From deepfakes to DNA: how SynthID watermarks AI

Hannah Fry welcomes listeners back to the Google DeepMind podcast and asks them to picture scrolling social media: slow-motion footage of a volcano erupting, a tornado tearing through a village, a protest in a square. A lot of people, she says, now ask the same question. Is that real? Did a human make it, or a machine?

As AI gets better at generating text, images, audio and video, that question has become one of the hard ones of the moment. Then she complicates it further. We are entering a world where AI can design biological molecules and structures that have never existed in nature, some of which could be designed to cause harm. How do you stop something dangerous before it gets made?

The answer, she says, might already be sitting in the thing you are looking at, or in the molecule you are about to synthesize: a watermark. Not the blocky logo on a stock photo. Something mathematical, and far more subtle. She is joined by two people working on that from different angles.

Pushmeet Kohli is VP of Science at Google DeepMind and one of the architects of SynthID, the watermarking system now being adopted across the industry. Jeremy Ratcliffe is a biosecurity researcher whose team has applied the same technology to biology. Hannah starts with Jeremy: watermarking everything an AI emits sounds like a good idea, but why does it actually help?

For biology, Jeremy says, the motivation is provenance. You want to know where a sequence came from, and specifically to tell sequences that exist in nature apart from sequences that are products of AI systems. The risk that worries him is an AI-generated sequence with properties we already know are problematic, even if you cannot read those properties off the letters themselves.

Hannah asks what makes a good watermark. People hear the word and think of banknotes or passports. Are there rules? Jeremy’s list for their work is human imperceptibility, so it is hard to see which part of the data was marked — otherwise it would be easy to erase — high detectability, so a system can find the mark with confidence, and generalizability, so you are not inventing a bespoke method for every data type.

Hannah asks Pushmeet whether that applies beyond biology. He says DeepMind started the watermarking project almost eight years ago to give users a sense of provenance for what they are seeing. Ten years ago it was hard to imagine systems that could create images, video, audio, text and proteins or enzymes indistinguishable from a human or from nature. Users need a way to believe what they are looking at.

A watermark, he says, needs three properties. It must not degrade quality, or people will not use it and the point is lost. It must be robust against attack and transformation: if someone tries to remove it, even after they change the signal, it should persist. And it should be easy to use — easy to put into the signal and easy to detect afterwards. Imperceptibility, robustness and scalability are the three they have designed every system around, so users have more control over what they see, use or design.

Hannah notes that watermarking has been a big subject this summer, even though generative AI has been public for a few years. Why did it take so long to become widespread? Pushmeet goes back to image-editing software. As those tools got sophisticated, people worried whether a photo was real or had been tampered with, and specialized systems learned to spot the tiny differences a fake left behind.

As generative AI got better, those tiny differences went away. That raised an uglier question: is the game over? Will humans lose the ability to tell whether something was AI-generated? That, he says, is where watermarking came in.

The way to make sure people can always understand the origin of a signal, Pushmeet says, is to inject a signal into it — a bias that does not go away. Even if the models become perfect, and can make an image indistinguishable from a camera or text indistinguishable from a person, you specifically put in imperceptible traces so users can later detect that it came from an AI model.

Hannah checks that when he says “we,” he means DeepMind in the literal sense: they were the ones who found a scalable solution. Yes, he says. The team has been on this for almost eight years. They started with images because of fake news and misinformation. The problem is still extremely hard given robustness, imperceptibility, efficiency and scalability, but an image is a large amount of data. A one-megapixel image is on the order of a million numbers, or about three million depending on encoding — a lot of room to hide information without changing the content.

They built image watermarking first. Then they had to face modalities that are not that high-dimensional. A sentence is not a million numbers; it is a few words, and you cannot change those words casually without changing the meaning. So the methods they developed for text are quite different from the ones for images, video and even audio.

Hannah notes that the idea they pioneered has been brought into law: generative content in the EU has to carry some form of watermarking. Pushmeet says regulators and governments want users to know the origin of what they consume, and watermarking is seen as a robust technology that can scale. That is why the idea has been taken up across the industry. SynthID is used by Nvidia and by partners including OpenAI. He calls it remarkable that so many generative-AI labs have adopted it.

Hannah sets up the rest of the episode: two applications, media on one side and biological structures and sequences on the other. Are the solutions similar? Jeremy says they are motivated by similar principles. His team could adopt a lot of existing work, including the open-source SynthID text library, and embed it directly in another system. Not just the same tricks: sometimes the actual same code, with adaptations on top.

