DeepMind's proteins now carry a signature that survives the lab

FACT. On 30 September 2026 Google DeepMind announced SynthID Bio and published the underlying methods paper, "Function-preserving watermarking of AI-generated proteins", in Nature as an open-access article. The paper introduces SynthIDBio, described by the authors as "a family of methods for watermarking protein sequences and structures to establish the provenance of those generated with AI."

FACT. "Family of methods" is accurate and means two genuinely distinct mechanisms, not one mechanism with cosmetic variants:

1. SynthIDBio-sequence — a sampling-level watermark. It wraps ProteinMPNN, the standard open sequence-design model, with the tournament sampling algorithm taken from DeepMind's earlier SynthID-text watermarking work. It biases which amino acid is emitted at each position, so the signature lives in the protein sequence itself.
2. SynthIDBio-structure — a weights-level watermark. It is a fine-tuned AlphaFold 3 model whose diffusion module has been trained to emit watermarked 3D coordinates, so the signature is produced by inference itself and cannot be switched off by whoever runs the model.

FACT. Signatures therefore go into both sequence and structure, via two different mechanisms, applied at two different points in the protein-design pipeline (resequencing a designed backbone, versus structure prediction).

FACT. Accompanying the paper, DeepMind open-sourced the code and the in vitro validation data and released weights for the recommended structure model (s = 0.001) at https://github.com/google-deepmind/synthidbio (Apache-2.0 software; CC-BY for data; AF3 weights remain under AF3's own terms; a separate "weights prohibited use" policy is included in the repository).

FACT. The DeepMind blog post carries two third-party endorsements: Sarah Carter (biosecurity policy expert, Principal at Science Policy Consulting), who is described as having reviewed the work; and James Diggans (VP, Policy and Biosecurity at Twist Biosynthesis), described as having provided early feedback on the paper. Both are COMPANY-SOURCED — I retrieved them via the DeepMind blog and could not independently retrieve their original statements. Diggans' comment is pre-publication feedback given to the authors, not an independent post-publication assessment of results.

FACT. The blog also announces ongoing, as-yet-unpublished work: SynthID Bio integrated into Evo 2 (a genomic model) with the Hie lab at Stanford University and Arc Institute, to watermark the genome of an Evo 2-designed bacteriophage; DeepMind says early bacterial-culture testing confirmed the watermarked phages are functional and that a technical manuscript will follow.

FACT — discrepancy worth recording. One retrieved secondary source (AI Governance Institute, 2026-10-01) describes SynthID Bio as embedding watermarks into "AI-generated DNA sequences and three-dimensional protein structure predictions". That is incorrect against the paper. The peer-reviewed work covers protein sequences and predicted structures. DNA-level / bacteriophage-genome watermarking is only ongoing work with no published manuscript. This is a concrete example of secondary coverage drifting from the primary artefact on this story.

FACT — the problem statement, per the paper. Genomic AI design has broken the core assumption behind commercial gene-synthesis screening. Screening compares orders against databases of known threats; the historical assumption was that an unfamiliar sequence is probably an undiscovered natural organism. Because AI can now create entirely new sequences with little resemblance to known hazards, screeners can no longer make that assumption, and verifying an unfamiliar order requires exhaustive manual review that stalls legitimate research.

FACT — the prior options, per the paper's own framing. Three provenance routes existed, each with a specific weakness:

• Central databases of provenance: data-rich and the entry cannot be deleted, but retrieval is prone to false positives at scale, and they raise privacy, IP and central-authority problems.
• Cryptographically signed metadata: privacy-preserving, but "trivial to remove" and, without signatures, forgeable.
• Watermarking: high detectability and quality preservation by being imperceptible, no central coordination required, and it can establish provenance for open model predictions.

FACT — prior biology watermarking was weak. Concurrent/prior work was limited: Chen et al. (Bioinformatics, 2025) showed only in silico experiments on wild-type PDB monomer structures; FoldMark (bioRxiv preprint) showed "a noticeable decrease in accuracy" when watermarking protein structures. The authors' conclusion: "Combined, these show that function-preserving watermarking is not yet available."

COMPANY CLAIM. What changed on 30 September is that function-preserving watermarking is now available and peer-reviewed — for protein sequences (validated in vitro on synthesised, functional binders) and for AF3-predicted structures (TPR > 99.8% at 0.1% FPR).

INTERPRETATION. The real change is not the watermark; it is that the imperceptibility constraint changed shape. For images and text, imperceptibility is perceptual — a human shouldn't notice. For proteins, imperceptibility is functional — the molecule must still fold and bind. That is a much harder constraint, and it is the part the wet-lab data addresses and the part that previous work failed.

