ChemGraphSafe

Why this matters

Chemistry agents such as ChemGraph do more than answer questions. They plan workflows, call cheminformatics and simulation tools, and assemble results across many steps. A safety layer for such an agent has to make two kinds of decision correctly:

Hackathon scope

This milestone covers request triage only. ChemGraphSafe classifies the incoming request. It does not generate or evaluate responses, execute agents or tools, train models, or enforce anything in production.

Policy v0.1

A provider-native refusal is recorded as ABSTAIN, separate from policy REVIEW. Transport and schema failures are recorded as explicit errors and count as misses.

What the framework provides

Decision models

A decision model ("System One" model) takes a state and typed questions and returns a probability for every option instead of generated text. The answer cannot fall outside the option set, so a triage decision and its class probabilities come back in one call. When those probabilities are genuinely calibrated, they make it possible to set a threshold and to defer uncertain cases to review.

Once the Kev or Laya adapter lands, other open System One-compatible models (for example Lev) are welcome as further adapters.

Current status

From the repository's local verification record (macOS, 2026-10-19):

• Locked install, lint, and 35 tests pass using harmless fixtures and mock HTTP. No paid inference was used.
• The offline evaluate → report example runs end to end, and its output is clearly marked MOCK/OFFLINE.
• The real SciHazard import passes both pinned checksums: 250 chemistry records, of which 22 native/split label conflicts are quarantined, leaving 228 eligible groups. 100 groups are selected (50/50).
• The frozen split has 10 + 10 development cases and 40 + 40 evaluation cases, with zero policy annotations (source labels only).
• The live Jev smoke test and evaluation have not run yet. Training, calibration, and live LLM comparisons are contributor work.

Contributor tracks

The work is split into four tracks that can proceed independently. Pick one bounded item and open an issue from the contribution template. Full details are in docs/contributor-tracks.md.

Suggested first issues

1. SciSafetyBench chemistry challenge loader (loader contract).
2. Audit source conflicts and provisional annotations, with inter-reviewer agreement.
3. Kev adapter, using the upstream repository (not the unrelated PyPI package named kev).
4. Laya adapter with a pinned checkpoint and a documented meaning of confidence.
5. Calibration report (Brier, ECE, reliability) for genuine full distributions only.
6. Robustness and leakage audit with harmless perturbations.
7. Training export contract that refuses development and evaluation groups.
8. Upstream Kev or Laya fine-tuning recipe, evaluated through the same runner.

How to join

Anyone is welcome: chemists and safety specialists, ML engineers, evaluation and statistics people, and software developers. The hackathon recommends teams of 3 to 10 participants and does not enforce a limit.

1. Register for the hackathon at luma.com/ku88xh92, and join the hackathon Slack from the hackathon homepage.
2. Say hello. Introduce yourself in a GitHub issue or ping the maintainers on the hackathon Slack. Mention ChemGraphSafe and the track you are interested in.
3. Set up Python 3.12 and uv on macOS or Linux (file locking uses POSIX flock). Then run the offline example:

   git clone https://github.com/Autonomous-Scientific-Agents/ChemGraphSafe.git
   cd ChemGraphSafe
   uv sync --locked --extra dev
   uv run chemgraphsafe evaluate --config configs/offline.toml
   uv run chemgraphsafe report --run runs/offline   # open runs/offline/report.md

4. Read CONTRIBUTING.md and the contributor tracks.
5. Claim one bounded item by opening a contribution issue. State the track, the observable deliverable, and the command that proves it works.
6. Open a pull request that passes the same checks CI runs:

   uv run ruff check .
   uv run ruff format --check src tests
   uv run pytest -q

What you need

• A GitHub account, Python 3.12, and uv. No GPU is needed for the default install or for most tracks.
• Credentials for live runs only: OPENROUTER_API_KEY for Jev, ARGO_USER for hosted Argo (Argonne users), a codex login for Codex, or CHEMGRAPHSAFE_LLM_API_KEY for a generic endpoint. Export them in your shell; .env files are not loaded.
• A GPU only for the fine-tuning track.

Ground rules

• Do not commit or paste safety-dataset content. That covers raw downloads, request text, annotations, API responses, and run directories, in Git, issues, pull requests, and Slack. Share aggregate metrics and ID-only errors.
• No attack generation. Robustness work uses harmless perturbations, and borderline examples are documented without operational harmful details.
• Live commands spend real budget. smoke, live evaluate, and curate share one ledger capped at $10 and 500 attempts. Run them only deliberately, and coordinate before running them on shared credentials.
• Protect the holdout. Never train on development or evaluation groups. Changes to data, policy, or model configuration need a new data version and freeze, and code changes need a new run directory.
• Coordinate policy changes separately, because they invalidate comparisons.
• Respect source licenses. New datasets must document access, redistribution, and hosted-processing rights before they are enabled.

Beyond this milestone

The longer-term goal is a safety layer for ChemGraph built on our own fine-tuned decision model. Each step below is future work and is not claimed by the current release:

• A live Jev pilot, then LLM baselines and provisional three-way policy labels with an independent human audit.
• Fine-tuned Kev or Laya checkpoints trained on a disjoint, licensed training partition and evaluated on a new untouched holdout.
• Calibrated thresholds, so that uncertain cases are routed to human review instead of guessed.
• Moving from request triage to agent trajectories: screening ChemGraph's plans, tool calls, and outputs, not only the incoming request.

Resources

• Hackathon: llmhackathon.github.io. See its submission guidelines and FAQ.
• ChemGraph: github.com/argonne-lcf/ChemGraph, described in Communications Chemistry 9, 33 (2026).
• Repository docs: dataset card, model integration card, evaluation and versioning, LLM adapter setup.
• Maintainers: @keceli, @tdpham2.