Capability overview

Identifying Emerging Biological Threats in Grove

Valthos builds national infrastructure for biodefense. Our platform, Grove, detects and characterizes emerging and novel threats, beyond what’s possible with most existing systems.


As AI expands the biological threat landscape, biodefense systems need to be able to detect both known and unfamiliar threats and produce assessments that operators can act on. Recent warnings underscore the urgency. In October 2026, the UK’s MI5 director general highlighted AI’s potential to enable new biological weapons as the misuse case to which he attaches the greatest weight. The U.S. Army’s 2026 Biodefense Strategy, released in September, similarly warns that AI and biotechnology are lowering barriers to engineering biological weapons.

Grove turns that urgent requirement into an operational capability. Grove integrates and deploys emerging AI methods to identify and mitigate biological threats. It ingests real-world biological data—often messy, incomplete, and high-volume—to support force health protection teams in the face of unfamiliar threats.

1Identifying emerging biological threats in Grove

Operational context

All biological responses start with reliable detection. Operators need to be able to identify potential threats across high-volume, diverse biological data streams, with enough context and confidence to decide whether to escalate the response.

Figure / 01

Resilient biodefense

Grove capabilities: detect biological threats, characterize their impact, and mitigate them, with continuous adaptation across the system.
Figure / 01

Resilient biodefense

Scroll across to see the full figure.

Figure 1. Resilient biodefense requires strengthening our ability to detect, characterize, and mitigate existing, emerging, and novel threats.

What this looks like in practice is more easily described through a case study. Imagine a clinical sample of blood sequenced from a patient in Hawaii. The sample produces millions of small unlabeled genomic sequences describing what is present in the patient. A rapid analysis in Grove identifies trace amounts of signal in the sample consistent with dengue virus.

Dengue virus is a pathogen of interest for the Department of War, and of particular concern for U.S. military surveillance due to limited access to diagnostics and treatment in operational environments. Dengue virus can cause fever and, in some cases, it can be fatal. The first finding of dengue virus is a signal, but that alone offers limited evidence to inform mitigation decisions. The immediate next questions include:

  1. Is dengue virus really present in the sample, or could the initial signal be a false positive?
  2. How does this virus relate to dengue virus samples previously seen locally and elsewhere, and what does that say about its geographic history?
  3. Does its genome contain an unusual combination of genetic material that indicates possible human manipulation?

Grove capabilities

Grove helps operators answer these questions. It takes the raw data and sample context and turns the initial signal on dengue virus into a traceable assessment of what the evidence does—and does not—support about the sample.

Figure / 02

Grove capabilities for identifying biological threats

Dengue virus 1Simulated sample: human serum in Hawaii, US

Presence

Are there potential threats in the sample?

Dengue virus 1 detected in the sample.

Confidence: High
Geographic attribution

Where do they come from?

Multiple methods link the genome to viruses sampled in Nicaragua.

Confidence: Medium
Chimeric signatures

Are there signs of human engineering?

No evidence of chimeras found in the sample.

Confidence: High
Figure 2. Grove capabilities for identifying biological threats: a summary of findings and confidence for the simulated sample.

Grove rapidly analyzes samples for potential threats and identifies possible medical countermeasures. Emerging threats with no countermeasure approved or available, or with mutations that elevate spread, are flagged as higher risk. This provides an operator with the ability to decide which samples warrant escalation across high volumes of input data, together with the evidence behind each conclusion.

Confidence differs across questions; for example, the quality of the genetic data needed for country-level contextualization is usually higher than what’s needed for confirming presence, and the reliability of the methods used to answer each question can vary. These differences remain in the assessment, allowing an operator to see what is well supported, what is uncertain, and why.

2Scenario: dengue in Hawaii

To demonstrate Grove’s threat identification capabilities, we computationally simulated a scenario in which a human clinical serum sample containing dengue virus at low abundance was collected and sequenced in Hawaii, U.S.

What’s present in the sample?

Why it matters

Operators need to rapidly identify the pathogen in a sample with high confidence to guide downstream decisions. In a real-world scenario, a potential pathogen could comprise a small fraction of the sequencing data, making it difficult to distinguish a true detection from background noise or misleading matches. Detection needs to be sensitive enough to catch these signals without generating false alarms that take away limited force health protection resources.

