Title: Securing the Language of Life: Inheritable Watermarks from DNA Language Models to Proteins
Venue: NeurIPS 2025
Accepted: yes
Keywords: Watermark

LLMs

DNA

AI for Science

AI Safety
Abstract: DNA language models have revolutionized our ability to design and manipulate DNA sequences—the fundamental language of life—with unprecedented precision, enabling transformative applications in therapeutics, synthetic biology, and gene editing. However, this capability also poses significant dual-use risks, including the potential creation of harmful biological agents. To address these biosecurity challenges, we introduce two innovative watermarking techniques: DNAMark and CentralMark. DNAMark employs synonymous codon substitutions to embed robust watermarks in DNA sequences while preserving the function of encoded proteins. CentralMark advances this by creating inheritable watermarks that transfer from DNA to translated proteins, leveraging protein embeddings to ensure detection across the central dogma. Both methods utilize state-of-the-art embeddings to generate watermark logits, enhancing resilience against natural mutations, synthesis errors, and adversarial attacks. Evaluated on a therapeutic DNA benchmark, DNAMark and CentralMark achieve F1 detection scores above 0.85 under diverse conditions, while maintaining over 60\% sequence similarity to ground truth and degeneracy scores below 15\%. A case study on a CRISPR-Cas9 system underscores CentralMark’s utility in real-world synthetic biology. This work establishes a vital framework for securing DNA language models, balancing innovation with accountability to mitigate biosecurity risks.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper addresses biosecurity concerns arising from the increasing capabilities of DNA language models by introducing two watermarking techniques, DNAMark and CentralMark. DNAMark embeds function-preserving watermarks within synthetic DNA sequences using synonymous codon substitutions, while CentralMark expands this approach by embedding inheritable watermarks detectable in both DNA and the resulting protein sequences through protein embedding-based generation strategies. Both approaches leverage semantic embeddings (Evo2 or ESM) to generate robust watermarks, aiming to balance detection reliability, functional preservation, and robustness to synthesis errors or adversarial edits. The methods are evaluated on a therapeutic DNA benchmark, demonstrating F1 detection scores above 0.85 under a range of mutations and attacks, and maintain a high level of biological sequence quality. A case study on watermarked CRISPR-Cas9 design further illustrates practical applicability.\n\nSTRENGTHS AND WEAKNESSES:\nStrength:\n\n1. The authors propose two dedicated watermarking schemes for DNA LMs: DNAMark, which preserves function via synonymous codon substitutions, and CentralMark, which makes the watermark inheritable and detectable at the protein level by using semantic embeddings. These approaches are adapted logically to the biological constraints of DNA/protein synthesis and expand watermarking beyond the standard green/red list approaches.\n\n2. The experimental results underscore the greater difficulty of DNA watermarking compared with text LLMs, and convincingly show that the proposed methods increase robustness over standard approaches (see, e.g., Table 1).\n\n\nWeaknesses: \n\n1. Key references of DNA watermarking and its history are missing in this paper. The authors should include an additional section of related works of DNA watermarking. For example, *DNA watermarks: A proof of concept* by D Heider and A Barnekow. This is just an example, many previous works on synthetic biology have the similar idea. The authors should do a detailed related works search and acknowledge previous pioneering works.\n\n2. DNA watermarking concept is not new in biology. Usually, due to biology, the DNA watermark is added on the third base of a codon. See the suggested reference above. Therefore, the claimed innovation point 2 does not hold. \n\n3. The watermarking strategy does not fully use the structure of the genetic code. For DNAMark, the method is constrained to altering only the third base. However, for several amino acids (e.g., Serine: TCT/TCC/TCA/TCG vs AGT/AGC, also Leucine, Arginine), synonymous codons exist where the first or second bases also differ. The paper provides no justification for ignoring these possibilities, which could offer a richer space for watermark embedding. For CentralMark, this method alters the second base to change the resulting amino acid. It is unclear why the first base, which also decisively changes the amino acid, was excluded from consideration. This arbitrary choice limits the scope of the method without clear reasoning.\n\n\n\n4. Lack of Technical Novelty: The watermarking methods in this paper, like SIR, KGW are existing method, but adapted to DNA sequence.\n\n5. The authors misuse SIR methodology. \n\n- They incorrectly claim \"unbiased distribution\" is the second property of SIR (line 161), but the original SIR paper never mentions this. The SIR paper discusses \"unbiased token preference,\" which is a different concept than the unbiasedness in the sense defined by Hu et al. [29]. The method used in this paper, which adds a bias into the logits, is fundamentally a distortion-based watermark and will degrade DNA sequence function.\n\n- The SIR method has a complex training loss to preserve the semantic-consistent broad range property. This paper also uses the same loss, claiming that \"logits should be varied sufficiently\". However, this paper then only select the maximum watermark logit value, and discard the continuous watermark logits that is produced by the watermark model, abandoning the core properties of SIR method.\n\n- In language model watermarking, there is a series of distortion-free watermarks [1-4] that provably preserve the original models distribution. Those algorithms can be naturally adapted to the DNA LMs. As the proposed watermarking methods cannot provide theoretical guarantee on the distribution bias, it could be outperformed by the distortion-free watermarks adapted to DNA models.\n\n6. Evaluation Concerns:\n\nThere are two major measures of watermarking: how does it affect the quality of the output, how detectable it is.