AI FOR SCIENCE · INTERVIEWS
DeepMind says an AI-designed protein can carry an invisible watermark and still work in the lab, and that the tool is meant to help DNA synthesis companies tell AI-designed sequences from natural ones.
What the paper's abstract does not say: who it is for (DNA synthesis companies screening orders), why sequence-matching screens can miss AI-redesigned proteins, that detection needs model makers and synthesis firms to share keys, and that DeepMind describes its role as catalyst, not operator.
The lab test covers protein binders only; robustness against deliberate removal is named as a risk; no synthesis company is described as using it yet.
Kohli says classifiers that try to tell AI content apart get less accurate as generators improve; a watermark instead adds an imperceptible, hard-to-remove bias at generation. He sets three requirements: no loss of quality, robustness to transformation, and easy to integrate and detect.
Text watermarking uses a secret key to favour some words among equally good ones; the protein-sequence version chooses among amino acids that should keep structure and function (such as leucine and isoleucine). The sequence version sits on the third-party ProteinMPNN, the structure version on AlphaFold 3, nudging atom positions.
Synthesis companies verify the buyer and compare orders against a database of known hazards. Ratcliff's worry is that AI can make proteins far from that database in sequence yet folding into the same thing, and splice them into an ordinary order. The watermark does not judge harm; it tells the screener a sequence came from an AI system they trust.
“you can make something that in sequence space is very different than something that's present in that pathogen database but might fold into the thing that is of concern.”Jeremy RatcliffRatcliff says watermarked binders (under two schemes) matched unwatermarked ones on hit rate and quantitative binding; he was sceptical beforehand. They also say it is, to their knowledge, the first watermark work to show both imperceptibility and preserved function with in vitro results, which is the authors' own priority claim.
“near identical hit rates, near identical quantitative measures of binding.”Jeremy RatcliffThe code will be open-sourced so others can integrate it without coordinating with DeepMind; for it to matter, model developers must adopt it and synthesis firms must exchange keys with them. DeepMind has no protein-design service and does not see itself setting the standard. A public detector invites circumvention, and Kohli calls the cat-and-mouse game a real risk.
The timeline entry for the paper (2026-09-30) records watermarks on protein sequences and AlphaFold 3 structures, with watermarked binders matching unwatermarked ones in hit rate and affinity on VEGF-A, SARS-CoV-2 RBD and PD-L1.
The interview names the user (a DNA synthesis company checking orders) and the threat (AI redesigning proteins far from known sequences in sequence space yet folding into the same thing, then splicing them into an ordinary order).
The same entry records DeepMind listing robustness to deliberate tampering as unsolved.
The two guests add that a public detector invites circumvention and Kohli calls the cat-and-mouse game a real risk; their ideal is that removing the watermark would require changing the protein's function, which is a goal, not a result.
The paper establishes a watermarking method and reports laboratory preservation of function.
The authors explicitly frame deployment as a proof of concept that still requires model developers, synthesis firms and shared key infrastructure; DeepMind describes its own role as catalyst, not operator.
By Ratcliff's account the watermark answers one question: did this sequence come from an AI system the screener trusts. Verifying the buyer and matching the order against a database of known hazards remain the other two steps. A sequence without a watermark is merely unmarked, not harmful, and a watermarked one is not thereby safe; that is our reading, and the interview does not say it.
Screening today matches orders against a database of known hazards; the watermark does not judge harm, it tells the screener a sequence came from an AI system they trust. By Ratcliff's account it covers the kind of sequence a match cannot see.
The watermark is written by whoever runs the design tool, even a third party's (ProteinMPNN), and detection needs model makers and synthesis firms to exchange keys. DeepMind has no protein-design service, so the gate to adoption is coordination, not technique.
SynthID text and image watermarks have been adopted by other AI companies, and detection is built into the Gemini app.
Company-reported
Kohli's statement, naming Nvidia; the captions for other names are unclear.
Watermarked binders (two schemes) match unwatermarked ones on hit rate and quantitative binding.
Company-reported
The guests' summary of their own experiments; no numbers or targets are given in the interview (see the paper).
To their knowledge, the first watermark work to show imperceptibility and preserved function with in vitro results.
Company-reported
The authors' priority claim; no comparison with prior work was offered.
Synthesis firms screen by identity checks and database matching, and AI-redesigned sequences may get past the matching.
Industry context
Ratcliff cites other academics' findings without naming them.
The code will be open-sourced; model developers must integrate it and synthesis firms must exchange keys with them.
Target
A plan and a precondition with no timetable; DeepMind has no protein-design service of its own.
Robustness against deliberate removal, and the risk that a public detector invites circumvention.
Not yet closed
Treated by the guests as a risk and further engineering headroom; no attack-test results are given.
No DNA synthesis company is described as using or piloting it.
Not yet closed
Ratcliff says everyone he has spoken to was excited, which is interest, not use.
Whether, once the code is open, any third-party protein-design tool or model developer integrates it.
Would show up as A model or tool maker announcing watermarking.Whether a DNA synthesis company or consortium pilots detection in public and says how keys are exchanged.
Would show up as A release from a synthesis firm or an industry body.Whether an independent team tries to remove the watermark while keeping binding.
Would show up as An independent attack or replication paper.Whether the result extends beyond binders to enzymes and other functions.
Would show up as New function types in a paper or follow-up preprint.Read 2026.10.01 The full YouTube auto-captions; names follow the byline on the timeline entry. Open the interview ↗