Google DeepMind has released SynthID Bio, a set of techniques that embed a hidden, machine-detectable signature in proteins designed by AI, the lab said in a blog post Wednesday. The method works on both amino acid sequences and predicted 3D structures, and DeepMind says the signature remains detectable after a protein has been physically made. The research appears in Nature, and the code, laboratory data and model weights are being released openly.

What Happened

SynthID Bio takes two routes. For sequences, it slightly steers which amino acids a design model picks at each position, leaving a statistical pattern that a detector can later recognize. For structures, DeepMind fine-tuned the diffusion network inside AlphaFold 3 so that the atomic coordinates it predicts carry a signature. Because the watermark is built into the model weights, any structure produced by that version of the model is marked, regardless of who runs it.

The team tested whether the mark changes how proteins behave. It designed binders for three targets, the cancer-related growth factor VEGF-A, the receptor-binding domain of the SARS-CoV-2 spike protein and the immune checkpoint protein PD-L1, and had them made and measured in the lab with support from Adaptyv Bio. According to DeepMind, watermarked designs matched unwatermarked ones on hit rate, binding affinity and how closely their sequences resembled natural diversity. The lab describes these as the first watermarked protein binders shown to be biologically functional.

RelatedOpenAI Says Its Models Broke Into Two Outside Data Sites and Left It Out of Their Answers

DeepMind reports near-perfect detection that tolerates digital noise and small shifts in atomic coordinates, while AlphaFold 3's prediction accuracy and key structural statistics were preserved. The post lists Pushmeet Kohli, David Stutz, Ali Cowen-Rivers and Jeremy Ratcliff among its authors.

Why It Matters

Companies that synthesize DNA screen incoming orders against databases of known dangerous sequences. AI design tools can produce proteins that work like known threats but look nothing like them, which makes list-based screening less reliable. A watermark offers a different check: a screener could confirm that an unfamiliar sequence came from a model with safeguards, and spend its attention on the orders that carry no such mark.

Twist Bioscience, one of the larger DNA synthesis suppliers, gave early feedback on the work. Its James Diggans called watermarking "a promising new addition to the biosecurity toolbox" in comments DeepMind published. Sarah Carter of Science Policy Consulting described it as one piece of the puzzle for tracking where biological designs come from.

Releasing the weights matters for adoption. A watermark only helps screeners if it is used widely, and protein design is spread across academic labs, startups and open-source projects, not concentrated in a few companies.

The Limits DeepMind Acknowledges

DeepMind frames SynthID Bio as one layer in a Swiss cheese model of biosecurity, in which several imperfect defenses cover each other's gaps. The company says making the watermark resistant to deliberate tampering is still unsolved, and a person who reworks a marked protein with a different design tool could remove the signature. It suggests pairing watermarks with provenance metadata or central registries of designs.

The scheme is also opt-in. A sequence produced by a model without SynthID Bio carries no mark, so the absence of a watermark cannot by itself flag an order as risky.

What to Watch

DeepMind says it is extending the approach to larger biological objects. With Stanford's Hie lab and the Arc Institute, it watermarked bacteriophage genomes designed with the Evo 2 genomic model, and Help Net Security reported that early tests produced functional phages; fuller results have not yet been published. The open questions are whether DNA synthesis providers build watermark detection into their screening, whether other protein-design labs adopt the method, and whether a tamper-resistant version follows.