Genomic language models embed detectable watermarks in synthetic DNA
Tracing model-generated DNA with position-independent watermarking
Cryptography and Security
Summary
Synthetic DNA created by AI models leaves no obvious mark showing where it came from, which can cause problems. This paper shows how to hide a special code, called a watermark, inside the DNA sequence so that a verifier can find it without extra context. The watermark can be detected even if the DNA has small changes like added, deleted, or changed bases. The authors tested this on two models and found it reliably identifies synthetic DNA while rarely giving false positives.
What this means in practice
- •For bioinformatics teams: Detect if a DNA sequence is synthetic and generated by specific language models without prior knowledge of sequence positioning.
- •For security engineers: Add provenance signals to synthetic DNA to help verify its origin in biosecurity and intellectual property contexts.$Commercial implications: Enables products for authenticating synthetic DNA origin for biosafety vendors or synthetic biology companies.
Authors
Kimon Antonios Provatas1, Christos Galanopoulos, Ilias Georgakopoulos-Soares
Abstract
Genomic language models can write synthetic DNA that carries no record of its origin. A generation-time watermark could provide a provenance signal, if a verifier can detect it using only the DNA sequence, a key, and published detector settings, without knowing where the generated region starts, which strand it lies on, or how it was divided into six-base tokens. We embed the SynthID tournament watermark in two genomic language models, Carbon and GENERator-v2. The verifier searches both strands, every start position, and four window lengths, and corrects its decision for the whole search. In a detection cohort of 1,544 held-out prompts, it found all 3,088 marked sequences per model, unedited and after one substituted, inserted, or deleted base. For ordinary sequences, the one-sided 95% upper confidence bound on the false-positive rate was at most 0.850%; one bound for the wrong-key control reached 1.015% (Carbon, after a deletion). In a development cohort, neither model showed a detectable change in likelihood or in predefined sequence measures. Under random edits placed without reference to the detector, detection stayed complete or nearly complete up to a 2% per-base edit rate. These results show statistical detection, not biological function, secret-key security, or robustness to an editor who sees the detector.