Google DeepMind watermarks AI-designed proteins with SynthIDBio

The work, reported by Ars Technica on 30 September, answers a gap flagged nearly a year ago. The software used to screen DNA sequences for potentially dangerous proteins does not recognise AI-designed proteins, because nobody has characterised them well enough to say which ones are threats.

DeepMind's proposal is to mark the designs themselves. SynthIDBio uses a key, similar to a cryptographic key, together with the identity of previously chosen amino acids to suggest the next one. ProteinMPNN then checks whether that suggestion still yields a functional protein. If it does, it is kept; if not, it is rejected. According to Ars Technica, the system only incorporates watermark amino acids when they are consistent with a working protein. Because the bias is spread across the whole sequence, the mark cannot be removed without knowing how it was encoded.

The chemistry is unforgiving. Proteins are built from just 20 amino acids. Some are chemically similar, others carry opposite charges. Many proteins have regions where limited substitutions are tolerated, and regions where even a slight deviation kills activity.

They are also small. A protein of 500 amino acids counts as fairly large, against millions of pixels in a typical image, so there is far less raw material in which to hide a signal. Ars Technica notes it was not obvious the SynthID approach would transfer at all. The team might have found too little room for a watermark, or found that cramming in enough information produced inactive proteins.

Why the timing matters

Biological tools cut both ways. The same protein design methods that have produced enzymes able to digest plastics or block venom proteins could in principle be turned toward toxins or viral proteins. The screening gap is the practical problem. A watermark on trusted designs gives screeners something to look for, and pushes everything unmarked toward greater scrutiny.

SynthID itself predates this work. It adds subtle marks to AI-generated digital material by influencing the probability of certain choices the model makes, so the bias ends up distributed systematically across the output. Google has previously applied it to text and images, where it survives basic exporting and resizing. Applying the same idea to a molecule is a different order of difficulty.

The protein design tool at the centre of the experiment, ProteinMPNN, was developed by the Baker Lab. David Baker shared the Nobel Prize with the head of DeepMind, a detail Ars Technica includes in its account of the research lineage.

ProteinMPNN works in two stages. A separate tool first describes a backbone configuration suitable for the design. ProteinMPNN then walks down that backbone, placing side chains one amino acid at a time. It chooses each one on its ability to fit the shape, interact with neighbours and satisfy other constraints such as forming catalytic pockets or binding another protein. SynthIDBio steps in during that walk.

Ars Technica's write-up is the most detailed account of the mechanism published so far. A shorter item dated 30 September, headlined "SynthID Bio Watermarks Secure AI Proteins," appeared in the recent headlines circulating alongside the Ars piece, though the full text was not available in the material reviewed here. Analytics Insight, meanwhile, published a profile of DeepMind chief executive Demis Hassabis on 29 September, framing the company's scientific discovery work more broadly. That piece is context, not evidence about the watermarking method.

What the surrounding coverage shows

The dossier also contains material that has nothing to do with proteins, which is worth separating out. Fox News reported on 30 September that Tadhg O'Keeffe, a medieval archaeology professor at University College Dublin, found that 70 to 80 percent of the medieval Roebuck Castle survives under Victorian plaster inside a campus building. UCD announced the discovery on 18 September. O'Keeffe told Fox News Digital that he began investigating after studying 18th-century watercolours by the artist Gabriel Beranger. It is a striking story, and it is not a biosecurity story.

Two other sources in the dossier are technical and unrelated to protein design. A catalogue page at vibecodingdiscover.com, dated 30 September, lists open-source AI tooling for agents, MCP servers, skills and RAG pipelines, including a local ElevenLabs alternative covering 646 languages and a sandbox runtime for autonomous agents. Materialize published a blog post on 29 September describing its third attempt at spilling data to disk, replacing Linux swap with a buffer pool it manages itself. The argument runs that DRAM latency is around 100 nanoseconds while local NVMe reads are tens of microseconds, a few hundred times slower, even though the bandwidth gap is closer to 10 times.

Those two are included here because they are among the freshest items in the dossier, not because they bear on the protein work. The relevant question for the DeepMind paper is narrower: whether a watermark can survive the constraints of protein chemistry well enough to be useful to the people doing the screening.

Ars Technica's account stops short of saying the system has been adopted by any screening body or deployed outside research. The paper describes a potential solution, published on a Wednesday, to a risk that was raised nearly a year earlier and remained unresolved. What happens next depends on whether the labs and databases that check sequences for threats take up the marking scheme, and on whether unmarked AI-designed proteins become, by default, a signal worth investigating.

For now the claim is technical rather than operational: a watermark can be embedded in a designed protein without compromising what the protein does. Everything else is still open.