DeepMind's SynthIDBio embeds a detectable watermark in AI-designed proteins without loss of function
Google DeepMind's SynthIDBio hides a watermark in AI-designed proteins that a detector reads near-perfectly without weakening how they bind. The authors call it a proof of concept, and a determined user can still scrub the mark by rerunning a design through another tool.
The Scientist · Science desk
What happened
- The sequence method builds the watermark into ProteinMPNN, the model many labs already use to write an amino-acid sequence onto a chosen protein backbone.
- A second method, SynthIDBio-structure, is a fine-tuned version of AlphaFold3 that hides an imperceptible mark in a molecule's 3D structure.
- The mark can be read only with a secret detection key, which DeepMind would share with trusted partners such as DNA synthesis companies.
- DeepMind is releasing the methods, the code, its in vitro data and the model weights to the research community.
Why it matters
- What's now possible capability Synthesis providers screening DNA orders could get an automated signal that a design came from a trusted model, and reserve slow manual review for orders that carry none.
- What it limits constraint The mark catches designs that pass through untouched but not a determined adversary who regenerates the sequence, so it works only as a layer inside broader biosecurity defenses.
- Who has to decide decision Open repositories like the Protein Data Bank, UniProt and GenBank could label or flag AI-generated submissions at intake, before mislabeled entries distort later biosecurity calls.
Next story · Product · Oct 7
SynthID.com lets anyone test a file for watermarks from Google, OpenAI, Nvidia and KakaoConfirmed19 publishers
The engineering claim is narrow. DeepMind wove a watermark into both a protein's amino-acid sequence and its 3D shape [4]. That is harder than marking text or an image, because a designed protein has to keep working after you hide a signal in it. A binder has to bind. Earlier methods for watermarking predicted structures cost a noticeable amount of accuracy [15].
So the test that counts is whether a marked protein still does its job. Pushmeet Kohli and his team at DeepMind "stress-tested the approach on a number of challenging problems," he said [2]. The watermarked binders bound to targets tied to viral infection, blood-vessel formation and immune regulation about as well as unmarked designs [3]. The paper, in Nature, reports comparable binding affinity and near-perfect detection but does not attach a figure to either [8][1][9].
The way around the mark is described by the researchers, not skated over. Run a watermarked protein through a different design tool and you can generate a new sequence that keeps the shape and function while dropping the signal [16]. Tessa Alexanian, a biosecurity researcher formerly at the International Biosecurity and Biosafety Initiative for Science in Geneva, calls it one tool in a layered framework [17]. "We're in a wild new world," she said [18].
Even so, it helps where screening is weakest. Synthesis providers check DNA orders against databases of known toxins and pathogen proteins, and an AI design can resemble nothing in those references even when the finished protein behaves like a known hazard [11][12]. James Diggans, vice-president of policy and biosecurity at the synthesis firm Twist Bioscience, said watermarking "could strengthen screening, focus resources on sequences that warrant closer review and make biosecurity more efficient" [21].
The signal is deliberately thin. It reveals only that a protein came from an AI tool, nothing about what the protein does [19]. Function screening still has to happen; the mark tells a reviewer which orders to weigh, not what they encode.
DeepMind calls the work a proof of concept for function-preserving biological watermarking [10]. The function-preservation part is the strong result and was the harder engineering problem; durability is the weaker part, and the team lists making the mark resist deliberate tampering as the next step [13].
What to watch
- Whether DNA synthesis firms and database maintainers actually adopt the detection keys, which only work if trusted partners hold them.
- The technical manuscript DeepMind has promised on watermarking the genome of an Evo 2-designed bacteriophage that stayed functional in culture.
- Whether independent labs reproduce the near-perfect detection and comparable binding using the released weights, code and in vitro data.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence72
- Adoption25
- Hype gap+12
- Incentives62
- Confidence70
Perspective Coverage
4 publishers- Builder
- Builder 51%
- Operator
- Operator 36%
- Investor
- Investor 13%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The watermarked designed protein binders had binding affinity comparable with their non-watermarked counterparts.