Hannah wants to walk through how it works, because it sounds almost magical: a single sentence with a watermark that is not whitespace or odd commas, but a record of how the words were generated, sitting in the words themselves. She suggests starting with text as the easiest case. Before that, though, she asks about software already online that claims to tell you whether text is AI-generated. How is that different?

Pushmeet says the traditional approach is to train a machine-learning classifier to distinguish model output from the natural world, using a very large amount of data. Early conversational models had tells. Hannah supplies one: they overuse constructions like “it’s not X, it’s Y,” and the word “quietly.” He agrees. As the models have become more sophisticated, those tells have become rarer, so a classifier’s accuracy falls as the generator gets better at its job.

They walk through watermarking step by step, starting with how a large language model picks the next word. When you watermark text, Pushmeet says, tokens are being sampled from a distribution over possible next words. He asks Hannah what she had for breakfast. She could start with “I,” or she could start by addressing him as “Pushmeet.” If both are valid starting points, she has optionality. Text watermarking uses that optionality, guided by a key.

Hannah restates it: behind the scenes a secret key says bias these words over others. Later, if you look at a stretch of text and see those patterns over and over, you can be confident it was AI-generated. Pushmeet clarifies that it is not that specific words have to repeat. The detector looks at how they appear and change together — the patterns of how they change, not a list of banned vocabulary.

With the key, Pushmeet says, you are not only claiming the text was generated by AI. If different models use different keys, you can check which model it was: this is Gemini, this is another lab. Hannah clocks the caveat immediately. You can only do that if you have the key. Without it, the pattern is invisible.

Hannah asks the obvious follow-up. If there are only a few words it could be, you cannot use the trick. Does that mean some text is unwatermarkable? Yes, Pushmeet says. A short snippet such as “What is the capital of France?” / “It is Paris” leaves almost nothing to change, so it will not be watermarked. That is a limitation of the approach.

Does this mean students cannot cheat on essays anymore? Can we detect anything that is AI-generated? Pushmeet says the ecosystem as a whole is moving toward watermarking, as other labs’ announcements show, but that does not mean they will all make their detectors public. And a public detector is itself a reason for people to learn to get around it, the same way classifiers were gamed. If you can query a public detector over and over, you might work back to something that evades that particular key configuration.

Hannah takes the implication: there is not yet a guaranteed, cast-iron way to detect any AI generation whatsoever. This is a big step toward that, not the finished article. Pushmeet agrees, at least not if you publish a detection system for every version of the keys.

On images and video, she notes, there is much more space to hide things. Pushmeet says the approach is different from text. You start with an unmarked image. A neural network looks at it and modifies it in a very subtle way to incorporate the signal. That watermarking model is co-trained with a detector network. They are trying to do the same job: take an unmarked image, inject a very small imperceptible signal — if users can see it, quality has been degraded — and still recover it later.

In the middle sits an adversarial agent that tries to break the mark. It might shrink the image, zoom in, crop, rotate, add noise, and run other transformations. The detector still has to say whether the original was watermarked. Both networks are trained in tandem so that, whatever the adversary in the middle has done, the watermark remains detectable.

Hannah asks what this means for users. Pushmeet says it is not just about text. In the years since SynthID launched, he would open a news site and see a reporter write that an image circulating of a house magically untouched in the California fires, or an image from the Iran war, had been run through SynthID and flagged as AI-generated.

All of a sudden, he says, you can see AI in places it definitely should not be. Hannah picks up the implication: SynthID is being used to tackle misinformation, in real time and at scale, not as a lab demo but as something newsrooms can actually run on images that are already circulating.

Can anyone do what he just described — take an image, some text, a video, run it through SynthID and find out whether an AI model generated it? Detection, he says, is embedded in the Gemini app. You can show Gemini an image and ask whether it was generated; it can run the SynthID detector and say yes, this came from a Google image model. Similar abilities are now available from other companies that have adopted the models.

Hannah asks whether each model can only detect its own outputs. Can Gemini only catch Gemini? People who inject the watermark have to agree to share the key, Pushmeet says. If they share it, you can detect it. There can be a central service: you go to the SynthID portal, ask if something is AI-generated, and it looks at all the keys partner institutions have given them. If a lab does not want to share its key, you would not be able to see that lab’s content.

Hannah turns to biology. Jeremy’s team has a proof-of-concept called SynthID Bio, watermarking AI-generated protein sequences and 3D biomolecular structures rather than text and video. He splits the upcoming publication in two. SynthID Bio Structure watermarks the predicted protein structure given a sequence, and builds on AlphaFold 3. SynthID Bio Sequence introduces watermarks into the strings of amino acids themselves.

