DeepMind watermarks AI-designed proteins without breaking them
SynthID Bio hides a detectable signal in protein sequences and structures. It's aimed at DNA-synthesis screening and public databases.
The facts
- SynthID Bio watermarks both protein sequences (via a modified ProteinMPNN) and predicted 3D structures (via fine-tuning part of AlphaFold 3's diffusion network)
- In wet-lab tests on three targets (VEGF-A, SARS-CoV-2 spike RBD, PD-L1), watermarked protein binders matched the hit rate, binding affinity and sequence diversity of unwatermarked versions, per Google DeepMind
- DeepMind says the AlphaFold 3 version preserves prediction accuracy while giving near-perfect detectability and resistance to digital noise or minor coordinate changes
- DeepMind is open-sourcing the methods paper, code, in vitro data and model weights, and is separately testing the approach on an Evo 2-designed bacteriophage genome with Stanford's Hie lab and Arc Institute
Google DeepMind has built a watermarking system for AI-generated proteins. It embeds a detectable signature into the amino acid sequence or the predicted 3D coordinates of a protein, without disrupting the protein's biological function. SynthID Bio extends the company's existing SynthID watermarking, already used for images, audio and text, into synthetic biology. There the target is not a file but a physical molecule that ends up synthesised in a lab.
The system adapts to the type of data. For sequences, it subtly guides which amino acids a generator picks, using a SynthID Bio-enabled version of ProteinMPNN alongside DeepMind's own AlphaProteo. For 3D structures, it fine-tunes a small part of AlphaFold 3's diffusion network, so watermarked coordinates come out of the model by default no matter who runs it.
DeepMind tested the system in the wet lab on three target proteins: VEGF-A, the receptor-binding domain of the SARS-CoV-2 spike protein, and PD-L1. The company reports that watermarked designs matched the hit rate, binding affinity and sequence diversity of unwatermarked ones. DeepMind calls these the first watermarked and biologically functional protein binders.
The motivation is biosecurity. DNA synthesis providers screen orders against databases of known threats before turning a digital design into a physical molecule. But DeepMind notes that AI can generate sequences with little resemblance to known hazards, undermining the old assumption that an unfamiliar sequence is probably a natural organism.
Sarah Carter of Science Policy Consulting, who reviewed the work, said the watermarks let developers 'lead on safety' while letting synthesis providers 'streamline screening.' James Diggans of Twist Bioscience, which gave early feedback on the paper, said watermarking could help 'focus resources on sequences that warrant closer review.' DeepMind also points to public databases such as the Protein Data Bank, UniProt and GenBank. Mislabelled AI-generated entries there risk polluting research and biosecurity decisions.
DeepMind is publishing the methods paper, open-sourcing the code and in vitro data, and releasing model weights to researchers. It is also working with Stanford's Hie lab and the Arc Institute to watermark the genome of an Evo 2-designed bacteriophage, a virus that infects bacteria. Early lab testing in bacteria cultures confirms these watermarked phages are functional, DeepMind says, though a technical manuscript on that work is still to come. The company flags robustness against deliberate tampering as an open problem. It frames watermarking as one layer in a 'Swiss cheese' model of overlapping defences, not a standalone fix.
Why it matters
This only works if it becomes an industry norm rather than a Google-only feature. A watermark covering AlphaFold 3 and ProteinMPNN outputs does nothing to flag sequences designed on other protein-generation models. Screening providers still need non-watermark methods for the rest of the field. Whether synthesis companies like Twist actually build automated checks for this signal into their screening pipelines, rather than treating it as one more input to manual review, will decide if it cuts screening time or just adds a metadata field.
Primary source
Google DeepMind — deepmind.googleWritten from the primary source above by The Neural Net’s automated desk (claude-sonnet-5, theneuralnet/pipeline@1) without human review. How this works. Corrections: check the source first — if we got it wrong, the source link is the record.