Biodefense with Omnii-1, through API and edge deployment

Over the past several years, the biodefense community has made meaningful progress in detecting and characterizing genetically modified pathogens. Several nations are also advancing the scientific and operational capabilities needed to attribute a biological attack to its likely source. But the risk environment is changing quickly enough that progress alone is not sufficient; defensive capabilities must continue to improve as the tools for biological engineering become more accessible and more powerful.

That urgency is increasingly explicit in national policy. In its July 2026 biosecurity strategy implementation update, the United Kingdom observed that “biological risks regularly top the National Risk Register.”¹ Later that year, the U.S. Secretary of the Army described “a volatile technological convergence where advanced biotechnology and artificial intelligence are dramatically lowering the barrier to engineering biological weapons.”²

Governments and nongovernmental organizations are responding with increasingly ambitious goals for speed, accuracy, and field readiness. SecureBio, for example, has set a target of reducing the interval between sample collection and actionable early-warning results to three days.³ The U.S. Army has announced a rapid-prototyping effort for distributed microsensors that can characterize chemical, biological, and environmental signals with on-device edge AI and minimal supporting infrastructure.⁴ The United Kingdom is also preparing a Microbial Forensics Consortium tabletop exercise focused on the response to the deliberate release of a biological hazard.⁵ At the same time, falling sequencing costs⁶ are making metagenomic data available to a wider range of routine applications, including wastewater surveillance.

In June, we released an Omnii-1 defense research preview,⁷ including early results on the detection of pathogenicity-associated protein paraphrases. Since then, we have focused on pretraining Omnii-1, equipping it with detection capabilities, and turning those model capabilities into an operational interface for vetted researchers and agencies. The result is a restricted API and edge deployment for characterizing DNA and protein sequences, for example in synthesis screening and metagenomic surveillance. Here, we examine where sequence-based defenses fall short, test how Omnii-1 addresses those gaps, and describe how we are bringing those capabilities into operational use.

Two areas of improvement have been rising in focus for the biodefense community. First, many biosurveillance systems still depend heavily on pattern-matching an observed sequence to a known-reference database via bioinformatics algorithms. As the U.S. Defense Threat Reduction Agency recently summarized, “current approaches can be slow, require prior knowledge of engineered sequences, and struggle to keep pace with modern engineering techniques.”⁸

Bioinformatics tools are currently a critical layer of biological defense, but they inherit a basic limitation of their underlying search and alignment algorithms: they excel at matching known patterns and struggle with unfamiliar sequences. However, an engineered sequence can preserve a relevant function while (a) diverging away from a known wild-type sequence and (b) diverging from its known structure. This resulting forever-asymmetric “recall gap” is what leaves an attack surface^aa An attack surface is “the set of points on the boundary of a system, a system element, or an environment where an attacker can try to enter, cause an effect on, or extract data from, that system, system element, or environment.”⁹ in the space between recognizable homology and preserved biological function.

The important question is therefore not simply whether today's bioinformatics tools work well generally, but rather: how large are these tools’ failure modes, and how well can they generalize beyond documented threats toward the out-of-distribution tail. Because biological sequence screening must operate at multiple sequence resolutions, we study robustness gaps across two common ones: full protein sequences and metagenomic short reads. Through our investigation, we show that Omnii-1 complements existing bioinformatics tools by recognizing biological function beyond familiar sequence matches. For full proteins, it identifies potentially pathogenic functions despite substantial sequence divergence. For metagenomic reads, it flags viral sequences that reference-based tools miss.

Finally, a capable detector is only as useful as its accessibility. Centralized compute and reliable connectivity may be available in routine laboratory settings, but are not always available at military installations, in rural regions, or in areas affected by conflict or natural disasters. Power and network access may be limited, intermittent, or intentionally severed. A practical defense therefore needs both broad biological generalization and a path to deployment close to where samples are collected. Omnii-1 thus forms the basis of our edge deployment, just as it does for the defense API.

Building off the work of our previous release,⁷ we first revisit the Paraphrase benchmark:¹⁰ a dataset of synthetically generated, divergent protein sequences stemming from natural pathogenicity related proteins. This benchmark serves as a robustness stress-test for predicting pathogenic relation and viability in the face of sequence and structural divergence. The landscape of 16,307 likely functional^bb We use permissive criteria for likely function: sequence identity to wild type > 0.2, template modeling (TM) score > 0.5, and median change in predicted local distance difference test score (ΔpLDDT) > −10. paraphrase proteins is depicted in Figure 2. This low-dimensional landscape, where the lower-left region contains proteins that have moved furthest from the sequence and structure that a reference-based system expects, illustrates a small realm of the enormous attack surface that biodefense tooling must generalize to and defend against. Paraphrases concentrate at high structural similarity, while the sparsely populated lower-left region marks the furthest departures.

To benchmark the state-of-the-art on the bioinformatics side, we first map the paraphrase defense surface^cc A defense surface is the counterpart of an attack surface: in our setting, it is the share of that same landscape of sequences that a screening tool successfully flags, and where it leaves gaps. formed by the popular aligner DIAMOND,¹¹ searched against a standard UniRef100 database (Figure 3A). DIAMOND misses many pathogenic paraphrases, particularly those with low sequence identity to known proteins. Adjacent, we display the defense surface formed by Omnii-1's tuned classifier head (Figure 3B). Across various thresholds based on probability or recall-, precision-, and F1-matched cutoffs anchored on DIAMOND performance, we see multiple large defensive gaps filled. Across these 16,307 viable pathogen paraphrases, DIAMOND flags 83.3% as pathogenicity related, with its top-ranked hits sourced from a pathogen or toxin. Omnii-1 achieves a recall (at a probability threshold of 0.5) of 98.5% recall while maintaining high precision.

Higher recall on pathogenic sequences is useful only if it does not come at the expense of too many false positives. We therefore expanded the evaluation to include functionally unviable paraphrases and proteins not associated with pathogens. At a probability threshold of 0.5, Omnii-1 raises recall from DIAMOND’s 78.6% to 95.8%, while precision remains similar (63.8% versus 64.9%). This substantially reduces missed positives with only a small decrease in precision, improving F1 from 71.1% to 76.6%. Figure 4A shows the full comparison, including recall-, precision-, and F1-matched settings.

To understand how Omnii-1 reasons about paraphrase proteins, we mapped its emitted mean log-probability across the same 16,307 viable, pathogen-labeled paraphrases (Figure 4B). This value can be conceptualized as the model’s familiarity with an input sequence given its training distribution, and thus can serve as a proxy for sequence naturalness. Naturalness generally increases with sequence identity to the wild-type protein, but some moderately divergent sequences also receive high scores.

We next extended this approach from full proteins to metagenomic short reads (~150 base pairs). As with protein sequences, conventional metagenomic screening can lose sensitivity once a construct is divergent from an aligner’s reference sequences. However, compared to the full protein resolution, short reads pose extreme payload and modeling challenges: (1) finding pathogen-origin read-sized needles in a gigantic metagenomic haystack, where datasets often contain ratios of 1/1000 pathogen-origin to background reads; and (2) reading partial context snippets of origin pathogen sequences with partial coding and non-coding regions represented (as depicted in Figure 1). An illustrative analogy is trying to parse the intent or positioning of an op-ed article when given only a single sentence.

To address these challenges, we prototyped a version of Omnii-1 specialized in detecting human-infecting viruses from short reads in raw metagenomic data. To build this version of Omnii-1, we both distilled and trained it as a lightweight embedding, classification, and retrieval model with a function-aware training recipe to learn from the diverse space of metagenomics. Our model thus provides a prediction probability of viral origin to every read in the payload.

To test detection across increasing sequence divergence, we generated mutated viral genomes from 24 species, spanning 60–100% sequence identity to wild type. From each viral variant, we sampled and “spiked in” 1,000 simulated short reads into wastewater backgrounds of various sizes. Figure 5 and Figure 6 compare two mutation regimes: arbitrary substitutions and synonymous coding substitutions, along with noncoding substitutions.^dd In arbitrary-mutation mode, nucleotides are changed randomly across the genome. In synonymous-mutation mode, mutations can also occur anywhere in the genome, but substitutions within protein-coding genes must preserve the encoded amino acid. Noncoding positions can change without this constraint.