Before.

• Protein-sequence watermarking existed only as in-silico work on wild-type monomers (Chen et al. 2025), with no experimental validation.
• Structure watermarking (FoldMark) came at a measurable accuracy cost.
• DeepMind's SynthID existed for text, images, audio and video — all digital, all perceptually defined as imperceptible.
• Gene-synthesis screening was doing escalating manual review of novel orders, with no positive, automated signal for "this came from a tool with safeguards".

Change.

• Two watermarking mechanisms adapted to biology: sampling-level for sequences, weights-level for structures.
• The sequence mechanism reuses SynthID-text tournament sampling; the structural mechanism is a composite-loss fine-tune of AlphaFold 3's diffusion module with a PointNet-inspired detector.
• The in vitro bar was met for the sequence method: watermarked binders matched unwatermarked hit rate, binding affinity and natural sequence diversity across three targets, with the signature still detectable on the physical protein.
• Everything is released: paper (open access), code, weights, in vitro data.

After.

• A watermarked protein can be ordered from a vendor, synthesised, and still be shown to carry a verifiable signature tied to a known model — with detection requiring only the exchange of secret keys, no central database.
• The bottleneck shifts from can we watermark a protein to will anyone adopt the standard, and who holds the keys.
• The attack surface is now explicit and published: resequencing removes the sequence watermark; molecular relaxation removes the structural watermark.

5.1 SynthIDBio-sequence (ProteinMPNN + SynthID-text tournament sampling)

FACT. ProteinMPNN decodes amino-acid sequences autoregressively, sampling token x_t at each step from p(· | x_<t). SynthIDBio-sequence replaces the sampling procedure with SynthID-text's tournament sampling:

1. Random seed. At each position t, a seed r_t = f_r(x_{t-H:t-1}, k) is derived by hashing the preceding H-gram of residues together with the secret watermarking key k. Experiments used H = 4.
2. Scoring. A binary g-function assigns every possible residue token a score of 0 or 1, conditioned on r_t. In the simplest case g(x_t, r_t) = 1 if h(x_t, x_{t-H:t-1}, r_t) / 2^n > 0.5, else 0.
3. Tournament. 2L candidate residues are sampled; pairs compete on g using key k_1, then 2^{L-1} remain and compete using k_2, and so on until one candidate survives. In practice this is implemented as a transformation on ProteinMPNN's logits rather than by explicitly sampling candidates. Experiments used L = 25 layers.
4. Detection. Given the secret key, recompute the H-grams and g-values for the candidate sequence and average them. Watermarked sequences score above the null expectation of 0.5; unwatermarked sequences sit near 0.5.

FACT — two operating modes.

• Non-distortionary: a unique key per layer, so token and sequence distributions are unchanged in expectation over the keys. The paper is explicit that this concerns distributions over tokens, not semantics, and that a distortionary watermark can still have no effect on protein function — "this can only be determined through experimental testing."
• Distortionary: the same key is reused across all 25 layers, which significantly biases generation conditioned on the H-gram. This is the strong-watermark mode used at low sampling temperature.

FACT — entropy is the binding constraint. Detectability depends on sampling entropy, and protein design normally uses low temperature (default 0.1) to reduce entropy. So the authors raise temperature to 0.3/0.5, use distortionary watermarking, or both.

FACT — the g-value filter is what buys a guaranteed detection rate. A calibrated threshold on the average g-value is added to the normal design filter stack. Calibration used roughly 3.5 million non-watermarked sequences: held-out non-watermarked binder designs across 23 targets, full-length PDB sequences (download of 18 April 2025), and UniRef50 sequences including length-clipped variants to enrich short sequences. At a 0.1% FPR threshold, this yields an expected 100% TPR on the designs that are synthesised. One figure cites a sequence-level average g threshold of 0.545.

FACT — compute trade-off, quantified. A 41.7% reduction in in-silico pass rate for the non-distortionary 0.5 setting at 0.1% FPR implies a 100/(100-41.7) = 171.5% increase in candidates needed. The authors argue the real cost is negligible in practice because AF3 structural validation dominates compute, and AF3 need not be run on candidates that fail the g-value threshold first.

