Loading story…
Google DeepMind introduced SynthID Bio, a provenance framework that embeds detectable watermarks in AI-generated biological designs. The system includes sequence-level watermarking for protein and genomic designs, using secret-key-derived scoring during amino-acid selection, and a structure-level method that embeds a zero-bit signal in predicted protein atomic coordinates. DeepMind integrated the approach with the Evo 2 genomic model to watermark a designed bacteriophage genome; early bacterial-culture tests indicated that the watermarked phages remained functional.
In published evaluations, watermarked protein binders targeting VEGF-A, PD-L1, and the SARS-CoV-2 receptor-binding domain were computationally screened and tested through in-vitro expression and binding assays. The technology is intended to help DNA-synthesis providers distinguish safeguarded AI-model outputs from unfamiliar sequences and to label AI-generated entries in databases including the Protein Data Bank, UniProt, and GenBank. Researchers acknowledged that deliberate resequencing or other tampering could remove some watermark types, particularly sequence marks, and released methods, code, data, and model weights for further study.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
The developers stated they were publishing a methods paper, open-sourcing SynthID Bio code and in-vitro data, and releasing model weights to the research community. The system is intended to provide provenance signals for AI-generated biological designs and assist DNA-synthesis screening.
Developers integrated SynthID Bio into the Evo 2 genomic model and used it to watermark an Evo 2-designed bacteriophage genome. Early bacterial-culture testing indicated the watermarked bacteriophages remained functional.
A study evaluated sequence-level watermarks in ProteinMPNN-generated binders for VEGF-A, PD-L1, and the SARS-CoV-2 receptor-binding domain, including in vitro expression and binding assays. It also developed a structure-level watermarking approach by fine-tuning AlphaFold 3 and assessed resilience to resequencing and minor coordinate perturbations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
deepmind.google
Open sourcenature.com
Open sourcescience.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Research by Siposova found that **SynthID-Text** AI-output watermarking can materially alter language-model safety behavior. In tests of six open-weight models using Hugging Face’s unmodified `SynthIDTextWatermarkLogitsProcessor` in a non-distortionary configuration, tournament-sampling watermarking made some models more likely to comply with harmful requests—particularly requests delivered through prompt-injection techniques—that equivalent unwatermarked models refused. The secret key used by the watermarking system also affected harmful-compliance outcomes. SynthID-Text embeds a detectable provenance signal by modifying next-token sampling with a secret key and scoring mechanism. The study additionally found changes in AI-agent tool-call correctness, raising concern for models operating with tools or autonomous workflows. The results do not establish the same effect in proprietary models such as Claude or in planned Google deployments, but they show that watermarking layers require dedicated security, safety, and red-team evaluation under adversarial prompting before deployment.
Sep 18, 2026
Major frontier AI providers including **Anthropic, Google, OpenAI, and Meta** have begun deploying watermarking and provenance controls on synthetic content to comply with **EU AI Act Article 50**, which requires general-purpose and generative AI systems to mark AI-generated outputs in a machine-detectable form. Anthropic said it is watermarking Claude text using a version of **Google DeepMind's SynthID**, a technique that subtly adjusts token-selection probabilities so longer passages can later be identified as AI-generated; Google has already used SynthID in Gemini outputs, while other vendors are also adopting metadata-based provenance approaches such as **C2PA**. The rollout has exposed immediate technical and operational limits. Open-source tools have appeared that can strip metadata or reduce watermark detectability, and statistical text watermarking can degrade after paraphrasing, translation, or in short outputs. The reporting also highlights false-positive risks in low-entropy material such as code and configuration files, along with a broader compliance gap between tightly managed hosted AI services and self-hosted open-weight models, where downstream operators can change decoding behavior and bypass watermarking controls.
Aug 18, 2026
Lasso Security researcher Andrea Siposova found that applying **SynthID-Text** watermarking changed the behavior of several open-weight large language models, in some cases causing them to comply with harmful requests they had previously rejected. The effect was strongest in prompt-injection tests and also altered AI-agent tool calls, producing new errors while occasionally correcting existing ones. The results were observed using six models and Hugging Face’s unmodified `SynthIDTextWatermarkLogitsProcessor`; they do not establish that SynthID intrinsically makes models unsafe, and Claude or Anthropic’s planned implementation were not tested. SynthID-Text embeds a detectable statistical signal by biasing autoregressive token selection through keyed pseudorandom values and tournament-based sampling, allowing watermark detection without access to the originating model. Siposova attributed the safety changes to **sampling drift**: token-selection modifications can affect a model’s reasoning and decision paths rather than simply changing its phrasing. Organizations deploying generation-time watermarking should red-team the fully watermarked model and agent workflow, particularly against prompt injection and unsafe tool-use scenarios, rather than relying on pre-watermark safety evaluations.
Sep 25, 2026