Google watermarks AI-designed proteins to flag synthetic sequences

On Wednesday, 30 September, Google's DeepMind team published a research paper describing a system that embeds a hidden signature directly into AI-designed protein sequences, according to Ars Technica.

The watermark comes from Google's SynthID technology, which already marks AI-generated images and text. It is meant to let labs tell which proteins came from trusted design pipelines and which did not. The paper's authors had to test whether the SynthID approach would survive at all, because proteins are built from just 20 amino acids and many of them matter.

Why a watermark in a protein is hard

Ars Technica notes that some amino acids are chemically similar, such as leucine and isoleucine, while others carry opposite charges and will break a fold if swapped. A protein of 500 amino acids counts as fairly large in this field, so there is far less raw material to hide a signal in than in an image with millions of pixels. The team started with ProteinMPNN, a popular design tool from the Baker Lab, and ran SynthIDBio alongside it. As the designer places amino acids one by one along the protein backbone, SynthIDBio uses a key and the identity of earlier choices to suggest the next residue. ProteinMPNN then accepts or rejects the suggestion based on whether the protein still functions.

Ars Technica quotes no named researcher in the piece, but describes the process plainly: watermark residues enter only when they are consistent with a working protein.

The biosecurity gap the method targets

Ars Technica frames the work as a response to a known screening problem. Software that checks DNA sequences for dangerous proteins does not recognise AI-designed proteins, because nobody has characterised them well enough to know what to look for. The same protein design tools that produced enzymes able to digest plastics or block venom proteins could, in other hands, be pointed at toxins or viral proteins. The risk was flagged nearly a year before the paper appeared, and until now there was no clear remedy.

The timing fits a broader push in the field. Analytics Insight reported on 29 September that Google DeepMind chief executive Demis Hassabis is positioning AI as a tool for scientific discovery, and a separate item dated 1 October described DeepMind watermarking proteins to allow lab verification. Hansa Biopharma announced a partnership with Cradle on 1 October to advance AI-driven protein design and engineering, while another 29 September report covered AI structure prediction speeding the search for molecular glues. None of those items gives independent verification of the watermarking method.

What is not settled

The paper, as summarised by Ars Technica, does not say whether SynthIDBio has been adopted by other protein design groups or built into screening pipelines. It also does not establish how a watermark survives if a sequence is altered after generation. Those questions matter because the stated goal is to open everything else up to closer scrutiny, which assumes a working distinction between marked and unmarked designs. Google's own SynthID has survived basic image edits such as resizing and exporting, but a protein has no equivalent of resizing.

For now the result is a proof of concept on one widely used design tool. Whether it scales to other generators, or to the labs most likely to misuse them, is the next test.