DeepMind’s Protein Watermarks Can Be Detected Easily—and Removed Just as Easily

DeepMind’s new protein watermarking methods can identify AI-generated designs with striking accuracy, but their vulnerability to simple edits limits what they can offer biosecurity. The techniques, grouped under the name SynthIDBio, could help trace where a protein design came from. For now, experts see them as one possible screening layer, not a dependable way to stop misuse.

The problem SynthIDBio addresses is that familiar screening methods look for amino acid sequences resembling known dangerous molecules. AI systems can generate proteins unlike anything in existing databases, making sequence matching less useful. A hidden signal could give screening systems another clue: whether a design came from a particular generation system, even if the protein itself is novel.

Two ways to mark an AI-designed protein

DeepMind’s first method, SynthIDBio-sequence, works with ProteinMPNN. The program generates amino acid sequences expected to fold into a user-specified three-dimensional shape. SynthIDBio-sequence subtly biases the program’s choices using a secret key. A detector with access to that key can then estimate whether the sequence bears the watermark.

The research team reported that the marked proteins retained their ability to bind to target molecules as well as unmarked versions. That matters because a watermark that disrupts a protein’s intended behavior would make the method less useful in research and development. The design challenge is to make the signal detectable without changing what the protein does.

The second method, SynthIDBio-structure, places the signal in a protein’s predicted three-dimensional structure. It modifies how AlphaFold 3 arranges atoms, introducing tiny changes that a detector can recognize. These adjustments are designed to be too subtle to amount to obvious distortion.

In tests of both systems, detectors found more than 99% of watermarked proteins and correctly classified 99.9% of unwatermarked proteins. Those results make the methods look promising under the conditions tested. They don’t show that the marks will remain detectable after someone deliberately tries to remove them.

The watermark can be stripped

That gap between detection in a test and resilience against tampering is central to the experts’ reservations. Bruce Wittmann, a principal applied scientist at Microsoft, described the methods as “effective but brittle.” He pointed to weaknesses the DeepMind researchers also discuss: the watermarks can be removed by changing the marked data.

For a sequence watermark, that could mean “resequencing”: altering the amino acid sequence until the detector no longer recognizes the signal. A structure watermark could be obscured by adding noise to the protein’s spatial coordinates or modifying them in other ways. Once someone removes the signal, a screening tool may have no way to tell that a watermark was there.

That makes the watermark’s potential role narrower than its high test accuracy might suggest. It could help identify the source of a design when the mark is intact. It can’t, by itself, establish that an unmarked protein was never generated by AI. Nor does the reported detection rate address how often a determined user could evade the detector through modification.

Roy Sleator, a biology professor at Munster Technological University in Ireland who was not involved in the research, sees practical uses if the marks can be applied and detected reliably. They could help trace a design’s origin, flag engineered proteins for additional biosecurity checks, and reduce false claims about how a protein was made. Sleator also said the method might help keep artificial designs from cluttering standard databases.

Open tools complicate adoption

Watermarking also depends on where protein design happens. Much of the software used to predict or generate proteins is open source, meaning people can inspect and modify the code. A watermark built into one program can’t automatically mark designs produced with other tools, and users who alter the software could remove or avoid its watermarking features.

Wittmann argued that making watermarking a standard across the field would be difficult while the software remains widely open to modification. He also cautioned that any policy requiring watermarks would be hard to enforce. “I imagine it would be very difficult to ensure the regulations were being followed,” he said.

Even an indelible mark would not necessarily deter every harmful actor. It might help investigators identify who created a protein or reveal unauthorized use of a design system. But Max Brackmann, a chemical, biological, radiological and nuclear arms expert at Switzerland’s Spiez Laboratory, said a person intent on carrying out an attack may not be deterred by the prospect of being identified afterward.

George Rose, professor emeritus of biophysics at Johns Hopkins University, was more skeptical still about relying on regulation to control generative protein technology. “I’m convinced it won’t work,” he said, arguing that efforts to keep useful technology under wraps have rarely succeeded.

A useful signal, with clear limits

The backdrop is a rapid expansion in protein engineering. AlphaFold, introduced in 2020, made it possible to predict a protein’s three-dimensional structure from its amino acid sequence. The work associated with Demis Hassabis, John Jumper and David Baker was recognized with the 2024 Nobel Prize in Chemistry. Protein design systems build on related capabilities to create proteins that don’t already exist.

That work can support medicine, but experts have also raised concerns about novel proteins being used to create biological threats, including viral proteins that evade immune defenses or existing vaccines. As George Rose put it, “Anything that can be used for good can be used for bad.”

SynthIDBio offers a way to add evidence of origin to AI-generated designs, and its test results show that the signal can be detected without obvious loss of protein function. But its usefulness will depend on whether marks persist across software, databases and real-world attempts to alter them. The most credible near-term use is as one part of screening and provenance checks; whether it can become a reliable field-wide signal remains an open question.

For related coverage, see AI is solving ‘impossible’ math problems. Can it best the world’s top mathematicians?, AI-written code can beat humans at biomedical analysis, some studies find. What does that mean for the field?, and AI found a weakness in one of the world’s most studied encryption systems—is your data under threat?.

Help improve Live Science Pro: Share feedback using this form.