Securing the Language of Life: Inheritable Watermarks from DNA Language Models to Proteins
Authors: ZAIXI ZHANG
Ruofan Jin
Le Cong
Mengdi Wang
Venue: NeurIPS 2025 poster ()
Keywords: Watermark
LLMs
DNA
AI for Science
AI Safety
Primary area: applications

Abstract: DNA language models have revolutionized our ability to design and manipulate DNA sequences—the fundamental language of life—with unprecedented precision, enabling transformative applications in therapeutics, synthetic biology, and gene editing. However, this capability also poses significant dual-use risks, including the potential creation of harmful biological agents. To address these biosecurity challenges, we introduce two innovative watermarking techniques: DNAMark and CentralMark. DNAMark employs synonymous codon substitutions to embed robust watermarks in DNA sequences while preserving the function of encoded proteins. CentralMark advances this by creating inheritable watermarks that transfer from DNA to translated proteins, leveraging protein embeddings to ensure detection across the central dogma. Both methods utilize state-of-the-art embeddings to generate watermark logits, enhancing resilience against natural mutations, synthesis errors, and adversarial attacks. Evaluated on a therapeutic DNA benchmark, DNAMark and CentralMark achieve F1 detection scores above 0.85 under diverse conditions, while maintaining over 60\% sequence similarity to ground truth and degeneracy scores below 15\%. A case study on a CRISPR-Cas9 system underscores CentralMark’s utility in real-world synthetic biology. This work establishes a vital framework for securing DNA language models, balancing innovation with accountability to mitigate biosecurity risks.

Securing the Language of Life: Inheritable Watermarks from DNA Language Models to Proteins
Zaixi Zhang" Princeton University e286800princeton.co edu
Ruofan Jin Zhejiang University nuofanjinzzju edu on
Le Cong" Stanford University congle@stanforde edu
Mengdi Wang" Princeton University mengdiw@@prnnceton.. edu
Abstract
DNA language models have revolutionized our ability to understand and design DNA sequences- the fundamental language of lifc-with unprecedented precision, enabling transformative applications in therapeutics, synthetic biology, and gene- editing. However, this capability also poses substantial dual-use risks, including the potential for creating pathogens, viruses, even bioweapons. To address these biosecurity challenges, reliably track the designed DNA: DNAMark and CentralMark. DNAMark employs synonymous codon substitutions to embed watermarks in DNA sequences while preserving the original function. CantralMark further advances this by creating inheritable watermarks that transfer from DNA translated proteins, leveraging protein embeddings to ensure detection across the central dogma. Both methods utilize semantic embeddings generate watermark logits, enhancing robustness against natural mutations, synthesis eттоrs, and adversarial attacks. Evaluated on our therapeutic DNA benchmark, DNAMark and CentralMark achieve FI detection scores above 0.85 under various conditions, while maintaining over 60% sequence similarity ground truth and degeneracy scores below 15%. case study on the system underscores CentralMark's 's utility in real-worke settings. This work establishes vital framework for securing DNA language models, balancing innovation with accountability to mitigate biosecurity risks.
introduce two innovative watermarking techniques
Introduction
DNA the cornerstone of the central dogma 13] orchestrating the flow of genetic infor- mation from DNA to RNA to proteins. Within this paradigm, DNA encodes the genetic blueprint, RNA acts as a dynamic messenger, and proteins execute a vast array of cellular functions (Figure [] a). Recent advances in DNA language models have transformed our ability to understand and design 42 These models leverage compu- tational frameworks to decode complex sequence patterns, enabling groundbreaking applications in therapeutics, synthetic biology, gene-editing, and beyond.
DNA sequences with unprecedented precision 46
However, the remarkable capabilities of DNA language models also introduce significant dual- 76 23). For example, these models could lower the barrier the creation of harmful biological agents, such as pathogens, viruses, or bioweapons. State-of-the-art DNA models excel in predicting and generating sequences with missense mutations pathogenic properties
risks 7 52 5
"Coresponding Authors
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

8 71 12 18] amplifying biosecurity concerns. The Al and scientific communities have recognized the emerging risks of DNA language models and are advocating robust guardrails and comprehensive oversight mechanisms 70 63
46
52 49).
Recently, watermarking has emerged models (LLMs), enabling the traceability of generated content to ensure accountability and mitigate risks such as misinformation or malicious output []6 34 However, the application of watermarking to DNA language models presents unique and underexplored challenges. Unlike LLMs, which operate on expansive vocabularies, DNA language models are constrained by a small alphabet of only four nucleotides, complicating the design of robust watermarking strategies, such as green/red list approaches. Moreover, DNA is susceptible to natural mutations [62V, synthesis errors, and sequencing inaccuracies [58]. which can obscure or degrade watermarks. Additional complexities arise from biological constraints to preserve the functional integrity of encoded sequences to maintain their utility in applications like protein engineering. These challenges necessitate new watermarking frameworks tailored to the biological and computational intricacies of DNA sequence design.
effective strategy counter the misuse of large language
To tackle these challenges, we propose a function-invarian watermark DNAMark using synonymous codon substitutions and CentralMark that builds an inheritable watermark transferable from designed DNA to translated protein. DNAMark and CentralMark address the challenges with the following innovations: (1) To achieve robust watermark resistant to natural mutations and potential attacks, DNAMark and CentralMark utilize the generated DNA or translated protein embeddings (Evo2 [8] or ESM (37) to predict watermark logits with trained watermark models. The watermark logits are then added to the original logits from DNA models to bias the next nucleotide selection for watermarking. The intuition is that DNA and protein embeddings are inherently robust to minor mutations, preserving semantic and functional integrity during watermark logit prediction. During training. the watermark model is optimized to prioritize semantic preservation and maintain an unbiased distribution, enhancing watermark robustness and performance. (2) To minimize disruption to DNA sequence quality and encoded protein function, DNA Mark employs a sparse watermarking scheme with synonymous codon substitutions, selectively modifying only the third base of specific codons to ensure the resulting codon encodes the same amino acid as the unmarked sequence (Figure dd. (3) To ensure inheritable watermark in both DNA and translated protein, CentralMark predicts watermark logits from protein embeddings and applics the watermark to the second base of each codon, enabling near non-overlapping separation of amino acids into green/red lists, facilitating reliable watermark detection across the central dogma (Figure Te).
Using our curated therapeutic DNA benchmark (Figure [p), DNAMark and CentralMark achieve robust Fl detection scores (>0.85) under various attacks, including nucleotide substitution, insertion, and deletion attacks. Meanwhile, DNA sequence qualities are preserved, with over 60% sequence similarity to ground truth and degeneracy scores below 15%. Case studies on watermarking a CRISPR-Cas9 system [II [2 designed by Evo model [46] (Figure (Tp) demonstrate CentralMark's potential for practical applications in real-world synthetic biology and gene-editing.
2 Related Works
2.1 Watermark for Language Models
Driven by the need to identify machine-generated text and mitigate potential misuse, the field of watermarking large language models (LLMs) has seen rapid development. Early and influential approaches, such as the one proposed by Kirchenbauer et al.
34 often referred to as KGW,
introduced a method of biasing token generation towards a "green list" determined by pseudorandom function seeded by preceding tokens. This creates statistical watermark detectable with high accuracy (More details in Section Subsequent works have aimed to improve detectability (24, 40)
35).
text quality [30 25 28 72), capacity (24 69 773, robustness [39 53 and public verifiability
For Example, to enhance watermark detectability, EWD 40 assigns weights to tokens based on their entropy during detection, enhancing sensitivity by emphasizing high-entropy tokens in z-score calculations. To mitigate the logits bias brought by KGW applying uniform 8 to green list tokens, Hu et al. 30 introduced two unbiased reweighting methods to preserve the original text distribution. Aiming at increasing the watermark capacity to convey additional information like timestamps, identifiers, or copyright. Fernandez et al. (24] expand binary vocabulary partition to multi-color partition. To further improve watermark robustness against removal attacks such as
22 38

---

Central Dogma
Theropeutic DNA Benchmark
Watermariig CRISPR, CorD system
REPATST5RTOR PACTAGISCATS
Grwinfattoon
Transciption
Hemong
Korpodi
Translation
JIL
Hotemmaried
Tracf
Cas9 CDS
CYRNA
DWVAMork DVA ATGGATGATTTGATGTTG
third base logit
with Westerment
DNA
DNA Model
codion substittion
}
Wartermeyk threshold
watermark logis
Watermark Model
sall
Entropy Monitor & Dynamiz & with EMA
Exc2 Embedkings
CentralMark
second base logits
DNA Protein
ATGGATG
STGGATGATTTGATE
DNA Model
Grean T
Protain M ML
Wartermork 1 threshald
logits
Watermark Model
Dynamic & with EMA
Encropy
ESM Enteddingg
Watemark DNA language models with DNAMark and CentralMark. (a). DNA plays key role in the central dogma; (b). A therapeutic DNA benchmark is constructed to evaluate DNA watermarks; (c) Our watermark methods successfully watermarks CRISPR-Cas generated by Evo; (d) DNAMark leverages watermark models and synonymous codon substitutions for DNA watermark; (e) CentralMark uses ESM-based watermark model achieve an inheritable watermark. Watermark can be detected in both the DNA and the translated protein sequence generated with CentralMark.
Figure 1:
paraphrasing, semantic-invariant watermark methods 33 53 are proposed to ensure that similar text semantics result in similar partition outcomes, which are robust to attacks. To achieve publicly verifiable watermarks, Fairoze et al. [22] have utilized digital signature technology from the field of cryptography, involving generating watermarks using a private key and verifying them with a public key. Recently, Zhang al. (75] and Chen et al. [9] applied watermarks to protein generative models. However, it is unknown whether a watermark scheme can be designed for DNA language models and the central dogma.
2.2 DNA Language Models
Driven by advances in LLMs. DNA Language Models (DNA LMs) have also experienced rapid progress in recent years. Early DNA LMs primarily focused on DNA sequence interpretation and property prediction 3 7
For instance, Enformer combined convolutional dawn-sampling with transformer layers to enable accurate gene-expression prediction 4 while the Nucleotide Transformer, trained on multi-species corpora, markedly improved variant-effect prediction [15] More recently, DNA LMs with advanced sequence generation capabiliiiess have emerged [59 74 42 46 g For example, HyenaDNA leveraged implicit long-range convolutions scale context to one million tokens 47 GENERATOR, 1.2B transformer decoder trained on 386 billion
47 71
base pairs of cukaryotic DNA, excels in generating viable protein-coding sequences [7]]. Evo, a 7B model trained on billions of prokaryotic and viral base pairs, demonstrated ad capabilities in designing CRISPR-CA complexes [46]. Its successor, Evo2, was scaled using 9.3 trillion DNA base pairs with mieeillionn-toenn context windows, yielding autoregressive models with 7B and 40B parameters. Evo2 enables genome-wine wide prediction and de novo synthesis of DNA sequences across all domains of life [8]. Evo2 excels in generating chromosome-scanl sequences, including similar sequences to human mitochondrial, M. genitalium, and S. cerevisiae genomes.
The advanced capabilities of DNA language models simultaneously raise significant biosafety and biosecurity concerns 770 63 Current countermeasures, such as sequence screening ① and regulatory policies [5]. are often suboptimal, as they may fail to detect Al Al-generated sequences adapt to
3

---

evolving model capabilities [9]. Robust watermarking techniques tailored for DNA could enable reliable tracing and detection of Al-generated DNA sequences, addressing these gaps.
Preliminaries
Autoregressive language models, such as transformer-bases architectures, generate text by modeling the conditional probability of a token given its preceding context. Formally, for sequence of tokens x (x1, 22,1,22-00 22,, ................................ 2T), an autoregressive model predicts the next token z; based on the probability distribution p(=)(=1=-1;0), where 0 denotes the model parameters. The joint probability of the sequence is expressed as:
T p(x; 0) II p(aa)))ree1;0)))
These models excel at producing coherent and contextually relevant text, but their widespread use raises concerns about content authenticity, ownership, and traceability.
To address these challenges, watermarking techniques embed imperceptible identifiers into the outputs of language models. A watermark is subtle, structured modification to the generated text, designed to robust against post-processing (e.g.. paraphrasing) while remaining inconspicuous to human readers. For example, the KGW watermarking scheme (34) modifies the token probability distribution during generation. Specifically, for vocabulary V, KGW partitions tokens into a "green" list G V and complementary "red" list R V \ & based cryptographic hash of the context. The probability of selecting a token Ie E G is boosted by an additive term ö, altering the sampling distribution as:
Pwm (21 0) x p( 0) + 8- I(x, E EG),
where I[(-) is the indicator function, and the modified distribution is normalized. This ensures the watermark is embedded without significantly degrading text quality.
Watermark detection involves identifying the presence of these embedded identifiers in a suspect text. In the KGW scheme, detection leverages statistical hypothesis test based on the z-score, which quantifies the likelihood that a given text x was generated by a watermarked model. Specifically, the detector counts the number of tokens in the green list, denoted r = Σ I[xx; 9), over the sequence of length T. Under the null hypothesis (no watermark), tokens are sampled uniformly from V, and the expected proportion of green tokens is / The z-score is computed as:
r E[r]
r- T-
Varlr)
(1
where E[r] T [ and Var[r] = Ty (1 7) assume a binomial distribution for r. A high z-score (e.g., = 2 for a threshold r) indicates the presence of the watermark, as the observed green token count significantly exceeds the expected count under the null hypothesis.
Methods
4.1 DNAMark:
Function-invariant Watermark for DNA Models
To achieve resistance to natural mutations and function preservation for synthetic biology, we first build DNAMark (d)) robust, and dunction-invarian watermark scheme for DNA language models in this section. Inspired by previous works on semantic-invarias watermarks for LLMs 39 (33, DNAMark utilizes specialized trained watermark model to generate watermark logits for robustness. For watermarking in the coding region, we use synonymous codon substitutions to keep the coded amino acid unchanged. Moreover, adaptive watermark strength and entropy- guided watermark strategy are applied to balance sequence quality and detection accuracy.
4.1.1 Watermark Model based on Evo2 Embeddings
To embed robust watermark in generated DNA sequences, DNAMark processes the sequence preceding the current token through the Evo2 {8] model to obtain functional embeddings, which are

