Omnii Defense

Characterizing natural or synthetic pathogen sequences hinges on search and alignment algorithms. However, these bioinformatics algorithms are built to natively wield high precision for low-divergence sequences but suffer from low recall for high-divergence sequences. Recently, we showed that genome language models accurately predict pathogenic function for highly divergent protein-coding gene sequences without alignment, suggesting generalization beyond sequence toward functional understanding. This release extends our detection capabilities to metagenomic viral short reads, and deploys them as a restricted-access biodefense API and edge-ready package. To demonstrate our API’s augmented capabilities compared to popular bioinformatics algorithms alone, we run a series of synthetic and real-world evaluations that highlight Omnii-1’s complementary and robust recall lift in settings like viral evolution and the emergence of novel viruses.

Over the past several years, the biodefense community has made meaningful progress in detecting and characterizing genetically modified pathogens. Several nations are also advancing the scientific and operational capabilities needed to attribute a biological attack to its likely source. But the risk environment is changing quickly enough that progress alone is not sufficient; defensive capabilities must continue to improve as the tools for biological engineering become more accessible and more powerful.

That urgency is increasingly explicit in national policy. In its July 2026 biosecurity strategy implementation update, the United Kingdom observed that “biological risks regularly top the National Risk Register”¹. Later that year, the U.S. Secretary of the Army described “a volatile technological convergence where advanced biotechnology and artificial intelligence are dramatically lowering the barrier to engineering biological weapons”².

Governments and nongovernmental organizations are responding with increasingly ambitious goals for speed, accuracy, and field readiness. SecureBio, for example, has set a target of reducing the interval between sample collection and actionable early-warning results to three days³. The U.S. Army has announced a rapid-prototyping effort for distributed microsensors that can characterize chemical, biological, and environmental signals with on-device edge AI and minimal supporting infrastructure⁴. The United Kingdom is also preparing a Microbial Forensics Consortium tabletop exercise focused on the response to the deliberate release of a biological hazard⁵. At the same time, falling sequencing costs⁶ are making metagenomic data available to a wider range of routine applications, including wastewater surveillance.

In June, we released an Omnii-1 defense research preview⁷, including early results on the detection of pathogenicity-associated protein paraphrases. Since then, we have focused on turning those model capabilities into an operational interface for vetted researchers and agencies. The result is a restricted API and edge deployment for characterizing DNA and protein sequences across synthesis screening and metagenomic workflows. This post describes the technical gaps that motivated it, the evaluations we have run so far, and our first steps to deploying our models.

Focus is particularly sharp on rapidly improving two aspects of biological defenses. First, many biosurveillance systems still depend heavily on matching an observed sequence to a known database reference. As the U.S. Defense Threat Reduction Agency recently summarized, “current approaches can be slow, require prior knowledge of engineered sequences, and struggle to keep pace with modern engineering techniques”⁸.

Bioinformatics tools are a critical layer of biological defense, but they inherit a basic limitation of their underlying search & alignment algorithms: they maximize for pattern-matched precision and are thus strongest when a query still resembles something in their reference databases. However, an engineered sequence can preserve a relevant function while (a) diverging away from a known wild-type sequence and sometimes (b) diverging from its known structure. This resulting forever-asymmetric “recall gap” is what leaves an attack surface in the space between recognizable homology and preserved biological function.

The important question is therefore not simply whether today's bioinformatics tools work well generally, but rather: How large are these tools’ failure modes, and how well can they generalize beyond documented threats toward the out-of-distribution tail. Because biological sequence screening must operate at multiple sequence resolutions, we study screening robustness gaps across two cornerstones: full protein sequences and metagenomic short reads. A function-aware Omnii-1 layer complements existing bioinformatics tools at both resolutions, scoring proteins whose function may survive substantial sequence change and triaging metagenomic reads even when reference-based evidence is weak.

Second, a capable detector is only useful where it can operate. Centralized compute and reliable connectivity may be available in routine laboratory settings, but are not always available at military installations, in rural regions, or in areas affected by conflict or natural disasters. Power and network access may be limited, intermittent, or intentionally severed. A practical defense therefore needs both broad biological generalization and a path to deployment close to where samples are collected. The same combination of bioinformatics tooling and Omnii-1 forms the basis of our edge deployment, just as it does for the defense API.

