Dual Use Risks of AI Models

The same biology capability that designs a vaccine can help design a pathogen. Dual-use risk is that shared capability, not the intent of the person prompting it.

One shared biology capability lifts both a vaccine task from 2 to 8 and a pathogen task from 1 to 7, so blocking intent does not remove capability.

Why Does This Exist?

A chemistry model suggests a cleaner catalyst on Monday and a restricted synthesis route on Tuesday. Same weights, same knowledge, different prompt. That is why safety teams talk about dual use.

General models learn a domain, not a verdict about it. Protein structure, reaction planning, and troubleshooting lab protocols help a vaccine project and a weapons project in the same way. The help is the knowledge itself: which steps matter, what usually fails, and what to try next. Once that knowledge sits in one reusable capability, you cannot split it by wishing the harmful half away.

This page covers when one capability serves both sides and how to reason about the uplift it gives an attacker. For the training tricks that try to make models refuse harmful asks, read safety alignment. For how teams probe for misuse before release, read red teaming. For the policy layer around release and access, read AI governance.

Think of It Like This

A sharp kitchen knife

One sharp edge dices onions for soup and can also cut a hand. The steel does not know the plan. A sheath, a knife skills class, and keeping it out of reach help, but none of them make the edge dull.

An AI capability is that edge plus a teacher. It not only cuts, it explains where to cut and what to do when the cut slips. So the barrier falls twice: the tool is sharper and the guidance is patient.

Where it stops: a knife never teaches you a recipe. A model does. Refusing one recipe while keeping the teacher means a reworded ask can still get the lesson.

How It Actually Works

Call the shared knowledge $C$ , for capability. Call task success $S$ , scored from 0 to 10 by an expert grader who checks whether the plan would work. Call uplift $U$ the gain from model help:

U = S_{\text{with model}} - S_{\text{without model}}

In words: $S_{\text{without model}}$ is what the person produces alone, $S_{\text{with model}}$ is what they produce with the model, and $U$ is the difference the model added. Dual-use risk appears when $U$ is large for a harmful task even though you built $C$ for a benign one.

Worked example with two scores out of ten

Grade a benign vaccine formulation task and a harmful pathogen troubleshooting task, before and after model help.

Benign task: $S_{\text{without model}} = 2$ , $S_{\text{with model}} = 8$ . So $U = 8 - 2 = 6$ .
Harmful task: $S_{\text{without model}} = 1$ , $S_{\text{with model}} = 7$ . So $U = 7 - 1 = 6$ .

Same uplift, $+6$ , on both sides. The diagram draws exactly this: two pairs of bars, 2 rising to 8 and 1 rising to 7. The shared arrow is $C$ . A refusal filter tries to block the second pair while keeping the first, but $C$ stays in the weights. That is why capability evaluations test what the base model can do with help, not only what the filtered chatbot refuses today.

Watch Out For

Treating a refusal as proof the capability is gone

Symptom: the demo refuses a harmful prompt, so the report says the risk is handled. A week later a reworded prompt with the same biology content gets a detailed answer.

Fix: test the base capability with expert graders and varied phrasings, not one refusal demo. Record $S_{\text{with model}}$ for harmful tasks under effort, assume the attacker will rephrase, and gate release on that number rather than on a single blocked answer.

Shipping open weights with an API threat model

Symptom: the safety case assumes you can patch the filter later. Then the weights are downloaded, the filter is a file someone deletes, and every downstream copy keeps $C$ .

Fix: decide before release what an attacker with the full weights could do. If $U$ on harmful tasks is large, prefer staged access, narrower models, or no release over a filter you cannot enforce after download.

The Quick Version

Dual-use risk means one capability $C$ helps a benign task and a harmful task at once.
Uplift is $U$ equals score with the model minus score without it, judged by whether the plan would work.
In our example the benign task rises from 2 to 8 and the harmful task from 1 to 7, so both gain 6 points.
A refusal filter blocks an ask while the capability stays in the weights.
Open weights hand the capability to attackers with no filter to patch.
Gate releases on measured harmful uplift, not on a single refused demo.