- [2]
Pushmeet Kohli and his team at DeepMind "stress-tested the approach on a number of challenging problems," he said.
- [3]
The watermarked proteins were able to bind to a range of targets, including those involved in viral infection, blood-vessel formation and immune regulation, as efficiently as unwatermarked ones.
- [4]
SynthIDBio was developed by researchers at Google DeepMind in London, and it weaves a faint statistical signal into both the amino-acid sequence and 3D shape of computer-designed proteins without noticeably compromising their function.
- [5]
SynthIDBio-sequence integrates watermarking into ProteinMPNN, a commonly used sequence design model applied on top of a backbone structure before designs are filtered to predicted binders.
- [6]
SynthIDBio-structure is a fine-tuned AlphaFold3 model that embeds an imperceptible watermark into biomolecular structures.
- [7]
DeepMind is publishing its methods paper, open-sourcing the code and in vitro data, and releasing the model weights to the research community.
- [8]
The SynthIDBio methods paper was published in the journal Nature.
- [9]
The watermarked proteins showed near-perfect watermark detection accuracy.
- [10]
The authors describe the work as a proof of concept that function-preserving biological watermarking is feasible.
- [11]
DNA synthesis providers screen requests against databases of known threats, and because AI can create entirely new sequences with little resemblance to known hazards, screeners can no longer assume an unfamiliar sequence is an undiscovered natural organism.
- [12]
DNA synthesis companies could miss an AI-designed sequence that bears little or no resemblance to their reference databases even if the resulting protein performs much the same function as a known hazard.
- [13]
DeepMind says key remaining challenges include making the watermark more robust against deliberate tampering, and that it can be paired with provenance metadata like C2PA or central repositories.
- [14]
The watermark could be spotted only by someone holding a secret detection key, which would be shared only with trusted partners such as DNA sequence makers.
- [15]
Current methods result in a noticeable decrease in accuracy when watermarking protein structures.
- [16]
Someone can, in many cases, run a watermarked protein through another design tool to generate a new sequence that retains the protein's structure and function but obscures its synthetic origins.
- [17]
Tessa Alexanian, a biosecurity researcher formerly at the International Biosecurity and Biosafety Initiative for Science in Geneva, says the watermark is best viewed as one more tool in a layered framework for guarding against biological threats.
- [18]
"We're in a wild new world," said Tessa Alexanian.
- [19]
The watermark reveals nothing except that a protein was made using an AI tool.
- [20]
SynthID Bio can provide an automated verification signal, proving an order originated from a trusted model with built-in safeguards.
- [21]
James Diggans, Vice President of Policy and Biosecurity at Twist Bioscience, said watermarking "could strengthen screening, focus resources on sequences that warrant closer review and make biosecurity more efficient".
- [22]
SynthID Bio could help databases such as the Protein Data Bank, UniProt and GenBank, which are open to public submission, ensure synthetic entries are properly labeled or flagged, because mislabeled entries can have an outsized negative impact on biosecurity decision-making.
- [23]
In work with the Hie lab at Stanford University and the Arc Institute, DeepMind integrated SynthID Bio into Evo 2, a genomic model, to watermark the genome of an Evo 2-designed bacteriophage, and early laboratory testing in bacteria cultures confirmed the watermarked bacteriophages are functional.
Sources
3 independent publishers whose own reporting we read for this story.
- blog.googleSynthID Bio watermarks AI-designed proteins
2 articles · September 30, 2026
- deepmind.googleSynthID Bio: Watermarking methods for synthetic biology — Google DeepMind
2 articles · September 30, 2026
- nature.comSecret watermark labels proteins as ‘made by AI’
3 articles · September 29, 2026
- phys.orgGoogle DeepMind develops invisible watermarks for AI-designed proteins
1 article · October 1, 2026