Google DeepMind Builds Watermarking System to Identify AI-Generated Protein Designs

Google DeepMind has developed SynthID Bio, an AI watermarking system designed to identify proteins and biological structures generated by AI models, as researchers and biosecurity experts grapple with a new challenge—determining whether a biological design came from an AI system, even when it does not resemble any known natural or hazardous sequence.

The system embeds a detectable signature into AI-generated protein sequences and predicted 3D structures without significantly changing their biological properties, according to Google DeepMind. In laboratory testing, the company said watermarked protein designs retained their ability to function and bind to their intended targets.

The development is significant because AI models are increasingly being used to design proteins and other biological molecules. Protein design models can generate sequences that do not exist in nature. That creates a gap for existing screening systems, which largely depend on recognising known biological patterns or similarities.

Conventional DNA synthesis screening can compare submitted sequences against databases of known pathogens or hazardous organisms, but an AI-designed sequence could be novel and therefore have no obvious match.

SynthID Bio intends to add another layer. Rather than only asking about a biological sequence, screening systems could also ask whether it was generated by an AI model.

Google DeepMind embeds provenance information at the point where the AI model generates the biological design.

For 3D protein structures, Google DeepMind modifies atomic coordinates in predicted structures to embed a watermark. The company has also fine-tuned part of the AlphaFold 3 diffusion network so that the predicted structures contain a detectable signature.

This makes the technology different from simply attaching metadata to an AI-generated file. The provenance signal is embedded in the biological design itself.

That matters because metadata can be stripped when a design moves between software systems, while a biological watermark is intended to remain associated with the sequence or structure.

The potential application extends beyond identifying AI-generated proteins.

DNA synthesis providers already screen sequences for synthesis against biological risks. But increasingly capable AI models can generate novel biological sequences that may not closely resemble known hazardous sequences.

A watermark could give synthesis providers another signal during screening about whether a sequence originated from a model that uses the watermarking technology. The system could therefore create a link between AI model developers, biological design outputs, and downstream synthesis providers.

For companies developing AI biology models, this could also create a mechanism to demonstrate that their systems have safety measures built into the generation process.

However, the company acknowledges that watermarking is not a complete biosecurity solution. A major open question is how resistant such watermarks are to deliberate modification or attempts to remove them from AI-generated biological designs.