Figure 5 shows both read-level (Figure 5A) and mean-pooled (Figure 5B) embeddings of our specialized model, respectively hinting at semantic separation of viral origin versus background populations and semantic shifts with viral mutation. In Figure 5B, lines connect each species' runs in order of divergence, and the drift field overlays the mean step toward higher divergence in each region (shown only where more than eight steps fall in a cell). The trajectories flow toward a shared region largely independently of species, indicating that the model's representation shifts consistently with viral mutation. Consistent with this, displacement from each species’ wild-type embedding in the PCA plane increases with achieved divergence, rising steeply through about 20% and slowing beyond about 30%. Arbitrary substitutions produce larger shifts than synonymous substitutions.

In Figure 6, we compare our API’s findings with the popular Nucleic Acid Observatory (NAO, now called SecureBio Detection) metagenomic sequencing (MGS) workflow,¹⁴ which uses Nucleaze¹² against a database of vertebrate-infecting viral genomes, then aligns hits to the same database with Bowtie 2.¹³

These results show our strong recall gains (mean gain as high as 52%) on these simulated wastewater spike-ins, while maintaining a marginal false positive rate (FPR). Panels A–B of Figure 6 show recall against achieved divergence for 1,000-read, spike-only generated viruses from 24 species. The background setting (1M reads, 200k reads, or none) can be toggled for the whole figure. The purple curves show our Omnii-1-driven API and the gray curves show MGS; across species, our API maintains strong recall as divergence grows. Panel C shows the recall gain over MGS for every species and divergence level at the selected setting. The recall gain barely changes with background size, averaging about 31% for arbitrary and 52% for synonymous mutations. Panel D reports the FPR, the share of background reads flagged, for the conditions we tested against real background reads (all arbitrary conditions and part of the synonymous set). It stays at or below 0.5% in every condition and averages about 0.23% with 1M background reads and 0.17% with 200k background reads. These results overall demonstrate strong recall gains (and minimal FPR) over popular bioinformatics toolkits.

Biosecurity threats can also emerge naturally, often from zoonotic reservoirs or human populations with limited access to surveillance. These novel or highly divergent pathogens pose a particular risk because they can be missed by existing detection tools, leading to delayed public health responses. RNA viruses alone show how much room is left: of the 31,236 species the NCBI taxonomy assigns to a family, 239 have been reported to infect humans, and that set has grown in every decade since 1900 but one (Figure 7). It is not growing faster — the rate has run at about three species a year since the 1950s — but it keeps growing at the levels that matter for detection: no new family has entered it since 1989, while new genera have arrived in every decade since, each inside a family already known to carry human pathogens. A detector anchored to what is already catalogued will therefore trail what is emerging even within familiar lineages.

To test Omnii-1 on natural viral diversity, we asked the model to recover reads when close relatives of the source virus were missing from reference databases. We used short reads simulated from naturally occurring dengue and Bundibugyo Ebola virus genomes from Pathoplexus.¹⁶ This ablation experiment attempts to simulate nature: Dengue entered the record in 1907 as the second species of Orthoflavivirus, a genus already there since 1901, and Bundibugyo virus was discovered in 2007 and published formally in 2008 as the fifth species of Orthoebolavirus, a genus known since 1977. Removing a species, and then its whole genus, puts a reference database back in the state it was actually in each time.

To conduct the ablation itself, we progressively removed each target species and then its entire genus from the reference databases, pairing these conditions with Omnii-1 models retrained with the corresponding exclusions (Figure 8A). This tests Omnii-1’s capacity to generalize to, and robustly recover, out-of-distribution reads beyond the species and genera represented in its training data.

With the entire genus removed, the MGS workflow recovered fewer than 0.1% of read pairs for both viruses (Figure 8B). Omnii-1’s human-virus predictions expanded candidate recovery to 44.6% for dengue and 22.0% for Bundibugyo. Visualizing embedding space shows how genome-averaged viral read representations change with sequence divergence (Figure 8C).

We will continue to build on this early prototype, improving recovery and extracting the information needed to inform strong responses to emerging pathogen risks.

The Defense API brings Omnii-1's ability to recognize biological function directly to our partner's screening workflows. It deploys Omnii-1 to surface potential threats, including viral reads with no close matches in reference databases. Partners can submit metagenomic reads or assembled sequences and receive results that link flagged reads to Omnii-1’s predictions, taxonomic assignments, and other supporting bioinformatics evidence. The API is restricted to vetted partners; write to us if you would like access.