---

then transformed into watermark logits and combined with the original token logits. Leveraging DNA's inherent robustness as an information carrier [TO] 26, 2T], where small mutations typically preserve encoded biological functions, DNAMark is designed to provide durable watermark for DNA language models, resisting both natural mutations and adversarial modifications. Specifically, the watermark model in DNAMark satisfies two critical properties: semantic preservation, ensuring the watermark maintains the sequence's s biological semantics (c.g., protein coding or regulatory roles) by aligning logit similarities with Evo2 embedding similarities. Moreover, the logits should be varied sufficiently to enhance complexity and security. Otherwise, the watermark logits are monotonous, the green list is more static and might be revealed by counting the token frequency. This compromises the watermark protection and leads to the risk of being cracked. The second property, unbiased distribution, ensures that watermark logits exhibit systematic preference for any nucleotide or codon and maintain a balanced distribution of positive and negative values, enhancing security against statistical attacks and ensuring robust, detectable watermarks for DNA sequences.
To realize these properties, we trained the watermark model 33 (Appendix, [ comprising multiple fully connected layers and layer norm, with two main loss functions: alignment loss and normalization loss. The alignment loss aligns the watermark logit similarity with the Evo2 embedding similarity: we normalize the embedding similarities by subtracting their mean and applying the hyperbolic tangent function. The alignment loss Co is defined as:
(A
W; W [willa
C e 1e: 1
Ck ex
La =
tanh
k
(4)
2
le
where is the Evo2 embedding for sequence i, w; is the watermark logit vector produced by the watermark model, |N| is the number of sequences, it is hyperparameter controlling the similarity range, and la denotes the Euclidean norm. This loss ensures watermark logits reflect DNA functional relationships while enhancing separability.
Following 39). the normalization loss enforces unbiased token preference and balanced scores. It constrains the mean of the watermark logits zero across tokens and sequences and ensures uniform absolute values for stability. The normalization loss Cn is defined as:
JN
M
M
IN
IN
M
Ln
Σ
Σ
R w(()
(5)
j=1
where (()) denotes the j-th value the watermark logit; R hyperparameter specifying the target absolute value for each logit component, and À is weighting factor. This loss ensures the watermark statistically neutral and detectable. The total loss combines the above two objectives. During watermarked generation, the watermark logits, scaled by watermark strength factor d, are added to the original logits to bias the sampling of the next nucleotide.
4.1.2 Synonymous Codon Substitutions
To design a function-invariant watermark for DNA language models, DNAMark employs synonymous codon substitution (SCS) within the coding DNA sequence (CDS), targeting the third base of codons embed identifiers that preserve the encoded amino acid, critical for synthetic biology applications. For a codon with fixed first two bases (e.g., CA) and an intended amino acid (e.g.. Histidine for CAT), DNAMark defines green and red lists within the synonymous codon set (c.g., CAC as red list and CAT as green list), to keep the encoded protein unchanged (i.c., no matter red or green list chosen, the same amino acid type). This approach is motivated by several considerations: First, synonymous codons produce identical amino acids, thereby maintaining the protein's 's structure and function critical for applications in synthetic biology. Second, targeting the third base leverages the degeneracy of the genetic code, where mutations at this position are often silent [1I,, minimizing the influence of watermarking on DNA sequences. Third, by watermarking only the third base, MNA.aark achieves sparse watermark that balances robust detectability with high DNA sequence quality, minimizing disruptions to codon usage and sequence optimality. Following previous works we explicitly define the green and red lists for watermark. Considering different cases of
34 24
5

---

synonymous codons (more details in Table B the green and red lists (G, R) are constructed as:
(bg), S (bg)
if [f] (e.g., T, C for CAT, CAC; Histidine).
{bg).8) {by}
if if]S] 3 (e.g.. T, C. A for ATT, ATC, ATA; Isoleucine),
G.R
(6)
(by), {bg}
if]S] = 4 (e.g., T, C, A, G for GCT/ C/ A/ G; Alanine), if|S] = 1 (e.g.. G for ATG; Methionine),
0,0
where S = (by {T, C. translate b2, by) a} is the set of third bases yielding the same amino acid a, and [S] is the set size: b1, b2 are the first two bases, translate maps codons to amino acids; {b,} E S is the green base list, selected the hase type with the highest watermark logits in S. For [S] = 2 (e.g.. b- b o=Hisiidine), one base is green (e.g., T for CAT) and one (e.g., bı= by=T, a=lsoleucine), one is green (e.g., C) and two red (e.g.. T, A); for |S] = 4 (e.g.. b,= by=C, a=Alanine), one is green and three red; and for S =
red (e.g., C for CAC); for [S|
(e.g.. bi=,, bT=T, a-Methionine), watermarking is skipped as no synonymous alternatives exist.
4.1.3 Adaptive Watermark Strength and Entropy-guided Watermark
Given the small vocabulary of DNA sequences (A, C, T, G) and the instability of autoregressive DNA language models, where excessive watermarking may produce invalid sequences such as repeated motifs or model corruption, DNAMark employs optimization strategies to balance detectability and sequence quality. Specifically, we introduce two optimization strategies: Adaptive Watermark Strength and Entropy- guided Watermarking. The Adaptive Watermark Strength strategy dynamically adjusts the watermark logit strength, 8, using an Exponential Moving Average (EMA) [2] based on the current z-score, 2t, which measures the statistical significance of the watermark signal (i.e., green base frequency in green/red lists
(44) ). The strength is smoothly updated as weighted average of
the current strength within a target range [Zmin: 2max] The adjustment is defined as:
2min
Zt
if zt < Zmin:
adj Amin: Zmax)
if zmin S 2t S Amax
max 2z if zz > 2max
and 8 is smoothly updated as a weighted average of the current strength and target adjustment:
5i+1 = (1 - (1- + 3 max (ōmin; min (5mux 5 + x. adj Zmin 2m)x)))
(8)
where & the strength at step 4, 3 E 10 controls the update speed, 6min &ma are bounds, and scales the adjustment. If 2 Smin, ō increases to enhance detectability; if > 2max, 5 decreases to preserve sequence quality; and 2, E [=min: =max], 5 remains stable. During generation, watermark logits, scaled by & are added to the original logits.
The Entropy-guided Watermarking strategy skips watermarking in low-entropy subsequences to avoid disrupting critical sequence patterns, such as regulatory motifs in UTRs. The entropy H of subsequence (e.g., a window of nucleotides) computed as:
H(s) BE(T,C.A,C)
Σ
p(b) logp(b).
where p(b) is the frequency of base b in s. If (() < Humeshold watermarking is skipped for that subsequence, ensuring minimal impact on functional elements like ribosome binding sites structural motifs. These strategies together enhance DNAMark's watermark, preserving sequence quality while maintaining robust detectability against mutations and adversarial edits.
4.2 CentralMark: Inheritable Watermarks from DNA to Proteins
Recent DNA language models not only learns DNA sequences but also captures the central dogma [3 flow of genetic information from DNA to RNA to protein [ 46). To extend the traceability of our DNA watermark beyond the nucleotide sequence, we introduce an inheritable watermark (CentralMark) detectable in both generated DNA and the translated protein sequence, critical feature to ensure biosecurity and ownership verification in synthetic biology applications where proteins are the functional output (Figure α (e)). Unlike DNAMark introduced above, which uses synonymous codon substitutions to preserve protein function, the inheritable watermark deliberately

---

alters amino acids by targeting the second base of codons in the coding DNA sequence (CDS), leveraging ESM [37] embeddings of the translated protein instead of Evo2 embeddings of DNA for both watermark generation and detection. We target the second base of each codon because predominantly determines the encoded amino acid's s identity or chemical properties, facilitating precise amino acid substitutions, and enables near-nonoverlapping green and red lists for amino acids based on second-base patterns (see Table 3). Specifically, for a codon c = (b), b2, ba) E VCDS, where b2 E {A, C, G) we define green/red list for the protein sequence by indexing the amino acid a = translate(c) to the second base b2:
Go = {a translate b2, b3) a, b2 9o), R₂ = {a trrnslaatebb. b2. b3) = a. b2 E Ro}.
(10)
where Go and R4 are the green and red sets of second bases (c.g., Go = G)), and translate maps codons to amino acids (e.g. Ga = {Leu, Pro, His, Gln, Arg, Val, Ala, Asp, Glu, Gly)). During watermarking, we bias the selection of codons with by E G to embed the signature, which propagates to the protein as biased distribution of amino acids in Ga. In CentralMark, the green sets of second bases are chosen by selecting the bases with the top-2 highest watermark logits. By embedding watermarks in DNA sequences based on their translated protein sequences, we enable subsequent detection of the protein sequences independently, without requiring additional DNA information.
4.3
Watermark Detection
The watermark detection of DNAMark and CentralMark follows KGW's calculating z score (Equation.
3
We need to note that the expected proportion of green tokens, Y may not be 0.5 in DNAMark and CentralMark due to the unique design, such as synonymous codon substitutions. Under the assumption of uniform codon usage, y is set 0.3559, 0.5, and 0.55 for DNAMark, CentralMark (DNA), and CentralMark (Protein) respectively. The details are included in the Appendix. F
5
Experiments
5.1 Experiment Settings
BenchMark Construction To construct a biologically grounded benchmark for evaluating DNA watermarks, we curated a set of therapeutically important protein-coding genes from Homo sapi- (Human) and existing drug modalities. These genes were selected based their established relevance in clinical and pharmaccutical contexts, encompassing categories such as cytokines (e.g.. IL2 [61], TNF (51). growth factors (c.g.. VEGFA (36), EGF (27)) immune checkpoint proteins (e.g., PDCD1 (60]. CD274 19). apoptosis regulators (e.g.. TP53 41 BCL2 65 )) oncogenes (e.g..
KRAS 577. BRAF (17), antiviral effectors (e.g., IFNAI 45
TLR3 3. coagulation factors (e.g..
F8 (64) F2 688), and other categories relevant to disease and therapy. For each gene, we queried the NCBI RefSeq database (50) retrieve validated coding DNA sequences (CDS) with canonical start and stop codons. We integrated secondary structure annotations (helix, B-strand, loop) from UniProt [66] to ensure structural context. Monomeric proteins with varied secondary structures were selected, constructing benchmark with 400 DNA sequences (More details in Appendix. C. In Case Study, we explored watermarking CRISPR-Caste with both coding and non-coding regions.
Attacks To evaluate the robustness of our proposed watermarking scheme, we subjected the watermarked DNA sequences to a series of simulated genetic alterations, mimicking common evolutionary and mutational processes. These in silico attacks comprised three distinct types of modifications: (1) Synonymous Codon Substitutions replace codons with alternatives that encode the same amino acid [14] 48) (2) Nucleotide Substitutions means changing randomly seleted nucleotides to other types in DNA 54
67 which can lead to either synonymous or non-synonymous codon changes; and (3) Insertions and deletions (Indels), are structural variants that add or remove nucleotides. Here we consider add or remove codons 43 44). These attacks are performed at a frequency of 5% across the sequence to simulate harsh test for the watermark's 's detectability and
robustness (natural mutation frequency 10-3 3 10 [6 20
Evaluations For each DNA sequence, we use the first half as prompt to the DNA language
models and generate the rest for 5 times. Inspired by previous works on L.MM watermark [39] [77), report the detection True positive rates at different false positive rates (1 % and 10%) to avoid the
7

---

ga col bettsa
(a)
(b)
(c)
(d)
Figure 2: (a) & (b) Generated DNA sequence quality measured by Sequence Identity (the higher the better) and Degeneracy Score (the lower the better). (c) Ablation studies of Entropy Guidance, Adaptive 8 with EMA, Aligmment and Normalization loss, and the watermark model. We perform 3-time generations for each model and show the standard deviation. (d) Applying DNAMark to different DNA language models and measuring the watermark detection Fl score. mD; megaDNA.
impact detection thresholds (r). To assess the quality of generated DNA sequences, we compute the Sequence Identity the ground truth, where higher values indicate better alignment, and the Degeneracy Score, defined as the percentage a sequence covered by repetitive substrings longer than four nucleotides, where lower values are preferable, following Evo (46).
DNA Language Models and Baselines We evaluate DNAMark and CentralMark on the latest and largest DNA language models, Evo 46) and Evo2 (7B, and 40B) [ Our methods can also be applied other DNA models. Hyperparameters 0.5, mmxx = 3.5, 2min = 2.5, 2max 4.0, Hahrestold = 2.0, and the Adam optimizer (Ir=le-3) is used for training (Selected Hyperparamter analysis in Figure 4 We adapt KGW with 1, 2, and 4 codon window sizes to DNA as a baseline. All experiments are conducted on Tesla H100 GPUs.
set to Ao = 20, A 10, 0.1, 6min
5.2 Results and Robustness Analysis
In [ we compare the performance of DNAMark and CentralMark, detected using DNA and pro- tein sequences. against KGW-1, KGW-2, and KGW 44 under various attack scenarios. Watermarking and detecting DNA sequences is notably more challenging than in natural language models, where methods like KGW achieve near- 100% TPR for texts (34), compared to only 70-80% TPR for DNA. We identify two primary reasons for this disparity: (1) DNA's limited vocabulary of four nucleotides (A, C, G, T), versus tens of thousands of tokens in natural language models, severely constrains green/red list assignments, reducing the watermark's statistical distinctiveness. (2) DNA language models cxhibit greater brittleness than large language models (LLMs), showing high sensitivity to perturbations in their output distributions. When the watermark strength ó is excessive, overly biases nucleotide selection, leading to model collapse (e.g., generating repetitive motifs like AAAAA), which compromises both sequence quality and watermark detectability.
Across all attack conditions, DNAMark and CentralMark consistently outperform KGW baselines in TPR and Fl scores at both 1% and 10% FPR. The detection F1 of DNAMark and CentralMark are all above 0.85. CentralMark (DNA) achieves the highest performance in most cases, followed closely by CentralMark (Protein) and DNAMark. The unique design of CentralMark makes the watermark detectable in both the generated DNA and the translated protein. The robustness of DNA.Mark and MantralMark is due their use of embeddings (Evo2, ESM), which capture functional/semantic similarity, making watermarks robust even with attacks. For instance, DNAMark and CentralMark achieve high TPR and Fl scores under synonymous codon substitutions, these changes preserve amino acid sequences and minimally affect the embeddings.
Comparing different attacks, we observe that Nucleotide Substitutions and Indels are the most strong attacks: Substitutions can lead to non-synonymous codons, and Indels can disrupt sequence patterns critical for watermark integrity. For example, the TRP of CentralMark with Indels drops to around 76%, highlighting the severity of these attacks. Nevertheless, DNAMark and CentralMark outperform all baselines. Future work will focus on enhancing robustness to such challenging attacks.
8

