On September 30, Google DeepMind released SynthID Bio, a way to watermark AI-designed proteins (DeepMind blog; companion paper in Nature). What’s been validated so far is protein sequences and predicted structures; watermarking gene sequences is still an early experiment in bacteriophages, with no technical paper out yet. The team tested three targets — VEGF-A, the receptor-binding domain of the SARS-CoV-2 spike protein, and the immune checkpoint protein PD-L1. Binders designed with AlphaProteo and ProteinMPNN (a binder is a sequence that latches specifically onto a target protein) matched the hit rate, binding affinity, and sequence diversity of the unwatermarked versions once the watermark was added.

Start with who this is for. The people who design brand-new proteins are drug, enzyme, and antibody researchers — models like AlphaProteo and ProteinMPNN compute a sequence that binds a given target, narrowing the candidates that have to be validated in the lab. The pull for a watermark doesn’t come from them; it comes from the other end. The same design capability can produce toxins or pathogen components (NIST flags protein-engineering, genome-editing, and molecular-synthesis models as misusable to enhance viral virulence or design toxins), so DNA synthesis vendors screen orders for biosecurity before they make anything (the federal screening framework recommends vendors verify customer legitimacy and screen for sequences of concern), and the watermark is a provenance signal bolted onto that screen. So this isn’t “everything AI-for-science produces should be watermarked.” Proteins and nucleic acids get singled out because they can be synthesized into real biological agents — a dual-use risk most scientific output simply doesn’t carry.

Every watermark balances two goals that pull against each other: keep the mark invisible enough not to hurt the thing’s quality, and make it strong enough to recover later. The heavier the mark, the easier it detects and the more quality suffers — text, image, and audio can’t dodge this either. Text watermarks bias word choice, which touches fluency and variety (the SynthID-Text paper reports this detectability-versus-quality-and-diversity trade-off directly); image watermarks keep trading off “invisible” against “survives compression and cropping.” Proteins have the same trade-off, except the quality cost is unusually brutal: a sequence has to fold into a specific shape and bind at a specific site to work, and swapping one amino acid can sharply cut activity or kill it outright — where you swap and what you swap it for make all the difference. DeepMind showed that under this unforgiving quality constraint you can still embed a watermark without breaking function, producing what it calls the first-ever watermarked, biologically functional protein binders. That’s a genuine engineering result.

But reading the full material, none of the three conclusions from my piece last month on text watermarking got resolved in the biology setting — and two of them got sharper.

Same as before: whoever holds the key is the verifier

SynthID Bio’s sequence watermark is the same family as the SynthID-Text scheme used by Claude (confirmed by Anthropic in August 2026) and Gemini: each time the model picks an amino acid, a secret key assigns each candidate residue a pseudorandom score and the model quietly leans toward the high-scoring one. Any single stretch looks normal; recompute over enough length with the same key and the overall bias in the choices shows up. So detection is just “recompute with the key” — only someone holding the matching key can detect anything. The Nature paper describes exactly this: the detector uses the same secret key that was used at generation time (a shared secret, not a private key in the asymmetric-cryptography sense).

That carries the same corollary straight over from the text piece: no key, nothing to verify; whoever holds the key holds the right to verify. The governance questions left open for text transfer word for word to proteins. How many keys are there? One per model, one per institution, or one global key? One use DeepMind imagines is flagging AI-generated entries in protein databases (PDB, UniProt, GenBank) — but who runs that detection, who maintains the keys, the blog doesn’t say. Open-sourcing the method is not the same as open-sourcing “who verifies.”

The gap on misfires carries over too. Per the Nature paper, detection reaches a 100% true-positive rate at a 0.1% false-positive rate only after the set is filtered to sequences above a strength threshold; without that filter the true-positive rate is variable. The reason is the same one that makes low-entropy code hard to detect in the text case: the shorter the sequence and the fewer amino acids you can swap at each step, the less statistical room the watermark has to hide in. The unwatermarked binder sequences DeepMind used to calibrate that false-positive rate run 40 to 140 residues — short, right at the weak end of the signal. So while the underlying quantity is a continuous g-value statistic, what comes out is a yes/no verdict thresholded at a preset false-positive rate, and the official material says nothing about where a misclassified party would go to appeal.

Sharper: the sequence you most want to catch is the one with no watermark

The real mismatch is in the biosecurity use case. DeepMind positions the watermark as a provenance signal for DNA synthesis screening: a vendor receives an order and can automatically confirm it “originated from a trusted model,” freeing attention for the sequences of unknown origin.

The problem is that a watermark can only prove presence; it can’t make absence mean danger. Anyone who wants to build a dangerous sequence just uses an open-weight protein design model with no watermark — nothing to remove, nothing left behind. DeepMind lists “making the watermark more robust against deliberate tampering” as an unsolved problem (blog) — but tampering presupposes a watermark to tamper with, and the adversary never has to go there.

This is the same “only the compliant users of compliant vendors get covered” line from the text piece, at a different order of magnitude. In text, slipping past with an unwatermarked model dodges authorship detection — the cost is one assignment passed off as original. In biology the order still goes through the same customer and sequence screening; what an unwatermarked design escapes is only the provenance signal, so the one tool DeepMind is adding here is blind to exactly the sources you most want to stop.

One more distinction: proteins are not like text, images, or audio. A fake image can be posted straight to the internet with no checkpoint in between, and after the fact — was this AI-generated, by whom — there’s nothing to work with but reverse-engineering the watermark. Proteins have no “publish directly” channel: a digital sequence becomes a real molecule only by going through DNA synthesis (or other routes like peptide chemical synthesis), and synthesis vendors already vet customers — they know who placed the order. “Who ordered this sequence” is something the synthesis chain can already answer; the watermark adds nothing there. So even the accountability increment is limited for proteins — the one thing the watermark genuinely adds is letting the vendor confirm, from the sequence itself, that it “came from a model with safety guardrails,” which the ordering customer’s identity can’t answer (a fully compliant customer may still have used an unguarded model).

To put it plainly: provenance is not threat detection. The watermark can speed clearance of trusted sources and save manual review — that’s its real, positive value. But the large pile of “no watermark” sequences contains benign natural sequences, old designs from before AI, and things freshly built with an unwatermarked model; the watermark can’t tell them apart. It doesn’t replace actual interdiction, which still has to come from methods aimed directly at “what can this thing do” — matching against databases of dangerous sequences, predicting sequence function.

My read

First, what SynthID Bio actually advances is the engineering problem of function preservation, and it does it well — worth the credit. But reading it as a biosecurity gate is a misread. It’s a provenance aid, not a threat detector. The main force in synthesis screening still has to be judgment based on danger itself; the watermark just speeds trusted sources through.

Second, exactly as with text watermarks, the next real exam is at the governance layer, not the algorithm layer: who owns the keys, at what granularity they’re issued, who has the right to query a given sequence, whether PDB and UniProt wire up detection, and who maintains it if they do. DeepMind open-sourced the code, published the in vitro data, and released the model weights to researchers — far more transparent than text watermarking’s black box was at the start, which is good. But what’s open-sourced is the method, not the answers to these questions.

Third, pushing one step past the last piece: making “who built this sequence” checkable makes the opposite thing more urgent — finding the sequences that carry no watermark but are worth watching. AI makes designing new proteins easier, so the dangerous sequences worth watching may multiply along with it (a risk NIST raises for these tools). SynthID Bio has the provenance side’s tools in place; the hard part was always on the “absence” side.

References