Proteins were once only created by nature. But it\u2019s now possible to design completely new proteins from scratch using AI. The possibilities are endless. AI-designed proteins could become powerful drugs battling medical scourges, sentinels for the environment, or even the building blocks of synthetic life\u2014including dangerous new pathogens.<\/p>\n
Biosecurity is an obvious concern. But there\u2019s another problem too: biological AI slop. AI-generated structures could pollute the databases scientists rely on to test theories or tweak protein functions. Without a way to distinguish experimentally validated structures from ones that AI simply dreamt up, scientists could spend months building on a rotten foundation.<\/p>\n
To prevent this, AI-designed proteins could soon carry a watermark<\/a>. Adapted from a technology that labels AI-generated text, images, audio, and video, a new Google DeepMind method called SynthID Bio sneaks a subtle signal into proteins during the design process. The tool could be built directly into protein-design systems such as AlphaFold and RFdiffusion.<\/p>\n “AI is expanding what scientists can design, and DNA synthesis companies have an important role in helping that innovation scale responsibly,\u201d said<\/a> James Diggans at Twist Bioscience<\/a> in South San Francisco, who was not involved in the work but provided early feedback.<\/p>\n Not everyone is sold on blanket watermarking. The process can jostle protein structure just enough to produce a less optimal, if still functional, version of the molecules. For protein scientists tackling non-sensitive research questions, this could amount to \u201cadded complexity\u201d that worries them, Oliver Crook at the University of Oxford told<\/a> Science.<\/p>\n DeepMind acknowledges that SynthID Bio is just a first step towards tracking AI-generated biological molecules, and plenty of kinks still need ironing out. But they hope to start a conversation about the pros and cons of watermarks and how to best implement them. Ideally, watermarks allow research to continue freely while still preventing dangerous AI designs from crossing into the physical world.<\/p>\n Gap in the Guardrails<\/p>\n There\u2019s no doubt AI is transforming biological research. From deciphering protein structures and mapping their interactions to dreaming up entirely new proteins, these tools have opened a new window on the mechanics of life.<\/p>\n But it\u2019s a double-edged sword.<\/p>\n Last year, a study<\/a> found that existing biosecurity software struggles to recognize synthetic toxins generated by freely available AI tools. And a more recent study in which<\/a> scientists used AI to design entirely new bacteriophages\u2014viruses that infect bacteria\u2014earned scientific praise and set off alarm bells. The work showed AI can write biological functions at whole-genome scale, a scientific triumph that, in the wrong hands, could potentially help create a bioweapon.<\/p>\n Thankfully, a major guardrail is already in place. Cells build proteins from DNA instructions. So, to synthesize a protein, researchers must send the molecule\u2019s genetic blueprint to a commercial provider. There, the provider can compare the sequence to a large database of \u201ccontrolled\u201d DNA sequences. Suspicious sequences are flagged for human review to make sure they don\u2019t encode toxins or proteins from pathogens.<\/p>\n But AI-designed proteins complicate the picture. If a sequence widely differs from anything in the database, it could slip through the cracks, even if the resulting protein is a brand new toxin. AI tools can also tweak sequences just enough to evade detection. Conversely, a dangerous sequence might fly under the radar if it looks too much like one already labeled safe.<\/p>\n One workaround is to screen not just for matching sequences, but also for expected biological function<\/a>. But that means those conducting the screening need to have some idea of what the resulting protein might do\u2014a tall order for a new sequence unlike anything in nature.<\/p>\n A watermark might offer a simpler alternative.<\/p>\n A Digital Trail<\/p>\n DeepMind adapted its new method from SynthID-Text, released in 2024 to watermark AI-generated content.<\/p>\n The watermark is not an individual stamp slapped onto an existing sequence. Rather, it emerges from nuances in language during generation. When producing text, AI predicts how likely each word is to follow the words before it. SynthID-Text nudges those choices\u2014for example, favoring \u201cresearcher\u201d over \u201cscientist\u201d\u2014without changing a sentence\u2019s meaning. An average user wouldn\u2019t notice. But across longer chats, the tiny tweaks add up to a statistical signature that a detector can recognize as \u201cmade by AI.\u201d<\/p>\n Proteins are also strings of \u201cletters,\u201d or amino acids, that follow biophysical rules as they fold into three-dimensional shapes. SynthID Bio applies a similar trick to its predecessor, subtly altering design decisions, such as which amino acid comes next. It also slightly adjusts the protein\u2019s final form through tiny shifts in its atoms\u2019 locations. The approach fine-tunes a small part of AlphaFold3 for structural prediction, so proteins generated by the model inherently carry the watermark, regardless of who runs it.<\/p>\n Proteins are finicky, and even minute changes can scramble their function. So the team put its watermarking system through a series of stress tests, generating proteins designed to latch onto multiple targets, including those related to regulating the immune system, blood vessel growth, and viral proteins. In lab tests, the watermarked versions performed just as well as their unwatermarked counterparts, making them \u201cthe first-ever watermarked and biologically functional protein binders,\u201d wrote<\/a> the team.<\/p>\n But there\u2019s a catch: The watermark can be scrubbed. If you run a marked protein through another design tool to generate a new but functionally similar sequence, the tag effectively disappears. Also, SynthID Bio can\u2019t currently be used to identify the creator of a protein, limiting its ability to trace illicit use or to mark intellectual property.<\/p>\n Other systems are in the works. FoldMark<\/a>, for example, embeds a unique 32-bit digital watermark into a protein\u2019s structure by slightly changing its geometry. The team tested the system on several proteins and found they retained normal function. In simulations, the system could distinguish among as many as one million hypothetical users. Another idea<\/a> is to give scientists a private \u201cidentifier\u201d to watermark the proteins they create. A DNA synthesis provider could then check the sequence to see if an order came from an authorized user.<\/p>\n Regardless of the method, watermarking raises an inevitable question: Who gets the decoder key? DNA synthesis companies are one obvious choice. But there\u2019s little agreement on who else should get access. A recent survey<\/a> of 130 stakeholders including biosecurity experts, government agencies, policymakers, and academics did not land on a general consensus.<\/p>\n To keep the conversation going, DeepMind is releasing its SynthID Bio code and experimental data to researchers. The company is also expanding the technology to more complex biological systems. In collaboration with Arc Institute and Stanford University, the team has watermarked the genomes of AI-designed bacteriophages, without disabling them, in early tests.<\/p>\n