DeepMind open-sources SynthID Bio protein watermark

SynthID Bio landed in Nature on 30 September 2026. The company says it tested three binders in the lab.

On 30 September 2026 Google DeepMind published SynthID Bio in Nature, open access, and on its own blog. The methods put a hidden mark into sequences and 3D structures of proteins designed by AI. The paper, “Function-preserving watermarking of AI-generated proteins” (DOI 10.1038/s41586-026-10965-y), calls the work a proof of concept. Co-author Demis Hassabis wrote on X that biosecurity is “one of the most urgent challenges for the AI era” and that the tools are open source.

The stated reason sits outside the lab. DNA synthesis screening, the check a vendor runs before printing a gene, compares an order to known threats. A de novo sequence, one a model invents from scratch, can look unlike anything on that list. A watermark in the protein itself is DeepMind’s proposed extra layer. The Nature authors and the blog are DeepMind. This newsroom did not run the code.

First: what a protein watermark is

A watermark here is a hidden mark in the protein, not a stamp on a file. Think of a seal on the back of a banknote. The real mechanism is different: the model slightly biases the next amino acid, the building block of a protein, or nudges atomic coordinates in the predicted fold, until a statistical signature shows up. The analogy breaks if someone redesigns the sequence with another tool. Then the mark disappears.

What Nature published

David Stutz and Alexander I. Cowen-Rivers are listed as equal contributors. Affiliation: Google DeepMind, London. Hassabis and Pushmeet Kohli are on the author list. The paper was received on 29 September 2025, accepted on 29 July 2026, and published on 30 September 2026. It still has no volume or page numbers; the citation is Nature (2026).

Code and in vitro data sit at google-deepmind/synthidbio, with the initial commit on 30 September 2026. Software is Apache-2.0; in vitro data are CC-BY 4.0. The structure-side weights come with terms of use. “Open source” here does not mean unrestricted AlphaFold 3 weights. AlphaFold 3 is DeepMind’s model that predicts a protein’s 3D shape.

How the mark gets in, according to the company

SynthIDBio-sequence works on the amino-acid string. SynthIDBio-structure is an AlphaFold 3 fine-tuned so the predicted coordinates carry the signature even if someone else runs the model. For binders, proteins built to stick to a target, the blog describes AlphaProteo plus a SynthID Bio version of ProteinMPNN.

The paper cites SynthID-Text (Nature, 2024) as the precedent. The SynthID line already covered images in 2023 and text and video in 2024. According to the paper, the structure method can reach a true positive rate above 99.8% at a 0.1% false positive rate for strength values s in {0.001, 0.01, 0.1}. Those figures are the authors’ measurements, not an outside audit.

Three targets in the wet lab

According to DeepMind, watermarked designs against VEGF-A, a protein that helps blood vessels grow, the SARS-CoV-2 spike RBD, the receptor-binding domain of the virus’s spike, and PD-L1, a protein some cancer cells use to hide from the immune system, matched the hit rate, binding affinity, and sequence diversity of unmarked versions. The paper reports low-nanomolar binders for the RBD and subnanomolar binders for VEGF-A and PD-L1. Adaptyv Bio is thanked on the blog for in vitro help. No outside lab has repeated those assays in this check. “First-ever” is the company’s claim, not a third-party finding.

What the mark does not hold

Science, the same day, in a piece by Catherine Offord, talked to people outside DeepMind. Haiping Lu at the University of Sheffield likes the idea and doubts wide adoption. Marinka Zitnik at Harvard Medical School asks whether it works on very small proteins. Birte Höcker at the University of Bayreuth is skeptical about enzymes. Oliver Crook at the University of Oxford sees extra complexity for bench scientists.

Kohli told Science it is relatively easy to scrub the mark today. The paper admits the same hole: resequencing or OpenMM relaxation, a physics-based cleanup of the predicted fold, wipe the signature. A hostile actor would just use a model without a watermark. The scheme is zero-bit: it says whether the mark is there, not who designed the protein.

RUMOR: adoption by DNA synthesis providers, PDB, UniProt, or GenBank. RUMOR: performance on enzymes, very small proteins, or tightly constrained designs. Sarah Carter (Science Policy Consulting) and James Diggans (Twist Bioscience) commented on the paper on DeepMind’s blog; Carter reviewed the work and Diggans gave early feedback. Twist synthesizes DNA. There is no operational rollout.

What we still do not know

Nobody independent has repeated the wet-lab assays. The paper itself says open-sourcing limits a punitive model of adoption, and that people acting in bad faith can skip the watermarked tool. Work on watermarked bacteriophages with the Hie lab at Stanford and the Arc Institute is described on the blog and is not in the 30 September Nature paper.

The publication answers a narrower question than the biosecurity framing suggests. SynthID Bio is a proof of concept, with three binder tests reported by the authors, and a mark that the company says is still easy to remove.

Sources

Official

• Nature, Stutz et al., Function-preserving watermarking of AI-generated proteins
• DOI 10.1038/s41586-026-10965-y
• Google DeepMind, Introducing SynthID Bio, 30 Sep 2026
• GitHub, google-deepmind/synthidbio
• Demis Hassabis on X

Independent press

• Science, Catherine Offord, 30 Sep 2026