Building off the work of our previous release⁷, we first revisit the Paraphrase benchmark⁹: a dataset of synthetically generated, divergent protein sequences stemming from natural pathogenicity related proteins. This benchmark serves as a robustness stress-test for predicting pathogenic relation and viability in the face of sequence and structural divergence. The landscape of 16,307 likely functional paraphrase proteins — liberally set here at sequence identity > 0.2 to wild-type, template modeling (TM) score > 0.5, and median delta predicted local distance difference test (median ΔpLDDT) > −10 — is depicted in Figure 1 (A: individual paraphrases and per-protein medians; B: density). This low-dimensional landscape, where the lower-left region contains proteins that have moved furthest from the sequence and structure that a reference-based system expects, illustrates a small realm of the enormous attack surface that biodefense tooling must generalize to and defend against. Paraphrases concentrate at high structural similarity, while the sparsely populated lower-left region marks the furthest departures.

To benchmark the state-of-the-art on the bioinformatics side, we first map the Paraphrase defense surface formed by the popular aligner DIAMOND¹⁰, searched against a standard UniRef100 database (Fig 2A). Wide gaps across the surface are visible, illustrating the need for bolstered detection. Adjacent, we display the combined defense surface of DIAMOND and Omnii-1 (with its tuned classifier head), showing multiple defensive gaps filled (Fig 2B). The combined rule flags a sequence when either DIAMOND or Omnii-1 flags it; it defaults to an Omnii-1 threshold of 0.5 and can be toggled to recall-, precision-, or F1-matched Omnii-1 cutoffs. Across these 16,307 viable pathogen paraphrases, DIAMOND flags 83.3% as pathogenicity related, with its top-ranked hits sourced from a pathogen or toxin. Omnii-1 alone achieves a recall (at a probability threshold of 0.5) of 96.3%, and together with DIAMOND reaches 98.5% recall.

Across the full 47,754-example labeled comparison cohort, which includes non-pathogen controls, DIAMOND flags 56.8% of sequences as pathogenicity related, with 64.9% precision, 78.6% recall, and an F1 of 71.1%. Adding Omnii-1 at a probability threshold of 0.5 raises the fraction flagged to 70.4% and recall to 95.8% (F1 76.6%), with precision at 63.8%. Fraction flagged, precision, recall, and F1 are all reported in Figure 3A, including the recall-, precision-, and F1-matched settings.

To understand more about how Omnii-1 “sees” paraphrase proteins, we take a look at its emitted mean log-probability, mapped in Figure 3B across the same 16,307 viable, pathogen-labeled paraphrases shown in the heatmaps above. This value can be conceptualized as the model’s familiarity with an input sequence given its training distribution, and thus can serve as a proxy for sequence “naturalness.” Given Omnii-1’s genome language backbone, we note the naturally strong correlation of naturalness with sequence identity (x-axis) while also observing high-valued pockets throughout the middle band.

In addition to augmenting bioinformatics tooling with Omnii-1 at the protein resolution, we set out to do the same for metagenomic short reads (~150 base pairs in length). As with protein sequences, conventional metagenomic screening can lose sensitivity once a construct is divergent from an aligner’s reference sequences. However, compared to the full protein resolution, short reads pose extreme payload and modeling challenges: (1) finding pathogen-origin read-sized needles in a gigantic metagenomic haystack, where datasets often contain ratios of 1/1000 pathogen-origin to background reads; and (2) reading partial context snippets of origin pathogen sequences with partial coding and non-coding regions represented. An illustrative analogy is trying to make sense of the intent or positioning of an op-ed article when given only a single sentence.

To combat these challenges, we shifted our focus toward prototyping a specialized version of Omnii-1 that augments the modern bioinformatics stack for metagenomics to perform what we call viral “read rescue.” To build this version of Omnii-1, we both distilled and trained it as a lightweight embedding and retrieval model with a function-aware training recipe to learn from the diverse space of metagenomics.

To implement this compound metagenomics system, we employ a bioinformatics pipeline to identify a pool of high-confidence alignment evidence for viral origin, fire a tuned router to estimate if the sample has recoverable viral reads, and finally fire Omnii-1 selectively over the unresolved tail. Short-read screening begins with the evidence a conventional metagenomic pipeline already provides: paired reads with overlap are merged and then all merged and unmerged reads pass through quality control before passing through the bioinformatics pipeline composed of BLAST alignment¹¹ and Kraken classification¹². At this point, the metagenomics system preserves output provenance and separates reads that map cleanly from those the pipeline leaves unresolved. The unresolved population, and reads removed by quality control, are then examined by Omnii-1 in both forward and reverse-complement orientations. Each read receives a viral probability prediction alongside its origin in the pipeline.