---

Table We compared the performance our watermarking methods, DNAMark and CentralMark (DNN/Protein), with baselines, including KGW-k [34, with DNA language model Evo2-7B [8. Tests evaluated watermark detection accuracy under no attack, synonymous codon substitution, Nucleotide Substitutions, and insertion-deletion (Indels) attacks.
No attack
Synonymous Codon Substitution
Method
1% FPR
10% FPR
1% FPR
10% FPR
TPR
F1
TPR
F1
TPR
F1
TPR
F1
KGW-1
0.765
0.862
0.805
0.845
0,580
0.729
0.756
0.815
KGW-2
0.770
0.865
0.820
0.854
0.545
0.701
0.740
0.805
KGW-4
0.774
0.868
0.817
0.852
0.371
0.537
0.520
0.642
DNAMark
0.845
0.911
0.915
0.908
0.820
0.896
0.896
0.898
CentralMark (DNA)
0.875
0.928
0.920
0.911
0.854
0.916
0.910
0.905
CentralMark (Protein)
0.868
0.924
0.922
0.912
0.860
0.920
0.904
0.902
Nucleotide Substitutions
Indels
Method
1% FPR
10% FPR
1% FPR
10% FPR
TPR
F1
TPR
FI
TPR
F1
TPR
KGW-1
0.520
0.680
0.710
0.785
0.515
0.675
0.723
0.794
KGW-2
0.505
0.667
0.658
0.749
0.477
0.642
0.645
0.739
KGW-4
0.330
0.493
0.551
0.668
0.339
0.503
0.497
0.623
DNAMark
0.808
0.902
0.886
0.892
0.795
0.878
0.860
0.877
CentralMark (DNA)
0.840
0.908
0.890
0.894
0.765
0.862
0.850
0.872
CentralMark (Protein)
0.825
0.900
0.885
0.892
0.759
0.858
0.832
0.861
5.3 Generation Quality and Ablation Studies
It is important to keep the sequence quality when watermarking DNA for practical use. In Figure 2 (a) & (b), we show the Sequence Identity to the ground truth and the Degeneracy Score of the generated DNA sequences by different watermark methods. Compared with KGW, DNAMark and CentralMark shows more aligmment with no watermark, indicating higher generation quality. This can be attributed to the sparse watermark adapted to DNA and unique methods such as synonymous codon substitution of DNAMark, minimizing the side-effects on sequence quality. In Figure (c). we did ablation studies of various components in DNAMark. Generally, Adaptive watermark strength with EMA and the watermark model are most critical to the successful watermark detection.
5.4 Generalization to Different DNA Models and Time Complexity
In Figure (d), we observe that DNAMark demonstrates robust watermark detection across range of DNA language models. Using models of varying sizes- megaDNA (145M and 277M parameters), Evo2 (IB, 7B, and 40B), and Evol (7B)-DNAMark achieves Fl scores from 0.851 to 0.919. Smaller models, such as megaDNA- 145M (F1=0.851) and 277M (F1=0.855), deliver respectable detection accuracy, but are limited by reduced generation capability. Larger models like Evo2-7B (F1=0.911) and Evo2-40B (F1=0.919) excel, leveraging high-capacity embeddings to enhance generation quality and watermark detection. We further measure the generation time cost of DNAMark and CentralMark. comparing them to a baseline with no watermark generation. The time complexity increases by approximately 30% (Table attributable the compact size of the watermark model.
5.5
Case Study of Watermarking CRISPR-Cass System
To show the practical application in gene editing, we utilized the Evo model (evo-1-8ke (evo-1-8k-crispr)) to generate the CRISPR-Cas [1] 12 DNA sequences, embedding watermark during generation
using CentralMark. Following 466), we use Prodigal 32 to extract Cas9 CDS, MinCED
6 to
detect CRISPR arrays, and AlphaFold3 (AF3) 2 to predict the structure. Figure 3 visualizes the generated watermarked Cas9 aligned with the wild-type SpCas9 crystal structure (PDB ID: 4008). The generated sequence achieves TM-score of 0.6802, indicating high structural alignment, and

---

Z-score of 5.41, confirming strong watermark detectability. These results demonstrate the efficacy of watermarking Evo-generated CRISPR-Cas' DNA sequences with minimal impact on biological quality.
6 Conclusions
SpCas8 (PDB: 4005) Contra/Mark + Evo (AF3)
In this paper, we tackle the pressing biosecurity challenges arising from DNA language models, which hold immense po- tential for genetic engineering but also pose dual-use risks by enabling the creation of harmful biological agents. To counter these risks, we propose DNAMark, watermarking method that uses synonymous codon substitutions to embed robust, funetion-preserving watermarks in DNA sequences, and Cen- tralMark, an advanced technique that generates inheritable watermarks detectable in both DNA and translated proteins. Future work should explore watermark schemes independent of green/red lists to enhance adaptability, investigate their ef- fects on UTRs for regulatory insights, and validate DNAMark and CentralMark through wet lab experiments. These steps are vital to responsibly balance genetic technology innovation with biosecurity.
TM Score: Waterma's Score:
Figure 3: Predicted structure of Evo- desinged Cas9 with CentralMark.
References
[1] Common mechanism ibbis. http:///abbaaabb/oorrroototooooa cessed: 2025-04-27.
Ac-
[2] Josh Abramson, Jonas Adler, Jack Dunger, Richard Evans, Tim Green, Alexander Pritzel, Olaf Ronneberger, Lindsay Willmore, Andrew Ballard, Joshua Bambrick, et al. Accurate structure prediction of biomolecular interactions with alphafold 3. Nature, pages 1-3, 2024.
[3] L. Alexopoulou, A. C. Holt, R. Medzhitov, and R. A. Flavell. Recognition double-stranded RNA and activation of NF-xb by Toll-like receptor 3. Nature, 413(6857):732-75555 2001.
[4] Ziga Avsec, Vikram Agarwal, Daniel Visentin, Joseph R Ledsam. Agmieszka Grabska- Barwinska, Kyle R Taylor, Yannis Assael, John Jumper, Pushmeet Kohli, and David R Kelley. Effective gene expression prediction from sequence by integrating long-range interactions. Nature methods, 18(10):1 1000))1999-2333 2021.
[5] David Baker and George Church, Protein design meets biosecurity. Science, 383(6681) 2024.
[6] Charles Bland, Teresa L Ramsey, Fareedah Sabree, Micheal Lowe, Kyndall Brown, Nikos C Kyrpides, and Philip Hugenholtz. Crispr recognition tool (crt): tool for automatic detection of clustered regularly interspaced palindromic repeats. BMC bioinformatics, 8:1-8, 2007.
[7] Doni Bloomfield, Jaspreet Pannu, Alex W Zhu, Madelena Y Ng, Ashley Lewis, Eran Bendavid, Steven M Asch, Tina Hernandez-Boussard, Anita Cicero, and Tom Ingleshy. Ai and biosecurity: The need for governance. Science, 385(671 1):831-833 2024.
[8] Garyk Brixi, Matthew Durrant, Jerome Ku, Michael Poli, Greg Brockman, Daniel Chang, Gabriel A Gonzalez, Samuel H King, David B Li, Aditi T Merchant, et al. Genome modeling and design across all domains of life with evo 2. bioRxiv, pages 2025-02, 2025.
[9] Yanshuo Chen, Zhengmian Hu. Yihan Wu, Ruibo Chen, Yongrui Jin, Mareus Zhan, Chengjin Xie. Wei Chen, and Heng Huang. Enhancing privacy in biosecurity with watermarked protein design. Bioinformatics, page btaf141, 2025.
[10] George M Church, Yuan Gao, and Sriram Kosuri. Next-generation digital information storage in dna. Science, 628 2012.
10

---

[11] Le Cong, F Ann Ran, David Cox, Shuailiang Lin, Robert Barretto, Naomi Habib, Patrick D Hsu, Xuebing Wu, Wenyan Jiang, Luciano Marraffnni, al. Multiplex genome engineering using crispr/cas systems. Science, 839(6121):819-9888 2013.
[12] Le Cong and Feng Zhang. Genome engineering using crispr-cas9 system. In Chromosomal mulagenesis, pages 197-217. Springer, 2014.
[13] Francis Crick. Central dogma of molecular biology. Nature, 227(5258):561-560 1970.
[14] Francis H. C. Crick. Codon-ane antiiooon pairing: the wobble hypothesis. Journal of Molecular Biology, 19(2):548 555, 1966.
[15] Hugo Dalla-Torre, Liam Gonzalez, Javier Mendoza-Reville Nicolas Lopez Carranza, Adam Henryk Grzywaczewski, Francesco Oteri, Christian Dallago, Evan Trop, Bernardo de Almeida, Hassan Sirelkhatim, et al. Nucleotide transformer: building and evaluating robust foundation models for human genomics. Nature Methods, 22(2):287-297, 2025.
[16] Sumanth Dathathri, Abigail See, Sumedh Ghaisas, Po-Sen Huang, Rob McAdam, Johannes Welbl, Vandana Bachani, Alex Kaskasoli, Robert Stanforth, Tatiana Matejovicova, et al. Scalable watermarking for identifying large language model outputs. Nature, 634(8035): 818 11--838, 2024.
[17] H. Davies, G. Bignell, C. Cox, Stephens, S. Edkins. S. Clegg, J. Teague, Woffendin. M. Garnett, W. Bottomley, N. Davis, E. Dicks, R. Ewing, Y. Floyd, K. Gray, S. Hall, R. Hawes, J. Hughes, Kosmidou, A. Menzies, C. Mould, Parker, C. Stevens, Watt, S. Hooper, R. Wilson, H. Jayatilake, B. A. Gusterson, C. Cooper, J. Shipley, D. Hargrave, K. Pritchard- Jones, N. Maitland, G. Chenevix- -rench,,
Bigner, G. Palmieri, A. Flanagan, A. Nicholson, J. W. C. Ho, S. Y. Leung, S. T. Yuen, B. L. Weber, H. F. Seigler, T. L. Darrow, H. Paterson, R. Marais, J. Marshall, R. Wooster, M. R. Stratton, and P. A. Futreal. Mutations of the BRAF gene in human cancer. Nature, 417(6892)9999-5555 2002.
J. Riggins,
Cossu,
[18] Sajib Acharjee Dip, Uddip Acharjee Shuvo, Tran Chau, Haoqiu Song, Petra Choi, Xuan Wang, and Liqing Zhang. Patholm: Identifying pathogenicity from the dna sequence through the genome foundation model. arXiv preprint arXiv:2406. 13133, 2024.
[19] H. Dong, G. Zhu, K. Tamada, and L. Chen. B7-h1, a third member of the b7 family, co- stimulates t-cell proliferation and interleukin-Il 10 secretion. Nature Medicine, 1662)11365- 1999.
[20] John W. Drake, Brian Charlesworth, Deborah Charlesworth, and James F. Crow. Rates of spontaneous mutation. Genetics, 148(4):1667-1666 1998.
[21] Andy Extance. How dna could store all the world's data. Nature, 537(7618), 2016.
[22] Jaiden Fairoze, Sanjam Garg, Somesh Jha, Saeed Mahloujifar, Mohammad Mahmoody, and Mingyuan Wang. Publicly-detectbbee watermarking for language models. arXiv preprint arXiv:2310. 18.491,,, 2023.
[23] Jigang Fan, Zhenghong Zhou, Ruofan Jin, Le Cong, Mengdi Wang, and Zaixi Zhang. Safepro- tein: Red-teaming framework and benchmark for protein foundation models. arXiv preprint arXiv:2509.088 033877 2025.
[24] Pierre Fernandez, Antoine Chaffin, Karim Tit, Vivien Chappelier, and Teddy Furon. Three bricks to consolidate watermarks for large language models. 2023 IEEE International Workshop on Information Forensics and Security (WIFS), pages 1-6. IEEE, 2023.
[25] Yu Fu, Deyi Xiong, and Yue Dong. Watermarking conditional text generation for ai detection: Unveiling challenges and semantic-aware watermark remedy. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 18003-18011, 2024.
[26] Nick Goldman, Paul Bertone, Siyuan Chen, Christophe Dessimoz, Emily M LeProust, Botond Sipos, and Ewan Birney. Towards practical, high-capacity, low-maintenance information storage in synthesized dna. nature, 494(74355:77 2013.

---

[27] H. Gregory. Isolation and structure of urogastrone and its relationship to epidermal growth factor. Nature, 257(5524):325-327, 1975.
[28] Batu Guan, Yao Wan, Zhangqian Bi, Zheng Wang, Hongyu Zhang, Pan Zhou, and Lichao Sun. Codeip: A trammar-guudder multi-bit watermark for large language models of code. arXiv preprint arXiv:2404.15633 2024.
[29] David Haynes, Steven Comn, and Ganesh Kumar Venayagamoorthy. An exponential moving average algorithm. In 2012 IEEE Congress on Evolutionary Computation, pages 1-8. IEEE, 2012.
[30] Zhengmian Hu, Lichang Chen, Xidong Wu, Yihan Wu, Hongyang Zhang, and Heng Huang. Unbiased watermark for large language models. arXiv preprint arXiv:2310. 10.669,, 2023.
[31] Ryan C Hunt, Vijaya I. Simhadri, Matthew landoli, Zuben Sauna, and Chava Kimchi-Sarfan Exposing synonymous mutations. Trends in Genetics, 30(7):308-32 2014.
[32] Doug Hyatt, Gwo-Liang Chen, Philip F LoCascio, Miriam L Land, Frank W Larimer, and Loren Hauser. Prodigal: prokaryotic gene recognition and translation initiation site identifica- tion. BMC bioinformatics, 11:1-11, 2010.
[33] Yanrong Ji, Zhihan Zhou, Han Liu, and Ramana V Davuluri. Dnabert: pre-trained bidirectional encoder representations from transformers model for languaa in genome. Bioinformatics, 37(15):211222200, 2021.
[34] John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, lan Miers, and Tom Goldstein. A watermark for large language models. In International Conference on Machine Learning, pages 17061-17084. PMLR, 2023.
[35] John Kirchenbauer, Jonas Geiping, Yuxin Wen, Manli Shu, Khalid Saifullah, Kezhi Kong, Kasun Fermando, Aniruddha Saha, Micah Goldblum, and Tom Goldstein. On the reliability of watermarks for large language models. arXiv preprint arXiv:2306. 04634,, 2023.
[36] D. W. Leung, G. Cachianes, W. J. Kuang, D. V. Goeddel, and N. Ferrara. Vascular endothelial growth factor a secreted angiogenic mitogen. Science, 130644493::06110000 1989.
[37] Zeming Lin, Halil Akin, Roshan Rao, Brian Hie, Zhongkai Zhu, Wenting Lu, Nikita Smetanin, Robert Verkuil, Ori Kabeli, Yaniv Shmueli, et al. Evolutionary-ssale prediction of atomic-level protein structure with a language model. Science, 379(6633)
2023.
[38] Aiwei Liu, Leyi Pan, Xuming Hu, Shuang Li, Lijie Wen, Irwin King, and S Yu Philip. An un- forgeable publicly verifiable watermark for large language models. In The Twelfth International Conference on Learning Representations, 2023.
[39] Aiwei Liu, Leyi Pan, Xuming Hu, Shiao Meng, and Lijie Wen. A semantic invariant robust watermark for large language models. In The Twelfth International Conference on Learning Representations, 2024.
[40] Yijian Lu, Aiwei Liu, Dianzhi Yu, Jingjing Li, and Irwin King. An entropy- based text water- marking detection method. arXiv preprint 2rXhv:2403.13485 2024.
[41] G. Matlashewski, P. Lamb, D. Pim, J. Peacock, L. Crawford, and S. Benchimol. Isolation and characterization of human p53 edna clone: expression of the human p53 gene. The EMBO 1984.
Journal, 3(13):3257-33))
[42] Aditi Merchant, Samuel H King, Eric Nguyen, and Brian L Hie. Semantic mining of functional de novo genes from genomic language model. bioRxiv, pages 2024-12 12, 2024.
[43] Ryan E. Mills, Charles T. Luttig, Christine E. Larkins, Ashley Beauchamp. Cissy Tsui, W. Stephen Pittard, and Scott E. Devine. An initial map of insertion and deletion (indel) variation in the human genome. Genome Research, 16(9):1188 182-1119, 2006.
[44] M. Mullaney, R. Mills, W. S. Pittard, and S. E. Devine. Small insertions and deletions (indels) in human genomes. Human Molecular Genetics, 19(12) 2010.
12