5.2 SynthIDBio-structure (fine-tuned AlphaFold 3)

FACT. Because folding models such as AF3 are commonly published, sampling-based or post-hoc watermarking "can easily be bypassed". So the mechanism is embedded in the weights:

• Objective. L_total = L_diff + w_wm · L_wm, with w_wm = 0.1, combining AF3's standard denoising loss with a watermarking loss. The confidence head is left unchanged.
• Detector. PointNet-inspired. It computes per-residue geometric features (atom–atom distances, torsion angles), passes them through 1D convolutions, average-pools, and applies a linear classifier. Trained with binary cross-entropy to distinguish watermarked, non-watermarked and ground-truth structures. The detector remains secret and is not shared with users of the fine-tuned AF3 model.
• Noise injection. Uniform noise U(-s, s) with s ∈ {0.001, 0.01, 0.1} Å is injected into predicted coordinates before the detector sees them, to force robustness. A minimum perturbation (s ≥ 0.001) is needed for the watermark to survive crystallographic CIF files, which round coordinates to three decimals.
• Results (AF3 evaluation set). TPR exceeds 99.8% at 0.1% FPR for all three s values; 98.99% for s = 0.001 at the stricter 0.01% FPR. LDDT and template-modelling (TM) scores are not reduced relative to the AF3 baseline for s = 0.001; larger s causes a small decrease. Detection works across proteins, RNA and DNA biomolecules; detection is weak for structures below ~16 residues and reaches >99% for larger ones.
• Where the signal lives. Watermarked models shift the distribution of C–Cα atom distances (illustrated in methionine), some torsion angles (phenylalanine χ2) and some bond angles (arginine CG1–CB–CG2). The authors state these shifts are within AF3's own error margin versus ground truth, and that the published panels were deliberately chosen as worst-case examples.
• Invariance by construction. Because the detector's features (atom–atom distances, torsions) are invariant to rigid transformations, robustness to rotation and translation is structural rather than learned.

5.3 Verification and false positives

FACT. Verification is statistical, not cryptographic-in-the-signature-sense: recompute the g-value (sequences) or run the secret detector (structures), then threshold at an operating point calibrated to a target false-positive rate. There is no cryptographic proof embedded in the molecule. Correct operation depends on holding the correct key/detector and on calibrating the threshold on a representative negative population.

INTERPRETATION. Provenance is the control that makes everything else in the bio-AI safety stack possible. Model-level guardrails, customer vetting and sequence-similarity screening all have gaps — DeepMind frames this as a "Swiss cheese" defence model. A watermark is the first artefact that travels with the molecule through the entire digital-to-physical path, so a screener's decision can rest on something other than inference about intent.

FACT. The proposed screening model is a re-framing of the decision, not a bypass of it: an intact watermark is positive evidence of compliance — that a third-party-verified tool with sufficient mitigations was used, and that the submitter has not actively obscured provenance. Standard similarity-based screening must still run regardless; the paper explicitly says orders should still be screened by standard similarity approaches, with detection of low-homology segments outside the design coordinates triggering extra scrutiny.

INTERPRETATION. Two structural arguments in the paper are more durable than the watermark implementation:

• No central coordination. Contrast with database-based provenance, which needs a trusted central authority and suffers false positives at scale. Watermarking needs only key exchange between tool developers and trusted verifiers.
• Privacy and IP preservation. The design sequence itself is never published to prove where it came from; only the ability to verify a key-signed statistical pattern is shared. This matters commercially to a company running a hosted design service.

FACT — the security-economics framing is deliberate. The paper says the objective "aligns with the historical precedent of the gene synthesis industry: to raise the barrier to entry rather than guarantee absolute security", and that "widespread adoption of watermarking among model developers may systematically restrict malicious users to less performant, non-watermarked legacy models."

FACT. Concretely, for the first time:

• A watermarked protein can be physically synthesised and the signature still verified on the material — the authors describe "the first-ever watermarked and biologically functional protein binders", with low-nanomolar binders for SC2RBD and subnanomolar binders for VEGF-A and PD-L1.
• An open-weight structure-prediction model (AF3) can be released such that every structure it predicts is watermarked and the watermarking cannot be disabled by the user.
• Sequence watermarking is available as a drop-in change to an existing open design pipeline (--watermark flag), and is model-agnostic for other autoregressive protein decoders.
• A third-party verifier needs only a key and a threshold — no database membership, no submission of the design itself.

INTERPRETATION. The most consequential possibility is not biosecurity at all; it is plausible deniability becoming harder. Today a synthetic structure can be passed off as experimental. If watermarked structure predictions become the norm in the community, "was this computed or measured?" becomes a question with a statistical answer.

COMPANY CLAIM — not yet realised. Database curators at the PDB, UniProt and GenBank could use detection at submission time to auto-label synthetic entries. No database has committed to this.

