DeepMind’s SynthID Bio watermarks AI-designed proteins without breaking their function

AI tools can now design proteins that look like nothing in existing databases, which makes it hard to tell where a new sequence came from. Google DeepMind has a partial answer in SynthID Bio, a method that hides a statistical watermark inside AI-designed proteins without changing how well they work. The method was published in Nature on September 30, 2026.

The watermark fits into the way many proteins are designed. A designer first proposes a backbone, the overall shape of the protein, and then a tool fills in the amino acids, the building blocks of the chain, one position at a time. SynthID Bio uses a secret key to nudge those choices slightly, so the finished sequence carries a pattern that someone holding the key can detect. The design tool, ProteinMPNN, still rejects any amino acid that would break the protein, which is how the watermark avoids damaging it. A related method adjusts part of AlphaFold 3 so that the 3D structures it predicts carry a hidden pattern as well.

To check that the watermark costs nothing in performance, the team made binders, proteins built to latch onto a target, against three targets: VEGF-A, PD-L1 and part of the SARS-CoV-2 spike protein. Watermarked and unwatermarked designs matched on hit rate, meaning how many designs actually worked, as well as on how tightly they bound and how varied their sequences were, according to DeepMind and the paper. The watermarked binders gripped their targets strongly, at levels the paper describes as low nanomolar or subnanomolar, a range typical of tight binding.

DeepMind sees the main use in biosecurity and record keeping. Companies that synthesize DNA, along with public protein and genome databases, could use a detection key to confirm that a sequence came from a trusted AI design tool.

That confirmation only works one way, because the watermark records where a protein came from and says nothing about whether it is dangerous. Nature News, Ars Technica and DeepMind all note that the mark can be removed, for example by running the sequence through another design tool, and that it weakens in short proteins and fused ones. The paper is a proof of concept focused mainly on binders built on known backbones, so it does not guarantee the method works for every kind of protein or design system.

The code and data are public on GitHub. For DNA suppliers and databases, SynthID Bio could become one useful layer of screening, informative when the mark is present and silent when someone has deliberately washed it out.