DeepMind's SynthIDBio watermarks AI-designed proteins while binding viral, vascular and immune targets, but another design tool can scrub the tag

SynthIDBio encodes the watermark both at the sequence level, by subtly changing the pattern of amino-acid building blocks, and in the protein's 3D shape through tiny changes in atomic arrangement; detection requires a secret key shared only with trusted partners such as DNA sequence makers, and the watermark reveals nothing except that a protein was made using an AI tool. Prior watermarking ideas were used for images, video, audio and text, and work such as FoldMark attempted traceable signatures in protein structures; SynthIDBio differs by placing the mark at both sequence and structure levels and attaching it directly to the outputs of design tools such as AlphaFold and RFdiffusion. The Nature story describes the system as developed by researchers at Google DeepMind in London and as borrowing a trick already used to identify AI-made images, video, audio and text; it reports no watermark capacity, bit accuracy or detection threshold.

Pushmeet Kohli's team at DeepMind stress-tested the approach on a number of challenging problems and found that watermarked proteins bound a range of targets, including those involved in viral infection, blood-vessel formation and immune regulation, as efficiently as unwatermarked ones. This addresses the premise that a watermark is only useful if it does not interfere with what a protein is designed to do, turning the marking-versus-function tension into a testable question. The story quotes Kohli saying the team stress-tested the approach on challenging problems and reports comparable binding efficiency; it does not disclose the number of targets, the experimental systems or statistical detail.

The watermark can be scrubbed: someone who wants to erase the 'made by AI' tag can, in many cases, run a watermarked protein through another design tool and generate a new sequence that retains the protein's structure and function but obscures its synthetic origins. This reframes the watermark from a truth test into one layer of a layered biosecurity framework, complementing the argument by Alexanian and colleagues for moving from sequence matching toward functional screening. The story states directly that 'this molecular stamp can be scrubbed away' and quotes Tessa Alexanian calling it one more tool in a layered framework in a 'wild new world'; it does not quantify the erasure success rate.

Companion papers supply context on both governance and technique: among 130 interviewees across industry, government, academia and policy, 76% highlighted the urgency of AI misuse in biology, 74% called for clearer governance standards and 47% expressed skepticism about existing sequence-based screening; FoldMark reports over 95% watermark bit accuracy at 32 bits with minimal structural impact (scTM > 0.9) and, in wet-lab work on EGFP and CRISPR-Cas13, wildtype-level function (98% fluorescence, 95% editing efficiency) with >90% watermark detection. These works move watermarking from concept toward measurable metrics and wet-lab validation, while grounding the judgment that sequence-similarity screening does not fully cover AI-designed products in expert consensus and concrete tool performance. The expert percentages come from coded analysis of 130 semi-structured interviews; the FoldMark numbers are the bit accuracy, scTM and wet-lab functional figures reported in its own abstract.

The result is aimed at researchers designing proteins with tools such as AlphaFold and RFdiffusion, at DNA synthesis providers, and at biosecurity screeners, on the premise that detection keys are shared only with trusted partners. Its most direct use is marking the origin of AI-generated proteins and supporting synthesis-order screening and repository provenance; the story states plainly that the watermark reveals nothing except that a protein was made using an AI tool, so it fits as one layer alongside functional screening, access controls and metadata provenance.

The story gives no watermark capacity, detection sensitivity or false-positive rate, and does not quantify how often another design tool erases the watermark, so the mark's reliability in real order streams remains an open question. The companion literature sketches a wider picture: sequence-similarity screening loses detection power once sequence identity and longest common subsequence fall below certain thresholds, function-based screening is still starting from tractable targets such as toxins, and 47% of 130 interviewees were skeptical of existing sequence-based screening tools. Together these point to a question that is not yet answered: when design tools can produce functional proteins that diverge sharply from known sequences, how should watermarks, function prediction and order context be combined into a reliable determination.