To stress-test our detection system to this idea of robustness to sequence variation, we generated viral variants of 26 virus species, varying sequence identity to wild-type from 100% down to 60%. From each viral variant, we sampled and “spiked in” 1,000 simulated reads into wastewater backgrounds of various sizes. Figures 4 and 5 compare three mutation regimes: arbitrary substitutions, synonymous coding substitutions, and a balanced set that mutates coding and noncoding sequences more evenly.

Figure 4 shows both read-level (Fig. 4A) and mean-pooled (Fig. 4B) embeddings of our specialized model, respectively hinting at semantic separation of viral origin versus background populations and semantic shifts with viral mutation. In Fig. 4B, lines connect each species' runs in order of divergence, and the drift field overlays the mean step toward higher divergence in each region (shown only where more than eight steps fall in a cell). The trajectories flow toward a shared region largely independently of species, indicating that the model's representation shifts consistently with viral mutation. Consistent with this, a run's displacement from its species' wild-type embedding in the PCA plane grows with achieved divergence, rising steeply through about 20% and slowing beyond about 30%, and is largest for arbitrary (any) substitutions; the synonymous and balanced regimes move less and by similar amounts.

In Figure 5, for each regime, the production router assigns a graduated retrieval budget based on the input payload size. We compare our API’s findings with the popular Nucleic Acid Observatory (NAO) metagenomics pipeline¹³. These results show our strong recall lifts (e.g. as high as +83%) on these simulated wastewater spike-ins while maintaining marginal false positive rate (FPR). Panels A–C of Figure 5 isolate spike-in sensitivity for 1,000-read, spike-only generated viruses from 26 species. The orange curves add Omnii-1-selected read rescue by replaying cached generated-grid scores through the production P(rescue) router, and the figure can be toggled between a 1M background, a 200k background with 200× spike-in, and zero-background small-payload review-all semantics. With Species set to None / mean, the curves show the mean across available species. Panel D introduces metagenomic background scores into the same capacity-limited ranked queue for the evaluated mutation regimes: capacity tiers denote total retrieval slots normalized per million unresolved reads, and spike-in and background reads compete for those slots. Because the spike-in remains fixed at 1,000 reads, the absolute slot count scales with background size, so comparisons between background settings reflect both background competition and changing absolute capacity.

Biosecurity threats can also emerge naturally, often from zoonotic reservoirs or human populations with limited access to surveillance. These novel or highly divergent pathogens pose a particular risk because they can be missed by existing detection tools, leading to delayed public health responses. RNA viruses alone show how dynamic this sequence space is: among the thousands of known species in the NCBI taxonomy, the set reported to infect humans has kept growing since 1900, with new additions arriving in every era. Replaying the record (Figure 6) shows a space that keeps producing new human-infective lineages, so a detector anchored to what is already catalogued will trail what is emerging.

To test our read-rescue approach against natural viral diversity, we asked whether Omnii-1 could recover reads when close relatives of the source virus were missing from reference databases. We used short reads simulated from naturally occurring dengue and Bundibugyo Ebola virus genomes from Pathoplexus¹⁴.

To run this ablation analysis, we progressively removed each target species and then its entire genus from the reference databases (species-out removes only the target species; genus-out removes its entire genus), pairing these conditions with Omnii-1 models retrained with the corresponding exclusions (Fig. 7C). This tests Omnii-1’s capacity to generalize and recover reads beyond the species and genera represented in its training data.

With the entire genus removed, the standard workflow recovered fewer than 0.1% of read pairs for both viruses (Fig. 7A). Adding Omnii-1’s human-virus predictions (the Defense API counts a pair as recovered when either the cascade or an Omnii-1 human-virus call on either mate recovers it) expanded candidate recovery to 44.6% for dengue and 22.0% for Bundibugyo. Visualizing embedding space shows how genome-averaged viral read representations change with sequence divergence (Fig. 7B).

We will continue to build on this early prototype work, seeking higher recovery and other actionable details that are important for informing strong responses to an emerging pathogen risk.

The Defense API is an asynchronous screening service. A partner submits a metagenomic sample as paired-end (or single-end) FASTQ, as gzip-compressed or plain files delivered to an agreed cloud storage location and named by URI in a JSON request; short assembled DNA can instead be sent inline.

