AI watermarking doesn't visibly alter text. Instead, it uses a secret key to slightly boost the probability of certain words appearing in a sequence. This creates a statistically significant pattern that can only be detected by a tool with access to the original model and the secret key.

While de-duplicating protein databases helps learn diverse structures, subtle variations in similar sequences are essential for learning function, as a single mutation can be catastrophic. This justifies training models on massive, unclustered datasets to capture fine-grained functional determinants.

The goal for robust watermarking is to embed the signal so deeply that any attempt to remove it also fundamentally degrades the quality or purpose of the original content. For an image, this means destroying its visual integrity; for a protein, it means altering its biological function.

To validate their watermarking method, researchers didn't just rely on simulations. They physically created watermarked protein binders in a lab. Lab tests showed that watermarked proteins had nearly identical "hit rates" and binding capabilities as non-watermarked versions, proving the method's real-world effectiveness.

Current biosecurity screens for threats by matching DNA sequences to known pathogens. However, AI can design novel proteins that perform a harmful function without any sequence similarity to existing threats. This necessitates new security tools that can predict a protein's function, a concept termed "defensive acceleration."

Watermarking isn't a one-size-fits-all solution. High-dimensional data like images (millions of pixels) offers ample space to hide an imperceptible signal. In contrast, low-dimensional data like text requires a completely different method based on biasing word choice to avoid altering its meaning.

Existing bio-defense systems work by matching DNA sequences to known pathogen databases. However, generative AI can create novel sequences with different 'spellings' but the same dangerous function. Effective future defense must evolve to predict a sequence's function, not just its identity.

Initiatives like Google's Synth ID aim to standardize detection of AI-generated content. However, these systems are vulnerable. Simple user actions like screenshotting can strip metadata, and blending AI-generated assets with real footage can easily confuse detection algorithms, limiting their effectiveness.

Watermarking isn't about hiding data in whitespace. It works by using a secret key to subtly bias an LLM's selection of the next word from a list of valid options. A detector can then identify this biased pattern across a body of text to confirm its AI origin without altering meaning.