The Pulse
Google DeepMind Adds SynthID Watermarks to AI-Designed Proteins
Google DeepMind introduced SynthID Bio, a method for embedding detectable watermarks in AI-designed protein sequences and predicted structures. Lab tests found watermarked protein binders retained key measures of function, while deliberate
AI.info Team · Written with AI ·
Google DeepMind introduced SynthID Bio on September 30, a method for watermarking AI-generated protein sequences and predicted protein structures. The company says its proof of concept embeds a detectable signature in the biological design itself, including in proteins made in the lab, while preserving their function in testing.
Watermarks in sequences and structures
SynthID Bio uses different methods for different kinds of biological data. For protein sequences, it subtly guides the selection of amino acids; for predicted three-dimensional structures, it adjusts atomic coordinates to create a signal that can be detected later.
DeepMind tested sequence watermarking on protein binders, molecules designed to attach selectively to other proteins. The team paired its AlphaProteo binder-design method with a version of ProteinMPNN enabled for SynthID Bio, then tested designs against VEGF-A, the SARS-CoV-2 spike protein’s receptor-binding domain and PD-L1.
In wet-lab tests, DeepMind says watermarked designs matched unwatermarked versions on hit rate, binding affinity and natural sequence diversity. The announcement describes them as the first watermarked protein binders shown to retain biological function in testing.
AlphaFold 3 carries a structural signature
For predicted protein structures, SynthID Bio fine-tunes part of AlphaFold 3’s diffusion network so the watermark is built into the model’s weights. DeepMind says the resulting structures retain AlphaFold 3’s prediction accuracy and key structural feature distributions, with near-perfect detectability in its tests. The signal also held up against digital noise and minor coordinate changes.
The two approaches address a provenance problem that becomes harder when AI generates biological designs unlike known natural sequences. DNA synthesis providers screen orders against databases of known hazards; an unfamiliar sequence may otherwise require manual review to determine whether it is a new natural sequence or an engineered design. A detectable mark could help screeners verify that a design came from a model with safeguards, but DeepMind presents that as a potential use, not a system already deployed by synthesis providers.
Provenance, not a safety certificate
“SynthID Bio is an important piece of the puzzle for tracking the provenance of biological designs,” said Sarah Carter, a biosecurity policy expert and principal at Science Policy Consulting who reviewed the work.
Watermarking could also help identify synthetic entries submitted to public resources such as the Protein Data Bank, UniProt and GenBank, where mislabeled data can affect later research and biosecurity decisions. DeepMind says the method could flag such entries for review; it does not claim the watermark alone establishes whether a protein is safe.
The company is publishing a methods paper and says it will release code, in vitro data and model weights to the research community. It also identifies a major limitation: deliberate tampering remains a challenge. DeepMind suggests pairing watermarks with provenance metadata or central repositories of AI-generated biological data, rather than treating the mark as a standalone safeguard.
Early work extends to bacteriophages
DeepMind says it has also worked with the Hie lab at Stanford University and the Arc Institute to apply SynthID Bio to a bacteriophage genome designed with the Evo 2 model. Early tests in bacterial cultures found the watermarked bacteriophages functional, but the company says it will share details in a technical manuscript later.
For now, SynthID Bio is a research-stage demonstration spanning protein sequences, predicted structures and an early genome-design experiment. Its reported protein tests suggest a provenance signal can coexist with biological function; whether that signal can withstand deliberate removal, and how screening providers might use it, remain unresolved.