\n\nFor the quality part:\n\n- Insufficient evidence to support the paper's claims of preserving function. The evaluation of protein structure and function is limited to a single case study on CRISPR-Cas9. Despite having many proteins in their benchmark, the authors didn't study structure and function of other sequences.\n- Unclear functional metrics: While TM-Score measures global structural similarity between proteins, its connection to protein function is unclear. For instance, can a TM-score of 0.6802 serve as evidence that watermarked CRISPR-Cas9 retains gene-editing capability? The authors need to clarify this critical point.\n- The reported increased degeneracy scores and Sequence Identity shows that watermarking leads to quality degeneration. Recent watermarking literature has developed distortion-free methods, but this work doesn't follow these advances despite incorrectly claiming \"unbiased distribution.\"\n\nFor detection:\n- TPR around 70–80% raise questions about whether applying text watermarking methods directly to low-entropy DNA environments is the correct research direction. In text where entropy is typically high, people can easily achieve >0.99. \n\n\nSummary: The paper contains too many biological considerations that require verification from the biology community (e.g. whether TM-score correlates with function, codon translation efficiencies). On the technical aspect, this paper merely applying existing methods (with some concerns mentioned above). Given these issues, this work would be better suited for a biology-focused venue where domain experts can properly evaluate the biological claims and implications.\n\n\n[1] Kuditipudi et al. Robust distortion-free watermarks for language models. TMLR 2024\n\n[2] Christ et al. Undetectable watermark for language models. COLT 2024\n\n[3] Hu et al. Unbiased watermark for language models. ICLR 2024\n\n[4] Dathathri et al. Scalable watermarking for identifying large language model outputs. Nature 2024.\n\nQUESTIONS:\n1. In Fig 2(c), how could 3 samples yield such small F1 score standard deviations? Could you please confirm these are calculated from only 3-time generations.\n\n2. Why only second and third base are changed for watermarking? Why not first base?\n\nLIMITATIONS:\n- Lack technical innovation in watermarking methods\n\n- Non-distortion-free watermarking that degrades output quality and affects biological function\n\n- Limited evaluation of structural and functional impacts", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 2, "DATE": "2025-07-02"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nDNA models like Evo and Evo2 are extremely capable and have many positive applications in synthetic biology. However a bad actor may use these powerful models for creating viruses and bioweapons. To mitigate thiis, this paper is about adding a watermark to the DNA sequences generated by such models. A watermark here refers to a hidden signal embedded into the sequence which can later be detected to prove how the sequence was generated. A few challenges make this different compared to text or images, for example DNA only has 4 tokens (A, C, T, G), not thousands like human languages. Also, DNA must still produce functional proteins, so you can’t make arbitrary changes. Finally, DNA mutates naturally, and errors can happen in lab synthesis or sequencing. \n\nThe paper discusses two solutions. First, DNAMark. This watermarks the DNA by substituting synonymous codons (e.g. different 3 letter DNA the encodes the same amino acid). Then, a statistical method (z-score) is used to detect whether the watermark is present. This method does not change the amino acid. The second method is CentralMark, which modifies the second base of codons (which affects the amino acid). This changes the protein, but subtly. A key attribute here is that the watermark persists not just in the DNA, but also in the final protein made from it. Even if someone only has the protein, the watermark can be found using a protein model like ESM.\n\nThe results are sound for the approach presented. DNAMark and CentralMark achieve F1 detection scores above 0.85. Additionally, a case study on CRISPR-Cas9 showed a TM-score of 0.6802 and Z-score of 5.41, indicating both strong structural fidelity and reliable watermark detection in real-world gene-editing contexts.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths\n- The paper is well-motivated, and clearly written (I am not an expert in bio/DNA models but was able to follow most of it). \n- CentralMark is particulary novel. According to the paper, it is the first watermarking method that propagates from DNA to proteins, enabling post-translational watermark detection. \n- The experiments are extensive and and report a high F1 score. \n- The tests on a curated therapeutic DNA benchmark (400 human genes) and a CRISPR-Cas9 case study show that this is likely useful in a realistic context. \n\nWeaknesses:\n- It lacks a clarification on the limitations of the approach, and a discussion on the trade-off. It's clear the DNAMark perserve structual similarity and CentralMark slightly perturbs it, however, the paper offers limited quantitative analysis of functional impact beyond structural similarity. \n- While computational results are very promising, the paper lacks wet-lab validation. \n- The watermarking approach relies heavily on predefined green/red lists which might make it vulnerable to more sophisticated attacks. \n- KGW is reasonable staring point for a baseline, but the paper lacks comparison against other DNA-specific marking strategies such as Chen et al. 2025, which the paper cites.\n\nQUESTIONS:\n- How does the watermark affect biological function beyond sequence similarity? Have you evaluated whether the watermark affects protein function, such as enzymatic activity, expression levels, or fitness in cell assays?\n- Why were no DNA-native watermarking techniques used as baselines? \n- Do you see other technologies playing a complimentary role to your solution such privacy perserving methods or cryptographic methods?\n\nLIMITATIONS:\nYes.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 2, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-03"}

