News · 2026-10-02

DeepMind publishes protein watermarks with documented removal routes

Google DeepMind published SynthID Bio, a pair of methods for watermarking AI-generated protein sequences and predicted structures, in Nature on September 30. The experiments support function preservation in specified tests, while the same paper documents ways to remove both kinds of watermark, limiting what detection can establish about provenance.

Key facts

• Nature published the paper September 30, 2026.
• Sequence experiments covered binders for three targets: a coronavirus protein domain, VEGF-A, and PD-L1.
• The paper documents successful removal through resequencing and structural relaxation.
• Primary sources are the Nature article and DeepMind announcement.

A generated protein can travel farther than the software that designed it. Someone can copy its sequence, predict its structure with another tool, or order a corresponding molecule. A provenance signature embedded in the output could therefore be useful where a separate label or metadata file disappears. SynthID Bio explores that possibility without claiming it solves every screening problem.

The work separates two kinds of object. A protein sequence is a string of amino acids. A predicted structure specifies the arrangement of atoms in space. Marking a string and marking a geometry require different techniques, and their failure modes are different too.

For sequences, DeepMind integrates a tournament-sampling approach with ProteinMPNN. A secret key and preceding sequence context influence scores for candidate amino acids, gently biasing which residues are selected. Detection recomputes the keyed scores to look for the resulting pattern. A useful analogy is choosing synonyms according to a private rule while trying to preserve a paragraph’s meaning, except that here the choices can affect a molecule’s function.

For structures, the researchers modify the diffusion component of AlphaFold 3 and train a detector for a signature in atomic coordinates. The detector uses geometric features such as distances within residues and torsion angles. This resembles an invisible statistical pattern in a drawing’s geometry, rather than a visible stamp added to its corner.

The experimental question is whether those changes interfere with what users want from the protein. Sequence tests measured binding properties against three targets. The authors report no significant population-level differences in binding affinities or hit rates for the tested comparisons, while noting a hit-rate difference at one affinity threshold. The structure setting with the least disruption preserved the reported quality metrics relative to the baseline.

Those findings are valuable but bounded. A failure to detect a difference in these experiments does not prove identical behavior for every protein class or application. Our lesson on equivalence testing explains why that distinction matters. The title’s function-preserving claim should be read with the experiment’s scope, rather than as a universal guarantee.

The paper is also explicit about removal. Passing a marked sequence back through a design process effectively strips its signature. Constrained structural relaxation using OpenMM destroys the coordinate watermark. Mild noise and rigid transformations are different tests; surviving them does not establish survival under every transformation, mutation, or re-folding procedure.

A positive detection can therefore provide provenance evidence within a specified framework. A negative detection cannot prove the sequence is natural, was never generated by AI, or is safe. A malicious user can choose a non-watermarking tool, and ordinary processing can also change the output. Our existing lesson on content provenance and watermarking explains this asymmetry across other media.

DeepMind’s announcement quotes biosecurity policy expert Sarah Carter calling the method “an important piece of the puzzle.” It also reports support from Twist Bioscience’s James Diggans. These are relevant expert reactions, but they are not evidence of industry-wide adoption or an operational DNA-synthesis screening system. The paper explicitly calls for further research, coordination, implementation work, and standardization.

The official SynthID Bio repository publishes sequence code and instructions for the structure model; the AlphaFold 3 repository lists the structure-model weights. Their verified download size is absent from the dossier and is omitted here. A runtime video-memory requirement for the watermark release is also unstated in the inspected evidence; availability of weights does not establish a particular affordable configuration.

The strongest counter-argument is that removable marks and optional adoption offer limited protection against a determined adversary. The strongest use case is narrower: additional positive provenance evidence when cooperating generators and downstream users share a detection framework. SynthID Bio makes that possibility more concrete, while publishing enough limitations to prevent a provenance experiment from becoming an unsupported safety guarantee.

Primary source, verified: read the paper →

Ground Truth. (2026, October 2). DeepMind publishes protein watermarks with documented removal routes. Ground Truth. https://groundtruth.day/news/synthid-bio-protein-watermarks-and-removal.html

@misc{groundtruth:synthid-bio-protein-watermarks-and-removal,
  title  = {DeepMind publishes protein watermarks with documented removal routes},
  author = {{Ground Truth}},
  year   = {2026},
  month  = {oct},
  url    = {https://groundtruth.day/news/synthid-bio-protein-watermarks-and-removal.html}
}

Topics: research · biosecurity · provenance · watermarking · proteins