ToxiMol tests whether multimodal AI can redesign toxic molecules

From predicting toxicity to proposing changes

Can an AI system suggest changes to a toxic molecule without abandoning its structure or producing an impractical alternative? A preprint by Fei Lin and colleagues examines that question through ToxiMol, a benchmark for molecular toxicity repair.

The task goes beyond assigning a toxicity label. Models receive a molecule’s SMILES string—a text representation of its structure—a two-dimensional molecular drawing, and instructions describing the toxicity to address. They must return three candidate alternatives. A case counts as successful if at least one candidate passes every requirement in the accompanying evaluation system, ToxiEval.

Crucially, “repair” here means success under computational checks. The study does not demonstrate that the generated alternatives are safe in laboratory experiments or in people.

A balanced set of molecular challenges

The researchers assembled 660 toxic molecular examples from datasets available through Therapeutics Data Commons. These cover 11 primary tasks, including mutagenicity, drug-induced liver injury, skin sensitization, acute toxicity and inhibition of the hERG potassium channel, which is associated with cardiac risk.

Each primary task contributes 60 examples. Two tasks contain finer subdivisions: Tox21 includes 12 subtasks with five examples each, while ToxCast includes 10 selected subtasks with six examples each. The team used molecular fingerprints and clustering to select structurally varied examples rather than simply drawing all samples at random.

Instructions combine a shared template with task-specific and, where applicable, subtask-specific guidance. This makes the requested edit depend on the toxicity endpoint rather than treating every form of toxicity as the same problem.

What counts as a successful repair?

ToxiEval first checks whether RDKit, a chemical software toolkit, can parse a generated structure. Candidates that fail this check are rejected before further assessment.

Valid candidates then face five simultaneous requirements. The TxGemma-27B-Predict model must assign an acceptable toxicity result for the requested task. Candidates must also meet thresholds for drug-likeness, estimated synthetic accessibility, compliance with Lipinski’s oral-drug design rules, and structural similarity to the starting molecule.

For example, the benchmark requires a drug-likeness score of at least 0.5 and a structural similarity score of at least 0.4. Synthetic accessibility is an estimate, not evidence that a molecule has actually been made. Likewise, resemblance to known drug-like compounds does not establish therapeutic effectiveness.

These combined checks distinguish generating a readable molecular structure from producing an alternative that satisfies the benchmark’s broader constraints.

Uneven performance across models and tasks

The experiments assess 43 models: 39 general-purpose multimodal models and four science- or chemistry-focused models. In the main results table, Claude Opus 4.5 has the highest reported overall success rate, at 43.3%. InternVL 3.5 241B-A28B reaches 36.7%, while the science-focused Intern-S1 reaches 34.4%.

Performance depends strongly on the task. Claude Opus 4.5 scores 93.3% on hERG_Central but 8.3% on drug-induced liver injury and 0% on LD50, the acute-toxicity regression task. Across the evaluated models, LD50 and liver-injury repair remain particularly difficult. Larger models do not consistently outperform smaller ones, and reasoning-oriented variants do not show a uniform advantage.

Additional experiments probe the setup. With Claude 3.7 Sonnet, requesting more candidates raises success from 24.7% with one candidate to roughly 35% with three or four. Larger candidate sets provide no sustained improvement, and LD50 remains unsolved in that experiment.

Images provide a modest benefit in the tested comparison. Across five runs, GPT-4.1 averages 30.5% success with SMILES plus molecular drawings, versus 28.9% with SMILES alone. This result concerns one model and setup; it does not establish that images provide the same benefit across all systems.

The boundary between benchmark scores and safety

The central limitation is reliance on a single toxicity predictor. Its outputs supply a consistent computational reference, but the authors explicitly acknowledge possible systematic biases and do not equate predictions with definitive toxicological conclusions.

The benchmark also draws from existing public datasets that models may have encountered during training. The authors therefore caution against interpreting the results as a strict test on entirely unseen compounds. Small subtask samples further limit the breadth of individual endpoint results.

ToxiMol offers a structured way to compare proposed edits under shared constraints. It does not show that AI has reliably detoxified drug candidates. Confirming reduced toxicity still requires laboratory validation and multiple sources of evidence.