Function-preserving watermarking of AI-generated proteins

SynthIDBio-sequence

Following recent de novo protein design approaches^16,18,48,49 that combine conditional structure generation, sequence generation and filtering, SynthIDBio-sequence integrates SynthID-text¹³ into a commonly used sequence design model, ProteinMPNN¹⁶. The ability to detect the watermark within the generated designs relies on the underlying entropy during sampling from ProteinMPNN. If there is sufficient entropy, SynthID-text can reach good detectability while being non-distortionary^13,23, meaning that watermarking does not change the distribution over sequences in expectation over a secret watermarking key. As protein design typically uses low temperature, limiting entropy, we also consider SynthID-text’s distortionary variant and introduce another filter on the basis of the watermark signal.

Non-distortionary SynthID-text

Like large language models, ProteinMPNN is an autoregressive model, providing a probability distribution p(x_t∣x_<t) over the next token (amino acid, in this case) to sample. We use p(x_t∣x_<t) to refer to the distribution after any modifications through top-p sampling^50,51. SynthID-text then further modifies this distribution to add a detectable signature through a sampling procedure called tournament sampling. This strategy consists of three components: a random seed generator, a scoring function and a sampling algorithm. At each step t of sampling, the random seed generator provides a random seed r_t that is conditioned on a secret key k and possibly the context, that is, the history of x_<t. The scoring function assigns a so-called g-value to each possible token based on the random seed and the sampling algorithm then tries to bias sampling towards high g-values.

The random seed generator is a deterministic function f_r(x_<t, k) applied to the random secret key k. A common choice is using a hash function f_r = h(x_t−H:t−1, k) that hashes the secret key together with the H-gram x_t−H:t−1 = (x_t−H, …, x_t−1) observed before the token x_t to be sampled^21,22. The scoring functions are set as binary functions g(x, r) ∈ {0, 1} that assign either 0 or 1 to every possible token x on the basis of the current seed r. Although there are various ways to define these g-values, we follow¹³ and use a binary function. Again, we make use of a hash function h that takes as input the token to be generated, x_t, the seed r_t and the H-gram context:

where n is the number of bits of the hashing function h used.

Tournament sampling then considers multiple scoring functions g_l indexed by the layer l ∈ [L] (generated by using a hash function h that also depends on l). We use different keys (k_l) per layer. The sampling algorithm takes as input a probability distribution over tokens p(x_t∣x_<t) and the seed r_t, and outputs the next token, that is, the next amino acid for the designed sequence. For l = 1, that is, a single tournament layer, sampling works as follows: given the distribution p(x_t∣x_<t), we sample two candidate tokens \({x}_{{t}_{1}}\) and \({x}_{{t}_{2}}\) and let them compete in terms of their scores \(g({x}_{{t}_{1}},{r}_{t})\), \(g({x}_{{t}_{2}},{r}_{t})\) and pick the winner, or a random token in case of a tie. This is generalized to multiple layers by starting with l = 1, sampling 2^L candidates and 2^L−1 pairs and letting them compete this way using g₁. For l = 2, \({2}^{L-1}=\frac{{2}^{L}}{2}\) candidates are left over; pairs now compete using g₂. This process concludes at l = L where only one candidate remains. To ensure non-distortionary sampling (see algorithm 3 in ref. ¹³), we refrain from biasing sampling for repeating contexts, that is, repeating seeds r_t that typically stem from seeing the same H-gram multiple times throughout sampling²³. Biasing is also not applied to the first H − 1 tokens. In the protein design context this is beneficial to ensure higher diversity. Note that this approach generalizes to any residue that may be fixed beforehand as part of the protein design pipeline.

Watermark detection is based on the fact that tournament sampling maximizes the scoring functions g_l across all layers l ∈ [L] throughout the sequence. As we can evaluate these scoring functions given the secret key k and the full sequence, we can compute an overall average g-value:

where m is a mask indicating which tokens to evaluate (m_t = 1) or skip (m_t = 0) due to repeating contexts.

Distortionary watermarking

The detectability of SynthID-text, especially with low entropy and shorter sequences, can be improved through distortionary watermarking. In tournament sampling, this can be accomplished using two equivalent strategies: we can sample more than two candidates per layer, resulting in s^L candidates when using s leaves at each level, or using the same keys \({k}_{l}={k}_{{l}^{{\prime} }}\) across multiple layers, \(l\ne {l}^{{\prime} }\). The latter is equivalent to the former in that using the same key twice in a row will effectively use s = 4 leaves. However, by using the former strategy, we can also use an s that is not a power of two. We follow the latter strategy for simplicity, taking an extreme approach of using L = 25 layers, all using the same key. This typically results in significant biasing of the generated sequences (conditioned on the H-gram context).

