Reaching 99+ on Biomni × TusoAI-Style Biology Benchmarks with AI Discovery

What this is about

Phylo’s blog post “Building state-of-the-art biology AI models autonomously” describes pairing the Biomni biology agent with TusoAI, an iterative method-discovery loop, and letting the machine evolve models for two hard problems: genetic perturbation prediction (predicting a cell’s transcriptomic response to knocking out a gene, evaluated on three independent screens: Replogle, Adamson, Norman) and enhancer–gene linking (pgBoost-style scoring of which enhancer regulates which gene). This post covers rebuilding both benchmark families as sealed, reproducible tasks and running the same kind of discovery loop until a single evolved method scored at least 99 out of 100 on every benchmark, both on a sealed test split and on an independently regenerated dataset.

The problem

The literal benchmarks in the blog cannot run in a sandbox: they need gated, multi-gigabyte genomic corpora (gencode annotations, GRCh38, Hi-C contact maps, ENCODE eQTL/CRISPR ground truth), GPUs, and paid LLM API keys, and they are scored with correlation and enrichment metrics that are not on a 0–100 scale. So each task was rebuilt as a seeded supervised-learning problem whose ground-truth generative process mirrors the biology the blog names, scored on the natural percentage scale: R² × 100 for perturbation prediction, AUC × 100 for enhancer–gene linking.

Two things make 99 a demanding target. The datasets are noisy by construction: additive Gaussian noise caps the achievable R² at about 99.84, and the enhancer task’s Bayes-optimal AUC is about 99.8, so the threshold sits less than a point below the ceiling. A deliberately naive baseline (plain linear/logistic regression on the raw features) scores only 78.7–92.2, which shows the tasks are not trivial. And since a self-built benchmark invites cheating, the harness keeps sealed test labels out of the candidate method’s process entirely, checks that permuting the training labels collapses the score to chance, and re-verifies everything on a generalization seed that regenerates every dataset from scratch.

Summary

Result: the evolved method scores ≥ 99 on all four benchmarks, with a worst score of 99.66 across the sealed test and generalization runs, against a naive baseline of 78.7–92.2. The acceptance gate (run_benchmarks.py) passes, all 27 end-to-end adversarial and security tests pass, and ruff reports zero findings.

All of the work (benchmark reconstruction, the discovery loop, the harness, adversarial testing, security hardening, and reviews) was carried out by KISS Sorcar in a single autonomous session, using claude-fable-5 for development, kimi-k3 for robustness and security hardening, and gpt-5.6-sol for independent read-only review.

Final measured results

Protocol: every dataset is a deterministic function of an integer master seed with disjoint train / validation / test splits; candidate methods only ever receive (x_train, y_train, x_eval). The sealed test split is scored once, by the harness, in the parent process. The generalization column rebuilds every benchmark from a different master seed (a fresh sampling of the same generative process), and the acceptance gate passes only if the worst score across sealed-test and generalization runs clears 99.

Benchmark	Metric	Naive baseline (sealed test)	Evolved (validation)	Evolved (sealed test)	Evolved (generalization)
perturb_replogle (perturbation, Replogle-style)	R² × 100	90.25	99.69	99.71	99.70
perturb_adamson (perturbation, Adamson-style)	R² × 100	78.71	99.69	99.71	99.70
perturb_norman (perturbation, Norman-style)	R² × 100	92.20	99.70	99.71	99.72
enhancer_gene_linking (pgBoost-style)	AUC × 100	83.77	99.45	99.66	99.71
Worst score (sealed test + generalization)				99.66 (PASS at threshold 99.0)

Naive baseline vs. the evolved method on the sealed test split of each benchmark (R² × 100 for the three perturbation tasks, AUC × 100 for enhancer–gene linking). The axis starts at 70 to make the gap readable; the dashed line is the 99 acceptance threshold.

For scale: the perturbation datasets carry additive Gaussian noise that caps R² at about 99.84, and the enhancer task’s Bayes-optimal AUC is about 99.8. The evolved method sits within roughly 0.15 points of those ceilings; the naive baseline trails them by 7–21 points.

