A new technique developed by Google DeepMind can “watermark” AI-designed proteins without compromising their function. The technology could help scientists identify proteins created by generative AI, track their origins and flag them for additional biosecurity checks.

AI has given researchers powerful tools for designing proteins that do not exist in nature. These tools could support the development of new medicines, but they could also be misused to create biological threats.

“This could reduce biosecurity threats such as unauthorized toxin creation, and could aid in database curation and prevent human designs from cluttering standard databases,” Roy Sleater, a professor of biology at Ireland’s Munster Institute of Technology who was not involved in the study, told Live Science via email.

“In practice, it could help trace the origin of a design, flag engineered proteins for additional biosecurity checks, and reduce misleading claims about how a protein was made,” Sleater said.

However, other experts warn that the watermarks could be removed using some of the same AI-driven techniques used to create them.

Why AI-designed proteins raise biosecurity concerns

AlphaFold, an artificial intelligence system developed by DeepMind, was a major milestone in protein engineering. The technology can predict the three-dimensional structure of a protein from the sequence of its building blocks, known as amino acids.

Proteins fold into complex three-dimensional shapes that determine how they function. In 2024, AlphaFold-related work helped earn Demis Hassabis, John Jumper and David Baker the Nobel Prize in Chemistry.

But the same advances could also make it easier to design entirely new proteins. Some engineered proteins could potentially evade the immune system or existing vaccines, raising concerns about their use in biological weapons.

“Anything that can be used for good can also be used for bad,” said George Rose, professor emeritus of biophysics at Johns Hopkins University.

Current screening tools often identify potentially dangerous or restricted molecules by comparing their amino acid sequences with those of known threats. That approach becomes more difficult when AI generates proteins that have never been seen before.

DeepMind’s watermarking technology is intended to help address that problem.

How DeepMind’s SynthIDBio protein watermark works

DeepMind describes its protein-watermarking research as a family of technologies called SynthIDBio. The first system, SynthIDBio Sequence, embeds a hidden signal in the amino acid sequence of proteins designed by a program called ProteinMPNN.

When a user gives ProteinMPNN a desired protein shape, the program selects amino acids that should fold into that shape. SynthIDBio Sequence subtly influences those choices using a secret watermark “key.”

Once the protein sequence has been generated, someone with the hidden code can calculate how likely it is that the sequence was produced using that key. In a recent study, the DeepMind team found that watermarked proteins could bind to their targets just as effectively as proteins without the watermark.

A second system, called SynthIDBio Structure, embeds the watermark in the protein’s predicted structure rather than directly in its sequence. It does this by modifying the way AlphaFold 3 predicts how atoms are arranged.

The system gives the AI an additional task: make small changes to the predicted structure that can later be detected by a specialized tool. The changes are designed to be subtle enough that they do not create obvious distortions or compromise the protein’s function.

In testing, the two systems detected more than 99% of watermarked proteins while correctly ignoring 99.9% of proteins without watermarks.

Why AI protein watermarks may be removed

Experts who spoke with Live Science agreed that SynthIDBio represents an impressive technological achievement, but they said the systems are not yet ready for widespread implementation.

“These two techniques are effective but fragile,” Bruce Whitman, Microsoft’s chief applied scientist, told Live Science via email. The DeepMind team also notes in its paper that the watermarks can be removed.

“I think it’s very difficult to make sure regulations are followed.”

Bruce Whitman, principal applied scientist at Microsoft

Whitman said that a watermark embedded in a protein sequence could be removed by changing the amino acid sequence. A structural watermark could also be disrupted by altering the predicted structure. Screening tools cannot determine whether a watermark has been removed.

That weakness could limit the technology’s value as a long-term biosecurity measure.

Watermarks could support biosecurity—but not replace it

Indelible watermarks could help identify who originally created a suspicious protein and when someone accessed the software used to design it. That traceability could deter some misuse and help researchers investigate the origin of an AI-generated protein.

However, Max Brackmann, an expert in chemistry, biology, radiology and nuclear weapons at the Spiez Institute in Switzerland, said people intent on creating biological weapons may not be deterred by the possibility of being identified after an attack.

Another challenge is that much of the software used for protein prediction and generation is open source. Researchers can freely use and modify the code, making it difficult to ensure that watermarking remains part of every version of a program.

Whitman cautioned that the field may need to move toward closed-source systems before watermarking can become an industry standard. He added that watermarks should be treated as an additional layer of biosecurity rather than a complete solution.

Top-down regulation may also be difficult to enforce.

Rose was even more skeptical about regulating the use of AI-generated proteins.

“I’m sure it won’t work,” he said. “When a great technology comes along that does something, government regulations that keep it secret never succeed.”

Help us improve Live Science Pro: We are always striving to improve our content. Leave your feedback about Pro here.