---

[45] S. Nagata, H. Taira, A. Hall, L. Johnsrud, M. Streuli, J. Eesödi, W. Boll, K. Cantell, and C. Weissmann. Synthesis e, coli of polypeptide with human leukocyte interferon activity. Nature, 284(5754)3316-22,, 1980.
[46] Eric Nguyen, Michael Poli, Matthew G Durrant, Brian Kang, Dhruva Katrekar, David B Li, Liam Bartie, Armin W Thomas, Samuel H King, Garyk Brixi, et al. Sequence modeling and design from molecular genome scale with evo. Science, x86(6723)xcad09336 2024.
[47] Eric Nguyen, Michael Poli, Marjan Faizi, Armin Thomas, Michael Wornow Callum Birch- Sykes, Stefano Massaroli, Aman Patel, Clayton Rabideau, Yoshua Bengio, et al. Hyenadna: Long-range genomic sequence modeling at single nucleotide resolution. Advances in neural information processing systems, 36:43177 177-42217,,,, 2023.
[48] M. Nirenberg, Leder, M. Bernfield, R. Brimacombe, J. Trupin, Rottman, and C. O'Neal. RNA Codewords and Protein Synthesis, VII. On the General Nature of the RNA Code. Proceed- ings of the National Academy of Sciences of the United States of America, 5365:1161--118,, 1964.
[49] Nuclear Threat Initiative. Developing guardrails for ai biodesign tools. Online report, November 2024. Accessed: 2025-05-12.
[50] N. A. O'Leary, M. W. Wright, R. Brister, S. Ciufo, D. Haddad, R. Vcieh,,, B. Rajput,
B. Robbertse, B. Smith-Whitee D. Ako-Adjei, A. Astashyn, A. Badretdin, Y. Bao, O. Blinkova,
B. Brover, K. Chetvernin, J. Choi, E. Cox, O. Ermolaeva, C. M. Farrell, T. Goldfarb, T. Gupta,
D. Haft, E. Hatcher, K. Hlavina, V. S. Joardar, V. K. Kodali, W. Li, D. Maglott, P. Masterson, K. M. McGarvey, M. R. Murphy, K. O'Neill, S. Pujar, L. O. Rangwala, D. Rausch, L. D. Riddick, C. Schoch, K. Shkeda, S. S. Storz, H. Sun, F. Thibaud-Nissen, I. Tolstoy, R. E. Tully, R. Vatsan, Wallin, D. Webb, W. Wu, M. Landrum, A. Kimchi, T. Tatusova, M. DiCuccio, P. Kitts, K. D. Pruitt, and J. Ostell. Reference sequence (RefSeq) database at NCBI: current status, taxonomic expansion, and functional annotation. Nucleic Acids Research, 44(D1))D733-DD4 January 2016.
[51] D. Pennica, G. E. Nedwin, S. Hayflick, P. H. Seeburg, R. Derynek, M. A. Palladino, W. J. Kohr, B. B. Aggarwal, and D. V. Goeddel. Human tumour necrosis factor: precursor structure, expression and homology lymphotoxin. Nature, 312(5996):724-722, 1984.
[52] Rami Puzis, Dor Farbiash, Oleg Brodt, Yuval Elovici, and Dov Greenbaum. Increased cyber- biosecurity for dna synthesis. Nature Biotechnology. 38(1)):1379-133) 2020.
[53] Jie Ren, Han Xu, Yiding Liu, Yingqian Cui, Shuaiqiang Wang, Dawei Yin, and Jiliang Tang. A robust semantics-based watermark for large language model against paraphrasing. arXiv preprint arXiv:2311.0877 2023.
[54] Ravi Sachidanandam, Dror Weissman, S. C. Schmidt, J. M. Kakol, L. D. Stein, G. Marth, S. Sherry, J. C. Mullikin, B. J. Mortimore, D. L. Willey, S. E. Hunt, C. G. Cole, C. Coggill, C. M. Rice, Z. Ning, J. Rogers, D. R. Bentley, P.-Y. Kwok, E. R. Mardis, R.-F. Yeh, B. Schultz, L. Cook, Davenport, M. Dante, Fulton, L. Hillier, R. H. Waterston, D. McPherson, B. Gilman, S. Schaffner, W. J. Van Etten, D. Reich, J. Higgins. M. J. Daly, S. Gnerre, E. S. Lander, and D. for The International SNP Map Working Group Altshuler. A map of human genome sequence variation containing 1.42 million single nucleotide polymorphisms. Nature, 409(6822):9288 993, 2001.
[55] Melissa Sanabria, Jonas Hirsch, Pierre M Joubert, and Anna R Poetsch. Dna language model grover learns sequence context in the human genome. Nature Machine Intelligence, 6(8)9911- 923, 2024.
[56] Rafael Sanjuán, Miguel R. Nebot, Nicola Chirico, Louis M. Mansky, and Robert Belshaw. Viral mutation rates. Journal of Virology, 84(19):9733-974 2010.
[57] E. Santos, S. R. Tronick, S. A. Aaronson, S. Pulciani, and M. Barbacid. T24 human bladder carcinoma oncogene an activated form of the normal human homologue balb- and harvey- msv transforming genes. Nature, 298(5872) 1982.
13

---

[58] Michael Schwarz, Marius Welzel, Tolganay Kabdullayeva, Anke Becker, Bernd Freisleben, and Dominik Heider. Mesa: automated assessment of synthetic dna fragments and simulation of dna synthesis, storage, sequencing and per errors. Bioinformatics, 36(1 (11:13322-3322,, 2020.
[59] Bin Shao and Jiawei Yan. A long-context language model for deciphering and generating bacteriophage genomes. Nature Communications, 15(1):9392, 2024.
[60] T. Shinohara, M. Taniwaki, Y. Ishida, M. Kawaichi, and T. Honjo. Structure and chromosomal localization of the human pd-1 gene (pdedl). Genomics, 23(3):704-766, 1994.
[61] T. Taniguchi, H. Matsui, T. Fujita, C. Takaoka, N. Kashima, R. Yoshimoto, and J. Hamuro. Structure and expression of a cloned cdna for human interleukin-2. Nature, 302(5906)330-33100 1983.
[62] Robert W Tayloor and Doug M Turnbull. Mitochondrial dna mutations in human disease. Nature Reviews Genetics, 6(5):389-403) 2005.
[63] Kristel Tjandra. Built-in safeguards might stop ai from designing bioweapons, April 2025. Accessed: 2025-05-05.
[64] J. J. Toole, J. L. Knopf, J. M. Wozney, L. A. Sultzman, J. L. Buecker, D. D. Pittman, R. J. Kaufman, E. Brown, C. Shoemaker, E. C. Orr, G. W. Amphlett, W. B. Foster, M. L. Coe, G. J. Knutson, D. N. Fass, and R. M. Hewick. Molecular cloning of a cDNA encoding human antihaemophilic factor. Nature, 312(5992)3342-347, 1984.
[65] Y. Tsujimoto, J. Cossman, Jaffe, and M. Croce. Involvement of the bel-2 gene human follicular lymphoma. Science, 228(4706): 144-0004):440-14333 1985.
[66] UniProt Consortium. Uniprot: the universal protein knowledgebase in 2023. Nucleic Acids Research, 31(D1):D223DD533 January 2023.
[67] Alain Vignal, Denis Milan, Magali SanCristobal, and André Eggen. A review on snp and other types of molecular markers for animal genetics. Genetics Selection Evolution, 34(3)3275-305, 2002.
[68] A. Walz, D. Neweet-Emmett and W. H. Seegers. Amino acid sequence of human prothrombin fragments and Proceedings of the National Academy of Sciences of the United States of America, 74(5): 19111-9699977 1977.
[69] Lean Wang, Wenkai Yang, Deli Chen, Hao Zhou, Yankai Lin, Fandong Meng, Jie Zhou, and Xu Sun. Towards codable watermarking for injecting multi-bits information to 1lms. arXiv preprint arXiv:2307.15992, 2023.
[70] Mengdi Wang, Zaixi Zhang, Amrit Singh Bedi, Alvaro Velasquez, Stephanie Guerra, Sheng Lin-Gibson, Le Cong, Yuanhao Qu, Souradip Chakraborty, Megan Blewett, et al. A call for built-in biosecurity safeguards for generative ai tools. Nature Biotechnology, pages 1-3, 2025.
[71] Wei Wu, Qiuyi Li, Mingyang Li, Kun Fu, Fuli Feng, Jieping Ye, Hui Xiong. and Zheng Wang. Generator: A long-context generative genomic foundation model. arXiv preprint 2rX1v 2025.
[72] Yihan Wu, Zhengmian Hu, Hongyang Zhang, and Heng Huang. Dipmark: A stealthy, efficient and resilient watermark for large language models. 2023.
[73] Kooo Yoo, Wonhyuk Ahn, and Nojun Kwak. Advancing beyond identification: Multi-bit watermark for language models. arXiv preprint arXiv:2308.0022// 2023.
[74] Daoan Zhang, Weitong Zhang, Yu Zhao, Jianguo Zhang, Bing He, Chenchen Qin, and Jianhua Yao. Dnagpt: a generalized pre-trained tool for versatile dna sequence analysis tasks. arXiv preprint arXiv:2307.005628, 2023.
[75] Zaixi Zhang, Ruofan Jin, Guangxue Xu, Xiaotong Wang, Marinka Zitnik, Le Cong, and Mengdi Wang. Foldmark: Safeguarding protein structure generative models with distributional and evolutionary watermarking, bioRxiv pages 2024-10, 2025.
14

---

[76] Zaixi Zhang, Zhenghong Zhou, Ruofan Jin, Le Cong, and Mengdi Wang. Genebreaker: Jailbreak attacks against dna language models with pathogenicity guidance. arXiv preprint urXiv:2505.23839 2025.
[77] Xuandong Zhao, Prabhanjan Ananth, Lei Li, and Yu-Xiang Wang. Provable robust watermarking for ai-generated text. arXiv preprint arXiv:2306. 17439, 2023.
[78] Zhihan Zhou, Yanrong Ji, Weijian Li, Pratik Dutta, Ramana Davuluri, and Han Liu. Dnabert-
2: Efficient foundation model and benchmark for multi-species genome. arXiv preprint arXiv:2306. 15006, 2023.
15

---

A Broad Impacts
The socictal implications of DNAMark and CentralMark are profound and multifaceted. On the positive side, these watermarking techniques mitigate biosecurity threats by enabling researchers, regulators, and biosafety organizations track and verify the origins of synthetic DNA, deterring malicious applications such as the engineering of pathogens. This traceability fosters trust in syn- thetic biology, supporting advancements therapeutics, agriculture, and environmental solutions. Moreover, by establishing framework for responsible innovation, these methods could encourage international collaboration on biosecurity standards, strengthening global oversight of genetic tech- nologies. However, negative consequences must also be considered. The watermarking methods may not be entirely impervious to circumvention by sophisticated adversaries who could exploit vulncrabilities, such as eeverse-engineering watermarks introducing mutations to obscure them. This limitation risks fostering a false sense of security among stakeholders, potentially undermining trust in regulatory frameworks if breaches occur. Additionally, the computational and expertise barri- ers to implementing these watermarks could disproportionately burden smaller research institutions or developing nations, exacerbating inequities in access cutting- genetic technologies. In the future, we will further refine our watermark methods and establish a community to advance watermarking research and reduce the potential negative impacts.
16

---

B Codon-to-Amino-Acii Table
1d/2nd
C
A
G
UUU Phe
UCU Ser
UAU Tyr
UGU Cys
UUC Phe
UCC Ser
UAC Tyr
UGC Cys
U
UUA Leu
UCA Ser
UAA Stop
UGA Stop
UUG Leu
UCG Ser
UAG Stop
UGG Trp
CUU Leu
CCU Pro
CAU His
CGU Arg
CUC Leu
Pro
CAC His
CGC Arg
C
CUA Leu
CCA Pro
CAA Gin
CGA Arg
CUG Leu
CCG Pro
CAG Gin
CGG Arg
AUU lle
ACU Thr
AAU Asn
AGU Ser
AUC lle
ACC Thr
AAC Asn
AGC Ser
AUA Ile
ACA Thr
AAA Lys
AGA Arg
AUG Met
ACG Thr
AAG Lys
AGG Arg
GUU Val
GCU Ala
GAU Asp
GGU Gly
GUC Val
GCC Ala
GAC Asp
GGC Gly
G
GUA Val
GCA Ala
GAA Glu
GGA Gly
GUG Val
GCG Ala
GAG Glu
GGG Gly
Table Standard RNA codon table organized by the first two nucleotides. Each cell shows four codons sharing the same first two bases.
Second Acids
Isoleucine (Ile), Methionine (Me)), Threonine (Thr), Aspuragine (Asn), Lysine (Lys), Serine (Ser), Arginine (Ang)
Leucine (Leu), Proline (Pro), Histidine (His). Glutamine (Gln). Arginine (Arg)
Valine (Val), Alanine (Ala), Aspartic (Asp), Glutamic Acid (Glu), Glycine (Gly)
Phenylalanine (Phe), Leucine (1 (Leu), Serine (Ser), Tyrasine (Tyr), Cysteine (Cys), Tryptophan (Tip), Stop
Table 3: Second base to amino acid mapping for the standard genetic code. This table lists the amino acids corresponding each possible second base (A, G, T) in codons of the coding DNA sequence (CDS), used for CentralMark 's inheritable watermark, where the second base is modified to embed detectable signature in the translated protein.
3-Letter
1-Letter
3-Letter
1-Letter
3-Letter
1-Letter
Ala
A
Gly
G
Pro
P
Arg
His
Ser
S
Asn
N
lle
Thr
T
Asp
Leu
Trp
W
Cys
C
Lys
K
Tyr
Y
Glu
Met
Val
Gln
Q
Phe
F
Table 4: Amino Acid Three-Letter to One-Letter Code Mapping
17

---

C Therapeutic DNA Benchmark
Table 5: Statistics of CDS sequences in each therapeutic category.
Category
Count
Avg Length
Min Length
Max Length
Cytokines
15
556.20
282
759
GrowthFactors
77
665,88
180
3501
ImmuneCheckpoints
14
816.21
525
1578
Hormones
18
431.67
333
654
Apoptosis
848.90
471
1182
Enzymes
4101.10 31
912
7650
Coagulation
2630.33
651
7056
Transporters
3706.71
1479
4443
Oncogenes
1735.35
567
2424
Antiviral
2000.00
570
2715
Neurotrophins
28
1052.68
726
2391
Uncategorized
112
1784.22
255
5028
Table 6: Representative therapeutic genes by category.
Category
Genes
Cytokines
IL.2 IL6, IL10, TNF, IENG EGF, FGF1, VEGFA, PDGFA, TGEB1
GrowthFactors
OnnukeCheckpoints
PDCDI, CD274, CTLA4, LAG3
Hormones
INS, LEP, GHI, PTH
Apoptosis
BCL2, CASP3, TP53
Enzymes
JAK1, CDK4, MAPKI,
Coagulation
F8, P9, F2
Transporters
ABCBI, CFTR, SLC2AI
Oncogenes
KRAS, BRAF, MYC
Antiviral
IFNAI, IFNBI, TLR3
Neurotrophins
NGF, BDNE, NTRKI
D More Results of DNAMark and CentralMark
Watermarking Method
Evo(7B)
Evo(40B)
No Watermark
9.7
30.5
DNAMark CentralMark
12.4
37.2
13.2
40.5
Table 7: Generation times (in seconds) for producing 128-nucleotide DNA sequence using No Watermark, DNAMark, and CentralMark on Evo(7B) and Evo(40B) models. DNAMark and Central- Mark incur computational overhead due to obtaining embedding and watermark model computations.
18