1. Will any synthesis provider, or the major sequence providers collectively, agree a key-exchange protocol — and who is liable when a detector produces a false positive that fast-tracks a harmful order?
2. Can the 41.7% pass-rate cost be brought down enough to clear the adoption bar the authors themselves identified?
3. Can sequence watermarking be made robust to resequencing without destroying function — the analogue of the open "regeneration attack" problem in text and image watermarking?
4. Can relaxation robustness be trained into SynthIDBio-structure, given that relaxation is normal practice before database deposition?
5. Can a watermark encode enough to differentiate users without becoming a privacy or attribution liability? Zero-bit is a hard ceiling on accountability.
6. How does SynthIDBio behave when a structure already carries a competing watermark (e.g. FoldMark)? Entirely unstudied.
7. Will the field converge on watermarking, on a metadata-exchange standard, or on a hybrid — and who sets the detection-key infrastructure?
8. What is the actual expected screening-burden reduction? Nobody has run this in production, so nobody knows.
9. Does watermarking protein sequences carry behavioural side effects analogous to those reported for SynthID-Text in language models?
10. Can the Evo 2 bacteriophage-genome result be independently reproduced, and does it raise its own dual-use questions by making viral genomes traceable and by demonstrating a template for genome-level design?

FACT — already committed.

• The Evo 2 / bacteriophage-genome watermarking manuscript is promised: "we will share more details in a technical manuscript soon."
• Weights for the recommended s = 0.001 structure model are released via the repository, with access instructions in the AF3 repository.

PREDICTION (medium confidence). Independent wet-lab replication attempts of the affinity-preservation result will appear within months; the authors released in vitro data specifically to enable this, and the FPR/TPR calibration data make re-derivation straightforward.

PREDICTION (medium confidence). An adversarial follow-up will publish a cheaper watermark-removal attack than resequencing — partial resequencing is explicitly named as unstudied by the authors and is the obvious next move. Expect the "raise the barrier, don't guarantee security" framing to be tested against a concrete measured cost of attack.

PREDICTION (low-medium confidence). A metadata-exchange standard (rather than a watermark) gains the wider institutional backing, because it carries a payload and supports attribution. Hybrid proposals combining both are more likely to succeed than either alone — the C2PA-plus-watermark pattern DeepMind itself points to.

PREDICTION (low confidence). At least one synthesis provider or database announces a pilot within 12 months. Twist Biosynthesis's "promising" framing is the strongest existing signal but is far from a commitment.

Watch items.

• The promised bacteriophage manuscript, and whether genome-level watermarking raises its own dual-use questions.
• Whether relaxation-robust structure watermarking is trained and released; without it, database deposition stays unserved.
• Any key/verifier governance proposal from a standards body or synthesis-provider consortium — that is where the real institutional commitment will show up.
• Whether any competing structure watermark (FoldMark and others) shows up in real submissions, which would force the interoperability question.

The genuinely important thing here is not the watermark. It is that a molecule can now carry evidence of its own origin through the entire digital-to-physical pipeline, and that this evidence was shown to survive the one test that matters — synthesis.

Watermarking text and images is a solved-enough problem that "the model was involved" has become an unanswerable question in practice, because the evidence is either trivially strippable or statistically weak. Biology is the rare domain where the artefact is physical, where the cost of failure is measured in more than reputation, and where a function-preserving watermark can actually be falsified in a lab. DeepMind ran that falsification test and it held: watermarked binders matched unwatermarked hit rates and affinities across three targets, and the signature survived being physically synthesised.

The sobering half is that the authors are unusually candid about how little this buys operationally. Their own watermarked sequence can be stripped by running ProteinMPNN again — a browser-accessible tool. Their own watermarked structure loses its watermark under constrained relaxation, which is exactly what happens before database deposition. A punitive enforcement model is ruled out by their own analysis because a malicious actor would simply use a non-watermarking tool. And the use cases are, in the Discussion's own words, "hypothetical at the time of writing", requiring "industry-wide coordination and standardization" that has not begun.

Three things are worth taking away for anyone building AI systems in a regulated domain:

1. Build provenance into the artefact, not beside it. The value of embedding the signature is that it cannot be deleted without deleting the thing. This is the transferable design lesson.
2. "Works in a lab" and "works in an ecosystem" are different claims. DeepMind has earned the first. The second requires other people to change their workflows, and there is currently zero committed adoption by any synthesis provider or database.
3. A signal whose absence triggers scrutiny and whose presence unlocks speed is an optimisation target. The authors identify the dilution attack themselves and prescribe the layered answer — keep screening everything. That prescription, not the watermark, is the part to act on.

The right posture is to read this as a serious, well-executed technical proof of concept that has deliberately chosen openness over lock-in — code, weights and wet-lab data all released — and to be clear that the hard part, from here, is institutional rather than technical.