SynthID Bio: Google DeepMind Brings Invisible Watermarks to AI-Designed Proteins

Researchers at Google DeepMind have introduced SynthID Bio, a family of methods that hide a detectable watermark inside AI-generated protein sequences and structures, while preserving the function of the proteins tested. The work is described in an open-access paper, “Function-preserving watermarking of AI-generated proteins”, published in Nature on 30 September 2026, alongside an announcement on the Google DeepMind blog. The authors include David Stutz, Alexander Cowen-Rivers, Jeremy Ratcliff, Demis Hassabis, and Pushmeet Kohli.

Why AI-designed proteins need a label

Models such as AlphaFold 3 and modern protein-design tools can now generate new structures and functional proteins at scale. As these designs move into databases, publications and DNA synthesis orders, it becomes harder to tell which were produced by AI and by which system. The authors argue that tracing this origin matters for both biosecurity and the integrity of scientific data.

How SynthID Bio works

SynthID Bio comes in two forms:

• SynthID Bio-sequence uses a secret key to subtly bias which amino acids the design model ProteinMPNN picks at positions throughout the protein. Detection uses the same key to score the whole sequence: watermarked designs score higher on average than ordinary ones. DeepMind used it with AlphaProteo to design protein binders.
• SynthID Bio-structure is a version of AlphaFold 3 whose diffusion module was fine-tuned together with a separate detector network. Its predicted structures carry subtle shifts in certain atomic distances and angles that are invisible to the eye but picked up by the detector, which, according to the paper, is kept private.

Because the signal lives in the sequence or structure itself, it can be checked on the design, not only on the software that produced it.

Does the watermark affect function?

This is the central question, and the team tested it in the lab. Working with Adaptyv Bio for in vitro validation, they compared hundreds of watermarked and non-watermarked binder designs against three targets: VEGF-A, PD-L1, and the SARS-CoV-2 spike receptor-binding domain. According to the paper, watermarking did not significantly change the distribution of binding affinities, and the best watermarked binders reached sub-nanomolar affinity for VEGF-A and PD-L1. Hit rates were broadly similar, with one exception: at the strictest binding threshold tested, non-watermarked designs performed better.

For structures, from the watermarked AlphaFold 3 models were detected with a true-positive rate above 99.8% at a 0.1% false-positive rate, while prediction accuracy was maintained.

Key terms in plain language

• Watermark: a hidden, machine-detectable signal embedded in content to show where it came from.
• Binder: a designed protein that attaches to a specific target molecule.
• True-positive / false-positive rate: how often the detector correctly flags a watermarked design, and how often it wrongly flags an unwatermarked one.

Limitations and open questions

The authors describe SynthID Bio as a proof of concept. DeepMind notes that making the watermark more robust against deliberate tampering remains a key challenge. The paper also notes that adding extra sequence to a design, such as an expression tag, dilutes the signal in proportion to its size, and that detection is less reliable for very short sequences and structures.

DeepMind also reports early, ongoing work with the Hie lab at Stanford University and Arc Institute to watermark the genome of a bacteriophage designed with the Evo 2 model; these results are not yet part of the published paper.

Practical takeaways for researchers

• Function can be preserved: watermarking binders did not significantly change binding affinity in this study.
• A signal for screening: DNA synthesis providers and databases such as the PDB, UniProt, and GenBank could use watermarks to flag AI-generated entries.
• Open resources: according to DeepMind, the code and in vitro data are being open-sourced, and the model weights are being released to the research community; the paper notes that the structure detector itself is not shared.

Frequently asked questions

Join the discussion

Should AI-designed biological sequences carry a watermark by default? Tell us in the comments.

Reference: Stutz, D., Cowen-Rivers, A.I., Ortiz-Jimenez, G., Ratcliff, J., et al. Function-preserving watermarking of AI-generated proteins. Nature (2026). https://doi.org/10.1038/s41586-026-10965-y
Announcement: https://deepmind.google/blog/introducing-synthid-bio/

Disclaimer:
The research discussed in this article was conducted and published by the authors of the referenced paper. CBIRT has no involvement in the research itself. This article is intended solely to raise awareness about recent developments and does not claim authorship or endorsement of the research.

Follow Us!

• X
• LinkedIn
• Facebook
• Reddit
• Tumblr
• Pinterest
• YouTube
• Instagram
• RSS Feed

Learn More: