TL;DR: On September 30, 2026, Google DeepMind introduced SynthID Bio, a proof-of-concept system that embeds a detectable watermark in AI-designed protein sequences and predicted structures without breaking biological function.

Google DeepMind said its new SynthID Bio technology places an imperceptible signature directly into biological code so provenance can be verified on a synthesized, physical protein, not only in a digital file, while preserving function in laboratory testing, according to Google DeepMind. The company described the work as a proof of concept for watermarking AI-generated proteins while preserving biological function. The related research paper was published in Nature on September 30, 2026, according to Nature.

A watermark meant to survive synthesis

SynthID Bio is described as a family of watermarking methods developed for synthetic biology to support biosecurity and scientific integrity, according to Google DeepMind. The system adapts its method to the data type, guiding amino-acid choices for sequences and adjusting atomic coordinates for predicted three-dimensional structures to create a signal for detection.

The goal is provenance: distinguishing AI-generated designs from natural sequences and linking a design to the model system that produced it. Google DeepMind said generative AI is helping scientists address biological challenges, from predicting protein structure with AlphaFold to designing new proteins with AlphaProteo and ProteinMPNN and developing new bacteriophages that infect bacteria. The same capability creates challenges because novel AI designs can bypass traditional DNA-synthesis screening, while mislabeled synthetic structures risk polluting public databases and misleading downstream research, according to Google DeepMind.

According to Ars Technica, the DeepMind team published a research paper offering protein watermarking as a potential solution. Ars Technica reported that the system creates a watermark on protein sequences themselves without compromising protein function, allowing new proteins designed by trusted researchers to be identified and leaving other sequences open to closer scrutiny.

How SynthID builds on existing watermarking

SynthID Bio extends Google’s SynthID approach previously used for AI-generated digital material, according to Ars Technica. Ars Technica reported that SynthID influences the probability of certain choices an AI model makes, distributing that bias systematically through the product, whether text or images.

In digital media, the watermark cannot be identified without knowing how it was encoded, which makes it difficult to remove, and distribution through the file helps it survive basic exporting and resizing, according to Ars Technica. Transferring that idea to proteins was uncertain because proteins use only 20 amino acids, some chemically similar such as leucine and isoleucine and others with opposite charges, and because many proteins contain regions where limited sequence changes are tolerable alongside areas where slight deviation inactivates the protein, according to Ars Technica. Ars Technica also noted scale: images often contain millions of pixels, while proteins containing 500 amino acids are fairly large, leaving less raw material to hide a signal.

Google DeepMind said SynthID Bio subtly guides amino-acid selection for sequences and adjusts atomic coordinates for predicted structures. The company said those adjustments did not compromise biological function in experiments, which it described as essential for treating disease and advancing research.

Tested in wet-lab protein binders

Google DeepMind said it verified the sequence approach for protein binders, molecules built to selectively latch onto other proteins, by using its AlphaProteo binder-design method alongside a SynthID Bio-enabled version of ProteinMPNN, a commonly used protein-sequence generation method. In that workflow, ProteinMPNN is applied to backbone structures before structural metrics are used to filter designs to predicted binders, according to Nature.

The wet-lab testing covered three target proteins: VEGF-A, the SARS-CoV-2 spike-protein receptor-binding domain, and PD-L1, according to Google DeepMind. Google DeepMind reported that watermarked designs matched the hit rate, binding affinity, and natural sequence diversity of unwatermarked versions, successfully creating what it called the first-ever watermarked and biologically functional protein binders.

Nature reported low nanomolar binders for the SARS-CoV-2 receptor-binding domain and subnanomolar binders for vascular endothelial growth factor A and programmed death ligand 1. The experimental design used known backbones from AlphaProteo that were resequenced using ProteinMPNN with or without the sequence-watermarking method, according to Nature. Across targets and backbones, Nature reported that watermarking did not affect the binding-affinity distribution or binding hit rates.

The abstract in Nature described near-perfect watermark-detection accuracy for functional designed binders with binding affinity comparable to non-watermarked counterparts. The paper framed the work as a proof of concept that function-preserving biological watermarking is feasible, according to Nature.

