From deepfakes to DNA: the science of watermarking AI
Hannah Fry talks with Pushmeet Kohli and Jeremy Ratcliffe about SynthID, DeepMind's invisible watermarking technology. They cover its origins and design requirements, how it works for text, images, and video, why it matters for regulation and misinformation, and how SynthID Bio extends watermarking to protein structures and sequences to help screen AI-designed biological material without changing function.
The conversation opens with a scenario most people will recognize: scrolling past a striking clip of a volcano eruption or a tornado and asking whether it is real. Hannah Fry frames this as a question that is getting harder as AI improves at text, images, audio, and video, and now extends to biology, where AI can design molecules and structures that never existed in nature, some of which could cause harm. The proposed answer is a watermark that is invisible and mathematical rather than a visible logo. Pushmeet Kohli (VP of Science at Google DeepMind, one of the architects of SynthID) and Jeremy Ratcliffe (research scientist on the biosecurity team) explain how the same underlying idea has been applied to content provenance and to protein design.
Why watermarking, and what makes a good one
Pushmeet explains that DeepMind started the watermarking project nearly eight years ago, initially focused on images because of concerns about fake news and misinformation. The goal was to give users a sense of provenance, so they can trust what they see. He defines three requirements: the watermark must not degrade quality (imperceptibility, otherwise people will not use it), it must be robust against transformations and deliberate removal attempts, and it must be easy to embed and detect at scale. Jeremy adds that for biology, the aim is to distinguish sequences that come from nature from those produced by AI systems, especially when an AI-generated sequence might have problematic properties that cannot be spotted from the sequence alone. He also stresses high detectability and generalizability, meaning one method should work across many systems rather than requiring bespoke solutions for each data type.
Why now
Pushmeet’s account of the timing is that forensic tools once worked by spotting tiny artifacts left by image editing. As generative models became more sophisticated, those artifacts disappeared, and the natural question became whether detection was simply over. Watermarking shifts the approach: rather than hunting for flaws, it deliberately injects a persistent, imperceptible bias into the signal at generation time, so origin can be checked even when generative models are good enough to be indistinguishable from camera output or human writing. He notes that regulators have taken notice, with generated content in the EU expected to carry some form of watermarking, and that SynthID has been adopted by partners across the industry, including Nvidia and OpenAI.
Text watermarking
The text mechanism is one of the more striking parts of the discussion. A large language model has a distribution over possible next tokens. Where several words are equally valid starting points, a secret key can bias the selection toward some choices over others. No single word is a signature; the detector looks for statistical patterns across a passage, and each model family can use its own key so that the source model can be identified. Pushmeet is candid about limits. Very short texts, such as the answer to ‘what is the capital of France’, offer too little optionality to carry a signal. Hannah raises the obvious question of whether students can still cheat on essays, and the answer is not a clean yes. The ecosystem is moving toward watermarking, but not every lab will publish its detector, and a publicly queryable detector can invite people to reverse-engineer the key configuration and evade it. Pushmeet contrasts this with classifier-based detection, which becomes less reliable over time as models lose the stylistic ’tells’ they once had.
Images and video
For images, the approach is different. A watermark generator neural network makes a subtle modification to the image, and it is co-trained with a detector network. An adversarial agent applies transformations such as shrinking, cropping, rotating, zooming, and adding noise, and the detector has to keep finding the watermark regardless. Both networks are trained in tandem. Pushmeet highlights real-world impact: news outlets have run SynthID on circulating images, including ones about wildfires and the Iran war, and identified AI-generated content in places where it should not have been. SynthID detection is now built into the Gemini app, and a central portal can check content against the keys shared by partner institutions. The limitation is clear: if a lab does not share its key, its content cannot be checked this way.
SynthID Bio
Jeremy describes two systems. SynthID Bio Structure builds on AlphaFold 3 and watermarks predicted protein structures by making small shifts in atomic positions, such as distances or angles between atoms, so the same atoms sit in a slightly different configuration. SynthID Bio Sequence works at the level of amino acid strings and introduces watermarks by choosing between amino acids that are likely to preserve the fold and function, such as leucine and isoleucine. For sequence design, the team uses ProteinMPNN, a third-party structure-to-sequence model, and Jeremy notes that its autoregressive logic is quite analogous to how transformers generate text, which is why the text watermarking code could be adapted with relatively little change. Pushmeet describes the team’s surprise at how easily it worked.
The motivation is biosecurity, specifically DNA synthesis screening. Jeremy explains that people can order DNA sequences from synthesis companies, and the concern is that someone might obtain sequences that enable the construction of something dangerous, such as an extinct influenza. Current screening verifies customer identity and compares orders against databases of hazardous sequences. The worry is that AI can design sequences that are far from anything in those databases in sequence space yet fold into a harmful structure, and that harmful fragments can be cut and pasted into innocuous orders. A watermark does not detect harm directly; it signals that a sequence came from an AI system with built-in safeguards, which gives screeners an extra checkpoint and context when they compare against existing databases.
On validation, the team did wet-lab work rather than relying on simulation. They produced protein binders, both watermarked under two schemes and unwatermarked, and measured hit rates and binding strength. The results were near-identical across conditions, suggesting the watermark did not measurably change function. Jeremy notes that they were initially skeptical, and the results surprised them.
Operationalizing and the wider community
Jeremy frames this as a proof of concept. The team plans to open source the code, but operational adoption requires coordination: model developers need to integrate watermarking into their tools, synthesis companies need to exchange keys with model providers, and the engineering can still be improved to make watermarks easier to embed and detect. Jeremy reports that the biosecurity community has been receptive, because screening filters catch problematic orders but are not perfect, and practitioners already think about tomorrow’s threats. He describes DeepMind’s role as catalyst rather than standard-setter, since it does not run a protein ordering service.
Bio resilience is positioned within a broader strategy. Jeremy references a memo outlining Google DeepMind’s and Isomorphic Labs’ vision, aligned with the UK’s biological security strategy across prevention, detection, and response. The team works on natural threats, AI-augmented threats, and projects that span both. Their theory of change is that making biology less useful to someone with malicious intent can prevent misuse in the first place, and that stronger public health tools, such as helping epidemiologists identify outbreaks earlier, make outbreaks less likely. Both speakers acknowledge that AI will bring large benefits to drug discovery and health, and that controls must make problematic uses difficult or infeasible.
Limits and the cat-and-mouse problem
The closing discussion turns to the future of digital provenance. Pushmeet notes industry alignment on standards that attach provenance metadata to files, but metadata can be stripped, which is why strong binding through watermarks matters. Hannah raises the cat-and-mouse concern: as a system becomes more universal and its rules become clearer, adversaries have more reason to build tools that undo it. Pushmeet’s response is that secret keys are central, and that the ideal watermark is so entangled with the signal that removing it would destroy the content or the function it was designed for. Jeremy agrees that this is early days. He emphasizes that DeepMind is not the first to watermark content, but they believe they are the first to show both imperceptibility and function preservation in lab-based results.
The episode ends with the thought that a biological object could carry a record of where it came from, a kind of certificate of authenticity. The overall impression is of a team that is building the technology and its governance together, and that is looking ahead to threats before they fully materialize.