Integration into protein design pipeline

We make two key adjustments to the common protein design and filtering pipeline. First, we use distortionary or non-distortionary tournament sampling on top of ProteinMPNN, which may change the distributions of key metrics relevant for protein design. Second, to guarantee sufficient detectability, we introduce another g-value filter to the filtering stage. This filter is meant to ensure a specific target FPR and essentially trades computational resources for better detectability. We collected a representative population of non-watermarked protein binder and natural protein sequences to determine our FPR thresholds. As average g-values are more variable for shorter sequences, we enriched the natural sequence dataset for shorter sequences by clipping select UniRef50 sequences up to the first m residues. In total, this dataset consisted of n = 700,000 non-watermarked binder sequences (of length 40 to 140 residues due to length parameters); n = 661,581 full-length sequences that are over 40 residues in length from the full PDB dataset downloaded on 18 April 2025 (ref. ⁹); n = 700,000 full-length sequences from the March 2022 build of UniRef50 (refs. ^25,26); n = 700,000 UniRef50 sequences clipped to m = 40; and n = 700,000 UniRef50 sequences clipped to m = 140 (98.5% of sequences were precisely of length 140) for a total of nearly 3.5 million sequences. We consider FPR values of 0.01%, 0.1% and 1% for in silico experiments, whereas we use 0.1% for in vitro validation. This essentially trades computational resources for better detectability by having to generate significantly more design candidates to ensure a similar number of passed designs after filtering. Exact thresholds used can be found in the Supplementary Information.

Design selection and filtering

We chose the three targets that had the largest number of experimentally validated binders in past AlphaProteo campaigns for our in vitro study. These targets and their cropped sequences were VEGF-A (UniProt no. P15692-4 (V40-K133)), PD-L1 (UniProt no. Q9NZQ7-1 (N17-A132)) and SC2RBD (UniProt no. A0A8B6RKS7 (T221-G414)). For each target, we first filter all designs to those that pass our strictest quality checks and then selected the top 15 parent sequences based on binding affinity as previously measured using bio-layer interferometry¹⁷. These parent sequences were used as backbone structures for the resequencer experiments.

From each backbone, we then produced 6,000 designs through resequencing per setting: non-watermarked sequences; distortionary watermarked sequences with temperature 0.1; and non-distortionary watermarked sequences with temperature 0.5. These sequences were filtered on the basis of AF3 metrics (Supplementary Information) and a FPR-based g-value threshold of 0.1%. Finally, we computed confidence value and agreement value per design. The confidence value was defined as the average of the following metrics: complex interface predicted template modelling, binder’s predicted template modelling in complex with the target, and the predicted template modelling of the binder in isolation. The agreement value was defined as the average of the following metrics: complex LDDT, complex interface LDDT, and binder’s LDDT with the generated backbone. Designs were sorted by the product of the agreement and confidence values and the top six were selected for each setting.

In vitro validation set-up

Synthetic gene fragments encoding the designed protein binders were codon-optimized and purchased from Twist Bioscience. For binders targeting SC2RBD and VEGF-A, gene fragments were ordered as complete constructs containing the binder sequence and C-terminal GFP11 (RDHMVLHEYVNAAGIT) and Twin-Strep (WSHPQFEKGGGSGGGSGGSAWSHPQFEK) tags. These constructs were used directly after concentration normalization, and sequence validation consisted of batch Sanger sequencing (Microsynth) of 10–15% of designs selected randomly. For binders targeting PD-L1, the C-terminal tags were assembled into constructs using Gibson-type assembly (NEBuilder HiFi DNA Assembly Kit, New England Biolabs) with 24-bp overlaps. Assembly products were amplified by polymerase chain reaction (Q5 High-Fidelity DNA Polymerase, NEB), quantified using a dye-based DNA quantification assay (Qubit DNA Quantification Kit, Invitrogen), and analysed by capillary electrophoresis on a ZAG DNA Analyzer (Agilent) to confirm fragment size and integrity. For sequence validation, 10–15% of constructs were randomly selected for batch Sanger sequencing (Microsynth). Furthermore, Illumina short-read amplicon sequencing (Amplicon-EZ, Genewiz) was performed on a subset of the library to confirm construct identity before expression.

