For billions of years, proteins could only be created by nature. Today, artificial intelligence makes it possible to design entirely new proteins from scratch, with applications ranging from medicines to environmental sensors. That same capability raises biosecurity concerns and a lesser-known problem: the pollution of scientific databases with AI-generated structures that were never validated in the lab.
To address both risks, Google DeepMind introduced SynthID Bio, a method that embeds a subtle watermark into proteins during their design. According to a report published on October 5, 2026 by Singularity Hub and written by Shelly Fan, the technique could be built directly into protein-design systems such as AlphaFold or RFdiffusion, so that generated molecules carry a signal of their origin.
SynthID Bio is inspired by SynthID-Text, the tool DeepMind released in 2024 to watermark AI-generated text. In the case of text, the model slightly adjusts its word choices without changing the meaning; across a long passage, those small adjustments form a statistical signature that a detector can recognize. Proteins are also strings of “letters,” in this case amino acids, so the principle can be carried over.
The new method subtly alters design decisions, such as which amino acid comes next, and makes minimal adjustments to the position of some atoms in the final structure. To do so, DeepMind fine-tunes a small part of AlphaFold3 devoted to structure prediction, so proteins generated by that model inherently carry the mark, regardless of who runs it.
Proteins are delicate: tiny changes can disrupt their function. That is why the team put the system through demanding tests, designing proteins able to bind several targets, including molecules involved in regulating the immune system, blood vessel growth and viral proteins. In lab assays, the watermarked versions performed just as well as their unmarked counterparts. The authors describe them as “the first-ever watermarked and biologically functional protein binders.”
The context explains the urgency. To make a protein, researchers usually order its genetic sequence from a commercial DNA synthesis provider, which compares it with databases of controlled sequences and flags suspicious ones for human review. But an AI-designed protein can differ so much from anything known that it slips through, even if it is dangerous, and AI tools can tweak sequences just enough to evade the filters.
A watermark would offer a simpler route: if the sequence carries the signal, the provider would know it came from an AI design system. James Diggans of Twist Bioscience, who was not involved in the work but gave early feedback, said AI is expanding what scientists can design and that DNA synthesis companies have an important role in helping that innovation scale responsibly.
The method has clear limits. The mark can be removed: if a watermarked protein is run through another design tool to generate a different but functionally similar sequence, the signal effectively disappears. In addition, SynthID Bio cannot currently identify the creator of a protein, which limits its usefulness for tracing illicit use or protecting intellectual property.
Nor are all scientists convinced about blanket watermarking. Oliver Crook of the University of Oxford told the journal Science that the process can shift the structure enough to produce a less optimal, if still functional, version, and that for non-sensitive research it could amount to added complexity that worries researchers.
Other proposals exist. FoldMark, for example, embeds a unique 32-bit digital watermark into a protein's structure by slightly changing its geometry; in simulations it could distinguish among as many as one million hypothetical users. Another idea is to give each scientist a private identifier to mark their designs, so that the synthesis provider can check whether an order came from an authorized user.
Whatever the method, an unavoidable question arises: who holds the key to read the mark? DNA synthesis companies are the obvious choice, but there is no agreement on who else should have access. A recent survey of 130 stakeholders, including biosecurity experts, government agencies, policymakers and academics, did not reach a general consensus.
To move the debate forward, DeepMind is releasing the SynthID Bio code and its experimental data to the research community. The company is also extending the technology to more complex biological systems: in collaboration with the Arc Institute and Stanford University, the team has, in early tests, watermarked the genomes of AI-designed bacteriophages without disabling them. “By working openly with partners across biosecurity, gene synthesis, and policy, we can ensure safety and responsibility keeps pace with AI-driven discovery,” the team wrote.
In conclusion, SynthID Bio is a first step, not a definitive solution. It shows that functional proteins can be watermarked and clearly lays out the open questions about robustness, identification and key governance. Its value will depend on DNA providers, labs and regulators agreeing on how to use these signals without slowing legitimate research.
