Google DeepMind's SynthID watermarking technology, originally developed to identify AI-generated text, images, audio, and video, has been extended into a new domain: biology. Researchers at the University of Maryland have adapted the system to embed invisible watermarks directly into AI-designed protein sequences, establishing a potential tracking mechanism for synthetic biology that leaves the proteins intact.

Watermarking at the amino acid level

The method builds on SynthID-Text, which operates by subtly adjusting the probability distribution of tokens during generation—in this case, amino acids rather than words. Using an unbiased Gumbel sampling approach, the researchers embedded a watermark derived from a private key into the amino acid probability distribution of protein design models, including ProteinMPNN.

ProteinMPNN, released in 2022, is among the more prominent AI models for designing novel protein sequences. It takes a desired three-dimensional protein structure and works backward to produce amino acid sequences expected to fold into that shape. The field it belongs to has moved quickly into the mainstream: the 2024 Nobel Prize in Chemistry recognized computational protein design, awarded to David Baker, along with AI-driven protein structure prediction, shared by Google DeepMind's Demis Hassabis and John Jumper for AlphaFold2. The watermarking layer sits on top of this workflow, influencing which specific amino acids are selected without altering the overall statistical properties of the output.

Validation testing showed that pLDDT scores—a standard metric for predicted protein folding quality—remained unchanged after watermarking. Structurally, the proteins appeared just as sound with the watermark as without it.

The biosecurity case

As AI protein design tools grow more powerful and more accessible, the ability to generate novel biological sequences raises legitimate safety concerns. Con provenance methods, such as metadata logs attached to files, can be stripped away as easily as EXIF data from a photograph, offering no durable chain of custody.

An embedded statistical watermark works differently. It resides within the sequence itself, surviving copy-paste operations, file format conversions, and distribution across systems. Anyone with access to the corresponding private key can later detect the watermark, enabling organizations to determine whether a given protein sequence was produced by a specific AI model.

The capability also plugs directly into existing biosecurity infrastructure. The International Gene Synthesis Consortium (IGSC) already maintains frameworks for screening DNA synthesis orders against databases of known dangerous sequences. Because that screening relies on matching orders against catalogs of known hazards, a genuinely novel AI-generated sequence may not resemble anything in those reference databases—leaving a documentation gap that sequence-embedded provenance could help fill. Watermarked protein sequences could be tracked through these same channels, adding a layer of AI-specific provenance to the screening process.

Where this stands today

There is no commercial product called "SynthID Bio" available for purchase or deployment; the research sits squarely in proof-of-concept territory. The underlying SynthID technology from Google DeepMind is real and actively deployed for watermarking AI-generated text, images, audio, and video. The protein application extends those principles but has so far been demonstrated only in a research setting and has not yet been productized. Whether the method transfers to other protein design models and finds uptake in real synthesis-screening workflows remain open questions for the field.

The study also highlights a structural advantage of statistical watermarking over alternative approaches. Because the watermark is embedded in the generation process itself rather than appended afterward, it creates a form of provenance that is inherently tied to the AI model. A protein sequence cannot be watermarked after the fact using this method—it must happen at generation time, which means it naturally tracks the origin point rather than some downstream processing step.