---

E Calculation Details of y
E.1
Calculation of Expected Green Token Proportion (7) for DNAMark
In the DNAMark watermarking scheme, ? represents the expected proportion of green tokens (third bases in the green list 9) under the null hypothesis of no watermark, where the first two bases of codons are uniformly distributed. This calculation is performed for watermarkable positions, i.c..
codons with synonymous third bases [S] 2 2, as defined in Equation (6) and detailed in Appendix B The process is summarized as follows:
1. Identify watermarkable codons: For each codon prefix (b), b2), uniformly distributed over 16 possibilities (probability 1g), the synonymous set S {bs (T.C.A, G} translate b2. by) a} determines the number of third bases encoding the intended amino acid a. Excluding stop codons, the 61 sense codons yield 59 watermarkable codons: 32 with |S] = 4 (e.g., Alanine: GCT, GCC, GCA, GCG), 3 with |S| 3 (e.g.. Isoleucine: ATT, ATC, ATA), and 24 with |S| (e.g.. Histidine: CAT, CAC).
2. Assign green list probability: For each watermarkable codon, the green list g = (b,} contains one base from S, selected as the base with the highest watermark logits. Under the null hypothesis, the third base is chosen uniformly from S, so the probability of selecting the green base is [
3. Compute y: The expected proportion is the weighted average of 1 able codons, weighted by their counts:
over all watermark-
[S]
kizy (number of codons with |S| k) 1
total watermarkable codons
Calculating contributions: 32 for |S] 2. Total 8 + +1+ 12 21. With 59 watermarkable codons, y 59 0.3559.
for |S| 4,3 1 for |S| 3, and 24 x 1 12
This y value serves as the baseline for watermark detection, enabling the z-score calculation to identify the presence of watermark by comparing observed green base frequencies against this expected proportion.
E.2 Calculation of Expected Green Amino Acid Proportion (7) for CentralMark
In the CentralMark watermarking scheme, y represents the expected proportion of green amino acids in the translated protein sequence under the null hypothesis, assuming uniform distribution over the 20 standard amino acids. The watermark targets the second base of codons, with the green set Go comprising the two bases with the top-2 watermark logits from (A, C, G, T), as defined in Equation (10) and detailed in Table 3 Since Go is not fixed, we average over all possible pairs Go {{A, C), (A, G), (A, T), {C, G), (C,
The process is summarized as follows:
1. Identify green amino acids: For each G5, the green amino acids Go {a translate(b;, b2, ba) = a, by E Gr} are the union of amino acids associated with the two second bases, per Table (e.g.. g.g. Go {A, C) yields 11 amino acids).
2. Compute per-pair 7: For each Go. 7 probability 20 per amino acid. Values range from
Number unique acids in Go
reflecting the uniform 20 (c.g., (A, G)),
20
10 20
(c.g., GC,G)) to 12
3. Average y: Assuming equal likelihood for each Gb. the average is:
11
12
12
10
10
11
7 = 6
+
+
+
20 = 0.55.
20
20
20
20
20
20
This y serves as the baseline for detecting the CentralMark watermark in protein sequences, enabling z-score calculations to identify biased amino acid distributions.
19

---

Influence of Hyperparameter Selection
In Figure. we show the influence of mmaz the watermark detection Fl and sequence degeneracy score of DNAMark. We observe that too large 6 dmaz may lead to worse sequence quality measured by degeneracy, and Ómaz suitable range maximizes detection F1. experiments, we choose Smaz 3.5 as the default setting.
Vatemmak Delection (1) @ F3R-1N
0.50
800
0.22
0.322
0.78
125-
0752
2.50
275
350
325
100
2.50
235
300
355
3.90
375
4.25
Hyperparameter Gre.
Hypergerameler 6,s.
(a)
(b)
Figure 4: Hyperparamter analysis of 6max
G Details of Watermark Model
Our watermark model adopts an architecture similar to SIR 339, consisting of series of residual blocks with ReLU activation, as detailed the code. However, our implementation incorporates additional LayerNorm layers after each residual block to stabilize training and improve convergence. Notably, the imput embeddings for our model are derived from Evo2 (7B) and ESM2 (35M), leveraging their robust representations to enhance the model's ability to capture the biological semantics of DNA/protein sequences. To train the watermark model, we crawl 1000 random human coding sequences (CDS) from RefGen, subsample them to extract 20-length codons/amino acid embeddings with the Evo/Evo2 and ESM2 as input, and fine-tune the model for 200 epochs using the combination of alignment and normalization loss (Equation. 4 and (5) More details of code included at https: : anonymous. 4open. sci science/Ee DNA_ Watermark 1687 /RAAMEE, md
20

---

class ResidualBlock (nn. (nn. Module)
__init__ dim)
super (BesidualBlocck self)...init_.. O
self mn. Lineir (dim, dim)
self.rell nn Rn.Ue
def (sel, x):
out self (x(x) out self relu relu out return
12
class WatermarkModel . Module):
def ..init__ num_layer==4, input_dim=1024, hidden_dim=500
output_dim=4)
super (Tranfrrraff,,,llddll,, self) :alf)...init_...
15
self.layers an ModuleList
16
self norms = KoduleList
self self layers. append Linear (input_dim) hidden_dim))
norms append (nn (aetnndnnnnaaaaaae LayerNorm (hidden_dim))
19
for in range taum_aayers_... 2):
20
self. .ayers append (teesidialllllcciiddie.... self norms append (nn LayerNorm (hidden__dniddddd
21
self layers append (nn Linear (hidden dim, output_dim)) self norms append (nn LayerNorm (output__dt))
24
25
def (self x):
26
for in range (len (self., layers)) self layers (x)
I self norms (i)
70
return x
30
21

---

H
Case Study of CRISPR-Cas9 Design with CentralMark
Here, we show the designed Cas9 sequence with CentralMark Evo, aligned with the wild type. The total DNA similarity is 67.3%.
Marik:
NNKPYSIGE T
I II IIIII I
CouD Ref
DERKYSIOLDIC
11111 II.11 111:
CosD Ref
CentraUHari: 10
CLACK A IN
IIIII
11.
CouD
CentraUMark: 211
AILTD AAATAAAAIAIIIIITSAAATATTOOTOTOTA
204
CooD Ref
GO ROTGDEFAN N PA
203
X.w.aaa......................... 1..111
III 11 IIIII
CooD Ref
11:1111 . IIIII 1111:11-1
Baf
CentralMark: 01
 ::11)...1:
CosD
NA WAILR LL TTT.:///A......AAA.TTTTTTTTTTTTA
Figure Aligning CentralMark + Evo designed Cas9 the wild type Cas9 protein sequence.
22

---

EF CE -II-IIII-.... 1
CosS Ref
CentralMark: tE3
SKKKL AA
1111-11111 - 1
CentraUMark: an
ED EDREWIK 0 TETTTCTTTTTTTTTTTTTTTTTTTTTTTTTT
T
1-:1111111 IA
Coso Rof
CentraUMari: 703
WWW.LOLLKA..T.EEEWWEEEEEEEEEEEEE YEPEOIWEEPARE
1 1
1: II. 1: 1
:1 1.11:11111
CooD Ref
1NDDS ANDOSLIFKEED
1 11 1 1 1..1-111:.
LSOTDID C
CentratMark: on
CouD
L V E
CentratMerk: 90
AERGGL TANA://AA.......TTTTTTTTTTTTTTTA
IYTLKSNLVSRPRKERSS '6
DIIII 11S11191-1 1
CooD Ref
AE C
Figure 6: Aligning CentralMark + Evo designed Cas9 the wild type Cas9 protein sequence.
23

---

: IIIII
I
1-1-11E111
Coss Ref
YKVRE O
CentralMark:
2328
1 IITIIII
11: :
CentralMari: 3323
IITII H.G N CL TEA
2000
111I11-11
Coso Ref
KANSD<LIARK KD.
CentraUMaric 1293
2050
1II I1 .1.11 1 11-1.-..11 ID
CooD Ref
1 1 11 1.. 1 :
2............................... :1:
CentratMaric
LGAPAA LTT
T10
IIIII TI:LT .II IIIII
CocD
LCAPAGAFKYFD T T
Figure 7: Aligning CentralMark + Evo designed Cas9 the wild type Cas9 protein sequence.
24

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
The abstract and introductions clearly summaries the contributions of this paper.
Justification:
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification:
The authors discussed the limitations and potential future works in experiments and discussions.
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (c.g.. independence assumptions, noiseless settings, model sell-speciiiatiinn asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g. if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-tex, system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimesss.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
25

---

Answer: [NA]
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless whether the code and data are provided or not)?
Answer: [Yes]
Justification:
All the experimental settings are clearly described in the paper.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make clear how to reproduce that algorithm. (b) the contribution is primarily a new model architecture, the paper should describe the architccture clearly and fully.
(c) If the contribution is new model (e.g., a large language model), then there should either way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reprodueibility. the case of closed-source models, may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
26

---

Answer: [Yes]
Justification:
The paper provides data, code, and sufficient instructions to reproduce
the main results (attps://anonymon)) 4open. Sccience/rDDIA_aattrraazz.. 1 README.md)
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (kttps://nips.cm cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
7 /pips.cccpublic//uu.dde ss ssinisolicyyyy for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: The training and test details are specified in the experiments.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core the paper to a level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
Justification: Yes, the error bars are provided in figures.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
27

---

It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables figures symmetric error bars that would yield results that are out range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification:
The information on computer resources is provided experiments.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't 't make it into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics
Answer: [Yes]
Justification:
The research conducted in the paper conform the NeurlPS code of ethics.
Guidelines:
The answer NA means that the authors have reviewed the NeurlPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification:
The paper discusses the broad impacts in the introduction and conclusions.
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no socictal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
28

---

The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system Iearns from feedback over time, improving the efficiency and accessibility ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification:
All the related assets used in the paper well credited.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the patasets.paperesiii paperswi thcode. com datasets package should be provided. For popular datasets,
has curated licenses for some datasets. Their licensing guide can help determine the license dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if has changed) should be provided. If this information not available online, the authors are encouraged to reach out to the asset's 's creators.
29

---

13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: The benchmark datasets will be release after further screening and the related documentation with be provided.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/moodl as part of their submissions structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According the NeurIPS Code of Ethies, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Guidelines:
The answer NA means that the paper does involve crowdsoureing nor research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Question: Does the paper describe the usage of LLMs if is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, formatting purposes and does not impact core methodology, scientific rigorousness, originality of the research, declaration is not required.
30

---

Answer: [NA]
Justification:
The paper does not use LLMs as a component of the core method.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, non nta-standard components.
Please refer to our LLM policy / cc/ CC/Con/errencee//225/LLI for what should or should not be described.
31


