Photo: Steve A Johnson / Pexels
Google DeepMind's watermarking technology gets adapted for protein sequences in a proof-of-concept that could reshape biosecurity
Google DeepMind’s SynthID watermarking system, originally built to tag AI-generated text, images, audio, and video, has found a surprising new frontier: biology. Researchers at the University of Maryland have adapted the technology to embed invisible watermarks directly into AI-designed protein sequences, creating a potential tracking mechanism for synthetic biology that doesn’t compromise the proteins themselves.
How you watermark a protein #
The technique builds on SynthID-Text, which works by subtly adjusting the probability distribution of tokens (in this case, amino acids rather than words) during the generation process. The researchers used what’s called an unbiased Gumbel sampling approach, embedding a watermark derived from a private key into the amino acid probability distribution of protein design models like ProteinMPNN.
ProteinMPNN, which arrived in 2022, is one of the more prominent AI models for designing novel protein sequences. It takes a desired three-dimensional protein structure and works backward to generate amino acid sequences that should fold into that shape. The watermarking layer sits on top of this process, nudging which specific amino acids get selected without changing the overall statistical properties of the output.
Validation showed that pLDDT scores, a standard metric for predicted protein folding quality, remained unchanged after watermarking. The proteins looked just as structurally sound with the watermark as without it.
The biosecurity case #
As AI protein design tools become more powerful and more accessible, the ability to generate novel biological sequences raises legitimate safety concerns. Traditional provenance methods, like metadata logs attached to files, can be stripped away as easily as removing EXIF data from a photo. They offer no durable chain of custody.
AI, tech, and the markets they move—in one daily briefing.
Daily. Free. Join 34,000+ readers across crypto, finance, and policy.
An embedded statistical watermark is different. It lives inside the sequence itself, surviving copy-paste, file format changes, and distribution across systems. The watermark can later be detected by anyone with access to the corresponding private key, enabling organizations to determine whether a given protein sequence was generated by a specific AI model.
This capability plugs directly into existing biosecurity infrastructure. The International Gene Synthesis Consortium (IGSC) already maintains frameworks for screening DNA synthesis orders against databases of known dangerous sequences. Watermarked protein sequences could be tracked through these existing channels, adding a layer of AI-specific provenance to the screening process.
Where this stands today #
There is no commercial product called “SynthID Bio” available for purchase or deployment. This research sits squarely in proof-of-concept territory. The underlying SynthID technology from Google DeepMind is real and actively deployed for watermarking AI-generated text, images, audio, and video. The protein application is an extension of those principles, demonstrated in a research setting but not yet productized.
The research also highlights a structural advantage of statistical watermarking over alternative approaches. Because the watermark is embedded in the generation process itself rather than appended afterward, it creates a form of provenance that’s inherently tied to the AI model. You can’t watermark a protein sequence after the fact using this method. It has to happen at generation time, which means it naturally tracks the origin point rather than some downstream processing step.
Disclosure: This article was edited by Diego Almada Lopez. For more information on how we create and review content, see our