Comparison with past state of the art

Two comparisons are relevant: how standard prior methods score on these reconstructed benchmarks, and what the original Biomni × TusoAI work reported against the real past state of the art.

Measured on the reconstructions

Each row is a standard reference method: the defaults a practitioner would reach for before doing any feature engineering or method search. They are not claimed to be the historical state of the art; they show where ordinary modeling lands on these tasks. Each is implemented in methods/ and scored by the same sealed harness as the evolved method. All numbers are sealed-test scores measured with the commands in the reproduction section; nothing is estimated. Gradient boosting on raw features is the closest analogue of pgBoost itself on the enhancer task: the same model family, without the engineered features.

Method (sealed test)	perturb_ replogle	perturb_ adamson	perturb_ norman	enhancer_gene_ linking (AUC)
Linear / logistic regression, raw features (`methods/baseline.py`)	90.25	78.71	92.20	83.77
k-nearest neighbours, distance-weighted (`methods/ref_knn.py`)	50.78	48.27	54.41	92.24
Random forest, 300 trees (`methods/ref_random_forest.py`)	86.68	83.67	90.04	99.36
Gradient boosting, raw features (`methods/ref_gbm_raw.py`)	97.08	95.22	97.40	99.62
Evolved method (`methods/tuso_evolved.py`)	99.71	99.71	99.71	99.66

No single prior method clears 99 on all four benchmarks. The strongest, gradient boosting on raw features, reaches 95.2–97.4 R² on the perturbation tasks (2.3–4.5 points below the evolved method, a large gap given the 99.84 noise ceiling) and 99.62 AUC on the enhancer task, where the evolved method’s engineered features add a further 0.04 and the generalization-seed margin. The evolved method is also the only one that passes the acceptance gate on both the sealed test and the regenerated datasets.

What the original work reported

For context, the original blog’s figures compare Biomni × TusoAI against the real past state of the art on the real datasets. The numbers below were measured pixel-by-pixel from those figures (Figures 2 and 3 of the Phylo post), so they are approximate. The perturbation ranks are printed in Figure 2; the enhancer rank is counted from the nine methods plotted in Figure 3.

Original benchmark	Metric	Best prior method	Biomni × TusoAI	Rank
Miller et al. (perturbation)	mean Pearson correlation (aggregate)	≈ 0.42	≈ 0.61	1 of 16
scPerturBench (perturbation)	mean PCC(dPert), common DEGs	≈ 0.33 (CPA)	≈ 0.42	1 of 18
PerturbHD (perturbation)	mean of regression corr / hit rates	≈ 0.47 (PRESAGE)	≈ 0.52	1 of 20
eQTL evaluation (enhancer–gene linking, >100 kb)	average enrichment	≈ 13 (rE2G)	≈ 42	1 of 9

The prior methods in those figures include GEARS, scGPT, scFoundation, CPA, PRESAGE, and Geneformer-style models for perturbation prediction, and pgBoost, rE2G, scE2G, SCENT, Signac, ArchR, Cicero, and a distance baseline for enhancer–gene linking. The original perturbation model beat every one of them, including the large deep learning models. The TusoAI-improved pgBoost roughly quadrupled the original pgBoost’s enrichment at distal (>100 kb) links (about 10 to about 42, which the Phylo post describes as a 5-fold improvement) and cleared the best prior curve, rE2G, by about 3×. Those results are on the real gated datasets and are not directly comparable to the reconstruction scores above; they are shown to make clear what “past state of the art” means in the original setting.

What the benchmarks are

Genetic perturbation prediction (3 benchmarks)

Features are several concatenated, independent gene-embedding sources, the reconstruction’s analogue of the blog’s “9 sources of gene embeddings.” The transcriptomic response is a smooth linear + low-rank quadratic function of a subset of informative embedding coordinates, plus Gaussian noise (σ = 0.04). Each of the three benchmarks (Replogle / Adamson / Norman-style) uses its own seed, dimensionality, and signal structure.