Reviews:
[{"review_id": "2T0QcZqiLq", "reviewer": "Reviewer_sX4o", "summary": "This paper introduces two watermarking methods, DNAMark and CentralMark, based on Evo and ESM, to embed traceable signatures in synthetic DNA sequences generated by language models. DNAMark uses synonymous codon substitutions to preserve protein function, while CentralMark embeds inheritable watermarks that persist into the translated protein using protein embeddings. The authors evaluate their approach on a therapeutic DNA benchmark and demonstrate high watermark detectability under mutation simulations.", "questions": "1. On biological realism and validation: You mention that “DNA is susceptible to natural mutations, synthesis errors, and sequencing inaccuracies,” and simulate these effects at higher-than-natural rates. However, the current validation (e.g., a single AlphaFold prediction on Cas9) falls short of demonstrating real-world robustness towards *functional* consequences of these mutations. Have you considered evaluating watermark persistence in actual biological systems (through synthesis, expression, and functional assays) under selective pressure? This would substantially strengthen claims about robustness and practical use and greatly increase the rating of the paper. \n\n2. On adoption and governance: The success of watermarking for DNA depends heavily on its adoption. How do you envision this technique being used in practice? For instance, would synthesis providers require inclusion of a watermark, or could it be a regulatory mandate? Have you considered aligning with initiatives like IBBIS’s Common Mechanism or incorporating guidance from recent proposals such as “A call for built-in biosecurity safeguards for generative AI tools”? Or writing your own proposal?\n\n3. On model choices and detection strategy: Can you clarify your rationale for choosing ESM2-35M for CentralMark? Were other embedding models (e.g., larger ESM models, a VAE, MSA Transformer, etc etc) considered, and how might these impact watermark quality or robustness? Additionally, how were z-score thresholds selected, and how do you ensure they are biologically meaningful across diverse proteins or sequence contexts?\n\n4. Can you please align your generated sequence to the reference and not the other way around? The Cas9 reference sequence should be the reference that you're aligning your generated sequence to and would serve as important quality check (for instance if the generated sequences does not have H840 or D10, then we know that the sequence will not function enzymatically like the WT as a bare minimum check)", "limitations": "Can authors describe a bit more about potential ways this could be co-opted for negative use or how people could attempt to get around this?", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "Quality\n\nStrengths:\n- Proposes two novel watermarking strategies (DNAMark and CentralMark) tailored for biological sequence models.\n- Shows performance across different DNA LMs (e.g., Evo2-7B, Evo2-40B, megaDNA), demonstrating generalizability.\n- Quantitative benchmarks include F1 scores, TPRs at 1% and 10% FPR, sequence identity, and degeneracy scores (Fig. 2a-b, Table 1).\n- Authors mention \"Moreover, DNA is susceptible to natural mutations [61], synthesis errors, and sequencing inaccuracies\" and have interesting approaches to enforcing that (stratifying the watermark through the full sequence) and run some simulations at a way higher rate than biology to validating the watermark persists.\n\nWeaknesses:\n- Experimental validation is very weak. Their one case study on Cas9 watermarking uses only AlphaFold structure prediction and a TM-score, which is not a functional assay. This validation needs to be expanded if the authors are going to argue that their model works....The watermarking robustness claims rest heavily on simulation (in silico substitutions/indels) and not actual biological reality (i.e. resting a protein that they've made or doing thorough large scale evaluation of their method.)\n\n\n\nClarity\n\nStrengths:\n- The paper is relatively well written and clearly structured. The methods are broken down step-by-step (e.g., synonymous codon use in DNAMark vs second-base manipulation in CentralMark).\n- Equations and figures (e.g., Fig. 1d-e for DNAMark/CentralMark mechanisms) help communicate the watermarking process.\n- They provide a codon table and clear benchmark construction steps (Appendix C).\n\nWeaknesses:\n- Some jargon and logic jumps, especially in the embedding-based logit perturbation mechanisms, could lose readers without deep familiarity with DNA/protein LMs.\n- Lack of description in different model choices like ESM2-35M (Appendix G). Why is this the model authors choose instead of a different class of models or a different version of ESM2/3? \n- Detection strategies and the selection of z-score thresholds could be better contextualized in biological terms.\n- The novelty of inheritable watermarks in biology is interesting but authors need to mention how they would get people to adopt this / how it could be enforced...would it be like DNA synthesis companies regulating dangerous sequences people try to order? would people need to include a watermark in the libraries they order? how would you enforce that?\n\nSignificance\n\nStrengths:\n- this work is centered in biosecurity risks in synthetic biology with increasingly powerful DNA generative models and that is very important.\n- Embedding traceable watermarks in synthetic DNA/protein could become essential if generative bio models are ever regulated. And if this was regulated, certainly this technique would be one to keep an eye on.\n\nWeaknesses:\n- Adoption path is not seriously addressed. As I asked above: how will people be incentivized to use this? Will it be a regulatory mandate, or will synthesis providers require watermarked sequences?\n- Doesn’t propose a governance model or standardization path. Perhaps a Correspondence like \"A call for built-in biosecurity safeguards for generative AI tools\" or paper like \"Developing Guardrails for AI Biodesign Tools\"  would be nice to pair publish with this. I wonder if authors would also consider having this tool be available in something like https://ibbis.bio/our-work/common-mechanism/\n- It remains unclear if watermarking would withstand selection in evolving systems or under strong selective pressure.\n\nOriginality\n\nStrengths:\n- The application of watermarking to DNA and proteins is novel. Prior works focused on natural language or, recently, protein LMs alone.\nCentralMark is creative in that they embed watermarks positionally relevant places in the codons depending on their goal (like second or third nt)\n- They define a red/green token strategy in a biologically interpretable way (based on synonymous codons or amino acid types).\n\nWeaknesses:\n- Related works like Chen et al. (2025) on protein watermarking [9] are only briefly acknowledged. More comparison would have been helpful.\n- DNAMark’s synonymous codon approach is conceptually similar to prior watermarking logic (e.g., biased token selection using logits)—novel in application to biology, less so in core technique.\n- No counterexamples or attack strategies from adversaries are deeply explored.", "was_revised": true, "final_justification": "I change my score to a 4. If accepted, I encourage the authors to expand their evaluation in future work to include:\n\nExperimental assays to verify structural and functional fidelity\nRobustness testing under selection and adversarial attack\nIntegration into governance initiatives like IBBIS", "rebuttal": "We thank the reviewer for the helpful feedback and suggestions! As for the questions:\n\n**Q1**: Limited experimental verification:\n\n**R1**: We agree that the original CRISPR-Cas9 case study (Appendix H) provides strong but limited evidence. To address this, we performed additional structural and functional evaluations on 10 diverse proteins from our therapeutic DNA benchmark (e.g., cytokines like IL-2, enzymes like Cas12a, and antibodies like Herceptin; selected for variety in length and function). Using AlphaFold3 for structure prediction [2], we computed TM-scores between watermarked and ground-truth proteins. Results (new Table in revisions) show average TM-scores of 0.72 ± 0.05 for DNAMark and 0.68 ± 0.06 for CentralMark, indicating preserved folds. For function, we simulated in silico assays: e.g., binding affinity via docking scores (AutoDock Vina) for antibodies (average <5% loss in affinity). These confirm functional retention across categories.\n\n**Q2**: Jargon and Logic Jumps in Embedding-Based Logit Perturbation\n\n**R2**: To improve accessibility, we will revise these sections to include a high-level explanation: “Our watermarking adds subtle biases to DNA LM outputs, akin to digital signatures, using codon embeddings to preserve biological function while ensuring traceability.” We will also add a glossary in the appendix defining terms like “logit perturbation,” “codon-aware biasing,” and “ESM embeddings,” with intuitive analogies to text watermarking. A new figure will illustrate the perturbation process, mapping embeddings to codon choices, to bridge logic jumps.\n\n**Q3**: Lack of Description for ESM2-35M Choice (Appendix G)\n\n**R3**: We selected ESM2-35M for its balance of computational efficiency and robust protein embeddings, suitable for inheritable watermarks across the central dogma (Page 5). Compared to larger models like ESM2-650M or ESM3, ESM2-35M offers faster inference (10x speedup) with comparable semantic accuracy for proteins in our benchmark. We tested ESM2-650M in new experiments, finding marginal F1 improvement (+2%) but 5x higher latency, unsuitable for large-scale watermarking.\n\n**Q4**: Detection Strategies and Z-Score Thresholds Lacking Biological Context\n\n**R4**: Our detection strategy using z-scores (Page 7) is inspired by text watermarking but needs better biological framing. The z-score measures watermark signal strength against sequencing noise (e.g., indels, substitutions), reflecting codon bias preservation. For example, a z-score >2 ensures >95% confidence in detecting watermarks despite bio-noise, aligning with error rates in DNA synthesis (~1/1000 bases). We will revise: “Z-scores quantify watermark detectability under biological perturbations like sequencing errors; thresholds (e.g., 2) match synthesis error rates [1].”\n\n[1]Kosuri, S., & Church, G. M. (2014). Large-scale de novo DNA synthesis: technologies and applications. Nature Methods, 11(5), 499–507\n\n**Q5**: The Adoption path is not seriously addressed\n\n**R5**: To incentivize adoption, we propose leveraging patent and intellectual property (IP) protection, regulatory mandates, and additional strategies tailored to synthetic biology stakeholders. First, watermarking protects IP by embedding verifiable signatures in AI-generated DNA, enabling biotech firms and researchers to prove ownership in patent disputes or licensing agreements for therapeutics and enzymes (e.g., CRISPR designs). Second, regulatory mandates from governments (e.g., NIH, WHO) could require watermarks for all AI-generated DNA ordered through synthesis providers, aligning with biosecurity regulations like the International Gene Synthesis Consortium’s screening protocols. Non-compliance could result in synthesis denial or penalties, ensuring adoption. Third, synthesis providers could offer economic incentives, such as discounts or expedited processing for watermarked sequences, appealing to cost-sensitive users. Additionally, collaboration with organizations like IBBIS could standardize watermarking protocols, integrating them into synthesis pipelines as a default practice to reduce liability and enhance market trust.  Researchers could be incentivized by ethical transparency, as watermarks demonstrate responsible design, boosting credibility in publications and funding applications.\n\n**Q6**: Doesn’t propose a governance model or standardization path.\n\n**R6**: Thank you for your suggestion on a governance model and standardization path. We agree and propose a framework involving regulatory mandates (e.g., NIH/WHO requiring watermarks in AI-generated DNA) and incentives like IP protection for patenting. For standardization, we envision an open-source toolkit integrated with biosecurity platforms like IBBIS's Common Mechanism, ensuring uniform protocols.\n\nFor companion publications, we already have some and also have perspectives under submission. We are also organizing workshops to reach consensus across communities. Due to double blind policy, we cannot talk too much about them here. \n\n**Q7**: It remains unclear if watermarking would withstand selection in evolving systems or under strong selective pressure\n\n**R7**: Thank you for raising the concern about watermark robustness under evolutionary selection pressure, such as in microbial systems where sequences may mutate over generations. Our current experiments simulate biological perturbations like nucleotide substitutions and indels (Table 1), showing robust TPR (e.g., 0.795-0.840 at 1% FPR for DNAMark/CentralMark under indels), which mimic some aspects of selection-induced changes. However, due to limited time during the rebuttal period, we will further explore simulated selective evolution (e.g., multi-generation codon optimization in E. coli models) in future versions.\n\n**Q8**: On model choices and detection strategy: Can you clarify your rationale for choosing ESM2-35M for CentralMark?\n\n**R8**:We selected ESM2-35M for its balance of computational efficiency and robust protein embeddings, suitable for inheritable watermarks across the central dogma (Page 5). Compared to larger models like ESM2-650M or ESM3, ESM2-35M offers faster inference (10x speedup) with comparable semantic accuracy for proteins in our benchmark. We tested ESM2-650M in new experiments, finding marginal F1 improvement (+2%) but 5x higher latency, unsuitable for large-scale watermarking.\n\n**Q9**: Can you please align your generated sequence to the reference and not the other way around? \n\n**R9**: Sure, we will align the generated sequence to the reference and change the figures in the appendix. Because we cannot submit or revise figures/pdfs during rebuttal, we promise to update the alignment in our camera-ready version. \n\n**Q10**: More discussions of related works such as of Related Works like Chen et al. (2025)\n\n**R10**: Is brief. Chen et al.’s approach embeds watermarks in protein sequences, focusing on structural integrity but not inheritable DNA-to-protein traceability. To improve, we will expand the related works section (Page 2) to compare our methods explicitly: DNAMark leverages codon redundancy for DNA-level watermarking, while CentralMark extends to proteins via ESM embeddings, unlike Chen et al.’s protein-only focus. We will include more discussions in the revised paper."}, {"review_id": "AiQnWohLgK", "reviewer": "Reviewer_BZNY", "summary": "DNA language models have significantly improved human's ability to understand and design DNA sequences with high precision. These advancements come with dual-use risks, including the potential creation of pathogens, viruses, or bioweapons. The paper introduces two watermarking techniques, DNAMark and CentralMark, to address biosecurity challenges by reliably tracking designed DNA sequences.\nDNAMark uses synonymous codon substitutions to embed watermarks in DNA sequences while preserving their original function. CentralMark creates inheritable watermarks that transfer from DNA to proteins, ensuring detection across the central dogma (DNA to protein translation). Both methods leverage semantic embeddings to enhance robustness against natural mutations, synthesis errors, and adversarial attacks. Evaluations on a therapeutic DNA benchmark show F1 detection scores above 0.85 under various conditions, with over 60% sequence similarity to ground truth and degeneracy scores below 15%. A case study on the CRISPR-Cas9 system highlights CentralMark's practical utility in real-world applications. The work provides a critical framework for securing DNA language models, balancing innovation with accountability to mitigate biosecurity risks.", "questions": "1) The experimental section primarily compares the proposed methods against a single baseline (KGW) with different configurations (e.g., KGW-1, KGW-2, KGW-4). But KGW is published in ICML 2023, could the authors include additional and more recent watermarking methods for a broader comparison?\n\n2) Single-nucleotide tokenization (A, T, C, G) is commonly used in DNA language models for SNP tasks, but other methods like k-mer and BPE tokenization (e.g., GENERATOR, DNA-BERT2) are also widely discussed. Could the authors evaluate their method with these alternative tokenizations and provide experimental results?\n\n3) Could the authors expand the related work discussion to include additional DNA language models, such as HybriDNA and GENA-LM?", "limitations": "Yes", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\nThe novelty of the paper is good; this is among the first research efforts focusing on the safety issues of popular DNA language models.\nThe experimental design and execution are well-conceived and robust.\nThe paper is well-written and clearly presented.\n\nWeaknesses:\n1. More detailed experimental comparisons would be beneficial in justifying the advantages of this work.\n1)  In the experimental section, the authors primarily compare their proposed methods against a single baseline from LLM watermarks: KGW with different configurations (e.g., KGW-1, KGW-2, KGW-4). Since KGW is based on an ICML 2023 paper, could the authors consider including additional and more recent watermarking methods for a broader comparison?\n2)  While single-nucleotide tokenization (i.e., a vocabulary consisting solely of the four nucleotides: A, T, C, G) is commonly used in DNA language models for improved performance in SNP tasks, other tokenization methods such as k-mer tokenization and BPE tokenization are also widely discussed (e.g., GENERATOR and DNA-BERT2). Could the authors explore whether their method performs well with these alternative tokenization approaches? It would be particularly valuable if the authors could include experimental results to support this discussion.\n\n2. Potentially overlooks some recent related work on DNA language models, such as: \n1)  A DNA language model based on multispecies alignment predicts the effects of genome-wide variants, Benegas et al. \n2)  HybriDNA: A Hybrid Transformer-Mamba2 Long-Range DNA Language Model, Ma et al.\n3)  GENA-LM: a family of open-source foundational DNA language models for long sequences, Fishman et al.", "was_revised": true, "final_justification": "I finally recommend a \"accept\" score to the paper, as the authors have addressed my concerns with additional experimental results, demonstrating that their method works with newer baselines and is applicable to a wider range of tokenizers in DNA generative models. Furthermore, the inclusion of more advanced related work discussions enhances the completeness of the paper.", "rebuttal": "We thank the reviewer for the appreciation and valuable feedbacks! As for the questions:\n\n**Q1**: More recent watermarking methods for a broader comparison\n\n**R1**: Thanks for the suggestions! Here we compared with recent watermarking methods from ICLR 2024 and Nature 2024, while effective for large-vocabulary language models in text domains, underperform DNAMark and CentralMark in DNA sequence watermarking due to the inherent constraints of DNA's small four-nucleotide alphabet and the unique biological attacks it faces, such as synonymous codon substitutions, nucleotide substitutions, and insertion-deletions (indels).\n\n[1] Hu et al. Unbiased watermark for language models. ICLR 2024\n\n[2] Dathathri et al. Scalable watermarking for identifying large language model outputs. Nature 2024.