Hannah points out that a folded structure is a string of amino acids, so they sound like versions of the same data. Embedding the watermark is very different, Jeremy says. For structure they change the positions of individual atoms: a slightly different distance or angle. For sequence they change the selection of an amino acid. Structure keeps the same atoms in a slightly different configuration. Sequence actually changes the content, but not necessarily the functional meaning of that content.

Why do this at all? One use case is provenance: detect whether an order going to a DNA synthesis company came from an AI system. Non-biologists, Hannah says, often do not realize you can send off a sequence and have it “printed.” The worry is tricking those companies into printing something hazardous. Jeremy agrees that is one of the concerns. There is a large body of industry groups and academics working to make screening more robust, and his team wants to contribute.

The primary fear is that someone acquires DNA that lets them make, in a lab, something we do not want them to make, or that gets around regulation — an extinct pandemic influenza, for instance, which he dryly calls generally overall bad. If synthesis companies can detect that something is AI-generated, that is an extra stop. A watermark tells you it came from a system with built-in safety guardrails, as opposed to another model or something from nature.

Hannah asks what those companies already do. Mostly, Jeremy says, they verify identity: you are an academic, this is your university affiliation, you are who you say you are, and the address is a laboratory, not a random person in a basement. Then they compare the order to a database of known hazardous things, with a couple of algorithms. A match means they block the order or go back and ask for motivation and licensing.

The risk with AI systems, shown by other academics, is that you can make something very different in sequence space from anything in that pathogen database, yet it might fold into the thing of concern. The amino-acid string looks innocent. Once it is a protein, it could be harmful, with the same behavior as something on the restricted list. Current systems would not catch it. As the models get better, you might get even further away in sequence — something really wacky in the ribbon that still folds into harm — and sneak under detection.

You can also cut and paste. If one portion of an order would be blocked, you splice in something of concern that sits far from the restricted database, then in the lab put it back where it originally belonged. Hannah restates the point of the watermark: it is not that you will detect anything potentially harmful. At the very least you can say this is AI-generated — be careful, because it may not look like anything already on the list — and which system it came from. If you trust that AI system for reasons beyond the watermark, you can have some confidence in how it was made.

She asks how the watermark gets into the protein-design process, analogous to text and images. Somewhat fortuitously, Jeremy says, ProteinMPNN — a structure-to-sequence model — works in a way that is pretty analogous to how transformer models generate text. It is a third-party tool, not something Google developed, and it has been out in the world for years. It is almost the opposite of AlphaFold: instead of sequence to structure, it goes from structure to sequence.

That step matters in a design pipeline. You often choose a target by how you want things to interact in three-dimensional space, then this model predicts a sequence that will fold into that configuration. Hannah underlines the analogy: complex folds are built from a ribbon of amino acids, a string, like a string of text. When you fold a protein there are places you can swap amino acids with similar properties, leucine and isoleucine for example. SynthID Bio Sequence introduces watermarks through those selections, aiming to keep structure and therefore function.

Hannah stops him. He said you can make the swap and it does not matter. Can you be sure? That, Jeremy says, is what they specifically test. The whole idea of the research was to inject the watermark and still keep the function they were designing for.

Pushmeet jumps in: what is cool is that watermarked proteins now exist. These are real things, not simulations. They do stuff, they are watermarked, and they will always be detectable. Importantly, from their own laboratory experiments, they do not change function at all. They made protein binders — the things that stick — and tested them in the lab. Jeremy confirms they physically made them.

Measurements you get from binders include hit rate, how many designs actually bind, and how well they bind. Across both, things watermarked under two different schemes versus binders that were not watermarked had near-identical hit rates and near-identical quantitative binding. Hannah says you would expect to lose a tiny bit. Jeremy admits that before the wet-lab data he was a little skeptical. It blew their minds how easy it was. Proving it in biology took them all a bit by surprise.

This is still a proof of concept, Hannah says, a demonstration that it works. Is the idea that any lab would eventually be able to read their watermark? Jeremy would not even frame it as “our” watermark. It is technology other people can use. Model developers who generate new proteins will have to integrate watermarking into their own schemes, and because the code is being open-sourced they can do that without coordinating with DeepMind. On the synthesis side, keys and other details have to be exchanged between model providers and the DNA companies. Those are separate coordination problems.

From DeepMind’s side, he says, there is still engineering headroom to make the watermark both more detectable and a little easier to embed. That kind of community work is what would make adoption easier for all the players. Hannah asks whether, as with text, detection is universal or specific to a key. If someone takes the public implementation and shares the key plus the context length — how much preceding context matters for the mark — you would be able to detect output from any such system.

