Scientists can now ‘watermark’ AI-generated proteins to deter bioweapon creation. But will it really work?

With artificial intelligence (AI), scientists have a powerful new tool for creating never-before-seen proteins, which can be used to make either groundbreaking new medicines or devastating bioweapons.

To help guard against nefarious uses of these proteins, scientists have recently figured out a way to “watermark” them without compromising their function. A team from Google DeepMind developed this technique to better track the provenance of AI-designed proteins.

“This has the potential to reduce biosecurity threats, such as unauthorized toxin creation, and may help with database curation, preventing artificial designs from cluttering the standard databases,” said Roy Sleator, a biology professor at Munster Technological University in Ireland, who was not involved in the research.

“In practice, it could help trace a design’s origin, flag engineered proteins for extra biosecurity checks, and reduce misleading claims about how a protein was made,” Sleator told Live Science in an email.

However, in its current form, the same AI technologies that add watermarks can also strip them away, other experts warned.

New ways to hide watermarks

The unveiling of the AI program AlphaFold in 2020 was a milestone in protein engineering. The tool, which won Demis Hassabis, John Jumper and David Baker the Nobel Prize in Chemistry in 2024, can reveal the 3D structure of a protein from the sequence of its building blocks, called amino acids. Proteins fold like origami, adopting 3D shapes that dictate their function.

However, AlphaFold’s technology also opened the door to generating brand-new proteins that could be used to create biothreats, including viral proteins that can evade our immune systems and existing vaccines.

“Anything that can be used for good can be used for bad,” said George Rose, professor emeritus of biophysics at Johns Hopkins University.

Current screening tools identify novel dangerous or restricted molecules by seeing how similar their amino acid sequences are to those of recognized threats. But the problem is that AI could come up with proteins that don’t look like anything we’ve ever seen. That’s what the new watermarking technique aims to solve.

The DeepMind team has framed the watermarking effort as a “family” of related techniques they call SynthIDBio. The first member of this family is SynthIDBio-sequence, which encodes watermarks into the amino acid sequences of proteins created by a program called ProteinMPNN.

When users tell ProteinMPNN the desired 3D shape for their protein, it chooses amino acid options that ultimately fold into that shape. SynthIDBio-sequence subtly influences how the program chooses each amino acid according to a secret watermarking “key.” Once the sequence is generated, anyone who knows the hidden code can assess how likely the sequence is to have been created under the key’s bias. In their recent study, the DeepMind team showed that proteins built with this watermark could still bind to their targets as well as non-watermarked proteins.

A sister technique, called SynthIDBio-structure, instead embeds a watermark directly into the protein’s structure. It does this by altering the function of AlphaFold 3, DeepMind’s flagship protein prediction algorithm.

When AlphaFold predicts a structure, SynthIDBio-structure gives it a side mission: The AI must make minuscule tweaks to how the atoms in the protein are arranged. These tweaks can be picked up by a detector later, and they’re small enough that they don’t look like obvious distortion.

In a test, these two systems created hidden watermarks that could be detected with incredible accuracy, flagging more than 99% of watermarked proteins and correctly ignoring 99.9% of non-watermarked proteins.

How to bypass a protein watermark

Live Science spoke to several experts who agreed that SynthIDBio was an impressive technical feat. However, they said it wasn’t ready for widespread implementation yet.

The two techniques are “effective but brittle,” Bruce Wittmann, a principal applied scientist at Microsoft, told Live Science in an email. That’s because, as the DeepMind team also notes in their paper, the watermarks can be easily removed.

“For sequences, watermarks can be removed by ‘resequencing’ — effectively, altering the protein amino acid sequence such that the watermark is no longer detectable,” Wittmann said. “For structures, watermarks can be removed by adding noise to or otherwise modifying the spatial coordinates of the structure.” Screening tools wouldn’t be able to detect if a watermark had been removed from a protein.

Experts are also skeptical that watermarking would provide a long-term solution for biosecurity.

An indelible watermark could identify who originally made a nefarious protein, or identify when a user was accessing a protein generation software without permission. This might deter some criminals, but terrorists looking to create a novel protein for a biological weapon would be less likely to care about being identified after a successful attack, said Max Brackmann, a chemical, biological, radiological, and nuclear arms expert at the Spiez Laboratory in Switzerland.

Additionally, the vast majority of software for protein prediction and generation is open-source, meaning much of the code is freely available to use and modify. That makes it far harder to bake watermarking into these programs. Wittmann warned that the field would have to shift toward closed-source models before watermarks could become an industry standard.

He added that watermarking could act as one layer of a biosecurity defense shield, rather than offering standalone protection. Top-down regulation would be challenging to enforce. “I imagine it would be very difficult to ensure the regulations were being followed,” he said.

Rose was even blunter about regulating the use of generative proteins.

“I’m convinced it won’t work,” he said. “Once there’s a sweet technology that does something, government regulation to keep it under wraps has never been really successful.”

Help us improve Live Science Pro: We’re always trying to make our content better. Leave us feedback about Pro here.