comments: SUMMARY:
This paper proposes DNAMark and CentralMark, two watermarking techniques that enable the tracking of designed DNA while preserving its biological function. Notably, CentralMark supports watermark detection at the protein level, and both methods leverage semantic embeddings to enhance watermark robustness.

STRENGTHS AND WEAKNESSES:
strengths
1. The paper tackles a timely and impactful problem with real-world relevance in biosecurity and AI accountability.
2. The dual loss function (alignment + normalization) is a good design that balances robustness and stealth.
3. CentralMark introduces a novel protein-level watermarking strategy that extends traceability beyond DNA.

Weakness:
1. The paper does not address the method's resistance to forgery or adversarial embedding, specifically, whether an attacker could imitate or fabricate a valid watermark by leveraging knowledge of the codon selection strategy.
2. The fixed watermark strength introduces a potential trade-off between detectability and biological expression integrity, which is not explored.

QUESTIONS:
1. How does the method perform in highly conserved or low-degeneracy regions where synonymous substitutions are limited or unavailable?
2. How sensitive is the watermark detection to natural sequencing noise or synthesis errors not explicitly modeled in the 5% mutation simulations?

LIMITATIONS:
1. The fixed watermark strength introduces a potential trade-off between detectability and biological expression integrity, which is not explored.
2. The method relies on Evo2 embeddings, which may not generalize across species or novel domains without retraining.
TITLE: Official Review
CLARITY: 3
IMPACT: 3
ORIGINALITY: 3
DATE: 2025-07-03

