A watermark you cannot see, stamped into the amino acids of designed molecules. It works beautifully. The researchers who built it will tell you, in writing, that anyone who wants to evade it simply will.
A Signature With No Ink
Start with the problem, because the problem is genuinely new.
For most of history, if you wanted to know where a protein came from, the answer was: a living thing made it. Proteins were found, isolated, sequenced, and studied, but not composed. That changed. Generative models can now design protein sequences that have never existed in any organism, fold them in silico, and hand you a candidate binder for a target of your choosing. The 2024 Nobel Prize in Chemistry went, in part, for exactly this: half of it to David Baker “for computational protein design.” 4
Which raises a question that would have been incoherent twenty years ago. Given a protein sequence, can you tell whether a machine wrote it?
Google DeepMind’s answer, published this year in Nature by Stutz and colleagues, is a system called SynthID Bio. 1 It embeds a watermark directly into the amino acid sequence of a designed protein: a statistical fingerprint, invisible to inspection, that a detector holding the right key can recognize later.
I have read the paper, DeepMind’s announcement, and Nature’s own news coverage, and the technical work is elegant. What interests me more is that the people who built it have gone out of their way to tell you what it cannot do. That combination, a real advance shipped with a frank account of its limits, is rare enough that it deserves to be the story.
The Conflict of Interest, Up Front
Before anything else, a disclosure, because it belongs at the top rather than in a footnote.
This research was, in the paper’s own words, “funded by Alphabet Inc and/or a subsidiary,” and the paper states that “All authors are employees of Alphabet and may own stock” in the company. 1
That is not an accusation. It is context. A company that sells AI tools has built, published, and open-sourced a method for marking AI output as AI output. There are good reasons a company would do that sincerely, including a genuine interest in not having its tools implicated in a biosecurity incident, and there are also commercial and regulatory reasons to be seen doing it. Both can be true. The work should be evaluated on its evidence, and the evidence here is substantial, but a reader is entitled to know who paid and who holds stock before weighing claims about the safety of that same company’s products.
How Do You Watermark a Molecule?
The mechanics are the pleasing part, so let me take them slowly.
Protein design models do not output a single answer. At each position in a sequence, a model like ProteinMPNN produces a probability distribution over the twenty amino acids, and the sequence you get depends on how you sample from those distributions. Crucially, many different sequences fold into essentially the same structure and do essentially the same job. Proteins are degenerate in this sense: there is slack.
Watermarking exploits the slack.
The method the paper uses is a form of tournament sampling. In rough terms, instead of drawing one candidate amino acid at each step, the system draws several and runs them against one another in a bracket, where the winner of each matchup is decided by a pseudorandom function seeded with a secret key and the local sequence context. The result is a sequence that remains a perfectly valid sample from the model’s distribution, but whose choices collectively encode a statistical bias that only the key-holder can detect. 1
An analogy that is imperfect but useful: imagine a translator who, given a hundred equally good ways to render a sentence, always happens to choose the one whose third word has an odd number of letters. Each individual choice is unremarkable and defensible. Across a whole document, the pattern is unmistakable to anyone who knows to look, and invisible to everyone else.
The implementation here is what the paper calls zero-bit: the detector answers one question, watermarked or not, rather than reading out an embedded message. 1
It Works Better Than I Expected
Detection performance is the first thing to check, and the numbers are strong.
The paper reports a 100% true positive rate at a 0.1% false positive rate for sequence detection, and above 99.8% detection for structures. 1 That second figure is the more surprising of the two, because it means the watermark survives being expressed not just as a sequence of letters but in the three-dimensional coordinates of a folded protein.
The structure-detection piece involved fine-tuning a version of AlphaFold 3, which is a nicely recursive detail: one of the field’s landmark structure-prediction systems repurposed to spot the signature of its cousins’ designs. 1
Then the obvious objection. A watermark that preserves the model’s output distribution in theory might still make proteins worse in practice. Statistical validity is cold comfort if your watermarked binder does not bind.
