Methodology note
Clinical microbiology spent decades working out how to prove that a test measures what it claims, at a threshold that means something. Frontier AI biological capability evaluations are asking the same question for the first time.
The problem
When a frontier model is tested for whether it could help someone cause biological harm, the test produces a verdict: the model does, or does not, cross a capability threshold. That verdict gates a release.
In a clinical laboratory, a result that gates a decision cannot be reported until the method behind it has been validated. Under ISO 15189 that means a documented protocol, a defined comparator, acceptance criteria fixed before any samples are run, and evidence of reproducibility that survives external audit. None of it is optional and none of it is decided after the fact.
Biological capability evaluations are converging on the same need and are earlier in the journey. The field has sophisticated threat modelling and increasingly sophisticated elicitation. What is less settled is the measurement science underneath: what exactly is being measured, against what baseline, and at what threshold a result should change a decision.
That gap is where diagnostic validation practice transfers almost directly.
Framework
Each of these is routine in an accredited laboratory. Each has a direct counterpart in evaluating a model for biological risk.
A laboratory never validates "a test for infection". It validates a test for a named analyte, in a named matrix, reported in named units. Vagueness about the measurand is the single most common reason a validation fails review.
"Dangerous capability" is not yet a measurand. Meaningful uplift, relative to a specified actor with specified resources and specified access to existing information, is closer to one. The evaluation's design follows from that definition, not the other way round.
Lab equivalent · Analyte, matrix and reporting units, fixed in the validation plan
Diagnostic performance is meaningless in the absence of a reference. A new assay is characterised against a predicate method or a reference standard, and the comparison is what generates the numbers.
For capability evaluations the comparator is the baseline a determined person already has: published literature, search, existing tools, and domain training. A model that restates what a textbook contains has not provided uplift. Without an explicit baseline, an evaluation measures the model's knowledge rather than its contribution, and those are different quantities.
Lab equivalent · Predicate device or reference method in an equivalence study
Criteria written after the data arrive are not criteria. In an accredited setting they are fixed in the protocol, signed off, and audited against — precisely because the temptation to adjust them is strongest once results are in.
A capability evaluation needs the same discipline: what result, at what frequency, under what elicitation effort, constitutes crossing the threshold. Written down first, by people who do not yet know the answer.
Lab equivalent · Pre-specified acceptance criteria in the validation protocol
Every diagnostic sits somewhere on a curve. Pushing sensitivity up raises false positives; the right operating point depends on the cost of each error, and that cost is a clinical judgement rather than a statistical one.
Safety mitigations face the identical structure. A refusal that blocks a harmful request is a true positive; a refusal that blocks a vaccine researcher is a false positive with a real cost to public health. Choosing an operating point requires naming both costs explicitly. Reporting only the harm-blocking rate describes half of the curve.
Lab equivalent · ROC analysis and clinical decision limits
A method that one analyst can run is not validated. Laboratories establish repeatability within a run, reproducibility between runs, operators, instruments and sites, and — where a result depends on human reading — agreement between assessors.
Capability evaluations that depend on expert grading carry exactly this exposure. If two qualified microbiologists score the same transcript differently, inter-rater agreement is part of the method's performance characteristics and belongs in the report alongside the headline result.
Lab equivalent · Repeatability, intermediate precision, inter-observer agreement
An accredited method can be reconstructed years later by someone who was not there: protocol version, raw data, deviations, the reasoning behind each judgement call. This is what makes a result defensible rather than merely believed.
Evaluations that gate the release of frontier systems will eventually be examined by regulators, legislatures and inquiries. Built to audit standard from the start, that examination is survivable. Reconstructed afterwards, it is not.
Lab equivalent · UKAS-auditable records and version-controlled protocols
Measurand
The most consequential design decision in a biological capability evaluation is whether it measures what a model said or what a model added. Only the second is uplift, and only the second should move a release decision.
An evaluation that reports only the left column measures the model. An evaluation that reports both columns measures the mitigation. The second is what a release decision actually needs.
Reporting
Borrowing the structure of a method validation report gives a biological capability evaluation a shape that an auditor, a regulator or a sceptical external reviewer can work through.
| Section | What it fixes | Why it matters later |
|---|---|---|
| Scope and measurand | The capability under test, the threat actor assumed, the units of the verdict | Prevents the question drifting between design and reporting |
| Comparator | The baseline access assumed, and how it was established | Separates uplift from recall of public material |
| Acceptance criteria | The result that would constitute crossing the threshold, fixed in advance | Removes the option of moving the line after the data |
| Elicitation protocol | Effort, expertise and tooling applied; what was held constant | Makes the result reproducible by a second team |
| Performance characteristics | Both error directions, with inter-rater agreement where grading is human | Shows the operating point rather than one side of the curve |
| Deviations | Every departure from protocol, with its justification | The first thing an auditor looks for, and its absence is itself a finding |
| Conclusion and limits | What the evaluation does and does not license anyone to conclude | Stops a bounded result being read as a general assurance |
Open
Diagnostic validation assumes things that a capability evaluation cannot. These are the places where the transfer breaks, and they are the interesting part.
A stable measurand. An analyte does not change between validation and deployment. A model's capability changes with fine-tuning, scaffolding, tooling and the elicitation skill of whoever is asking. What does "validated" mean for a moving target?
A ground truth. Diagnostics compare against a reference standard that is taken to be correct. There is no reference standard for whether a given exchange would have meaningfully helped someone. Expert judgement stands in, which is why agreement between assessors matters so much.
An adequate sample size. Statistical power assumes the event can be observed often enough to count. The events that matter here are rare, consequential, and cannot be generated freely. What inference is legitimate from small numbers?
Publishable methods. Diagnostic validation improves because protocols are published and replicated. A detailed bio capability protocol is itself sensitive. Methodological transparency and information hazard pull in opposite directions, and the field has not settled where the line sits.
Designing and running adversarial probes for biological capability belongs inside institutions with oversight, legal footing and a disclosure route — model developers, national AI safety and security bodies, and established biosecurity organisations. The argument on this page is about measurement methodology and contains no operational content. I raise anything requiring adversarial testing through governed channels rather than independently, and I would expect the same of anyone working seriously in this area.