DeepMind watermarks AI-designed proteins without changing how they work
Google DeepMind's SynthID Bio embeds a traceable mark in an AI-designed protein that a detector can find in the physical molecule, without changing how it works. The mark is meant to help DNA synthesis firms screen orders and trace which model made a sequence.
The Product Desk
What happened
- In Adaptyv Bio's wet-lab tests, watermarked protein binders matched unmarked designs on hit rate, binding affinity and sequence diversity across three targets.
- DeepMind published the work on Wednesday in a company blog post and a paper in Nature.
- The team extended SynthID Bio to the Evo 2 genomic model and watermarked the genome of a bacteriophage, a virus that infects bacteria, that Evo 2 designed.
- Early tests in bacterial cultures show the watermarked phages still work, and DeepMind plans a technical paper on the result.
- DeepMind released the code and lab data as open source and is giving the model weights to researchers.
Why it matters
- Who's exposed exposure The mark is only as secure as how its keys are stored and shared, so whoever controls the keys controls who can verify a design's origin.
- What it limits constraint Detection is a statistical call whose cut-off sets the false-positive and false-negative rate, so a screener cannot treat a single hit or miss as proof.
- What it sets up precedent If databases like the Protein Data Bank, UniProt and GenBank adopt the labels DeepMind proposes, carrying a provenance tag could become a norm for AI-designed entries.
At a DNA synthesis company, a person screens the orders that come in. To build an AI-designed protein, a lab orders DNA from one of these firms, and the firm checks the order against databases of known threats [8]. DeepMind says AI can now design sequences that look little like any known hazard, and those unfamiliar orders can trigger slow manual reviews [9]. SynthID Bio is aimed at that moment: a watermark could tell the reviewer that an order came from a trusted model [10].
The pitch is one thing. The mark itself is more specific. For sequences, SynthID Bio runs inside ProteinMPNN, a design tool from the Baker Lab, and uses a key much like a cryptographic key to suggest each amino acid, while ProteinMPNN rejects any choice that would not fold into a working protein [4][5]. To read the mark back, software scans the whole sequence with the key and counts how often its suggestions appear [6]. For 3D structures the mark is baked into a fine-tuned slice of AlphaFold 3's weights, and DeepMind says the model keeps its accuracy while detection stays near-perfect [13]. The signature can be read from the physical protein, not only the digital design file [11]. Sarah Carter, a biosecurity policy expert at Science Policy Consulting who reviewed the work, called it "an important piece of the puzzle for tracking the provenance of biological designs" [12].
A screening team has to be careful about what the check actually buys. A watermark only exists if the designer used a tool that writes one, and many AI protein design tools do not use ProteinMPNN [19]. So the mark raises confidence in orders from cooperating models [10], and it does not cover an order from someone who picked an unmarked tool [19]. DeepMind says it still needs to make the mark harder to remove on purpose [20].
Two further limits are physical. Very short proteins may carry too few marked amino acids to find, and fusing a marked protein to an unmarked one can dilute the signal [18].
James Diggans, vice president of policy and biosecurity at Twist Bioscience, described it as a way to steer review toward the orders that need it: "For Twist, watermarking offers a promising new addition to the biosecurity toolbox that could strengthen screening, focus resources on sequences that warrant closer review and make biosecurity more efficient as AI-designed biology continues to advance" [14].
What to watch
- DeepMind's promised technical paper on the watermarked bacteriophage will show whether structure marks hold in a self-replicating genome.
- Whether synthesis firms such as Twist wire the key check into order screening, and who ends up holding the keys, decides if review times actually change.
- Adoption by AI protein design tools outside ProteinMPNN will determine how much designed-protein output the mark can ever cover.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence54
- Adoption36
- Hype gap+12
- Incentives66
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Google DeepMind has brought its SynthID watermarking technology to synthetic biology with a tool called SynthID Bio, which hides a signature in a protein's amino acid sequence or predicted 3D structure.
- [2]
Google DeepMind announced SynthID Bio on Wednesday in a blog post and a paper in Nature.
- [3]
In lab tests, the watermark did not change how the proteins worked.
- [4]
SynthID Bio works inside ProteinMPNN, a popular protein design tool from the Baker Lab, John Timmer reported for Ars Technica.
- [5]
SynthID Bio uses a key, similar to a cryptographic key, to suggest each next amino acid, and ProteinMPNN rejects any suggestion that does not fit a working protein.
- [6]
To detect the mark, software scans the whole sequence with the key and measures how often the suggested amino acids appear.
- [7]
The team designed binders against three targets, VEGF-A, the SARS-CoV-2 spike protein RBD and PD-L1, using AlphaProteo and a SynthID Bio version of ProteinMPNN; Adaptyv Bio helped with the lab tests, and the watermarked designs matched unmarked ones on hit rate, binding affinity and sequence diversity.
- [8]
To make a designed protein, a lab orders DNA from a synthesis company, and these companies screen orders against databases of known threats.
- [9]
Google DeepMind says AI can now design sequences that look little like any known hazard, so unfamiliar orders can then need slow manual reviews.
- [10]
A watermark could show that an order came from a trusted model.
- [11]
Google DeepMind says a test can find the signature in the physical protein as well as in the digital design.
- [12]
SynthID Bio is an important piece of the puzzle for tracking the provenance of biological designs.
- [13]
For structures, SynthID Bio fine-tunes a small part of AlphaFold 3's diffusion network so the watermark sits in the model's weights, and Google DeepMind says AlphaFold 3 keeps its accuracy while detection is near-perfect.
- [14]
For Twist, watermarking offers a promising new addition to the biosecurity toolbox that could strengthen screening, focus resources on sequences that warrant closer review and make biosecurity more efficient as AI-designed biology continues to advance.
- [15]
Google DeepMind says the mark could help label AI-made entries in public databases, naming the Protein Data Bank, UniProt and GenBank.
- [16]
The system is only as secure as the process that shares and stores its keys.
- [17]
Detection is statistical, so the cut-off sets the rate of false positives and false negatives.
- [18]
Very short proteins may carry too few marked amino acids to detect, and fusing a marked protein with an unmarked one could dilute the signal.
- [19]
Many AI protein design tools do not use ProteinMPNN.
- [20]
Google DeepMind says it still needs to make the mark harder to remove on purpose.
- [21]
Google DeepMind added SynthID Bio to Evo 2, a genomic model, with the Hie lab at Stanford University and the Arc Institute, and together they watermarked the genome of a bacteriophage, a virus that infects bacteria, that Evo 2 designed.
- [22]
Early tests in bacteria cultures show the watermarked phages work, and Google DeepMind plans to publish a technical paper.
- [23]
Google DeepMind has made the code and lab data open source and is releasing the model weights to researchers.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
2 independent publishers whose own reporting we read for this story.
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
Entities
- ProteinMPNNFollow
- Red Queen BioFollow
- Twist BioscienceFollow
- Baker LabFollow
- SynthIDFollow
- Sarah CarterFollow
- Google DeepMindFollow
- SynthID BioFollow
- AlphaFold 3Follow
- AlphaProteoFollow
- James DiggansFollow
- Arc InstituteFollow
- Evo 2Follow
- Adaptyv BioFollow