Every color laser printer marks its pages with a grid of pale, nearly invisible yellow dots, encoding the printer's serial number and the date and time of the print job.

On September 30, Google DeepMind researchers announced SynthID Bio, the same idea applied to proteins. In this case, the AI model generating the protein sequence is the printer. The protein is the paper, and the dots are a signal embedded during generation that someone with the right key can later decode.

The analogy needs one adjustment and one hard stop.

At each amino acid position in a protein sequence, the AI model has several amino acids that would serve about equally well. The secret key biases which of those near-equivalent choices wins. The finished protein has ordinary residues, ordinary length, ordinary function. There is no barcode to find, no dots, and no insert to excise. The signal is spread across patterns of amino acid residues and read statistically.

Think of this as a proof of concept more than a useful tool right now. The watermark carries one bit, present or absent, and cannot say which model or whose account produced the thing.

The hard stop is that it would have to be built into any AI model used to produce protein sequences. The authors concede in the discussion that a malicious actor "would simply use a non-watermarking tool in the first place."

However, this work demonstrates that designed proteins can be watermarked, that those watermarks can be read back with a high degree of sensitivity and specificity, and that the watermarks did not degrade the proteins' function. The paper in Nature is more interesting than the coverage of it, because the authors spend their discussion explaining why the thing they built may not do the job it is being praised for.

Two methods, and the difference between them is the whole story.

SynthIDBio-sequence runs inside ProteinMPNN. It uses tournament sampling, lifted from SynthID-text, where a secret key scores candidate amino acids at each position and the higher scorer wins. Detection recomputes those scores across the finished sequence and asks whether the average sits above chance.

SynthIDBio-structure is a fine-tuned AlphaFold 3. The signature goes into the diffusion module's weights, so predicted atomic coordinates carry it whether or not the person running the model wants them to.

Detection requires the secret key, and the key has to be held, shared and rotated by somebody. The authors are explicit that this limits the method to models behind hosted interfaces, and that open-weight deployment needs innovations that do not exist yet. They call for public-key watermarking as future work. Nobody has said who runs any of it.

They also flag the incentive tension plainly. Very low false positive rates mean heavy filtering, heavy filtering means more compute per design, and if that cost exceeds what faster synthesis screening is worth to a customer, the customer does not watermark. A voluntary scheme priced above its benefit is a voluntary scheme nobody joins.

What I keep coming back to is the framing in their biosecurity section, which is the most honest sentence in the paper. The objective is to raise the barrier to entry, not to guarantee security. That is the gene synthesis industry's own historical standard, and it is a reasonable thing to aim at. It is not what "strengthening biosecurity" sounds like to a general reader.

I sit in AI governance meetings for a living, mostly about models that read charts rather than design proteins, and the pattern is the same one. The technical artifact arrives finished and the institutional question arrives unanswered. Here the technical artifact is genuinely good. Function-preserving watermarking of a designed binder was not obviously possible and now it is demonstrated. The institutional question is who, if anyone, will be required to use it, and that question is not addressed by a better watermark.