What we found

All short fragments of genomic sequence from dengue virus were flagged in our sample, with all but two of them passing confirmatory checks. The agreement between the screening and confirmatory checks provides strong confidence for the presence of dengue virus (Figure 3).

How Grove investigates

Grove uses a two-stage approach. First, a fast and sensitive screen identifies potential pathogens. Then, more targeted checks determine whether the evidence supports each detection.

Benchmark results

The dengue example is a single scenario; benchmarking lets us assess detection performance more broadly across other priority biological threats. We evaluated Grove detection accuracy in a comprehensive benchmark, which measures performance across high-priority biological agents in a complex sample background. Grove correctly identifies the target in all samples (120/120), and correctly avoids false-positive detections in all samples designed to test misidentification (25/25) (Figure 4).

Benchmark · Figure / 04

Pathogen detection benchmark results

01 / Test cases02 / Initial screen03 / Final resultTarget virus added120 / 120 confirmed120 cases120 flagged120 positive test cases flagged by the initial screen9 confirmed by 1 supporting method9 confirmedby 1 method106 confirmed by 2 supporting methods106 confirmedby 2 methods5 confirmed by 3 supporting methods5 confirmedby 3 methodsControls with other viruses0 / 25 false positives25 cases22 controls: no target threat detected3 controls flagged by Kraken 222 controls remain negativeAll 3 initial false positives were not confirmed22 casesNo target threatdetected22 casesNo target threatdetected3 flagged by Kraken 23 not confirmed

Flow widths show counts within each panel.

Benchmark · Figure / 04

Pathogen detection benchmark results

Scroll across to see the full figure.

Figure 4. Grove detected and confirmed all 120 positive test cases, with confirmation groups showing the number of supporting methods. Three initial false-positive calls in the 25 negative controls were not confirmed, leaving zero false positives at the final stage.
Show detailsHide details

Pathogen identification benchmarking details

To more comprehensively benchmark the identification process, we computationally simulated sequencing reads from multiple biothreat agents in real wastewater sequencing data. We used reference sequences from CDC High-Priority Biological Agents, computationally combining them with background sequencing data at a low level. We also included negative controls containing close relatives of the target threats to test for false-positive detections. This benchmark consists of 120 positive test cases spanning 46 viral species/subtypes and 25 negative controls containing close relatives of the targets.

We simulated read pairs from each target genome using ART at a target mean depth of coverage of 1×, with an Illumina HiSeq 2500 error profile, paired-end 150-nt reads, and a mean fragment length of 300 nt (SD, 30). We added simulated read pairs computationally to 15 million virus-removed read pairs from a real wastewater sequencing background (SRR30162568).

Initial screening uses Kraken 2 with a broad viral database. Candidate detections are evaluated by aligning reads to a custom pan-viral reference database and comparing sequences against NCBI’s broader core_nt nucleotide database. Influenza A virus detections are also evaluated using a separate method for HA and NA subtyping against a broad influenza reference database. We call a test case confirmed if it is confirmed by at least one method.

Grove detected and confirmed all of the biological agents in this benchmark (Figure 4). On the test set with close relatives, the confirmation steps correctly rejected 3 initial false-positive calls, all of which were orthopoxviruses (vaccinia and ectromelia virus isolates), thus yielding zero false positives. These results illustrate the value of sensitive screening with more specific confirmation.

What is the sequence’s geographic origin?

Why it matters

The geographic origin of a sequence can indicate whether we’re seeing the result of local spread or a new introduction from somewhere else. The case of this hypothetical individual in Hawaii with no recent travel raises concern about how dengue virus may have reached Hawaii. Estimating where a virus came from can be difficult because the timing of its introduction may be unknown, viral surveillance leaves sampling blind spots, and closely related viruses can circulate in multiple places. Geographic attribution requires strong supporting evidence and an explicit accounting of uncertainty.

What we found

In our hypothetical example, the results indicated the dengue virus sequence originated from lineages in Nicaragua, and suggested a possible introduction from Nicaragua to Hawaii. This is consistent with our ground truth in this scenario, the ancestry proposed for the original isolate by Shin et al. 2013.

