# Google watermarks AI proteins for biosecurity

> DeepMind develops a system to identify trustworthy AI-designed proteins and flag unknown ones for closer scrutiny.
- Title: Google watermarks AI proteins for biosecurity · Ars Technica
- Summary: DeepMind develops a system to identify trustworthy AI-designed proteins and flag unknown ones for closer scrutiny. Google's DeepMind has created a…
- Keywords: google, deepmind, protein design, ai watermarking, biosecurity, synthid, proteinmpnn, dna synthesis, technology, science, watermarks, proteins
- Source: Ars Technica — https://arstechnica.com/science/2026/09/google-figures-out-how-to-watermark-ai-designed-proteins
- Published: 2026-09-30T15:54:52+00:00
- Read time: 3 min
- Topics: google, deepmind, protein design, ai watermarking, biosecurity, synthid, proteinmpnn, dna synthesis, technology, science
## AI tools pose biosecurity risks
AI-based protein design tools have created major successes, such as enzymes that digest plastics. But the same tools could be used to make toxins or alter viral proteins.
## Current screening misses AI proteins
Software that identifies DNA sequences encoding threatening proteins cannot detect AI-designed proteins because they have not been characterized well enough to be recognized as threats.
## Google proposes protein watermarking
On Wednesday, the DeepMind team at Google published a research paper offering a potential solution: protein watermarking. The system creates a watermark on protein sequences without compromising function.
## SynthID adapted for proteins
The work was based on Google's SynthID tech, which adds subtle watermarks to AI-generated digital material. The watermark influences the probability of certain choices the AI makes, distributed throughout the product.
## Proteins present unique challenges
Proteins are composed of only twenty amino acids, any of which could be essential for structural integrity or catalytic activity. Proteins containing five hundred amino acids are fairly large, leaving little raw material to hide a signal.
## How protein structure works
Amino acids have a constant section made of two carbon atoms linked to a nitrogen. A protein is made by linking these sections to form a backbone. Side chains hanging off each amino acid determine how the backbone folds in three-dimensional space.
## ProteinMPNN builds proteins step by step
Google started with ProteinMPNN, a popular AI protein design tool developed by the Baker Lab. It works in two stages: first describing a backbone configuration, then placing side chains one amino acid at a time based on constraints.
## SynthIDBio integrates the watermark
A variant called SynthIDBio steps in during the process. It uses a cryptographic key and previously chosen amino acids to suggest a new one. ProteinMPNN determines whether the suggested amino acid works for a functional protein.
## Watermark distributed throughout protein
The watermark is randomly distributed across the entire length of the protein. Detecting it is not a simple yes-or-no question. You must scan the whole sequence knowing the key and measure how often suggested amino acids appear.
## Watermarked proteins remain functional
The team designed proteins that physically interact with key natural proteins previously targeted with AI designs. The watermarked versions worked just fine, binding the intended targets without serious problems.
## DNA synthesizers gain screening tool
When someone orders DNA sequences, synthesizers screen for ability to encode viral portions, toxic proteins, and similar threats. Google envisions its system giving synthesizers greater confidence by identifying AI designs from trusted sources.
## System has known limitations
The team highlighted several potential holes. The system is only as secure as the key distribution system. Very short proteins may incorporate too few watermark amino acids to be identified. Watermarks could be diluted by padding sequences.
## Other design tools need integration
Many AI-based protein design software packages do not rely on ProteinMPNN. Some use a similar one amino acid at a time approach that should integrate well with SynthIDBio, but not all will be able to watermark their designs.
## Practical utility remains uncertain
Watermark identification is done on a statistical basis, so how you set the cutoff makes a big difference in false positives and false negatives. It is not clear this will be especially useful in practice in its original form.
## Key takeaway

Google's DeepMind has created a watermarking system for AI-designed proteins that allows DNA synthesizers to identify trusted sources and focus screening on unknown designs.