So DeepMind tested it in a laboratory. Binders were designed using AlphaProteo together with ProteinMPNN, and in vitro validation was performed by Adaptyv Bio, an external company. The result, in DeepMind’s description: watermarked binders “matched the hit rate, binding affinity, and natural sequence diversity” of their unwatermarked counterparts. 2
That is the result that makes this more than a mathematical curiosity. The watermark appears to be free. You can stamp a designed protein without paying for it in function, at least for this class of binders in this set of assays.
DeepMind has released weights, code, and the in vitro data. 2 Open-sourcing a security tool is a defensible choice, and I will come back to why it is also a complicated one.
The Admission
Now the part that makes this paper unusual.
Buried in the discussion, the authors state that a simple strategy “effectively removes the watermark.” 1 Nature’s news coverage of the work, by Elie Dolgin, carries a subheadline stating plainly that the marker “can be erased.” 3
The specific vulnerability is not exotic. The watermark lives in the particular amino acids chosen at particular positions, within the slack the model’s distribution allows. But that same slack means many other sequences fold the same way. Re-sample the sequence while holding the structure fixed, using any ordinary inverse-folding tool, and you get a protein that does the same job with different letters, and the statistical signature does not survive the substitution.
The authors say so themselves. And then they say the thing I keep returning to, which is the most clear-eyed sentence in the entire body of work: a malicious actor “would simply use a non-watermarking tool in the first place.” 1
Read that again, because it is an extraordinary thing for a research team to put in print about its own invention.
The threat model most people imagine when they hear “biosecurity watermark” is a bad actor designing a dangerous protein, and the watermark catching them. SynthID Bio does not do that, and its creators are telling you it does not. Someone intent on misuse will not reach for the watermarking tool and then laboriously strip the mark. They will use one of the many models that never marked anything.
The paper describes itself, repeatedly, as a “proof-of-concept.” 1 That is the correct word and the authors chose it.
So What Is It Actually For?
If it does not stop adversaries, what is the point? I think the answer is genuinely worthwhile, and it becomes clear once you stop thinking about villains and start thinking about paperwork.
Consider the ordinary, non-malicious confusion that generative biology is about to create. Sequence databases such as the Protein Data Bank, UniProt, and GenBank were built over decades to catalog the proteins of the living world. What happens when designed sequences start flowing into them in volume? Without provenance, the record of what nature produced becomes mixed with the record of what a model produced, and separating them after the fact may be impossible.
DeepMind explicitly raises this: the method could be used to flag entries in those databases as machine-designed. 2 That is not an adversarial application. It is curation, and it is the kind of unglamorous infrastructure problem that becomes unfixable if you wait.
The second application is attribution rather than detection. A watermark tied to a key tells you which system produced a sequence, if the key-holder cooperates. DeepMind notes the method could be paired with C2PA-style provenance metadata, borrowing the content-credentials approach developed for images and video. 2 In a world where a protein design might pass through a model, a cloud API, a synthesis provider, and a laboratory, a cryptographic thread running through that chain has obvious value for audit, for liability, and for the ordinary question of who made this.
The third application is the one that would make the biggest practical difference and is the least developed. Commercial DNA synthesis companies screen orders against databases of sequences of concern. That screening is the main chokepoint between a dangerous design and a physical molecule, and it is a hard problem precisely because a novel designed sequence may resemble nothing in any database.
James Diggans of Twist Bioscience, quoted in DeepMind’s announcement, says “watermarking offers a promising new addition to the biosecurity toolbox.” 2 Note the carefulness of that: an addition to a toolbox, not a solution. Sarah Carter, a biosecurity policy expert and principal at Science Policy Consulting who reviewed the work, is quoted saying “SynthID Bio is an important piece of the puzzle for tracking the provenance of biological designs.” 2 A piece of a puzzle. Both endorsements are, in their phrasing, explicitly partial.
Not Just Proteins
One more result, and it is the one most likely to be oversold, so let me mark it carefully.
DeepMind reports working with the Hie lab to apply watermarking to phage genomes designed with Evo 2, and states that “Early laboratory testing in bacteria cultures has confirmed these watermarked bacteriophages are functional,” with a manuscript described as coming soon. 2
Watermarked viruses that still work is, if it holds up, a significant extension: from marking a single protein to marking an entire designed genome that must assemble into a functioning infectious particle. But “a manuscript is coming soon” is not a result anyone outside the labs involved can evaluate. It is an announcement about a forthcoming announcement. File it under promising and unpublished, and do not let it be reported as established.
