats.

Zero cost to legitimate tasks

The critical test of any security method is its impact on the utility of the audited model. The VFUSE audit modifies neither the model’s weights nor the sequence generation procedure — it is an exclusively analytical layer applied post hoc. The authors record zero performance degradation on standard protein design benchmarks: structural alignment accuracy and the diversity of generated sequences remain unchanged.

This paper sets a methodological precedent for applying mechanistically interpretable tools in generative biology — demonstrating that methods developed for understanding language models can be transferred to models that design physical biomolecules with potential biosecurity implications.