Is this out there working already? For this publication, Jeremy says, they have a proof of concept and will open-source the technology that lets people do the watermarking. It is a slightly different situation from watermarking Google’s own media models, because DeepMind does not run an internal protein-design service. They have started conversations with people on the model-development side and on the synthesis-screening side, hoping to catalyze a conversation about actually implementing it. They are not the organization people order proteins from, so they should not set the standard alone; they can be a catalyst for the services that already exist.

Hannah asks how the people who actually “print” proteins have reacted. Jeremy says he is generally skeptical by nature. They have all been so excited, maybe more than the team expected, which has been galvanizing as they take the last steps toward the real world. He is bullish on at least the amount of interest.

Pushmeet adds that one thing he finds remarkable about the bio community is how cognizant they are not just of today’s threats but of tomorrow’s. They have been extremely receptive because they see the challenge every day: orders for gene synthesis that can create proteins, filters that catch problematic orders, and the knowledge that those filters are not perfect. They want to work with the field on solutions that will work. Bio-resilience, he says, is going to sit more and more on people’s minds.

Hannah asks what else they are doing in the area. Jeremy points to a memo from about two months earlier that laid out Google DeepMind’s vision, plus Isomorphic Labs, on bio-resilience. It matched efforts across pillars rooted in the UK’s biological security strategy: prevent, detect and respond. Broadly they are looking at how to use AI to reduce biological risk, both natural threats and AI-augmented ones. SynthID Bio is an example aimed at AI-designed sequences and what that means for pathogen detection. Other concepts sit more in the natural-threat space, and some map across both.

Their theory of change, he says, is that if you make biology less useful for someone trying to do something malicious, that can prevent them from using it in the first place. New tools that make the public-health system more robust, or that make it easier for epidemiologists to identify an outbreak, can in themselves make an outbreak less likely. Hannah: you want the good side, the benefits, without all the potential downsides. Jeremy: absolutely.

Pushmeet says AI will have immense positive impacts on human health and on our understanding of biology at large. It is already happening: Isomorphic Labs and many other companies leveraging AI for drug discovery and health. At the same time there will be problematic use cases, and we need all the controls we can place so those tasks become difficult or infeasible.

Hannah goes back to digital media. The landscape is quite fragmented. Will we get to a central place that just tells you whether something is AI-generated? Pushmeet thinks the field is moving that way. There is industry alignment on the need for provenance solutions: companies have agreed that when there are edits or generative AI, that information should sit alongside the file.

The issue with that, he says, is that metadata can be stripped, which is why you need strong binding, which watermarks provide. Combine those approaches, and build a system that works for everyone in the community, and he thinks you get to a standard. Progress is being made. It just takes time.

Same question for biology: is the aim an industry standard everyone uses? Jeremy says they even note in the discussion that there is engineering headroom, including in how you calculate G values and introduce the watermark. At the surface, though, they believe an imperceptible watermark embedded in the sequences themselves is likely one of the best ways to identify the provenance of AI-generated sequences.

Hannah wonders about cat-and-mouse. The more universal a system becomes, the clearer the rules, the easier it might be for someone to undo it. Pushmeet says that is very much a risk, which is why the secret keys matter, whether you are embedding in a protein sequence or in images. The ideal is that the mark is hard to take away to the point that if you want to get rid of the detection signal, you have to change the function — destroy the capability you designed the thing for. So embedded that there is no way to undo it.

Hannah says this is not necessarily the final way of doing things. Early days. And yet the fact that a biological object can contain, written at that level, the story of where it came from is pretty incredible. Jeremy: they are not the first to do watermarks, but they are the first, to their knowledge, to show both imperceptibility and function preservation, including in vitro, with lab-based results. Hannah calls it amazing, thanks them both, and they thank her.

In the close, Hannah says words like guardrails and safety get thrown around a lot in AI. This, she says, is concrete proof of the lab putting its money where its mouth is. They pioneered watermarking AI-generated content well before most other labs were thinking about it, proved it was scalable and would not hit quality or speed, and now the ideas sit inside regulation. Rather than resting, they are already looking at the next threats, trying to help build a world that can harness the technology without leaving space for the harms — and doing that before the threats fully materialize.

The future, as it turns out, will come with a certificate of authenticity. She signs off as Professor Hannah Fry on Google DeepMind, the podcast, tells listeners there is plenty more to come in the series, and asks them to check the other episodes in the meantime.