2026-10-01
SynthIDBio watermarks ProteinMPNN sequences and a fine-tuned AlphaFold 3; wet-lab KD matches controls, with 100% TPR at 0.1% FPR.
Protein design is now a lab workflow. AlphaFold 3 predicts structures, ProteinMPNN fills amino acids onto a backbone, and tools such as RFdiffusion, AlphaProteo and BindCraft emit binders. Provenance is then hard: which model wrote this sequence, and can anyone tell after the fact.
Central databases need coordination, false-positive at scale, and collide with privacy. Cryptographically signed metadata can be stripped. Text and image watermarks do not transfer cleanly, because "quality" here is experimentally measurable function, not perplexity. Concurrent protein work either stayed in silico on wild-type PDB monomers, or paid a visible accuracy cost: FoldMark distilled into ESMfold raised RMSD. A watermark that stays functional and still detects was missing.
SynthIDBio is two methods.
On sequences, tournament sampling from SynthID-text sits on ProteinMPNN's autoregressive decoder. At each residue the model draws candidates from p(amino acid | prefix); a secret key assigns a binary g-value; the winner is kept. Stacking L layers strengthens the signal. Distinct keys per layer keep the token distribution undistorted in expectation. Protein design usually samples at temperature 0.1, where entropy is too low, so they also test a distortionary variant that reuses one key across L=25 layers. Detection uses the mean g-value over the sequence. A g-value filter, calibrated on about 3.5 million non-watermarked binder, PDB and UniRef50 sequences, trades extra candidates for a target false-positive rate.
The wet-lab study does not start from de novo design. For VEGF-A, PD-L1 and the SARS-CoV-2 receptor-binding domain, they take 15 AlphaProteo backbones with known affinity and resequence them. Eighteen designs per backbone: one parent, five non-watermarked, six undistorted at temperature 0.5, six distortionary at temperature 0.1. That is 222 non-watermarked sequences and 267 per watermark setting. Affinity is KD from surface plasmon resonance.
On structures, a sampling-time watermark would be switched off once weights are public. They freeze the AF3 trunk, fine-tune the diffusion module, and train a PointNet-style detector on intra-residue distances and torsion angles (1D convolutions, then average pool, then a binary head). The loss is the diffusion objective plus 0.1 times a watermark cross-entropy. Uniform noise U(-s,s) with s in {0.001, 0.01, 0.1} Å is added so the mark survives CIF rounding to three decimals. Those features are invariant to rigid transforms. Fine-tuning ran on 256 A100s for about a day, against roughly 20 days to train AF3. Inference adds no extra cost.
| Setting | Detection | Function / accuracy |
| Sequence, undistorted temp 0.5, g-value filter | 100% TPR at 0.1% FPR | No population-level SPR difference vs control; hit rate at KD≤10^-6 lower than control |
| Sequence, distortionary temp 0.1, g-value filter | 100% TPR | No population-level difference; SC2RBD median KD significantly lower than undistorted 0.5 |
| Structure, s=0.001 Å | TPR >99.8% at 0.1% FPR; 98.99% at 0.01% FPR | LDDT and TM-score not below the AF3 baseline |
Without the g-value filter, undistorted temperature 0.1 barely detects (TPR about 2.5% and 0.2%). Temperature 0.5 reaches about 94.4% / 67.3% / 29.3% TPR at 1% / 0.1% / 0.01% FPR; distortionary temperature 0.1 reaches 99.9% / 96.1% / 75.1%. The filter pins TPR at 100% and cuts pass rate. For undistorted 0.5 at 0.1% FPR the pass-rate drop is 41.7%, so candidates scale by about 1.715. AF3 structural filters dominate compute, and candidates that fail the g-value gate skip AF3, which is why they call the extra cost negligible in practice.
ProteinMPNN resequencing removes the sequence watermark. On 38,396 binders the attack largely erases it. If the attacker starts from a known binder, estimated hit rates after resequencing with structural filters are 97% (SC2RBD), 70% (PD-L1), 66% (VEGF-A); without filters, 33%, 20%, 3%. Structure watermarks survive 0.01 Å Gaussian noise. Noise of 0.1 Å destroys the small-s models; the s=0.1 model still hits 88.5% TPR. Constrained OpenMM relaxation with Amber99sb destroys the structure watermark. All nine negative controls showed no binding. The sequence mark is spread across secondary-structure types; how well a backbone can be marked varies.
This is one of the few biological watermarks with wet-lab binding data. The sequence path needs no ProteinMPNN weight change and can be turned off by anyone with the sampler. The structure path lives in the weights, so open release does not remove it. DeepMind released the sequence code and an access path for the recommended s=0.001 structure weights.
It does not solve biosecurity. DNA-synthesis screening and poisoning of PDB, UniProt or GenBank still need shared detection keys and operating points. For people running design pipelines, the practical claim is narrower: the wet-lab cost of watermarking is extra sampling, not dead binders. Watermarked designs in the introduction reach low-nanomolar affinity on SC2RBD and subnanomolar on VEGF-A.
The authors are explicit. Sequence watermarking is zero-bit: present or absent, no model identity. ProteinMPNN resequencing strips it, and a browser instance is enough. Random and right-to-left decoding are unsupported. Guaranteeing 100% TPR hurts pass rate. The wet-lab used known-binder backbones, not full de novo design, so success is a priori higher. Structure watermarks fail under force-field relaxation, are also zero-bit, and were not tested for differentiability against FoldMark.
With open weights, an adversary picks a non-watermarked tool or resequences. The paper frames this as raising cost, not providing a guarantee. Keys stay with trusted parties; public-key detection is future work. Detection drops on structures shorter than 16 residues.