Protein binders were expressed using an optimized prokaryotic in vitro transcription–translation system (8 μl reactions, 1 nM DNA, 37 °C, 8 h). Lysates were centrifuged at 10,000 r.p.m. for 2 min to remove aggregates before downstream assays. Soluble expression levels were quantified directly in clarified lysates using the incorporated splitGFP reporter assay⁵². Briefly, GFP1-10 was added to a final concentration of 0.13 mg ml^–1 and mixed with clarified lysate diluted in PBS pH 7.4 eightfold, in a total reaction volume of 6 μl in a black 384-well plate. A protein standard of known concentration—measured across eight concentration points—was used to generate a standard curve. The plate was incubated for 90 min at 30 °C to allow GFP11–GFP1-10 complementation. Fluorescence was recorded at 485 nm excitation and 520 nm emission in a plate reader (Pherastar FS, BMG Labtech). Plates were specific to single targets and included one positive control, which was the parent sequence from the original AlphaProteo campaign, and one negative control, which was a positive control for a different target. These controls randomly replaced generated binders.

Binding kinetics of the recombinantly expressed designed protein binders to their cognate protein targets were characterized using SPR spectroscopy on a Carterra LSA XT instrument, using a carboxymethylated sensor chip functionalized with Strep-Tactin XT (IBA Lifesciences). Proteins were captured directly onto biosensor surfaces via the C-terminal Twin-Strep affinity tag and wash steps removed non-specific background material, providing effective in situ purification before affinity characterization. The analyte, containing a dilution series of protein target (either PD-L1, VEGF-A or SC2RBD), was prepared in running buffer (10 mM HEPES, 150 mM NaCl, 3 mM EDTA, 0.05% Tween-20, pH 7.4) at seven concentrations in a half-log dilution series between 1,000 nM and 1 nM. Single cycle kinetic assays were performed (with a flow rate of 50 μl per minute, increasing analyte concentrations, no intermediate regeneration). The chip surface was regenerated (10 mM glycine-HCl, pH 1.5, 5 min) and washed (running buffer, 20 min) following each full single kinetic cycle. The data were processed and fitted globally to a 1:1 Langmuir binding model using custom fitting software. Final kinetic parameters (k_on, k_off, K_D) were selected on the basis of fit quality. Designs were classified as binders if their association signal was significantly above the negative control across all replicates. Although all such designs are labelled as binders (binding = TRUE), we only report K_D values for samples that produced quantifiable binding curves and stable kinetic fits. Samples labelled as binders with a null K_D typically represent weak interactors (often ≥1 μM) or cases where low expression or rapid kinetics precluded accurate affinity estimation. These should be interpreted as binders with insufficient signal for quantification rather than designs lacking affinity.

Resequencer attack robustness

We estimated the design hit rate after using resequencing to remove the watermark based on a combination of data generated as part of this study and historical AlphaProteo data. The resequencer attack was performed by running non-watermarked ProteinMPNN (with default 0.1 temperature) on a watermarked binder in complex with its target. In favour of the attacker, we assume a threat model where they obtain a watermarked design that is known to bind. We use the product of the in silico pass rate and the resequencer hit rate to estimate their hit rate. In the more realistic scenario of the design having unknown binding behaviour, percentages shown in Fig. 3d will be multiplied by AlphaProteo’s historical hit rate on PD-L1, VEGF-A and SC2RBD, which are 15%, 33% and 12%, respectively. Further details are available in the Supplementary Information.

Statistical testing

We use the two-tailed Wilcoxon rank-sum test for significance tests evaluating the difference in distributions (affinity or g-value). We use Fisher’s exact test for significance tests evaluating the differences in discrete data, such as the differences in hit rates.

SynthIDBio-structure

For watermarking predictions from AF3, SynthIDBio-structure fine-tunes AF3’s diffusion module to predict watermarked 3D atom coordinates jointly with a new watermark detector. As the watermark is not added post-hoc or during sampling, this has the advantage that the watermarking procedure cannot be removed once the model weights are publicly released.

Protein structure watermark detectors

Our watermark detector is inspired by early PointNet architectures²⁸ that operate on individual 3D coordinates, or groups thereof, using a subnetwork, before aggregating these features in a way that is agnostic to the number of 3D coordinates of the input. For protein structures, this means we apply a per-residue network across the whole protein and then average pool the resulting features. Intra-residue distances, that is, pairwise distances between all atoms, are the inputs into the per-residue network, together with torsion angles computed in a sliding window fashion across all quadruples of consecutive atoms. This choice of features makes the whole detector invariant to rigid transformations such as translations, rotations and reflections (or combinations thereof) because features only rely on intra-residue characteristics. Features are stacked into an array and we apply five layers of one-dimensional convolutional layers with 288 channels, each followed by rectified linear unit activations. We appropriately pad atoms and residues throughout the process of feature computation and 1D convolutions. The convolutions compute a fixed size feature vector per residue. We aggregate these features across residues using average pooling, followed by a dense layer predicting a single binary output. That is, we train a zero-bit watermark. Although we expect that the same approach will generalize to multi-bit settings, a multi-bit watermark is not intended in our open-model context.

