AI-designed proteins create an unusual provenance problem. A generated sentence can carry metadata in a file; a protein sequence may be copied into a database, synthesized in a laboratory and separated from the system that created it. SynthIDBio tries to place the origin signal inside the biological design itself.[1][2]
The work contains two methods, not one universal mark. SynthIDBio-sequence changes the amino-acid choices made during protein design. SynthIDBio-structure changes predicted three-dimensional coordinates. Each requires a detector with a secret key, and each can fail under different transformations.[1]
Two watermarks, two threat models
| Method | Where the signal lives | Reported strength and weakness |
|---|---|---|
| Sequence watermark | Statistical pattern across amino-acid choices | Detected reliably in tested designs while preserving measured binding; redesign or resampling can remove itSource 1Source 3 |
| Structure watermark | Small changes in predicted 3D coordinates | Detected under tested coordinate noise; standard energy relaxation destroyed the markSource 1Source 3 |
| External metadata | Registry, file record or signed manifest | Can carry rich provenance but can be separated from the molecule or copied incorrectly |
Function preservation is the central constraint
A watermark that makes a protein stop binding is not a useful provenance system. The researchers redesigned existing binders for three targets—SARS-CoV-2 receptor-binding domain, VEGF-A and PD-L1—and reported comparable binding performance between marked and unmarked designs that passed their filters.[1][3]
What the reported tests support
| Measure | Value | Context |
|---|---|---|
| Biological targets | Three | SARS-CoV-2 RBD, VEGF-A and PD-L1.Source 1Source 3 |
| Sequence detection | Near-perfect in the evaluated set | The reported detector threshold was set against a low false-positive rate.Source 1Source 3 |
| Structure detection | More than 99.8% in tested noise settings | Reported for the evaluated coordinate perturbations, not every possible structural transformation.Source 3 |
| Relaxation robustness | Failed | OpenMM relaxation with a standard force field removed the structure watermark.Source 1Source 3 |
A watermark proves less than many readers assume
Detection can indicate that a compatible system probably inserted a mark. It does not prove that the protein is safe, effective, legal, ethically produced or unchanged after generation. It also does not reveal all information about the model or laboratory unless that information is connected through another trusted record.
Removal is part of the security model
The sequence mark can be weakened by generating a new sequence for the same structure. The structure mark can disappear when coordinates undergo physically motivated relaxation. Those are not incidental bugs: protein design routinely includes optimization and refinement. A deployable system must specify which transformations it expects to survive and which changes count as legitimate loss of provenance.[1][2]
The most realistic design may therefore combine layers: an embedded signal that travels with the sequence, cryptographically signed metadata that carries richer context, and repository policies that preserve both. No single watermark can stop copying, redesign or deliberate evasion on its own.
SynthIDBio is valuable as a proof that biological function and machine-readable provenance can coexist under tested conditions. Its limitations are equally informative: when the object itself can be redesigned, provenance is a continuing chain of custody rather than an indelible stamp.
Sources & further reading
- Function-preserving watermarking of AI-generated proteins Nature · 30 Sep 2026 · Accessed 16 Oct 2026
- Secret watermark labels proteins as “made by AI” Nature · 30 Sep 2026 · Accessed 16 Oct 2026
- Google DeepMind develops invisible watermarks for AI-designed proteins Phys.org · 1 Oct 2026 · Accessed 16 Oct 2026