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nDNA language models have significantly improved human's ability to understand and design DNA sequences with high precision. These advancements come with dual-use risks, including the potential creation of pathogens, viruses, or bioweapons. The paper introduces two watermarking techniques, DNAMark and CentralMark, to address biosecurity challenges by reliably tracking designed DNA sequences.\nDNAMark uses synonymous codon substitutions to embed watermarks in DNA sequences while preserving their original function. CentralMark creates inheritable watermarks that transfer from DNA to proteins, ensuring detection across the central dogma (DNA to protein translation). Both methods leverage semantic embeddings to enhance robustness against natural mutations, synthesis errors, and adversarial attacks. Evaluations on a therapeutic DNA benchmark show F1 detection scores above 0.85 under various conditions, with over 60% sequence similarity to ground truth and degeneracy scores below 15%. A case study on the CRISPR-Cas9 system highlights CentralMark's practical utility in real-world applications. The work provides a critical framework for securing DNA language models, balancing innovation with accountability to mitigate biosecurity risks.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\nThe novelty of the paper is good; this is among the first research efforts focusing on the safety issues of popular DNA language models.\nThe experimental design and execution are well-conceived and robust.\nThe paper is well-written and clearly presented.\n\nWeaknesses:\n1. More detailed experimental comparisons would be beneficial in justifying the advantages of this work.\n1)  In the experimental section, the authors primarily compare their proposed methods against a single baseline from LLM watermarks: KGW with different configurations (e.g., KGW-1, KGW-2, KGW-4). Since KGW is based on an ICML 2023 paper, could the authors consider including additional and more recent watermarking methods for a broader comparison?\n2)  While single-nucleotide tokenization (i.e., a vocabulary consisting solely of the four nucleotides: A, T, C, G) is commonly used in DNA language models for improved performance in SNP tasks, other tokenization methods such as k-mer tokenization and BPE tokenization are also widely discussed (e.g., GENERATOR and DNA-BERT2). Could the authors explore whether their method performs well with these alternative tokenization approaches? It would be particularly valuable if the authors could include experimental results to support this discussion.\n\n2. Potentially overlooks some recent related work on DNA language models, such as: \n1)  A DNA language model based on multispecies alignment predicts the effects of genome-wide variants, Benegas et al. \n2)  HybriDNA: A Hybrid Transformer-Mamba2 Long-Range DNA Language Model, Ma et al.\n3)  GENA-LM: a family of open-source foundational DNA language models for long sequences, Fishman et al.\n\nQUESTIONS:\n1) The experimental section primarily compares the proposed methods against a single baseline (KGW) with different configurations (e.g., KGW-1, KGW-2, KGW-4). But KGW is published in ICML 2023, could the authors include additional and more recent watermarking methods for a broader comparison?\n\n2) Single-nucleotide tokenization (A, T, C, G) is commonly used in DNA language models for SNP tasks, but other methods like k-mer and BPE tokenization (e.g., GENERATOR, DNA-BERT2) are also widely discussed. Could the authors evaluate their method with these alternative tokenizations and provide experimental results?\n\n3) Could the authors expand the related work discussion to include additional DNA language models, such as HybriDNA and GENA-LM?\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 2, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-04"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper introduces two watermarking methods, DNAMark and CentralMark, based on Evo and ESM, to embed traceable signatures in synthetic DNA sequences generated by language models. DNAMark uses synonymous codon substitutions to preserve protein function, while CentralMark embeds inheritable watermarks that persist into the translated protein using protein embeddings. The authors evaluate their approach on a therapeutic DNA benchmark and demonstrate high watermark detectability under mutation simulations.\n\nSTRENGTHS AND WEAKNESSES:\nQuality\n\nStrengths:\n- Proposes two novel watermarking strategies (DNAMark and CentralMark) tailored for biological sequence models.\n- Shows performance across different DNA LMs (e.g., Evo2-7B, Evo2-40B, megaDNA), demonstrating generalizability.\n- Quantitative benchmarks include F1 scores, TPRs at 1% and 10% FPR, sequence identity, and degeneracy scores (Fig. 2a-b, Table 1).\n- Authors mention \"Moreover, DNA is susceptible to natural mutations [61], synthesis errors, and sequencing inaccuracies\" and have interesting approaches to enforcing that (stratifying the watermark through the full sequence) and run some simulations at a way higher rate than biology to validating the watermark persists.\n\nWeaknesses:\n- Experimental validation is very weak. Their one case study on Cas9 watermarking uses only AlphaFold structure prediction and a TM-score, which is not a functional assay. This validation needs to be expanded if the authors are going to argue that their model works....The watermarking robustness claims rest heavily on simulation (in silico substitutions/indels) and not actual biological reality (i.e. resting a protein that they've made or doing thorough large scale evaluation of their method.)