SynthID Bio: watermarks inside proteins

On 30 September Google DeepMind introduced SynthID Bio, watermarking methods for synthetic biology. The signature goes into the choice of amino acids and into the 3D coordinates of predicted structures, and it can be verified even on the synthesised protein. In lab tests against three targets, watermarked proteins worked as well as unmarked ones.

In short

The goal is biosecurity and clean scientific databases: knowing which molecule came from which model.
The methods, code, lab data and weights are released to researchers.
The next task, per DeepMind, is making the mark hold up against deliberate tampering.

Checked on1 October 2026Responsible editorTsvetelin IvanovHow we workMethod · Corrections

A watermark in a photo is an old trick. A watermark in a molecule that is then physically synthesised and still carries the signature is something else.

Here is why it is needed. Companies that synthesise DNA to order screen every order against databases of known threats. Until recently an unfamiliar sequence could pass for an undiscovered natural organism. With AI designing entirely new sequences, that assumption falls, and every odd order becomes a manual review.

The facts: on 30 September 2026 Google DeepMind introduced SynthID Bio, a family of watermarking methods for synthetic biology. For sequences the mark is embedded through the choice of amino acids, for predicted 3D structures through small adjustments to atomic coordinates; for structures a small part of AlphaFold 3's diffusion network is fine-tuned. The approach was tested on protein binders designed with AlphaProteo and with a SynthID Bio-enabled version of ProteinMPNN. In wet-lab tests against three targets, VEGF-A, the SARS-CoV-2 spike protein RBD and PD-L1, the watermarked proteins matched the hit rate, binding affinity and sequence diversity of unwatermarked ones. DeepMind is publishing its methods paper, open-sourcing the code and in vitro data, and releasing the weights to researchers. In separate work with the Hie lab at Stanford and Arc Institute, the mark was built into the genome of a bacteriophage designed with Evo 2; early lab tests confirm the phages are functional. DeepMind names robustness against deliberate tampering as the next challenge.

The signature survives even after the molecule becomes matter.

The most honest sentence in the text is about the limit: the next task is for the mark to withstand deliberate tampering. So today it helps the honest prove they are honest. It does not stop the malicious.

And that is exactly the point, read correctly. The synthesis company sees a signature from a model with built-in safeguards and can clear the order faster. No signature means a full review. The mark does not catch the bad actor; it frees up the people who have to look for one.

The backstory Claude designed proteins against 15 targets and hit 14 - our story from 19 August.

The visual is generated code art. No third-party images.

DeepMind put a watermark inside the protein itself, without taking away its function in lab tests

More on this

Google released EmbeddingGemma 2: an open 740-million-parameter model for searching text, code, images, video and audio on the device itself

AI weather forecast - 15 days out, in 8 minutes

Cloudflare gives agents a workspace, a small model for decisions and a search that starts costing money in November