Researchers at Google DeepMind have developed a way to embed watermarks in AI-generated proteins, a technique designed to track the provenance of designs that could otherwise be turned into bioweapons. The tools, a family of techniques the team calls SynthIDBio, hide marks either in a protein's amino acid sequence or in its three-dimensional structure.
AI protein design is a dual-use technology. AlphaFold, unveiled in 2020 and recognised with the 2024 Nobel Prize in Chemistry, can reveal how a protein will fold from its sequence of amino acids. But the same capability opens the door to generating brand new proteins, including viral proteins that could evade immune systems and existing vaccines.
The first technique, SynthIDBio-sequence, works with the design program ProteinMPNN. It subtly biases the program's choice of amino acids according to a secret key, so anyone who knows the code can later assess whether a sequence was generated under that bias. The second, SynthIDBio-structure, gives AlphaFold 3, DeepMind's flagship prediction algorithm, a side mission: make minuscule tweaks to how atoms in the protein are arranged, small enough to avoid obvious distortion but detectable later.
In tests, the two systems flagged more than 99% of watermarked proteins and correctly ignored 99.9% of unmarked ones. Watermarked proteins still bound to their targets as well as unmarked versions, the team reported.
Independent experts called the work impressive but said it was not ready for widespread use. Bruce Wittmann, a principal applied scientist at Microsoft, described the techniques as "effective but brittle". Sequence watermarks can be removed by "resequencing", altering the amino acid sequence so the mark is no longer detectable, he said, while structural watermarks can be scrubbed by adding noise to or otherwise modifying the spatial coordinates. Screening tools would not spot a removed mark.
Wittmann noted that most protein generation software is open source, making it hard to bake watermarking into the tools. He suggested the field would need to shift toward closed-source models before watermarks could become an industry standard, and framed watermarking as one layer of a biosecurity defence shield rather than standalone protection.
Others questioned whether watermarks would deter determined misuse. Max Brackmann, a chemical, biological, radiological and nuclear arms expert at the Spiez Laboratory in Switzerland, said terrorists aiming to create a novel protein for a biological weapon would be unlikely to care about being identified after a successful attack. George Rose, professor emeritus of biophysics at Johns Hopkins University, was blunt about regulation: "I'm convinced it won't work. Once there's a sweet technology that does something, government regulation to keep it under wraps has never been really successful."
Roy Sleator, a biology professor at Munster Technological University who was not involved in the research, said the approach "has the potential to reduce biosecurity threats, such as unauthorized toxin creation", could help keep artificial designs from cluttering standard protein databases, and could trace a design's origin and flag engineered proteins for extra checks.
The research was published in the journal Nature.