Fine-tuning AF3 for watermarking

In an abstracted view, AF3 consists of three key modules: the backbone (input embedder, template module, MSA module and pairformer; see fig. 1 in ref. ¹⁹), the diffusion module and the confidence module. Our approach embeds an imperceptible watermark into the protein structures generated by AF3 by fine-tuning its diffusion module. This is achieved by introducing a watermarking objective into the model’s training process, which modifies the network weights to directly incorporate the watermarking signal. Moreover, as the confidence module is based on the output of the predicted structure, it also needs to be fine-tuned alongside the diffusion module.

The diffusion module generates the 3D atomic coordinates of a protein structure. It is conditioned on features computed by the model’s backbone and operates by iteratively denoising a structure that begins as random 3D Gaussian noise. The denoising network, D, is trained to predict a clean structure x from a noised version x + ϵ, where \({\epsilon } \sim {\mathcal{N}}(0,{\sigma }^{2}I)\). The training objective minimizes the reconstruction error over a continuous schedule of noise scales σ, defined by the diffusion loss \({{\mathcal{L}}}_{{\rm{diff}}}\):

where λ(σ) is a noise scale dependent weight. In practice, the noise scales are discretized into T timesteps according to the schedule σ_T = 0 and

for t ∈ [0, T − 1]. AF3 implements this schedule with parameters ρ = 7, \({\sigma }_{\max }=160\), \({\sigma }_{\min }=0.0004\) and T = 200. To introduce the watermark, we co-train a detector network, d, that learns to distinguish between watermarked and non-watermarked structures. As SynthIDBio-structure is supposed to allow sharing of the model’s weights, embedding messages into the watermark is not required, and so a zero-bit watermark is sufficient.

We use two versions of the denoiser during fine-tuning: the original, pre-trained denoiser with frozen weights, denoted D_θ, and a copy with trainable weights, \({D}_{\widetilde{\theta }}\). The watermarking objective trains the detector d to assign a high probability to structures generated by \({D}_{\widetilde{\theta }}\) (watermarked) and a low probability to ground truth structures (x) and those from the original D_θ (non-watermarked). The watermarking loss, \({{\mathcal{L}}}_{{\rm{wm}}}\), is formulated as a sum of binary cross-entropy losses:

with

Here, T is a transformation applied to enhance watermark robustness. This involves adding uniform noise, T(y) = y + U(−s, s) with s ∈ {0.1, 0.01, 0.001} Å, to the coordinates before they enter the detector. This step ensures the watermark is resilient to small perturbations, which is generally desirable in watermarks and also makes sure the folded structures can be saved in common file formats that often round to three decimal points.

We explored two strategies for integrating the watermarking objective. The first involved applying \({{\mathcal{L}}}_{{\rm{wm}}}\) only to fully denoised structures (that is, after unrolling multiple denoising iterations during training). The second, which we found trained significantly faster and more smoothly, was to apply the watermarking loss at every step of the denoising process. The final training objective, \({{\mathcal{L}}}_{{\rm{total}}}\), combines the diffusion and watermarking losses:

where \({{\mathcal{L}}}_{{\rm{wm}}}(x,\sigma ,{\epsilon })\) represents the watermarking loss evaluated at a specific noise level, comparing the outputs of D_θ(x + ϵ, σ) and \({D}_{\widetilde{\theta }}(x+{\epsilon },\sigma )\). Note that we moved the weight λ(σ) into the expectation, ensuring a constant weighting of the watermark detection loss. By integrating \({{\mathcal{L}}}_{{\rm{wm}}}\) directly into the denoising schedule, the model learns to embed the watermark throughout the entire structure generation process.

Fine-tuning was performed on 256 A100 GPUs for approximately one day. Our fine-tuning set-up mirrors the ‘Fine tuning 3’ stage used in AF3 (see supplementary table 6 of ref. ¹⁹) with a reduced sampling weight for disorder PDB distillation data (from 0.02 to 0.01). Compared with the overall cost of training AF3 (about 20 days), SynthIDBio-structure is fairly cheap to train; however, we also found that training for less than one day results in a noticeable reduction in detectability (data not shown). Note that SynthIDBio-structure does not introduce any overhead during inference.

Confirming watermark imperceptibility

As watermarks trained following the above approach are usually not visible when looking purely at aggregate metrics such as r.m.s.d., LDDT or template modelling score, we also look at common per-residue feature distributions. These include: pairwise intra-residue atom distances, inter-residue atom distances between backbone atoms, bond angles and torsion angles⁵³. We compute these separately for watermarked, non-watermarked and natural structures from PDB in order to qualitatively and quantitatively measure shifts in distributions of these features in the form of histograms as shown in Fig. 4b.

Reporting summary

Further information on research design is available in the Nature Portfolio Reporting Summary linked to this article.