Projects

This project assesses the capabilities of AI-enabled and non-AI biological tools relevant to hazardous-virus design and examines their implications for biosecurity risk.

This project automates viral threat detection by screening viral genomes for high-risk recombination events. It applies a sliding-window algorithm across sequence junctions in NCBI and CASPER metagenomic data, producing a quantitative “surprise score” that automatically flags novel, anomalous viral variants for early biosurveillance triage.

This project revises and expands Coefficient Giving’s practical guide to household protection during extreme biological events, covering methods for reducing exposure through air, food, water, surfaces and other pathways. It assesses existing recommendations, identifies evidence gaps and develops clearer guidance for maintaining protection throughout prolonged emergencies.

This project, conducted with Sebastian Oehm and Askar Kleefeldt at SynX Therapeutics, maps global macrocyclic-peptide manufacturing capacity and its supply-chain vulnerabilities. It tests whether rapid-response therapeutics could be produced at population scale during a severe pandemic or deliberate attack, including threats enabled by AI-driven biological design.

This project ranks candidate experiments by cost, timeline and decision-relevance, and establishes the funding decision rules to pre-commit to before results arrive.

This project assesses whether genome language models can identify viruses that are increasingly different from those in their training data, informing both detection efforts and assessments of the models’ own capabilities.

This project conducts early engineering and strategic work toward the first draft of a handbook detailing how the average person can maximise their chances of surviving an extreme environment-to-human biological disaster, such as a mirror-bacteria pandemic.

This project investigates mirror bacteria, which could plausibly evade immune and ecological control if released. It reproduces recent population-model analyses suggesting that they would struggle to establish, then tests how strongly those conclusions depend on assumptions about predation, nutrient dynamics and spatial structure. This sharpens the quantitative basis for assessing mirror-life risk.

This project creates the Observatory, a public, source-linked dataset of frontier AI companies’ biological commitments. It records what is specific to biological risk beneath a generic “CBRN” label, who can authorise crossing a threshold, and whether each claim is binding or aspirational.

This project examines the gap between the theoretical effectiveness of pandemic PPE and its performance in real-world use, from a human-factors perspective.

This project tests whether predicted viral protein structures can replace experimentally derived structures when training inverse protein-folding models, gauging the potential effectiveness of pathogen data controls.

This project examines indoor air quality (IAQ) as a way to reduce airborne infectious-disease transmission, given that the vast majority of respiratory infections occur indoors. It assesses which interventions should be deployed in different contexts and investigates the policy levers needed to make the air in public spaces safer to breathe.

This project identifies current obstacles to developing mirror life and assesses the risk that AI could accelerate research to overcome them.

This project addresses the lack of an established route for concerning biological capability findings from frontier AI pre-deployment evaluations to reach the UK government. Drawing on evaluator interviews and the cyber precedent of coordinated vulnerability disclosure, it develops technical guidance for labs and evaluators on what to share, alongside recommendations for UK government bodies on how to receive it.

This project improves estimates of how sensitive wastewater sequencing is at detecting respiratory viruses by pairing untargeted nasal-swab prevalence data with deep wastewater metagenomics. It will help public health agencies price and size biosurveillance programmes against a defensible detection threshold rather than a guess.

A benchmark evaluating whether AI agents comply with US sanctions law.

Building a benchmark that probes whether and how models engage in "deal-making" — offering a potentially-scheming model something in exchange for revealing misalignment — with a focus on qualitatively analysing the model's reasoning about credibility, cheating and being evaluated.

Developing a framework to help AI-lab insiders judge whether and when to disclose high-impact information.

Designing a privacy-preserving side-channel monitor for AI compute — hardware-level monitoring that could help verify how chips are being used.

Designing and prototyping a simpler, smaller-attack-surface "cross-domain solution" for securely moving data — the kind of security-critical infrastructure needed to protect model weights against sophisticated state-level attackers under the SL5 standard.

Working toward a taxonomy for compositional interpretability and hierarchical concepts — top-down interpretability techniques aimed at pragmatic alignment goals.

Producing a rigorous threat model and capability-threshold analysis for Autonomous Replication and Adaptation (ARA) — working out where the weakest links are in the causal chain, and whether current lab safeguards adequately cover the threat.

Recent evals have begun to go beyond human-expert capability by asking models to predict real-world biology experiment outcomes — but that needs a constantly refreshed pool of experiments outside the training corpus to avoid measuring memorisation. Kamal is building an agent that automatically refreshes that pool by finding and formatting experiments from recent publications and preprints as eval tasks.

Applying Item Response Theory — the method behind the Epoch Capabilities Index — to item-wise eval data at SecureBio, to find the most information-rich items.

Auditing the effectiveness of Bloom as a measurement instrument for evaluating language models.

Testing whether LLM agents can model themselves and other agents in multi-agent settings — and whether, when a model fails to predict another agent, its guess gets pulled toward what it itself would have done. Relevant to any setting where one model monitors another.

Improving and challenging current LLM self-introspection techniques from an adversarial standpoint.

Studying how character traits shift reward-hacking rates and chain-of-thought monitorability, and whether a teacher model's "corrupted" self-account transmits to a student distilled on its reasoning.

Using deception detectors as reward signals for honesty training, developing methods to reduce obfuscation.

Building a control protocol that uses interrogation: a trusted model asks an untrusted model pointed questions about each proposed action, and a trusted judge uses the answers to catch dangerous actions while keeping useful ones flowing. The idea is that convincing justifications are easier to give when there’s a genuine reason, which should make the monitor more effective.

Investigating how agents influence one another over long-horizon, multi-turn interactions and tasks.

Testing whether the same persona evidence shapes a model more strongly when framed as its own prior behaviour or memory than when framed as another assistant's output or an external document — with implications for how memory, summaries and handoffs should be designed.

Working in Peter Hase's stream on interpretability for monitoring and steering LLMs — scoping a concrete project that turns interpretability into something practical for oversight.

Mapping extreme power concentration across frontier labs and governments: where the power actually lies, what kind of power it is, and how reversible it is.

Mapping the full U.S. response function — from active partnership and export exemptions through to restrictive instruments such as export controls, sanctions and supply-chain pressure — to identify the design choices that most affect the viability of a middle-power frontier-AI coalition, drawing on historical examples.

Investigating the "attractor" states LLMs drift into over long interactions (Claude's spiritual-bliss basin, Gemma's frustration spiral). He'll run many fast experiments to find basins systematically and see how character training, memory and compaction reshape them.

Developing new mechanistic-interpretability methods based on tensor networks.

Mapping the interests of middle-power nations and the kinds of coalitions they'd be interested in forming.

Developing verification layers for international AI agreements: researching physical side-channels (electromagnetic and power emissions) as fingerprints for LLM workload verification, letting a verifier classify what a cluster is actually running without trusting the operator.

In Kozzy Voudouris's stream, modelling what happens to scientific reliability when alignment research itself is automated.

Should more people be working on AI-enabled power concentration?

Tensor-network mechanistic interpretability for biological foundation models.

Mapping the scheming threat landscape within national-security and military AI deployment — which pathways are most plausible, most dangerous and least addressed, and whether scheming there is more likely to come from external interference or internal misalignment.

Investigating what causes “activation plateaus” in models — testing whether they arise because activations live on a non-linear manifold, and whether perturbing along the manifold versus across it predicts where the plateaus and their sensitive directions appear. This could give a data-independent way to discover a model’s features and steer it.

Understanding why models become evaluation-aware during post-training, and whether there are robust interventions for mitigating the rise in evaluation awareness and metagaming. Ryan is also collaborating with Ben Slater on the Bloom auditing project.