SynthID Bio

SynthID Bio is a family of watermarking methods developed by Google DeepMind for AI-designed protein sequences and predicted biomolecular structures. Announced on September 30, 2026, it extends SynthID to biological data. The research introduced two methods: SynthIDBio-sequence, which marks amino acid sequences during generation, and SynthIDBio-structure, which produces watermarked three-dimensional structure predictions using a fine-tuned AlphaFold 3 model.^[1][2]

The work is a proof of concept. Its central evidence consists of laboratory binding measurements for designed proteins and computational evaluation of predicted structures. These results support preservation of the properties tested, not a guarantee that watermarking preserves every biological function or makes a design safe.^[1]

Overview

The method names appear without a space in the paper, while the announcement and repository use "SynthID Bio" for the family.^[1][2][3]

Sequence watermarking

SynthIDBio-sequence adapts the tournament-sampling approach used by SynthID-Text to ProteinMPNN, a model that generates amino acid sequences for a supplied protein backbone. A secret watermarking key and preceding sequence context determine statistical scores for possible amino acids. Sampling favors choices with higher scores, spreading the signal across the resulting sequence. Detection recomputes these scores with the same key.^[1]

The paper distinguishes two sampling regimes. In the non-distortionary regime, sequence distributions remain unchanged in expectation over watermarking keys. The distortionary regime biases the distribution more strongly to improve detectability. This distinction concerns the model's sampling distribution: biological function still has to be tested experimentally.^[1]

A sequence can pass structural-quality checks while carrying a weak watermark. The researchers therefore added a separate watermark-score filter to retain sufficiently detectable designs. Their reported 100% true-positive rate for retained sequences is conditional on this filtering step, with a threshold calibrated to a 0.1% false-positive rate for the laboratory evaluation. It does not describe unrestricted detection of every generated sequence, every AI-designed protein, or every subsequently modified design.^[1]

Filtering reduces the fraction of generated candidates that can be retained. The paper evaluated this trade-off across 23 targets with 10,000 designs per target. Detectability before filtering depended on the sampling setting; the authors reported that filtering weakly marked candidates before expensive structural validation limited the additional computational cost in their pipeline.^[1]

Laboratory evaluation

The researchers tested binders against three protein targets: vascular endothelial growth factor A (VEGF-A), programmed death ligand 1 (PD-L1), and the SARS-CoV-2 receptor-binding domain (SC2RBD). They began with 15 previously validated AlphaProteo backbones per target and generated new sequences for those backbones. This was not a complete design campaign starting with untested backbones.^[1]

The comparison included 222 non-watermarked sequences and 267 sequences for each of two watermarking settings, excluding controls. Surface plasmon resonance measurements assessed binding affinity. Watermarked binders reached low-nanomolar affinity for SC2RBD and subnanomolar affinity for VEGF-A and PD-L1. The study found no statistically significant population-level affinity differences between non-watermarked binders and either watermarking group.^[1]

The results were not identical under every comparison. At the binding threshold K_D ≤ 10⁻⁶ M, the non-watermarked group had a significantly higher hit rate than the non-distortionary watermarking group. No significant hit-rate differences were found at thresholds K_D ≤ 10⁻⁷ M. The two watermarking settings also differed significantly in median affinity for SC2RBD. The paper therefore supports a narrower conclusion than an unconditional claim that watermarking has no biological effect.^[1]

Binding affinity and hit rate were the principal functional measurements. The study did not establish clinical efficacy, safety in humans, or preservation of arbitrary protein functions. The released materials are not intended, validated or approved for clinical use.^[1][3]

Structure watermarking

SynthIDBio-structure places the watermark in predicted atomic coordinates. The researchers fine-tuned AlphaFold 3's diffusion and confidence modules while training a separate watermark detector. The detector uses local geometric features, including distances and angles, rather than depending on a structure's absolute position or orientation. The paper describes keeping this detector separate from the structure-generating weights supplied to users.^[1]

Unlike the sequence method, the structure method embeds watermark generation in the model weights. It does not add a separate watermarking step after each prediction. The paper reports approximately one day of fine-tuning on 256 A100 GPUs and no additional inference overhead for the resulting structure model.^[1]