\n\n\n\nClarity\n\nStrengths:\n- The paper is relatively well written and clearly structured. The methods are broken down step-by-step (e.g., synonymous codon use in DNAMark vs second-base manipulation in CentralMark).\n- Equations and figures (e.g., Fig. 1d-e for DNAMark/CentralMark mechanisms) help communicate the watermarking process.\n- They provide a codon table and clear benchmark construction steps (Appendix C).\n\nWeaknesses:\n- Some jargon and logic jumps, especially in the embedding-based logit perturbation mechanisms, could lose readers without deep familiarity with DNA/protein LMs.\n- Lack of description in different model choices like ESM2-35M (Appendix G). Why is this the model authors choose instead of a different class of models or a different version of ESM2/3? \n- Detection strategies and the selection of z-score thresholds could be better contextualized in biological terms.\n- The novelty of inheritable watermarks in biology is interesting but authors need to mention how they would get people to adopt this / how it could be enforced...would it be like DNA synthesis companies regulating dangerous sequences people try to order? would people need to include a watermark in the libraries they order? how would you enforce that?\n\nSignificance\n\nStrengths:\n- this work is centered in biosecurity risks in synthetic biology with increasingly powerful DNA generative models and that is very important.\n- Embedding traceable watermarks in synthetic DNA/protein could become essential if generative bio models are ever regulated. And if this was regulated, certainly this technique would be one to keep an eye on.\n\nWeaknesses:\n- Adoption path is not seriously addressed. As I asked above: how will people be incentivized to use this? Will it be a regulatory mandate, or will synthesis providers require watermarked sequences?\n- Doesn’t propose a governance model or standardization path. Perhaps a Correspondence like \"A call for built-in biosecurity safeguards for generative AI tools\" or paper like \"Developing Guardrails for AI Biodesign Tools\"  would be nice to pair publish with this. I wonder if authors would also consider having this tool be available in something like https://ibbis.bio/our-work/common-mechanism/\n- It remains unclear if watermarking would withstand selection in evolving systems or under strong selective pressure.\n\nOriginality\n\nStrengths:\n- The application of watermarking to DNA and proteins is novel. Prior works focused on natural language or, recently, protein LMs alone.\nCentralMark is creative in that they embed watermarks positionally relevant places in the codons depending on their goal (like second or third nt)\n- They define a red/green token strategy in a biologically interpretable way (based on synonymous codons or amino acid types).\n\nWeaknesses:\n- Related works like Chen et al. (2025) on protein watermarking [9] are only briefly acknowledged. More comparison would have been helpful.\n- DNAMark’s synonymous codon approach is conceptually similar to prior watermarking logic (e.g., biased token selection using logits)—novel in application to biology, less so in core technique.\n- No counterexamples or attack strategies from adversaries are deeply explored.\n\nQUESTIONS:\n1. On biological realism and validation: You mention that “DNA is susceptible to natural mutations, synthesis errors, and sequencing inaccuracies,” and simulate these effects at higher-than-natural rates. However, the current validation (e.g., a single AlphaFold prediction on Cas9) falls short of demonstrating real-world robustness towards *functional* consequences of these mutations. Have you considered evaluating watermark persistence in actual biological systems (through synthesis, expression, and functional assays) under selective pressure? This would substantially strengthen claims about robustness and practical use and greatly increase the rating of the paper. \n\n2. On adoption and governance: The success of watermarking for DNA depends heavily on its adoption. How do you envision this technique being used in practice? For instance, would synthesis providers require inclusion of a watermark, or could it be a regulatory mandate? Have you considered aligning with initiatives like IBBIS’s Common Mechanism or incorporating guidance from recent proposals such as “A call for built-in biosecurity safeguards for generative AI tools”? Or writing your own proposal?\n\n3. On model choices and detection strategy: Can you clarify your rationale for choosing ESM2-35M for CentralMark? Were other embedding models (e.g., larger ESM models, a VAE, MSA Transformer, etc etc) considered, and how might these impact watermark quality or robustness? Additionally, how were z-score thresholds selected, and how do you ensure they are biologically meaningful across diverse proteins or sequence contexts?\n\n4. Can you please align your generated sequence to the reference and not the other way around? The Cas9 reference sequence should be the reference that you're aligning your generated sequence to and would serve as important quality check (for instance if the generated sequences does not have H840 or D10, then we know that the sequence will not function enzymatically like the WT as a bare minimum check)\n\nLIMITATIONS:\nCan authors describe a bit more about potential ways this could be co-opted for negative use or how people could attempt to get around this?", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 2, "DATE": "2025-07-07"}