Google DeepMind has taught its design tools to sign their work. SynthID Bio, published in Nature at the end of September (open access link), embeds a statistical watermark inside AI-generated proteins. For sequences, the method reweights the model's amino acid choices at positions where several choices serve about equally well, and the new weights form a pattern that a detector can read with a secret key. For predicted structures, the team fine-tuned part of AlphaFold 3 so the coordinates themselves carry the signature, and the signature survives synthesis.
The laboratory results are unambiguous. Using AlphaProteo with a watermarked version of ProteinMPNN, the team designed binders against three targets, VEGF-A, the receptor-binding domain of the SARS-CoV-2 spike protein, and PD-L1. Watermarked designs matched unwatermarked designs on hit rate, binding affinity, and sequence diversity. The watermark costs the protein nothing measurable.
The proposed uses are sensible. A DNA synthesis provider screening an order could treat a detected mark as evidence that the design came from a model with safeguards, and route the order accordingly, and public databases such as the Protein Data Bank (PDB) and UniProt could flag synthetic entries at submission, before mislabeled structures mislead later work. Provenance has real value in both places, because provenance routes human attention, and human attention is the scarce resource in every screening system.
The limit is equally clear, and the paper states the limit without flinching. Resequencing a design removes the sequence mark, and a determined designer can also use an unmarked tool, since adoption is voluntary and open tools exist. Most important, the mark answers only the origin question. A watermark reports who made a molecule. Screening’s binding question is what the molecule does. A signed toxin is still a toxin, and an unsigned benign protein is still benign. The signature is silent on function, and function is where the risk lives.
None of that reasoning makes SynthID Bio a failure. Screening was always going to be layered, because no single layer sees the whole problem. Provenance is a good layer for the cooperative majority of users, who are nearly all users, and the layer helps providers clear ordinary orders quickly and spend their review hours on the orders that deserve hours. The error would be pricing the layer as protection against the minority who intend harm. That minority will not watermark anything, and a screening regime that relaxes in the presence of a signature has the logic exactly backwards.
The right way to read the paper is as plumbing. DeepMind built a clean, cheap signal and published the signal’s limits in the same breath. A clean signal makes the rest of the screening stack faster and better aimed, and the stack still has to answer the hard question on its own.