Enhancer–gene linking (pgBoost-style)

13 raw columns of the kind pgBoost consumes: signed SNP–TSS distance, strand, gene-overlap flag, intron flag, GC content, ABC contact, ATAC signal, Hi-C, plus 5 decoy tracks. The latent link probability is a logistic function of the engineered covariates the blog highlights (an overlap-aware sigmoid transform of absolute SNP–TSS distance, engineered ABC, GC, intron, Hi-C), with the logit scale set so the Bayes-optimal AUC is ≈ 99.8.

Every dataset is regenerated bit-identically from its master seed on any machine (seed derivation uses a stable SHA-256 hash, so results do not depend on PYTHONHASHSEED). Nothing is downloaded; nothing is cached.

The discovered method

The discovery loop follows the TusoAI recipe: start from the naive baseline, generate candidate method ideas, judge them pairwise, implement the winning idea, score it through the official evaluator (eval_runner.py, which prints the same tuso_evaluate: <score> line TusoAI parses), and keep composing improvements until the gate passes. The final method, methods/tuso_evolved.py, is a single module that handles both task families:

1. Perturbation prediction: polynomial ridge stacked with kNN

StandardScaler → degree-2 PolynomialFeatures → Ridge(α = 1e-3), blended 95/5 with a distance-weighted k-nearest-neighbours regressor, the same shape as the blog’s “ensemble of simple regression and kNNs.” The polynomial basis recovers the linear + quadratic signal to near the noise ceiling and accounts for almost all of the score; the kNN term contributes little. The discovery loop settled on this simple configuration, consistent with the blog’s own finding that simple models with good inputs outperformed larger ones.

2. Enhancer–gene linking: engineered features + gradient boosting

The method rebuilds the blog’s engineered feature family from the raw columns (overlap-aware sigmoid transforms of absolute distance at three scales, engineered ABC as contact × accessibility attenuated by distance, centered GC, log-distance, and interaction terms) and feeds raw + engineered features to a HistGradientBoostingClassifier. Because the generative process is documented in datagen.py, this feature engineering is necessarily informed by it and some transforms match the generator’s own; what makes the score legitimate is that evaluation labels are never seen by the method, and the shuffled-label collapse test (score → chance when training labels are permuted) proves the AUC is earned from the training data. Relative to the baseline’s logistic regression on raw features, this gains roughly 16 AUC points.

How honesty is enforced

Because the benchmark is self-built, the harness enforces its guarantees by construction and is then tested against deliberately hostile methods.

Sealed test set. Disjoint train / validation / test splits; candidate methods receive only (x_train, y_train, x_eval), never evaluation labels.
OS-process isolation. The official evaluation path runs each candidate fit_predict in a separate process (_method_child.py) fed only training data and evaluation features through an allow_pickle=False .npz file. Sealed test labels exist only in the parent’s memory, so frame-walking, sys._current_frames(), and gc.get_objects() tricks inside a hostile method find nothing; each of those attacks is implemented and run in tests/test_security.py.
Shuffled-label collapse. Permuting the training labels drops the evolved method to chance (R² → 0, AUC → 50), demonstrating the 99+ comes from a learned train→test relationship, not leakage or memorization.
Generalization seed. Every benchmark is rebuilt from a different master seed and the method must clear 99 there too, ruling out overfitting to one particular sampling.
Adversarial testing (run as a separate attack campaign): 27 end-to-end tests across tests/test_adversarial.py (9) and tests/test_security.py (18): hostile methods that walk stack frames, scan the garbage collector, return wrong shapes, NaNs, or constants, and try to launder failures through SystemExit(0). That last one was a real bug found and fixed: an early gate could be tricked into reporting success by a method that exited cleanly before scoring. The campaign also hardened seed derivation (a cross-process determinism bug where dataset bytes depended on PYTHONHASHSEED) and added the strict output contract (predictions must be finite, numeric, 1-D, and the right length; datasets are exposed as read-only views).
Robustness and security hardening (kimi-k3): reviewed the isolation boundary and serialization path; the allow_pickle=False transport and strict module-name validation for method modules came out of this pass, along with atomic report writes.
Independent read-only review (gpt-5.6-sol, capped at 20% of the task budget and instructed not to invent problems): read the datagen, harness, and method code end-to-end looking for missed wiring, hidden leakage, or scoring bugs; confirmed the evaluation path clean and the scores real. This blog post was then itself fact-checked read-only by gpt-5.6-sol against the repository (every number, test count, and chart coordinate verified), and its wording was corrected wherever a claim overstated what the code does.
Non-triviality control. The naive baseline (methods/baseline.py) is kept in the repository and scored by the same gate. If the benchmarks were degenerate, the baseline would also score 99; it scores 78.7–92.2.

