DeepMind watermarks AI-designed proteins without changing how they work
Google DeepMind's SynthID Bio embeds a traceable mark in an AI-designed protein that a detector can find in the physical molecule, without changing how it works. The mark is meant to help DNA synthesis firms screen orders and trace which model made a sequence.
The Product Desk
What happened
- In Adaptyv Bio's wet-lab tests, watermarked protein binders matched unmarked designs on hit rate, binding affinity and sequence diversity across three targets.
- DeepMind published the work on Wednesday in a company blog post and a paper in Nature.
- The team extended SynthID Bio to the Evo 2 genomic model and watermarked the genome of a bacteriophage, a virus that infects bacteria, that Evo 2 designed.
- Early tests in bacterial cultures show the watermarked phages still work, and DeepMind plans a technical paper on the result.
- DeepMind released the code and lab data as open source and is giving the model weights to researchers.
Why it matters
- Who's exposed exposure The mark is only as secure as how its keys are stored and shared, so whoever controls the keys controls who can verify a design's origin.
- What it limits constraint Detection is a statistical call whose cut-off sets the false-positive and false-negative rate, so a screener cannot treat a single hit or miss as proof.
- What it sets up precedent If databases like the Protein Data Bank, UniProt and GenBank adopt the labels DeepMind proposes, carrying a provenance tag could become a norm for AI-designed entries.
Next story · Science · 5h ago
Baker lab's from-scratch zinc proteases cut their chosen target in 36% of 135 designsConfirmed2 publishers
At a DNA synthesis company, a person screens the orders that come in. To build an AI-designed protein, a lab orders DNA from one of these firms, and the firm checks the order against databases of known threats [8]. DeepMind says AI can now design sequences that look little like any known hazard, and those unfamiliar orders can trigger slow manual reviews [9]. SynthID Bio is aimed at that moment: a watermark could tell the reviewer that an order came from a trusted model [10].
The pitch is one thing. The mark itself is more specific. For sequences, SynthID Bio runs inside ProteinMPNN, a design tool from the Baker Lab, and uses a key much like a cryptographic key to suggest each amino acid, while ProteinMPNN rejects any choice that would not fold into a working protein [4][5]. To read the mark back, software scans the whole sequence with the key and counts how often its suggestions appear [6]. For 3D structures the mark is baked into a fine-tuned slice of AlphaFold 3's weights, and DeepMind says the model keeps its accuracy while detection stays near-perfect [13]. The signature can be read from the physical protein, not only the digital design file [11]. Sarah Carter, a biosecurity policy expert at Science Policy Consulting who reviewed the work, called it "an important piece of the puzzle for tracking the provenance of biological designs" [12].
A screening team has to be careful about what the check actually buys. A watermark only exists if the designer used a tool that writes one, and many AI protein design tools do not use ProteinMPNN [19]. So the mark raises confidence in orders from cooperating models [10], and it does not cover an order from someone who picked an unmarked tool [19]. DeepMind says it still needs to make the mark harder to remove on purpose [20].
Two further limits are physical. Very short proteins may carry too few marked amino acids to find, and fusing a marked protein to an unmarked one can dilute the signal [18].
James Diggans, vice president of policy and biosecurity at Twist Bioscience, described it as a way to steer review toward the orders that need it: "For Twist, watermarking offers a promising new addition to the biosecurity toolbox that could strengthen screening, focus resources on sequences that warrant closer review and make biosecurity more efficient as AI-designed biology continues to advance" [14].
What to watch
- DeepMind's promised technical paper on the watermarked bacteriophage will show whether structure marks hold in a self-replicating genome.
- Whether synthesis firms such as Twist wire the key check into order screening, and who ends up holding the keys, decides if review times actually change.
- Adoption by AI protein design tools outside ProteinMPNN will determine how much designed-protein output the mark can ever cover.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence54
- Adoption36
- Hype gap+12
- Incentives66
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Google DeepMind has brought its SynthID watermarking technology to synthetic biology with a tool called SynthID Bio, which hides a signature in a protein's amino acid sequence or predicted 3D structure.
- [2]
Google DeepMind announced SynthID Bio on Wednesday in a blog post and a paper in Nature.
- [3]
In lab tests, the watermark did not change how the proteins worked.
- [4]
SynthID Bio works inside ProteinMPNN, a popular protein design tool from the Baker Lab, John Timmer reported for Ars Technica.
- [5]
SynthID Bio uses a key, similar to a cryptographic key, to suggest each next amino acid, and ProteinMPNN rejects any suggestion that does not fit a working protein.
- [6]
To detect the mark, software scans the whole sequence with the key and measures how often the suggested amino acids appear.
- [7]
The team designed binders against three targets, VEGF-A, the SARS-CoV-2 spike protein RBD and PD-L1, using AlphaProteo and a SynthID Bio version of ProteinMPNN; Adaptyv Bio helped with the lab tests, and the watermarked designs matched unmarked ones on hit rate, binding affinity and sequence diversity.
- [8]
To make a designed protein, a lab orders DNA from a synthesis company, and these companies screen orders against databases of known threats.
- [9]
Google DeepMind says AI can now design sequences that look little like any known hazard, so unfamiliar orders can then need slow manual reviews.
- [10]
A watermark could show that an order came from a trusted model.
- [11]
Google DeepMind says a test can find the signature in the physical protein as well as in the digital design.
- [12]
SynthID Bio is an important piece of the puzzle for tracking the provenance of biological designs.
- [13]
For structures, SynthID Bio fine-tunes a small part of AlphaFold 3's diffusion network so the watermark sits in the model's weights, and Google DeepMind says AlphaFold 3 keeps its accuracy while detection is near-perfect.
- [14]
For Twist, watermarking offers a promising new addition to the biosecurity toolbox that could strengthen screening, focus resources on sequences that warrant closer review and make biosecurity more efficient as AI-designed biology continues to advance.
- [15]
Google DeepMind says the mark could help label AI-made entries in public databases, naming the Protein Data Bank, UniProt and GenBank.
- [16]
The system is only as secure as the process that shares and stores its keys.
- [17]
Detection is statistical, so the cut-off sets the rate of false positives and false negatives.
- [18]
Very short proteins may carry too few marked amino acids to detect, and fusing a marked protein with an unmarked one could dilute the signal.
- [19]
Many AI protein design tools do not use ProteinMPNN.
- [20]
Google DeepMind says it still needs to make the mark harder to remove on purpose.
- [21]
Google DeepMind added SynthID Bio to Evo 2, a genomic model, with the Hie lab at Stanford University and the Arc Institute, and together they watermarked the genome of a bacteriophage, a virus that infects bacteria, that Evo 2 designed.
- [22]
Early tests in bacteria cultures show the watermarked phages work, and Google DeepMind plans to publish a technical paper.
- [23]
Google DeepMind has made the code and lab data open source and is releasing the model weights to researchers.
Sources
2 independent publishers whose own reporting we read for this story.