On the AlphaFold 3 evaluation set, all three tested structure-watermarking models exceeded a 99.8% true-positive rate at a 0.1% false-positive rate. For the recommended model, the reported local distance difference test and template modelling scores were not lower than the AlphaFold 3 baseline. Models trained for greater noise robustness showed small accuracy reductions. Detection was less reliable for very short structures.^[1]

These are computational comparisons with reference structures and baseline predictions. They do not constitute laboratory evidence that every predicted structure corresponds to a functional molecule.^[1]

Provenance and limitations

The proposed use is to establish information about how a biological design was generated. A watermark could help a synthesis provider recognize output from a participating design tool, or help a database curator identify a synthetic submission. The paper treats these applications as hypothetical deployment scenarios requiring additional validation, governance and coordination.^[1]

A detected watermark is not a safety certificate. In the proposed screening setting, its meaning would depend on separately establishing that the originating tool has appropriate safeguards. The authors also retain conventional screening as part of a layered approach. Absence of a watermark does not establish natural origin, because an AI model may not use the method or the signal may have been lost.^[1]

The sequence implementation studied left-to-right decoding, not all decoding orders supported by ProteinMPNN. The structure method resisted rigid transformations and small coordinate perturbations, but this should not be generalized to arbitrary manipulation. The paper did not establish differentiation from every other structural watermarking scheme.^[1]

Research context and availability

Protein watermarking predates SynthID Bio. A 2025 Bioinformatics paper by Yanshuo Chen and colleagues proposed a framework for marking sequences generated by autoregressive protein-design models and verifying them locally. SynthID Bio's contribution includes laboratory testing of designed binders and a separate method for watermarking AlphaFold 3 structure predictions.^[1][4]

The official repository includes the sequence implementation, detection utilities and experimental data. The release distinguishes Apache 2.0 software, MIT-licensed ProteinMPNN model parameters, CC BY 4.0 experimental data, and structure-model parameters governed by the AlphaFold 3 Model Parameters Terms of Use.^[3] The AlphaFold 3 repository links the SynthID Bio-structure parameter download.^[5] The parameter terms restrict use to specified non-commercial activities by or for non-commercial organizations, so the complete release should not be described as unrestricted open-source weights.^[6]

Google DeepMind's announcement also described early work with Stanford University's Hie lab and the Arc Institute on watermarking bacteriophage genomes with Evo 2. It reported functional results in bacterial cultures and said a separate technical manuscript would follow. This announced extension is distinct from the protein and structure experiments in the Nature paper.^[2]

References

1. ^1 ^2 ^3 ^4 ^5 ^6 ^7 ^8 ^9 ^10 ^11 ^12 ^13 ^14 ^15 ^16 ^17 ^18 ^19Stutz, D., Cowen-Rivers, A. I., Ortiz-Jimenez, G., et al. "Function-preserving watermarking of AI-generated proteins." Nature, September 30, 2026. DOI: 10.1038/s41586-026-10965-y. The technical account above paraphrases this open-access article, licensed under CC BY 4.0; wording and organization have been adapted.
2. ^1 ^2 ^3Kohli, P., Stutz, D., Cowen-Rivers, A., and Ratcliff, J. "Introducing SynthID Bio." Google DeepMind, September 30, 2026.
3. ^1 ^2 ^3Google DeepMind. "SynthID Bio: Biological Sequence and Structure Watermarking." Official repository, documentation, experimental data and licensing notes. Accessed October 4, 2026.
4. ^Chen, Y., Hu, Z., Wu, Y., et al. "Enhancing privacy in biosecurity with watermarked protein design." Bioinformatics 41(7), btaf141, published online May 2, 2025. DOI: 10.1093/bioinformatics/btaf141.
5. ^Google DeepMind. "AlphaFold 3." Official repository, SynthID Bio-structure model-parameter availability. Accessed October 4, 2026.
6. ^Google DeepMind. "AlphaFold 3 Model Parameters Terms of Use." Last modified November 9, 2024. Accessed October 4, 2026.