Bringing Omnii-1 to the point of collection pairs sequence analysis with the sequencer in both time and space. We packaged the Defense API for local execution, so samples can be analyzed where they are collected, including settings where connectivity is unreliable or sequence data must remain on-site.

We tested the edge-deployed Defense API by pairing an Oxford Nanopore MinION sequencer¹⁷ with a MacBook Pro (Apple M3 Max laptop with 128 GB of memory) and analyzing environmental metagenomic samples (Figure 9A). Data is streamed directly from the MinION, through basecalling, bioinformatics, and Omnii-1 simultaneously. We spiked sequences of concern into the resulting reads to exercise the screening workflow against a realistic environmental background. The local interface displays live sequencing progress alongside flagged reads, functional classifications, and taxonomic summaries (Figure 9B). A locally-running AI chat model can help users interpret results.

Figure 9C provides a snapshot of the laptop’s processing workflow, generated by replaying time-stamped data from an earlier sequencing run. The timeline follows each batch through basecalling and analysis until its results are ready.

The evaluations in this study point toward a layered architecture for biological defense. While this may continue to evolve, alignment and search algorithms remain the most precise and interpretable when a close match exists. Through API and edge testing, we show that Omnii-1 adds a complementary function-aware layer for the unresolved out-of-distribution tail: protein sequences that have moved away from recognizable homology and reads that conventional metagenomic pipelines do not resolve.

Recent outbreak experience illustrates why that breadth matters. During the 2026 Ebola outbreak in the Democratic Republic of the Congo, initial clinical testing returned negative results before further investigation identified Bundibugyo virus, which was outside the scope of the assay used. A test can work as designed and still miss a pathogen it was never configured to recognize. Broader screening should therefore complement targeted assays, especially when the relevant organism may be unexpected, emerging, or deliberately altered.¹⁸

We used that case to ask whether the API could complement standard alignment- and reference-based detection when reference coverage is incomplete. In our evaluation, Omnii-1 generalized its pathogen detection of Bundibugyo virus strains that were absent from its training data and from the comparison reference databases. This is an encouraging result, showing the potential utility in helping users to prioritize further investigation.

Taken together, the protein and short-read results on the API and the edge suggest a path from model capability to operational pathogen early warning. The restricted API makes the same functional vocabulary available across resolutions; both the bioinformatics and Omnii-1 layers preserve familiar evidence where it exists; and the edge deployment extends initial analysis into environments where centralized infrastructure may not be available. Ultimately these model capabilities set the groundwork for long-context, full-genome characterization of pathogenic microorganisms.

Public discussion of engineered biological threats has become more direct, while rapid advances in biological language models are boosting our capabilities in molecular design, structure prediction, and functional prediction. Together, these trends create both an urgent need and an opportunity: use the same advances in biological modeling to build defenses that recognize function beyond familiar sequence matches. We will continue this work through the defense deployments outlined here and beyond.

Detection systems must evolve continuously, and not only in response to known pathogen lists. Biological design methods will keep changing, and natural outbreaks will continue to produce divergent sequences. Defenses that can reason about likely function, operate across data resolutions, and deploy under real-world constraints offer a way to keep pace with that change. The work presented here is an early step. Next, we plan further evaluation and model benchmarking, careful calibration, operational testing, and deployment with trusted partners under appropriate access controls.

In terms of horizon campaigns, we will be pushing Omnii-1 toward high-precision taxonomic and functional prediction across the viral evolutionary tree of life. Defense needs both an understanding of what a sequence is and what harm it could do, and at a precision that informs confident action. In current testing, Omnii-1 is exhibiting extreme taxonomic awareness: given solely a short (150-nucleotide) or long read (up to 64k nucleotides), Omnii-1 can precisely name the source species across the viral tree of life (Figure 10).

The security landscape requires us to build and use frontier tools that bolster capabilities across the hardest challenges in biodefense and pandemic prevention. As such, we continue to explore a range of collaborations with those conducting high-impact work in mitigating the risks of dangerous pathogens.

We're interested in partnerships to evaluate Omnii-1 on challenging pathogen detection problems, develop new biosecurity capabilities, and deploy biological intelligence in both cloud and field environments. This includes detecting emerging and previously unseen threats, including those potentially generated using AI.