A separate method for predicted structures

SynthID Bio also includes a structure-watermarking method tied to AlphaFold 3. Google DeepMind said SynthID Bio fine-tunes a small part of AlphaFold 3’s diffusion network, building watermarking ability directly into model weights so predicted three-dimensional coordinates inherently carry a detectable signature regardless of who runs the model.

Google DeepMind said the structure method preserves AlphaFold 3 prediction accuracy while offering near-perfect detectability, maintaining key structural-feature distributions and holding up against digital noise or minor coordinate changes. Nature described the companion method as a fine-tuned AlphaFold 3 model that embeds an imperceptible watermark into biomolecular structures.

The distinction matters because sequence watermarking addresses designed proteins intended for synthesis, while structure watermarking addresses predicted coordinates that researchers interpret and deposit. Google DeepMind illustrated the structure case with the 7PPA example, showing the AlphaFold 3 predicted structure, the ground-truth structure, and the watermarked structure. It also visualized a watermarked VEGF-A binder with watermark signal indicated by color for each amino acid.

Why DNA-synthesis screening needs provenance

Google DeepMind framed watermarking as a verification layer within layered biosecurity defenses, comparing the concept to a Swiss-cheese defense model in which multiple independent safety measures cover each other’s blind spots. The company listed model-level mitigations and customer vetting as critical layers with potential gaps, and positioned SynthID Bio as a tangible verification layer embedded in biological design itself.

That layer is aimed in part at DNA-synthesis screening. Converting digital protein designs into physical molecules requires ordering from DNA-synthesis providers, which screen requests against databases of known threats, according to Google DeepMind. Historically, an unfamiliar sequence might have been assumed to be an undiscovered natural organism, but AI can create new sequences with little resemblance to known hazards, so screeners can no longer make that assumption, according to Google DeepMind. Verifying that an unfamiliar order is not an engineered threat can require exhaustive manual reviews that stall research, and Google DeepMind said SynthID Bio can provide an automated verification signal showing that an order originated from a trusted model with built-in safeguards.

Sarah Carter, a biosecurity-policy expert and principal at Science Policy Consulting who reviewed the work, said SynthID Bio is an important piece of the puzzle for tracking provenance of biological designs, according to Google DeepMind. Carter said linking designs to the model developer empowers developers to lead on safety and allows synthesis providers to streamline screening for customers who used those models.

James Diggans, vice president for policy and biosecurity at Twist Bioscience, who provided early feedback on the paper, said AI is expanding what scientists can design and that DNA-synthesis companies have a role in helping innovation scale responsibly, according to Google DeepMind. Diggans said watermarking offers a promising addition to the biosecurity toolbox that could strengthen screening, focus resources on sequences that warrant closer review, and make biosecurity more efficient as AI-designed biology advances.

Databases, integrity, and limits

Google DeepMind said SynthID Bio could help maintain integrity for databases including the Protein Data Bank, UniProt, and GenBank. Those databases, many open to public submission, support scientific advances, but mislabeled entries can have outsized effects on biosecurity decision-making and downstream research, according to the company’s discussion.

An accompanying Nature news report summarized the safeguard as a way to flag proteins devised by tools such as AlphaFold, while noting that the digital marker can be erased. That caution points to an open issue for any watermark: detection depends on the watermark surviving handling, editing, and synthesis choices, and on broad adoption by model developers, synthesis providers, and database curators.

The Nature paper also placed watermarking among other provenance options, including centralized databases and cryptographically signed metadata about design processes. It noted that databases require central coordination, can produce false positives at scale, and may raise privacy issues, while signed metadata can preserve privacy but is easy to remove, according to Nature. Watermarking, the paper argued, promises high detectability and quality preservation by being imperceptible, offers a privacy-preserving alternative where provenance is harder to remove, requires no central coordination, and can establish provenance for open-model predictions.

Google DeepMind has not presented SynthID Bio as a finished biosecurity control. Its language remains proof-of-concept and laboratory validation rather than deployment across synthesis screening or public databases. The reported results cover designed binders and AlphaFold 3 predictions, not every class of AI-designed biological object.

Sources referenced