Watermarks in AI-designed proteins preserve binding in laboratory tests
Google DeepMind scientists have embedded detectable provenance watermarks in AI-designed protein binders and in AlphaFold 3 biomolecular structure predictions. Surface plasmon resonance measurements showed that watermarked binders bound three therapeutically relevant targets with affinity comparable with unmarked designs, although the authors caution that the sequence watermark can be removed and that the approach remains only a technical proof of concept.
Researchers at Google DeepMind have shown that AI-designed proteins can carry a hidden watermark identifying their origin without losing their function, a step towards tracking the provenance of AI-generated biological material. The study, “Function-preserving watermarking of AI-generated proteins”, was published in Nature on 30 September 2026.
“Tracking and establishing the provenance of AI-generated protein sequences and structures is becoming increasingly important to tackle a range of emerging challenges, including biosecurity and concerns about information veracity,” the authors wrote in the abstract. Their SynthIDBio methods embed a signature in designed protein sequences and in AlphaFold 3 predicted structures. “Our work is a proof-of-concept that function-preserving biological watermarking is feasible,” they added, calling it “a potential tool for provenance in the rapidly expanding era of AI-driven biological engineering”.
The authors conclude that the work “represents a notable step towards establishing and tracking provenance of biological objects”, with “potential implications for biosecurity and scientific integrity”.
How the watermark works
The sequence method nudges which amino acids are chosen at each step of design, guided by a secret key, so that finished sequences carry a statistical signature that only key holders can detect. The structure method trains the signature into the model’s weights.
Why provenance is signficant
The authors suggest that watermark detection could support nucleic acid synthesis screening, helping DNA synthesis providers judge orders for sequences with little similarity to known hazards. It might also flag machine-generated entries submitted to public resources such as the Protein Data Bank. The aim, they write, is “to raise the barrier to entry rather than guarantee absolute security”.
Testing function in the laboratory
A watermark is only useful if the protein still works. For the SARS-CoV-2 receptor binding domain, VEGF-A and PD-L1, the team resequenced 15 known binder backbones per target, producing 222 non-watermarked designs and 267 for each of two watermarking settings.
Binding kinetics were measured by surface plasmon resonance on a Carterra LSA XT instrument, and the authors thank Adaptyv Bio for contributions to the in vitro validation. “It gives us real binding kinetics and affinity data, not just a yes/no answer”, said Julian Englert, CEO and co-founder of Adaptyv Bio.
The designs included low nanomolar binders for the receptor binding domain and subnanomolar binders for VEGF-A and PD-L1. Affinity showed no significant population-level difference between watermarked and non-watermarked binders, with one exception: receptor binding domain binders from the distortionary setting had a significantly lower median dissociation constant than those from the non-distortionary setting. Hit rates did not differ significantly at a threshold of 10-⁷ M, but at 10-⁶ M non-watermarked binders had a higher hit rate than the non-distortionary setting. All nine negative controls showed no detectable binding.
Applying a detection threshold calibrated to a 0.1% false positive rate gave a 100% true positive rate for these designs, at the price of lower pass rates in silico. That means roughly 1.7 times as many candidates must be generated, although the authors “found that SynthIDBio-sequence adds negligible cost in practice”.
Because the structure watermark comes from fine-tuning AlphaFold 3 itself, it persists even if the model is shared openly. Detection exceeded 99.8% at a 0.1% false positive rate across all three variants tested, and the recommended variant did not reduce structural accuracy scores relative to the AlphaFold 3 baseline.
Limits of the approach
The sequence watermark sits in the sampling algorithm, which, the authors acknowledge, “also implies that the watermarking mechanism can easily be removed or turned off by users.” Resequencing 38,396 binders largely stripped it, though the estimated hit rate for an attacker starting from a known binder fell to 97%, 70% and 66% for the three targets with structural filters, and to 33% and 20% without them for the receptor binding domain and PD-L1. The structure watermark withstood small coordinate noise but not structural relaxation.
The authors also warn that “sophisticated actors could append short malicious sequences to watermarked designs”, diluting the signal, and that both watermarks are zero-bit, so they cannot tell users apart. They stress that operationalising the approach for biosecurity will need further innovation and industry-wide coordination.
All authors are employees of Alphabet, which funded the study.
Carterra noted that they continue to expand their platform to meet the demands of AI-driven discovery. The Carterra Vega™, launched in February 2026 as the industry’s first 48-channel HT-SPR system, enables primary screening of more than 20,000 small molecule interactions per day. Carterra also announced recently a collaboration with AstraZeneca “to develop hardware and software aimed at advancing lab-in-the-loop drug discovery.”
Reference:
Stutz, D., Cowen-Rivers, A. I., Ortiz-Jimenez, G., et al. (2026).
Function-preserving watermarking of AI-generated proteins. Nature.
https://doi.org/10.1038/s41586-026-10965-y