Introducing SynthID Bio

What it claims

SynthID Bio is a proof-of-concept family of watermarking methods for synthetic biology, extending Google DeepMind's SynthID into two data types: AI-designed protein sequences and AI-predicted 3D structures. The claim beyond the summary is the mechanism and the robustness/detectability properties, plus a stated open limitation.

How it works

The watermark is injected differently per data type:

• Sequences: it subtly guides the choice of amino acids during generation (a SynthID Bio–enabled ProteinMPNN, run alongside AlphaProteo for binder design). Watermarked designs matched not just hit rate and binding affinity but also natural sequence diversity of unwatermarked versions.
• 3D structures: rather than post-processing coordinates, it fine-tunes a small part of AlphaFold 3's diffusion network, baking the watermark into the model weights. Consequently the predicted coordinates carry the signature regardless of who runs the model. The page claims this "preserves AlphaFold 3 prediction accuracy" with "near-perfect detectability," maintains key structural feature distributions, and survives "digital noise or minor coordinate changes."

The intended deployment is as one layer in a "Swiss cheese" biosecurity model. Two concrete use points: (1) DNA synthesis screening — screeners historically assumed an unfamiliar sequence was an undiscovered natural organism, an assumption AI breaks; the watermark gives an automated signal that an order came from a trusted model, avoiding exhaustive manual review; (2) database integrity — flagging synthetic submissions to PDB, UniProt, GenBank.

Evidence

Wet-lab validation across three targets (VEGF-A, SARS-CoV-2 spike RBD, PD-L1), with in vitro help from Adaptyv Bio, produced the "first-ever watermarked and biologically functional protein binders." The bacteriophage extension (Evo 2, with Stanford's Hie lab and Arc Institute) has confirmed functional watermarked phages in bacteria cultures — but note this is early-stage; detection/accuracy numbers are not given numerically on the page (described only qualitatively as "near-perfect").

How to use it

The methods paper is published, with code and in vitro data open-sourced and model weights released to the research community. No licence name, install command, or model size is stated on the page. Partnership inquiries go to synthidbio@google.com. The bacteriophage/Evo 2 work is not yet released — a technical manuscript is promised "soon."

Limits

The authors flag this as a "first step" and "proof of concept," not a silver bullet. The explicitly named open weakness: the watermark is not yet robust against deliberate tampering — the current demonstrated robustness is only against digital noise and minor coordinate changes, not adversarial removal. They suggest pairing it with C2PA-style provenance metadata or central repositories to compensate. For a reader, the actionable gaps are: no quantified detection rates on the page, no licence details, and the genome-watermarking results unpublished.