The Honest Limits, Collected
Let me gather the caveats in one place, since they are scattered through three documents.
The watermark can be removed by re-sampling the sequence while preserving structure. 13 A determined adversary would skip the watermarking tool entirely. 1 The work is described by its authors as a proof of concept. 1 The validation covers a specific class of designed binders in a specific set of assays, not the full space of protein design. The phage extension is unpublished. 2 And the whole enterprise depends on adoption: a watermark on one company’s model is a watermark on one company’s model. Unless the field broadly agrees to mark its output, there will always be an unmarked path, and the mark’s absence will mean nothing at all.
That last point is the structural one, and no clever mathematics addresses it. Watermarking is a coordination problem wearing a cryptography costume. The technical question, can we mark proteins invisibly without breaking them, now has an answer, and the answer is yes. The hard question, will everyone who designs proteins agree to do it, is a matter of standards bodies, procurement rules, synthesis-company policy, and law.
There is also an argument, which I find worth taking seriously, that open-sourcing the method cuts both ways. Releasing weights and code lets others verify the work and adopt the technique, which is how science should operate and how a standard gets built. It also tells anyone curious exactly how the mark is constructed. Given that the authors have already published the removal strategy, I do not think the openness makes things meaningfully worse, and it makes independent scrutiny possible. But it is a choice, and it was made.
Nature’s Framing, and Mine
Elie Dolgin’s news piece in Nature leads with erasability, and the subheadline is unambiguous: the marker can be erased. 3 That is accurate and it is the right thing to foreground for readers who might otherwise hear “biosecurity watermark” and conclude the problem is handled.
I would frame it only slightly differently. The erasability is not a flaw in the engineering. It is a property of the medium. Proteins are degenerate; many sequences do the same job; any mark that lives in the choice among equivalents can be defeated by choosing again. The researchers did not fail to anticipate this. They anticipated it, measured it, wrote it down, and published anyway, with the correct label on the tin.
What they have built is not a lock. It is a maker’s mark. A silversmith’s stamp does not prevent anyone from forging silver; it lets honest goods be traced, and it makes the unmarked item worth asking about.
The Ending
Somewhere in a database, there is now a protein that carries a signature no microscope will reveal. It folds the way it should. It binds what it was built to bind. By every measure an experimentalist could apply, it is simply a protein. And a detector holding a secret key can look at its sequence of amino acids and say, with better than 99.9% confidence, that no living thing had anything to do with it.
That is a strange and slightly beautiful capability. It is also, by its inventors’ explicit account, not a defense against anyone who means harm. The gap between those two sentences is where the next few years of biosecurity policy will be fought, and the most useful thing Google’s researchers did was refuse to pretend the gap was not there.
There is a version of this story where a company announces it has solved AI biosecurity. That version would have been easier to write, better for the stock, and false. What we got instead was a careful paper, an honest limitation section, a partial endorsement from two outside experts, and a published method for defeating the very thing being announced.
I will take that. I would rather have a maker’s mark that admits what it is than a lock advertised as unbreakable.
References
- Stutz, D., Cowen-Rivers, A. I., Ortiz-Jimenez, G., Ratcliff, J., Zambaldi, V., Willmore, L., Abramson, J., Patani, H., Kouridi, C., Stimberg, F., Vecerik, M., Chu, A., Singh, S., Dathathri, S., Papa, E., De Bortoli, V., Doucet, A., Hassabis, D., Wang, J., Gowal, S., & Kohli, P. (2026). Function-preserving watermarking of AI-generated proteins. Nature. Published Sep 30, 2026. https://doi.org/10.1038/s41586-026-10965-y ↩
- Google DeepMind. (2026). Introducing SynthID Bio [Announcement]. https://deepmind.google/blog/introducing-synthid-bio/ ↩
- Dolgin, E. (2026, Sep 30). Secret watermark labels proteins as ‘made by AI.’ Nature. https://www.nature.com/articles/d41586-026-03033-y ↩
- The Nobel Prize. (2024, Oct 9). The Nobel Prize in Chemistry 2024 [Press release]. https://www.nobelprize.org/prizes/chemistry/2024/press-release/ ↩