How Grove investigates

Grove applies two complementary methods: sequence similarity comparison and an evolutionary tree analysis. Both approaches rely on stitching together the dengue virus sequence fragments we recover into a genome, and comparing this genome to other known dengue virus isolates. Applying two complementary methods allows us to check whether the geographic output holds up under different ways of analyzing the sequences, strengthening the result when they agree and adding uncertainty when they do not.

Benchmark results

Benchmarking lets us assess how well geographic attribution performs across a broader set of sequences. We used a larger panel of human viruses, and tested methods in Grove against a simple baseline that applies BLAST to find the closest reference sequence and assigns its recorded collection country. For dengue, Grove assigned the country to 88% of sequences and abstained on 12%; among calls made, 95% were correct. Across the larger panel, performance varied by virus, with more accurate assignments when closely related sequences tend to come from the same country. Overall, Grove assigned a country to 47% of sequences and, of those, 79% were correct (Figure 7). The BLAST baseline, which always makes an assignment, assigned 90% of dengue sequences correctly, and 59% across all viruses. Together, these results show that Grove’s sequence similarity method achieves a higher precision than the baseline in exchange for leaving more cases unresolved when the evidence is insufficient.

Benchmark · Figure / 07

Geographic attribution benchmark results

Assignment rateAssigned / all test genomesPrecisionCorrect / assigned genomes
Percentage(a) Dengue virus622 test genomes0%25%50%75%100%Dengue virus: Assignment rate, 548 of 622 (88.1%)88.1%548/622Dengue virus: Precision, 519 of 548 (94.7%)94.7%519/548All genomesn = 622(b) Broad panel93 viral species · 312 test genomes0%25%50%75%100%Broad panel, All genomes: Assignment rate, 148 of 312 (47.4%)47.4%148/312Broad panel, All genomes: Precision, 117 of 148 (79.1%)79.1%117/148All genomesn = 312Broad panel, Q1: Assignment rate, 16 of 68 (23.5%)23.5%16/68Broad panel, Q1: Precision, 12 of 16 (75.0%)75.0%12/16Broad panel, Q2: Assignment rate, 39 of 84 (46.4%)46.4%39/84Broad panel, Q2: Precision, 30 of 39 (76.9%)76.9%30/39Broad panel, Q3: Assignment rate, 41 of 74 (55.4%)55.4%41/74Broad panel, Q3: Precision, 31 of 41 (75.6%)75.6%31/41Broad panel, Q4: Assignment rate, 52 of 86 (60.5%)60.5%52/86Broad panel, Q4: Precision, 44 of 52 (84.6%)84.6%44/52Close relatives spreadacross countriesClose relatives foundin the same country
Benchmark · Figure / 07

Geographic attribution benchmark results

Scroll across to see the full figure.

Figure 7. Assignment rate (gray) and precision (blue) for geographic attribution by sequence similarity in Grove, using settings that require high confidence before making an assignment. Assignment rate is the fraction of all test genomes receiving a country assignment; precision is the fraction of assigned genomes whose assigned country matches the recorded collection country. Results are shown for dengue virus genomes (a) and genomes across a broad set of human viral species (b). In (b), the first pair of bars summarizes all genomes; the remaining four pairs show genomes grouped by their viral species’ geographic structure quartile. Species are ranked by how often closely related reference sequences were collected from the same country and divided into four groups. From left to right, these quartiles range from close relatives spread across countries to close relatives found in the same country.
Show detailsHide details

Geographic attribution benchmarking details

We evaluated 622 dengue virus genomes and 312 genomes across 93 human viral species. We excluded test genomes from the reference dataset used by the sequence similarity comparison. For evaluation, we withhold each test sequence’s recorded collection country and score how often Grove recovers it; note that this does not directly test where a patient became infected or from where a virus entered that country. Country assignments used fixed high-confidence settings and were scored against the recorded collection country. For Figure 7b, we calculated how often a viral reference genome’s three nearest neighbors came from the same country as that genome, and measured the geographic structure of a species as the average of that value across all reference genomes for the species. We ranked viruses by this measure and divided them into four approximately equal groups, each containing 23 or 24 species.