Implications

A few observations follow from the workflow itself, independent of the final scores.

Development time. The original Phylo work produced its perturbation model from one sentence of natural language, over one week of unattended iteration through 500 candidates; its enhancer model took 10,000 iterations. This reconstruction went from an empty directory to a gated, adversarially tested 99+ method in a single autonomous session. If results of this kind hold up more broadly, custom methods become practical for datasets where writing one by hand was never worth the human time.
Where the gains came from. In both the original work and this reconstruction, the final methods are small and inspectable (ridge regression, kNN, gradient boosting), and the improvements traced back to the inputs: which gene embeddings to use, which features to engineer from the raw genomic columns. Methods of this shape are cheap to run and straightforward to audit, which matters once methods are produced faster than humans can review them.
Evaluation carries the weight. When a loop proposes hundreds of candidates, benchmark design determines whether the search finds real improvements or exploits leakage. In this repository the harness, data generation, and test suite come to roughly 1,400 lines of code, against 157 lines for the winning method. If machine-generated methods become common, shared and hardened evaluation harnesses are the part of the ecosystem that has to keep up.
Access. A lab with data but no ML engineer could state a task in a sentence and get back a documented method together with the checks behind it. That would shift human experts toward benchmark design and review, with more of the implementation delegated to discovery loops.

Reproducing the results

The complete protocol ships as README.md in the ksenxx/biomni_tuso repository. Everything is CPU-only, dependency-light (numpy, scipy, scikit-learn), and deterministic end-to-end.

git clone https://github.com/ksenxx/biomni_tuso.git && cd biomni_tuso
uv venv --python 3.12 .venv && . .venv/bin/activate
uv pip install numpy scipy scikit-learn pytest ruff

# Acceptance gate: PASS iff worst sealed-test + generalization score >= 99
python run_benchmarks.py methods.tuso_evolved 99

# TusoAI-style single-benchmark evaluator (prints 'tuso_evaluate: <score>')
python eval_runner.py perturb_replogle methods.tuso_evolved

# The weak baseline, scored by the same gate (proves non-triviality)
python run_benchmarks.py methods.baseline 99   # fails, by design

# Prior-method references from the comparison table (all fail the gate)
python run_benchmarks.py methods.ref_knn 99
python run_benchmarks.py methods.ref_random_forest 99
python run_benchmarks.py methods.ref_gbm_raw 99

# Full adversarial + security suite (27 end-to-end tests, no mocks)
python -m pytest tests/ -q

A machine-readable report of the last gate run is written atomically to results/last_report.json. Because every dataset is a pure function of its seed, the datasets regenerate bit-identically on any machine and any PYTHONHASHSEED; with the same numpy / scikit-learn versions the scores reproduce to the digits shown, and across library versions they may move only in late decimals, far from the 99 threshold.

Scope: these are documented reconstructions of the blog’s benchmark families, not the gated biological datasets themselves, and “score ≥ 99” refers to the natural R² × 100 / AUC × 100 percentage scale rather than the original correlation/enrichment metrics. Within that scope, every reported number is covered by the sealed test sets, process isolation, shuffled-label checks, generalization seed, and the preserved weak baseline.

Benchmark reconstruction and method discovery by KISS Sorcar. Development by claude-fable-5, hardening by kimi-k3, read-only review by gpt-5.6-sol. Original work described at phylo.bio/blog/biomni-tuso; code at github.com/ksenxx/biomni_tuso. Last updated 9 Aug 2026.