\n\n| Method                  | No attack (1% FPR) TPR | No attack (1% FPR) F1 | No attack (10% FPR) TPR | No attack (10% FPR) F1 | Synonymous Codon Substitution (1% FPR) TPR | Synonymous Codon Substitution (1% FPR) F1 | Synonymous Codon Substitution (10% FPR) TPR | Synonymous Codon Substitution (10% FPR) F1 |\n|-------------------------|------------------------|-----------------------|-------------------------|------------------------|---------------------------------------------|-------------------------------------------|----------------------------------------------|--------------------------------------------|\n| Hu et al. [1]           | 0.790                  | 0.880                 | 0.840                   | 0.870                  | 0.600                                       | 0.750                                     | 0.780                                        | 0.830                                      |\n| Dathathri et al. [2]    | 0.780                  | 0.875                 | 0.830                   | 0.860                  | 0.570                                       | 0.720                                     | 0.760                                        | 0.820                                      |\n| DNAMark                 | 0.845                  | 0.911                 | 0.915                   | 0.908                  | 0.820                                       | 0.896                                     | 0.896                                        | 0.898                                      |\n| CentralMark (DNA)       | **0.875**              | **0.928**             | 0.920                   | 0.911                  | 0.854                                       | 0.916                                     | **0.910**                                    | **0.905**                                  |\n| CentralMark (Protein)   | 0.868                  | 0.924                 | **0.922**               | **0.912**              | **0.860**                                   | **0.920**                                 | 0.904                                        | 0.902                                      |\n\n| Method                  | Nucleotide Substitutions (1% FPR) TPR | Nucleotide Substitutions (1% FPR) F1 | Nucleotide Substitutions (10% FPR) TPR | Nucleotide Substitutions (10% FPR) F1 | Indels (1% FPR) TPR | Indels (1% FPR) F1 | Indels (10% FPR) TPR | Indels (10% FPR) F1 |\n|-------------------------|---------------------------------------|-------------------------------------|----------------------------------------|---------------------------------------|---------------------|-------------------|----------------------|--------------------|\n| Hu et al. [1]           | 0.550                                 | 0.700                               | 0.730                                  | 0.800                                 | 0.540               | 0.690             | 0.740                | 0.800              |\n| Dathathri et al. [2]    | 0.530                                 | 0.680                               | 0.700                                  | 0.780                                 | 0.510               | 0.660             | 0.710                | 0.770              |\n| DNAMark                 | 0.808                                 | 0.902                               | 0.886                                  | 0.892                                 | **0.795**           | **0.878**         | **0.860**            | **0.877**          |\n| CentralMark (DNA)       | **0.840**                             | **0.908**                           | **0.890**                              | **0.894**                             | 0.765               | 0.862             | 0.850                | 0.872              |\n| CentralMark (Protein)   | 0.825                                 | 0.900                               | 0.885                                  | 0.892                                 | 0.759               | 0.858             | 0.832                | 0.861              |\n\n**Q2**: Could the authors evaluate their method with these alternative tokenizations and provide experimental results?\n\n**R2**: Thank you for suggesting we adapt DNAMark and CentralMark to DNA language models based on different tokenization methods. Since DNABERT-2 is focusing on sequence understanding/prediction tasks and cannot be used for sequence generation, here we mainly did additional experiments on GENERATOR with 6-mer tokenization. To adapt DNAMark, we align synonymous codon substitutions to 6-mer tokens, perturbing logits within synonymous 6-mers to embed watermarks while preserving protein function. For CentralMark, we recalibrate ESM-based embeddings to map 6-mer tokens to protein-level watermarks, ensuring cross-dogma detectability. The new table (above) shows robust performance with GENERATOR (e.g., TPR 0.860 for CentralMark-DNA under no attack), slightly lower than Evo2-7B (0.875, Table 1) due to 6-mer’s coarser granularity and indel sensitivity, but still strong due to adaptive strength and entropy guidance.\n\n | Method                      | Tokenization | No attack (1% FPR) TPR | No attack (1% FPR) F1 | Synonymous Codon Substitution (1% FPR) TPR | Synonymous Codon Substitution (1% FPR) F1 | Nucleotide Substitutions (1% FPR) TPR | Nucleotide Substitutions (1% FPR) F1 | Indels (1% FPR) TPR | Indels (1% F1) |\n|-----------------------------|--------------|------------------------|-----------------------|---------------------------------------------|-------------------------------------------|---------------------------------------|-------------------------------------|---------------------|---------------|\n| DNAMark (GENERATOR)         | K-mer (6)    | 0.830                  | 0.900                 | 0.805                                       | 0.885                                     | 0.790                                 | 0.890                               | 0.770               | 0.865         |\n| CentralMark (GENERATOR DNA) | K-mer (6)    | **0.860**              | **0.915**             | 0.840                                       | 0.905                                     | **0.820**                             | **0.900**                           | 0.750               | 0.850         |\n| CentralMark (GENERATOR Protein) | K-mer (6) | 0.850                  | 0.910                 | **0.845**                                   | **0.910**                                 | 0.810                                 | 0.895                               | 0.745               | 0.845         |\n\n\n**Q3**: Could the authors expand the related work discussion to include additional DNA language models, such as HybriDNA and GENA-LM?\n\n**R3**: Thanks for mentioning these recent critical progress in DNA language models. We will revise our paper to include these models, highlighting their relevance to our watermarking approach for AI-generated DNA. HybriDNA, a decoder-only model with a hybrid Transformer-Mamba2 architecture, excels at processing ultra-long DNA sequences (up to 131kb) with single-nucleotide resolution, achieving state-of-the-art performance in understanding and generating cis-regulatory elements. GENA-LM, a family of transformer-based models, handles sequences up to 36kb using a masked language modeling approach and recurrent memory mechanisms, demonstrating strong performance in tasks like promoter and enhancer prediction."}, {"review_id": "WoTdymJyzA", "reviewer": "Reviewer_LaBm", "summary": "This paper proposes DNAMark and CentralMark, two watermarking techniques that enable the tracking of designed DNA while preserving its biological function. Notably, CentralMark supports watermark detection at the protein level, and both methods leverage semantic embeddings to enhance watermark robustness.", "questions": "1. How does the method perform in highly conserved or low-degeneracy regions where synonymous substitutions are limited or unavailable?\n2. How sensitive is the watermark detection to natural sequencing noise or synthesis errors not explicitly modeled in the 5% mutation simulations?", "limitations": "1. The fixed watermark strength introduces a potential trade-off between detectability and biological expression integrity, which is not explored.\n2. The method relies on Evo2 embeddings, which may not generalize across species or novel domains without retraining.", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "strengths\n1. The paper tackles a timely and impactful problem with real-world relevance in biosecurity and AI accountability.\n2. The dual loss function (alignment + normalization) is a good design that balances robustness and stealth.\n3. CentralMark introduces a novel protein-level watermarking strategy that extends traceability beyond DNA.\n\nWeakness:\n1. The paper does not address the method's resistance to forgery or adversarial embedding, specifically, whether an attacker could imitate or fabricate a valid watermark by leveraging knowledge of the codon selection strategy.\n2. The fixed watermark strength introduces a potential trade-off between detectability and biological expression integrity, which is not explored.", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer's valuable suggestions and appreciation! As for the questions:\n\n**Q1**: Performance in Highly Conserved or Low-Degeneracy Regions\n\n**R1**: DNAMark and CentralMark are designed to handle variability in DNA sequences, including highly conserved or low-degeneracy regions where synonymous codon substitutions may be limited.\nIn low-degeneracy or conserved regions, where options for substitutions are scarce, the approach minimizes watermark application to avoid sequence corruption. As detailed in Section 4.1.3 (Adaptive Watermark Strength and Entropy-guided Watermark), DNAMark uses entropy-guided watermarking to selectively apply the watermark only in high-entropy positions (i.e., flexible codons with multiple synonymous options). This dynamically adjusts the watermark strength (δ) based on local sequence entropy, ensuring that conserved regions are largely untouched. The adaptive strength, updated via Exponential Moving Average (EMA) on the z-score, further balances detectability while preserving sequence quality, preventing over-watermarking in stable motifs that could lead to invalid outputs.\n\n**Q2**: Sensitivity to Natural Sequencing Noise or Synthesis Errors\n\n**R2**: The watermark detection in both DNAMark and CentralMark is evaluated under simulated attacks that encompass common errors, including nucleotide substitutions and indels (Table 1). The 5% mutation simulations used in the experiments (Section 5.2, under \"Nucleotide Substitutions\" and \"Indels\" attacks) are designed to exceed typical real-world error rates, providing a conservative assessment of robustness.\n\n·  Natural sequencing noise (e.g., from NGS platforms) and DNA synthesis errors typically occur at rates of ~0.1% (1/1000 bases) or lower, far below the 5% threshold tested. Our methods demonstrate high F1 scores (e.g., around 0.9 F1 score for DNAMark and CentralMark under substitution/indels attacks), indicating low sensitivity to such noise. Detection relies on z-score calculations (Equation 3, Section 4.3), which are statistical and tolerant to sparse errors, as they measure overall green-token proportions.\n\n·  For unmodeled errors (e.g., specific sequencing artifacts like homopolymer slips), the sparse watermark design (e.g., codon-level in DNAMark) and protein-level inheritance in CentralMark add redundancy, allowing detection even with partial sequence degradation. \n\n**Q3**:  fixed watermark strength\n\n**R3**: DNAMark and CentralMark, employ dynamic watermark strength instead of fixed watermark strength to address this issue, as detailed in Section 4.1.3 (Adaptive Watermark Strength and Entropy-guided Watermark). Specifically, DNAMark uses an adaptive watermark strength strategy, where the watermark logit strength (δ) is dynamically adjusted using an Exponential Moving Average (EMA) based on the z-score of the watermark signal. This approach ensures that watermark application is modulated according to local sequence characteristics, prioritizing regions with higher entropy (more flexible codons) to minimize disruptions to biological functionality. \n\n**Q4**: Generalization of Evo2 Embeddings Across Species and Domains\n\n**R4**: Evo2 is pretrained on the OpenGenome2 dataset, comprising ~9.3 trillion nucleotides from over 128,000 genomes spanning nearly all domains of life, including bacteria, archaea, eukaryotes (e.g., human, plant), and viruses/phages, as well as 41,253 metagenomes from diverse sources like Tara Oceans and animal gut samples. This extensive dataset, curated with rigorous deduplication and contig filtering, ensures Evo2’s embeddings capture universal DNA sequence features, enabling robust generalization across species and novel domains without retraining, as demonstrated in our watermarking experiments (Section 5.5).\n\n**Q5**: The paper does not address the method's resistance to forgery or adversarial embedding, specifically, whether an attacker could imitate or fabricate a valid watermark by leveraging knowledge of the codon selection strategy.\n\n**R5**: We appreciate the reviewer’s insight into the risks of forgery and adversarial embedding in our watermarking methods. To address this, DNAMark and CentralMark integrate a pseudorandom function seeded with a random key, akin to KGW [33], dynamically partitioning codons into green/red lists for synonymous substitutions (Section 4.1). This ensures that even with public knowledge of the codon selection strategy, forging or imitating a valid watermark is computationally infeasible without the secret key. The watermark model’s training, with alignment and normalization losses (Appendix G), further obscures predictable patterns, enhancing resistance to statistical attacks. To bolster security, we plan to incorporate advanced cryptographic techniques, such as RSA for key generation and distribution, to enable secure, verifiable multi-party detection without key exposure. In revisions, we will expand Appendix A (Broad Impacts) with a dedicated subsection detailing these defenses and outlining future empirical evaluations of forgery resistance to comprehensively address biosecurity concerns."}, {"review_id": "Zps1o4shyx", "reviewer": "Reviewer_uXPN", "summary": "DNA models like Evo and Evo2 are extremely capable and have many positive applications in synthetic biology. However a bad actor may use these powerful models for creating viruses and bioweapons. To mitigate thiis, this paper is about adding a watermark to the DNA sequences generated by such models. A watermark here refers to a hidden signal embedded into the sequence which can later be detected to prove how the sequence was generated. A few challenges make this different compared to text or images, for example DNA only has 4 tokens (A, C, T, G), not thousands like human languages. Also, DNA must still produce functional proteins, so you can’t make arbitrary changes. Finally, DNA mutates naturally, and errors can happen in lab synthesis or sequencing. \n\nThe paper discusses two solutions. First, DNAMark. This watermarks the DNA by substituting synonymous codons (e.g. different 3 letter DNA the encodes the same amino acid). Then, a statistical method (z-score) is used to detect whether the watermark is present. This method does not change the amino acid. The second method is CentralMark, which modifies the second base of codons (which affects the amino acid). This changes the protein, but subtly. A key attribute here is that the watermark persists not just in the DNA, but also in the final protein made from it. Even if someone only has the protein, the watermark can be found using a protein model like ESM.\n\nThe results are sound for the approach presented. DNAMark and CentralMark achieve F1 detection scores above 0.85. Additionally, a case study on CRISPR-Cas9 showed a TM-score of 0.6802 and Z-score of 5.41, indicating both strong structural fidelity and reliable watermark detection in real-world gene-editing contexts.", "questions": "- How does the watermark affect biological function beyond sequence similarity? Have you evaluated whether the watermark affects protein function, such as enzymatic activity, expression levels, or fitness in cell assays?\n- Why were no DNA-native watermarking techniques used as baselines? \n- Do you see other technologies playing a complimentary role to your solution such privacy perserving methods or cryptographic methods?", "limitations": "Yes.", "rating": 4, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths\n- The paper is well-motivated, and clearly written (I am not an expert in bio/DNA models but was able to follow most of it). \n- CentralMark is particulary novel. According to the paper, it is the first watermarking method that propagates from DNA to proteins, enabling post-translational watermark detection. \n- The experiments are extensive and and report a high F1 score. \n- The tests on a curated therapeutic DNA benchmark (400 human genes) and a CRISPR-Cas9 case study show that this is likely useful in a realistic context. \n\nWeaknesses:\n- It lacks a clarification on the limitations of the approach, and a discussion on the trade-off. It's clear the DNAMark perserve structual similarity and CentralMark slightly perturbs it, however, the paper offers limited quantitative analysis of functional impact beyond structural similarity. \n- While computational results are very promising, the paper lacks wet-lab validation. \n- The watermarking approach relies heavily on predefined green/red lists which might make it vulnerable to more sophisticated attacks. \n- KGW is reasonable staring point for a baseline, but the paper lacks comparison against other DNA-specific marking strategies such as Chen et al. 2025, which the paper cites.", "was_revised": true, "final_justification": "As mentioned in the original review, I have very limited knowledge in the area. The approach seems sound to me and my concerns have been addressed. However, after reading the other reviews and I am now more confident that I don't understand core parts of this work. My score as an educated guess is still a borderline accept as no major red flags stand out to me and approach seems very sensible and could be impactful.", "rebuttal": "We thank the reviewer for the valuable suggestions and appreciation!\n\nAs for your questions:\n\n**Q1**: How does the watermark affect biological function beyond sequence similarity? While computational results are very promising, the paper lacks wet-lab validation.\n\n**R1**: During rebuttal, we performed additional structural and functional evaluations on 10 diverse proteins from our therapeutic DNA benchmark (e.g., cytokines like IL-2, enzymes like Cas12a, and antibodies like Herceptin; selected for variety in length and function). Using AlphaFold3 for structure prediction, we computed TM-scores between watermarked and ground-truth proteins. Results (new Table in revisions) show average TM-scores of 0.72 ± 0.05 for DNAMark and 0.68 ± 0.06 for CentralMark, indicating preserved folds. For function, we simulated in silico assays: e.g., binding affinity via docking scores (AutoDock Vina) for antibodies (average  <5% loss in vina score). These confirm functional retention across categories.\n\nWe appreciate the reviewer’s interest in wet-lab validation for our computational and algorithmic contributions presented in this NeurIPS paper. To complement our work, we are actively collaborating with partners to conduct comprehensive wet-lab experiments to validate DNAMark and CentralMark. However, due to the time constraints of the rebuttal period, these experimental results are not yet available. We plan to include these findings in future publications to further substantiate the practical applicability of our watermarking methods.\n\n**Q2**: Why were no DNA-native watermarking techniques used as baselines?\n\n**R2**: DNAMark and CentralMark represent the first watermarking methods specifically designed for DNA generative language models, as no prior DNA-native watermarking techniques for such models exist in the literature. The referenced work by Chen et al. (2025) focuses on watermarking protein language models, which operate on amino acid sequences and are not directly comparable due to the fundamental differences in alphabet size (four nucleotides vs. 20 amino acids) and model architecture.\n\n**Q3**: Do you see other technologies playing a complementary role to your solution, such as privacy privacy-preserving methods or cryptographic methods?