Toxicity is a question about dose.

Not whether. At what dose.

Liver injury is the most common safety reason a drug candidate dies, and the most common reason a marketed drug is withdrawn. It is usually found late. For a decade, models have been asked to label molecules toxic or safe from structure alone, and for a decade that number has not moved. We think the question was wrong, not the chemistry.

Liver injury is the first endpoint. The construction underneath it is the arithmetic of almost every quantitative safety decision in drug development, so the same engine extends outward.

1. DILILiver injuryDose-dependent drug-induced liver injury: the first endpoint, and the one the programme is built around.First
2. hERGCardiotoxicityBlock of the hERG channel, the classic route to QT prolongation, where exposure over potency is already regulatory arithmetic.Next
3. CYPInteractionsCytochrome P450 interaction, where the same ratio decides whether a co-prescription is safe.Next
4. CytoCytotoxicityGeneral toxicity to cells, the broadest early signal and a mechanism input in its own right.Later

Exposure over potency.

Injury happens when the concentration a dose produces meets the concentration a liver mechanism cannot tolerate. Divide one by the other and the ratio separates the dangerous drugs from the safe ones far better than structure alone ever has. The published work that establishes this does it with the potency half measured in a laboratory.

Our bet is that the measured half can be predicted too. If it can, the whole assessment runs before a milligram is synthesised. That is the open question in the field, and it is the company.

Dose-dependent injury, and only that.

There are two kinds of drug-induced liver injury and they are not one problem. The dose-dependent kind is reproducible, mechanistic, and the kind this engine predicts. The idiosyncratic kind is an immune response in a particular patient, with no clean dose relationship, and no method available today predicts it from a structure.

Much of the field trains on clinical labels dominated by the second kind using features that only encode the first. Naming the boundary is what lets the benchmark be honest, and it is written into the regulatory context of use.

Four ways a liver fails.

Dose-dependent injury runs through a short list of routes. Potency is predicted for each one separately, because a drug that is gentle on three and brutal on the fourth is a dangerous drug. The narrowest margin governs the call, and the engine says which route produced it.

1. 01Mitochondrial failureUncoupling and inhibition of the electron transport chain, the most common route to dose-dependent injury.
2. 02Bile salt transportInhibition of the bile salt export pump, and the bile-acid accumulation that follows.
3. 03Reactive metabolitesCovalent binding by species the liver creates while trying to clear the drug.
4. 04Oxidative stressRedox burden that outruns what the cell can buffer.

Public data, cleaned until it is honest.

The clinical labels, the mechanistic readouts and the exposure measurements are all public, which is what makes the first result provable on compute alone. They are also messy, overlapping and recorded under four different conventions. The mechanistic sets, the ones that matter most here, are small. Most of the work is in this block.

• DILIrank
• DILIst
• Therapeutics Data Commons
• Mechanistic assay sets
• Measured exposure tables
• Open TG-GATEs

1. 01Harmonise the sourcesClinical labels, mechanistic assay readouts and exposure measurements reconciled into one record per molecule, with every disagreement left visible.
2. 02Standardise the structureOne canonical form per molecule: salts stripped, tautomers and charges resolved, stereochemistry kept where the assay kept it.
3. 03Audit for leakagePublic liver sets descend from a shared pool of regulatory labels, so they overlap more than their names suggest. Overlap is found and removed before anything is trained.
4. 04Pair with exposureA toxicity label without a dose is half a datapoint. Labels are paired with the exposure that produced them, so the benchmark can ask a dose-conditioned question.
5. 05Split without leakageScaffold and time splits, plus a harder frontier split, so the test set holds chemistry the model never saw rather than cousins of it.
6. 06Keep provenanceEvery record carries its source and version. Every result re-runs in one command.

Frozen before we train.

The same liver endpoint is reported in the literature at wildly different scores, and the spread is explained by how the evaluation was built, not by the models. So a programme here competes on evaluation discipline before it competes on architecture. The benchmark is the first deliverable, and it is designed to be able to say no.

Built to be judged, not admired.

Architecture is the least interesting part of this. What matters is the shape: one representation of the molecule, one head per half of the ratio, and a third that turns them into a decision. Graph networks and pretrained encoders are both in play and both disposable, kept or dropped by what survives the benchmark.

1. 01One shared encoderA single learned representation of the molecule feeds every head, so sparse mechanistic data borrows strength from abundant exposure data.
2. 02An exposure headPredicts unbound concentration from structure. The literature has already shown this half can be predicted rather than measured.
3. 03A mechanism headPredicts potency per mechanism of injury. This is the half nobody has yet shown can be predicted, and it is the question the company exists to answer.
4. 04An integration headCombines the two into a margin and a call, with the threshold learned rather than assumed.
5. 05Negative controlsShuffled labels, structure-blind baselines and ablations run alongside, so a result that is really leakage shows up as one.

Every call carries its confidence.

A toxicity prediction without a confidence is a guess with a decimal point. Each call comes with a calibrated probability and a coverage guarantee, and an honest refusal when the molecule sits outside what the data covers. We could find no published liver model that reports this, which is reason enough to make it standard equipment.

Predictions filed before the assays run.

A retrospective benchmark can be gamed by anyone willing to look at it enough times. So the engine is also tested forwards: predictions on fresh compounds are registered first, the laboratory work is blinded, and the comparison happens against what was written down beforehand.

Written for a regulator to read.

Regulators now publish what they expect of a computational safety tool: a narrow stated context of use, evidence matched to the weight the tool carries in a decision, and a known applicability domain. We are building to that specification from the first commit rather than retrofitting to it, and pursuing the qualification path for the endpoint rather than assuming a prediction will be taken on trust.

A toxicologist stands behind the number.

Endpoints are defined and labels judged by people who know the biology, with the toxicology and pharmacology faculty of the Medical University of Warsaw. Metrics are chosen to match real safety decisions, not leaderboard habits. Synthesis and assays through partners feed measured results back into the engine.