Are there signs of chimeric engineering?

Why it matters

As part of our framework for detecting engineered threats, Grove looks for evidence of chimeric viral genomes: genomes containing segments from two or more viruses joined within the same molecule. While chimerism can arise naturally through recombination, it can also be a sign of deliberate engineering or manipulation of a sequence in the lab. If the dengue virus sequence found in our scenario showed evidence of chimerism, it would warrant escalation and further investigation into the origin.

What we found

In this dengue virus case study, Grove did not flag a chimeric signal. This is the expected result because we know that the genome in our sample is a natural dengue virus genome. Nevertheless, for an unknown sample, a negative result would not exclude other forms of manipulation or chimeric junctions without sequencing coverage.

How Grove investigates

Grove looks for genomic fragments whose two ends match different viral species. That provides evidence that material from two viruses may be joined into a single genome.

Benchmark results

Benchmarking lets us measure how well chimera detection performs across a broader range of viruses and engineered changes. We built a benchmark consisting of several RNA virus families, with chimeric examples containing changes involving different parts of the viral genome. Using discordance of the fragment ends, Grove distinguishes samples containing chimeras from unmodified controls better than two baseline approaches (Figure 9).

Benchmark · Figure / 09

Chimera detection performance by sequencing depth

Simulated chimeric samples and unmodified controls

0.50.60.70.80.91.0Detection performance (AUROC)Sequencing coverage of the viral genome (log scale)Classification ambiguity, 0.5×: 0.488 AUROCClassification ambiguity, 1×: 0.510 AUROCClassification ambiguity, 2.5×: 0.496 AUROCClassification ambiguity, 5×: 0.494 AUROCClassification ambiguity, 10×: 0.522 AUROCClassification ambiguityBaselineTaxonomic composition, 0.5×: 0.631 AUROCTaxonomic composition, 1×: 0.663 AUROCTaxonomic composition, 2.5×: 0.706 AUROCTaxonomic composition, 5×: 0.740 AUROCTaxonomic composition, 10×: 0.768 AUROCTaxonomic compositionBaselineViral mate discordance, 0.5×: 0.620 AUROCViral mate discordance, 1×: 0.692 AUROCViral mate discordance, 2.5×: 0.786 AUROCViral mate discordance, 5×: 0.846 AUROCViral mate discordance, 10×: 0.886 AUROCViral mate discordance0.690.890.5×1×2.5×5×10×0.5 = chance
Benchmark · Figure / 09

Chimera detection performance by sequencing depth

Scroll across to see the full figure.

Figure 9. Detection of simulated virus–virus chimeras across sequencing depths of coverage, comparing Grove’s use of discordance between fragment ends with baselines based on taxonomic composition and classification ambiguity (see drop-down details below). Higher AUROC indicates better discrimination between chimeric samples and unmodified controls; 0.5 represents chance performance.
Show detailsHide details

Chimera detection benchmarking details

The broader benchmark consists of chimeric examples with changes in both coding regions and UTRs. It compares the read-pair discordance approach with two baselines. The ambiguity baseline measures the fraction of classified read pairs assigned at the species level, such that greater ambiguity in read assignment (genus level or above) is interpreted as possible chimerism. The composition baseline uses Shannon entropy of viral taxonomic read assignments to measure how taxonomically mixed the sample is. The read-pair discordance approach outperforms the baselines at sequencing depths of 1× and above, reaching an AUROC of 0.69 at 1× and 0.89 at 10× (Figure 9).

At a sequencing depth of 10× and a true-positive rate (recall) of 80% for all three methods, the false-positive rates were 13% for the read-pair discordance approach in Grove, 39% for the composition baseline, and 76% for the ambiguity baseline.

3From initial assessment to deeper characterization

Our dengue example demonstrates how Grove behaves in one case, providing an initial assessment of a potential threat. The same core workflows support pathogen-agnostic detection across a wide range of sample types. For each sample, Grove brings together the findings from multiple methods into an interpretable profile, with evidence and limitations. This profile aims to give the operator information to support response decisions, and is the starting point for the next set of Grove workflows: characterizing the risk posed by an emerging threat, from transmissibility to medical countermeasure availability.