Each call is authenticated with both a per-partner key and a cloud identity token, is scoped to the partner's organization, and carries an idempotency key so retries never launch duplicate work.

A single request can carry up to one million read pairs, with a combined input size of up to 10 GB, and inline assembled input is limited to 20 sequences and 20 million nucleotides in total.

The service returns a request identifier immediately, and the caller polls for status. When the job completes, the response reports the sample-level verdict, and the reads behind it are retrieved as checksummed tables, with the model's output schema and the reference database version pinned to the result so that old results stay interpretable as the model is updated.

What comes back is the set of reads the system considers viral in nature, together with where each read came from. Every row carries its source file and mate identifiers, 1-based coordinates for long reads scored in overlapping windows, quality-control state, the taxonomic assignments from the bioinformatics workflow (including the Kraken taxon), the Omnii-1 scores, and the routing disposition and reason for each read. The tables carry no sequences or embeddings, so provenance can be audited without redistributing data.

Because the pipeline batches reads onto shared GPU serving, it analyzes millions of raw reads on the order of minutes to hours rather than days.

Field deployment shifts the engineering focus from model training toward limiting dependencies and speeding up inference. A model that performs well in a centralized environment may still be unusable where bandwidth is constrained, connectivity is disrupted, or sensitive sequence data cannot leave the point of collection.

To help fill this gap, we packaged our exact API to run on a laptop with an NVIDIA GPU and conducted tests focused on tasks relevant to detecting and characterizing novel or genetically engineered sequences (including AI-generated or -obfuscated sequences). To date, we have tested this edge capability using environmental metagenomic samples (via an Oxford Nanopore MinION sequencer) using our proprietary gLM and bioinformatics interpretation layer on a single MacBook Pro M4 MAX 16 inch laptop. We spiked sequences of concern into the metagenomic reads (where the baseline threat was expected to be low) to simulate particular threat axes we are evaluating.

The evaluations in this piece point toward a layered architecture for biological defense. While this may continue to evolve, alignment and search algorithms remain the fastest and most interpretable when a close match exists. Omnii-1 adds a complementary function-aware layer for the unresolved tail: protein sequences that have moved away from recognizable homology and reads that conventional metagenomic pipelines do not resolve. We can see immediate benefits from combining their different forms of evidence while retaining the provenance of each result.

Recent outbreak experience illustrates why that breadth matters. During the 2026 Ebola outbreak in the Democratic Republic of the Congo, initial clinical testing returned negative results before further investigation identified Bundibugyo virus, which was outside the scope of the assay used. A test can work as designed and still miss a pathogen it was never configured to recognize. Broader screening should therefore complement targeted assays, especially when the relevant organism may be unexpected, emerging, or deliberately altered.¹⁵

We used that case to ask whether the API could complement standard alignment- and reference-based detection when reference coverage is incomplete. In our evaluation, Omnii-1 generalized its pathogen detection of Bundibugyo virus strains that were absent from its training data and from the comparison reference databases. This is an encouraging result, not a substitute for prospective clinical validation: a broad model signal should prioritize further investigation, not be treated as organism identification or a definitive diagnosis.

Taken together, the protein and short-read results on the API and the edge suggest a path from model capability to operational pathogen early warning. The restricted API makes the same functional vocabulary available across resolutions; both the bioinformatics and Omnii-1 layers preserve familiar evidence where it exists; and the edge deployment extends initial analysis into environments where centralized infrastructure may not be available. Ultimately these model capabilities set the groundwork for long-context, full-genome characterization of pathogenic microorganisms.

Public discussion of engineered biological threats has become more direct, while rapid advances in biological language models have produced new models for both molecular design and structure and functional prediction. Together, these trends create both an urgent need and an opportunity: use the same advances in biological modeling to build defenses that recognize function beyond familiar sequence matches. We will continue this work through the defense deployments outlined here and beyond.

Detection systems must evolve continuously, and not only in response to known pathogen lists. Biological design methods will keep changing, and natural outbreaks will continue to produce divergent sequences. Defenses that can reason about likely function, operate across data resolutions, and deploy under real-world constraints offer a way to pace that change. The work presented here is an early step: next, we plan further evaluation and model benchmarking, careful calibration, operational testing, and deployment with trusted partners under appropriate access controls.

Likewise, the security landscape requires us to build and use frontier tools that bolster capabilities across the hardest challenges in biodefense and pandemic prevention. As such, we continue to explore a range of collaborations with those conducting high-impact work in mitigating the risks of dangerous pathogens.