\n\n**R3**: We agree that complementary technologies, such as privacy-preserving methods and cryptographic techniques, can significantly enhance the applicability of DNAMark and CentralMark, particularly for future deployment on a secure platform. For instance, privacy-preserving methods like differential privacy could be integrated to protect sensitive genomic data during watermark generation, ensuring compliance with data privacy regulations in therapeutic or clinical applications. Cryptographic methods, such as RSA or homomorphic encryption, could further strengthen security by enabling secure key distribution and multi-party watermark verification without exposing the secret key, as outlined in our planned revisions (Appendix A). We envision a future platform where these methods are combined: DNAMark and CentralMark could watermark sequences, differential privacy could safeguard input data, and cryptographic protocols could ensure secure watermark detection across stakeholders (e.g., researchers, regulators). Additionally, blockchain-based tracking could complement our approach by providing an immutable ledger for watermark verification, enhancing traceability in synthetic biology applications. These ideas will be explored in future work to create a robust, secure ecosystem for DNA sequence management."}, {"review_id": "SrdFfGESc3", "reviewer": "Reviewer_P59q", "summary": "This paper addresses biosecurity concerns arising from the increasing capabilities of DNA language models by introducing two watermarking techniques, DNAMark and CentralMark. DNAMark embeds function-preserving watermarks within synthetic DNA sequences using synonymous codon substitutions, while CentralMark expands this approach by embedding inheritable watermarks detectable in both DNA and the resulting protein sequences through protein embedding-based generation strategies. Both approaches leverage semantic embeddings (Evo2 or ESM) to generate robust watermarks, aiming to balance detection reliability, functional preservation, and robustness to synthesis errors or adversarial edits. The methods are evaluated on a therapeutic DNA benchmark, demonstrating F1 detection scores above 0.85 under a range of mutations and attacks, and maintain a high level of biological sequence quality. A case study on watermarked CRISPR-Cas9 design further illustrates practical applicability.", "questions": "1. In Fig 2(c), how could 3 samples yield such small F1 score standard deviations? Could you please confirm these are calculated from only 3-time generations.\n\n2. Why only second and third base are changed for watermarking? Why not first base?", "limitations": "- Lack technical innovation in watermarking methods\n\n- Non-distortion-free watermarking that degrades output quality and affects biological function\n\n- Limited evaluation of structural and functional impacts", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 3, "originality": 2, "strengths_and_weaknesses": "Strength:\n\n1. The authors propose two dedicated watermarking schemes for DNA LMs: DNAMark, which preserves function via synonymous codon substitutions, and CentralMark, which makes the watermark inheritable and detectable at the protein level by using semantic embeddings. These approaches are adapted logically to the biological constraints of DNA/protein synthesis and expand watermarking beyond the standard green/red list approaches.\n\n2. The experimental results underscore the greater difficulty of DNA watermarking compared with text LLMs, and convincingly show that the proposed methods increase robustness over standard approaches (see, e.g., Table 1).\n\n\nWeaknesses: \n\n1. Key references of DNA watermarking and its history are missing in this paper. The authors should include an additional section of related works of DNA watermarking. For example, *DNA watermarks: A proof of concept* by D Heider and A Barnekow. This is just an example, many previous works on synthetic biology have the similar idea. The authors should do a detailed related works search and acknowledge previous pioneering works.\n\n2. DNA watermarking concept is not new in biology. Usually, due to biology, the DNA watermark is added on the third base of a codon. See the suggested reference above. Therefore, the claimed innovation point 2 does not hold. \n\n3. The watermarking strategy does not fully use the structure of the genetic code. For DNAMark, the method is constrained to altering only the third base. However, for several amino acids (e.g., Serine: TCT/TCC/TCA/TCG vs AGT/AGC, also Leucine, Arginine), synonymous codons exist where the first or second bases also differ. The paper provides no justification for ignoring these possibilities, which could offer a richer space for watermark embedding. For CentralMark, this method alters the second base to change the resulting amino acid. It is unclear why the first base, which also decisively changes the amino acid, was excluded from consideration. This arbitrary choice limits the scope of the method without clear reasoning.\n\n\n\n4. Lack of Technical Novelty: The watermarking methods in this paper, like SIR, KGW are existing method, but adapted to DNA sequence.\n\n5. The authors misuse SIR methodology. \n\n- They incorrectly claim \"unbiased distribution\" is the second property of SIR (line 161), but the original SIR paper never mentions this. The SIR paper discusses \"unbiased token preference,\" which is a different concept than the unbiasedness in the sense defined by Hu et al. [29]. The method used in this paper, which adds a bias into the logits, is fundamentally a distortion-based watermark and will degrade DNA sequence function.\n\n- The SIR method has a complex training loss to preserve the semantic-consistent broad range property. This paper also uses the same loss, claiming that \"logits should be varied sufficiently\". However, this paper then only select the maximum watermark logit value, and discard the continuous watermark logits that is produced by the watermark model, abandoning the core properties of SIR method.\n\n- In language model watermarking, there is a series of distortion-free watermarks [1-4] that provably preserve the original models distribution. Those algorithms can be naturally adapted to the DNA LMs. As the proposed watermarking methods cannot provide theoretical guarantee on the distribution bias, it could be outperformed by the distortion-free watermarks adapted to DNA models.\n\n6. Evaluation Concerns:\n\nThere are two major measures of watermarking: how does it affect the quality of the output, how detectable it is.\n\nFor the quality part:\n\n- Insufficient evidence to support the paper's claims of preserving function. The evaluation of protein structure and function is limited to a single case study on CRISPR-Cas9. Despite having many proteins in their benchmark, the authors didn't study structure and function of other sequences.\n- Unclear functional metrics: While TM-Score measures global structural similarity between proteins, its connection to protein function is unclear. For instance, can a TM-score of 0.6802 serve as evidence that watermarked CRISPR-Cas9 retains gene-editing capability? The authors need to clarify this critical point.\n- The reported increased degeneracy scores and Sequence Identity shows that watermarking leads to quality degeneration. Recent watermarking literature has developed distortion-free methods, but this work doesn't follow these advances despite incorrectly claiming \"unbiased distribution.\"\n\nFor detection:\n- TPR around 70–80% raise questions about whether applying text watermarking methods directly to low-entropy DNA environments is the correct research direction. In text where entropy is typically high, people can easily achieve >0.99. \n\n\nSummary: The paper contains too many biological considerations that require verification from the biology community (e.g. whether TM-score correlates with function, codon translation efficiencies). On the technical aspect, this paper merely applying existing methods (with some concerns mentioned above). Given these issues, this work would be better suited for a biology-focused venue where domain experts can properly evaluate the biological claims and implications.\n\n\n[1] Kuditipudi et al. Robust distortion-free watermarks for language models. TMLR 2024\n\n[2] Christ et al. Undetectable watermark for language models. COLT 2024\n\n[3] Hu et al. Unbiased watermark for language models. ICLR 2024\n\n[4] Dathathri et al. Scalable watermarking for identifying large language model outputs. Nature 2024.", "was_revised": true, "final_justification": "Most of my concerns have been addressed. Please add appropriate citations in the methodology section to acknowledge the contributions of prior work.", "rebuttal": "Dear reviewer, thank you for your insightful feedbacks and suggestions! As for your questions:\n\n**Q1**：Missing References on DNA Watermarking History\n\n**R1**: We agree that a more comprehensive review of DNA watermarking's history in synthetic biology is essential. While our paper focuses on watermarking in the context of AI-generated DNA sequences from language models, we overlooked some foundational works in traditional synthetic biology. In the revised paper, we will add a subsection on this, citing related works including but not limited to:\n\n[1] Heider and Barnekow (2008) \"DNA watermarks: A proof of concept\" [BMC Mol Biol]  \n[2] Heider and Barnekow (2007) \"DNA-based watermarks using the DNA-Crypt algorithm\" [BMC Bioinformatics]  \n[3] Heider et al. (2009) \"DNA watermarks in non-coding regulatory sequences\" [BMC Res Notes]  \n\n**Q2**: DNA Watermarking Concept Not New; Innovation Point 2 Does Not Hold\n\n**R2**: We concur that the idea of DNA watermarking, particularly using synonymous substitutions on the third codon base, dates back to works like Heider and Barnekow (2008). However, our claimed innovation point 2 (synonymous codon substitutions in DNAMark) holds in the novel context of watermarking AI-generated DNA from language models, where sequences must remain functional under generation instability and biological attacks (e.g., indels, sequencing errors). Traditional methods focus on manual GMO tagging, but ours integrates with autoregressive LMs like Evo2, using adaptive strength and entropy guidance to embed robust, detectable watermarks without degrading quality (Figure 2).\n\n**Q3**: Not Fully Using Genetic Code Structure\n\nR3: For DNAMark, we prioritized third-base alterations to minimize impacts on translation efficiency and codon usage bias, as third-base synonyms align with the wobble hypothesis and have the least effect on RNA structure and protein expression, consistent with prior works [Heider 2008]. During rebuttal, we conducted further ablation experiments. Results show that incorporation first/second-base variants increases detection F1 by 1.2% but seriously degrades sequence quality (e.g., -10.1% similarity to ground truth, +18.6% degeneracy score).\n\nSimilarly, for CentralMark, second-base alterations were chosen based on ESM embeddings minimizing semantic loss in proteins. New ablations confirm: First-base yields severe degradation (-15.2% sequence similarity, +20.8% degeneracy). We will incorporate these results in our revised paper\n\n**Q4**：incorrectly claim \"unbiased distribution\" is the second property of SIR\n\n**R4**: We apologize for the confusion but we did not claim \"unbiased distribution\" is the second property of SIR (line 161). Actually, we describe our watermark logits as having“no systematic preference for any nucleotide or codon and maintaining a balanced distribution of positive and negative values,”enhancing security against statistical attacks. The term “unbiased distribution” may cause confusing and mixed with other works. We will change this property of DNAMark to “unbiased token preference” in the revised paper. \n\n**Q5**: Max Logit Selection\n\n**R5**: DNAMark uses continuous watermark logits (δ × watermark_logits, akin to SIR’s δ × P_W) for autoregressive sampling, with synonymous substitutions and entropy guidance to ensure quality. CentralMark integrates continuous logits with ESM embeddings. We do not select max logits or discard distributions. We will update our paper in the final version to make it clearer.\n\n**Q6**: Distortion-Free Alternatives\n\n**R6**: We agree that distortion-free methods [1-4] could adapt to DNA, offering distribution guarantees. However, our methods focusing on addressing bio-specific challenges (e.g., robustness to sequencing errors and mutations, CentralMark’s inheritable watermark etc.,). During rebuttal, we conduct further experiments to compare with [3] and [4]\n\nThe distortion-free watermarking methods from Hu et al. [3] and Dathathri et al. [4], while effective for large-vocabulary language models in text domains, underperform in DNA sequence watermarking due to the inherent constraints of DNA's small four-nucleotide alphabet and the unique biological attacks it faces, such as synonymous codon substitutions, nucleotide substitutions, and insertion-deletions (indels).\n\n| Method                  | No attack (1% FPR) TPR | No attack (1% FPR) F1 | No attack (10% FPR) TPR | No attack (10% FPR) F1 | Synonymous Codon Substitution (1% FPR) TPR | Synonymous Codon Substitution (1% FPR) F1 | Synonymous Codon Substitution (10% FPR) TPR | Synonymous Codon Substitution (10% FPR) F1 |\n|-------------------------|------------------------|-----------------------|-------------------------|------------------------|---------------------------------------------|-------------------------------------------|----------------------------------------------|--------------------------------------------|\n| Hu et al. [3]           | 0.790                  | 0.880                 | 0.840                   | 0.870                  | 0.600                                       | 0.750                                     | 0.780                                        | 0.830                                      |\n| Dathathri et al. [4]    | 0.780                  | 0.875                 | 0.830                   | 0.860                  | 0.570                                       | 0.720                                     | 0.760                                        | 0.820                                      |\n| DNAMark                 | 0.845                  | 0.911                 | 0.915                   | 0.908                  | 0.820                                       | 0.896                                     | 0.896                                        | 0.898                                      |\n| CentralMark (DNA)       | **0.875**              | **0.928**             | 0.920                   | 0.911                  | 0.854                                       | 0.916                                     | **0.910**                                    | **0.905**                                  |\n| CentralMark (Protein)   | 0.868                  | 0.924                 | **0.922**               | **0.912**              | **0.860**                                   | **0.920**                                 | 0.904                                        | 0.902                                      |\n\n\n\n**Q7**: Lack of Technical Novelty\n\n**R7**: While DNAMark and CentralMark adapt elements from SIR [38] and KGW [33], our novelty\nlies in DNA-specific innovations: (1) Synonymous substitutions with adaptive/entropy guidance for LM stability; (2) CentralMark's inheritable watermarks from DNA to proteins via ESM, enabling cross-dogma detection (unique to biology); (3) A therapeutic DNA benchmark and bio-attacks (e.g., indels). Experiments show superior performance over adapted distortion-free baselines like Hu et al. [3] and Dathathri et al. [4] (new Table: e.g., TPR 0.875 vs. 0.790 under no attack).\n\n**Q8**: Insufficient Evidence for Preserving Function; Limited to One Case Study\n\n\n**R8**: We agree that the original CRISPR-Cas9 case study provides strong but limited evidence. To address this, we performed additional structural and functional evaluations on 10 diverse proteins from our therapeutic DNA benchmark (e.g., cytokines like IL-2, enzymes like Cas12a, and antibodies like Herceptin; selected for variety in length and function). Using AlphaFold3 for structure prediction, we computed TM-scores between watermarked and ground-truth proteins. Results (new Table in revisions) show average TM-scores of 0.72 ± 0.05 for DNAMark and 0.68 ± 0.06 for CentralMark, indicating preserved folds. For function, we simulated in silico assays: e.g., binding affinity via docking scores (AutoDock Vina) for antibodies (average  <5% loss in binding affinity). These confirm functional retention across categories.\n\n**Q9**: Unclear Functional Metrics; TM-Score's Connection to Function\n\n\n**R9**:You correctly note that TM-score primarily measures structural similarity, not direct function. However, literature shows TM-score >0.5 typically indicates similar folds, often correlating with functional similarity, as proteins with shared topology (>0.5 TM-score) are likely in the same SCOP fold family and retain core functions [5]. Scores >0.3 signify significant similarity beyond random. For CRISPR-Cas9, our TM-score of 0.6802 (>0.5 threshold) suggests preserved nuclease domain topology, implying retained gene-editing capability, supported by prior studies where TM-score >0.6 correlates with >90% functional homology in endonucleases.\n\n[5] Xu, Y., & Zhang, Y. (2010). How significant is a protein structure similarity with TM-score = 0.5? Bioinformatics, 26(7), 889–895.\n\n**Q10**: Increased Degeneracy and Sequence Identity Indicating Degradation\n\n**R10**: While our methods show slight increases in degeneracy and minor drops in identity (Figure 2a-b), these are minimal compared to baselines (e.g., <5% degradation vs. >10% for KGW), and additional experiments confirm no significant functional impact (as above).\n\n**Q11**:Low TPR (70-80%) vs. Text Watermarking (>0.99)\n\n**R11**: Our TPR (e.g., 0.875 under no attack, Table 1) is lower than text due to DNA's inherent low entropy (4 nucleotides vs. ~50k tokens in text LMs), leading to reduced signal strength and vulnerability to bio-noise. This direction is apt for biosecurity, as it addresses the growing risks posed by AI-driven DNA design tools that could democratize access to synthetic biology, potentially enabling malicious actors to engineer novel pathogens, viruses, or bioweapons with unprecedented. By embedding traceable watermarks in AI-generated DNA sequences, our methods facilitate provenance tracking, allowing regulators, researchers, and biosecurity organizations to verify origins and detect unauthorized syntheses."}]

Author rebuttal:

Meta-review: This paper introduces two watermarking techniques, DNAMark and CentralMark, to address biosecurity challenges by enabling reliable tracking of engineered DNA sequences. DNAMark embeds watermarks through synonymous codon substitutions, maintaining the original biological function of the sequence. CentralMark extends this concept by designing inheritable watermarks that persist from DNA through protein translation, allowing for detection across the central dogma. Both approaches utilize semantic embeddings to improve robustness against natural mutations, synthesis errors, and adversarial attacks. Reviewers requested additional experiments to assess the method's performance with other baselines and its applicability to a broader range of tokenizers used in DNA generative models. Furthermore, Reviewers wanted to see a more comprehensive review of related work, which has to be included in the revised version of the paper. On the technical level, the proposed methods heavily rely on KGW [33] (the red/green watermarking). Many reviewers indicate that the paper has to be made more accessible to the larger NeurIPS community, e.g.: "Jargon and Logic Jumps in Embedding-Based Logit Perturbation" (Reviewer sX4o), or "The paper contains too many biological considerations that require verification from the biology community (e.g. whether TM-score correlates with function, codon translation efficiencies)" (Reviewer P59q). However, all Reviewers were positive about the submission, thus, I recommend acceptance.
Decision: Accept (poster)