Research map / Large language models / Language, safety and interpretability
Securing the Language of Life: Inheritable Watermarks from DNA Language Models to Proteins
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes DNAMark (synonymous-codon watermarking of DNA LM output using Evo2-embedding-driven watermark logits) and CentralMark (ESM-driven second-base watermark that is detectable in both DNA and translated protein), evaluated on a 400-sequence therapeutic DNA benchmark.
Problem
Watermarking DNA language models for biosecurity traceability is underexplored: DNA has a 4-letter alphabet, is mutated and sequenced with errors, and coding sequences must preserve protein function, so LLM watermarks such as KGW transfer poorly.
Approach
Use a trained watermark model that maps Evo2 (DNA) or ESM (protein) embeddings to watermark logits, biasing nucleotide choice; DNAMark restricts watermarks to third codon bases (synonymous, function-preserving), while CentralMark targets second codon bases so that the watermark is inherited by the translated protein's amino acid distribution.
Key results
- Under no attack, CentralMark (DNA) reaches TPR 0.875 and F1 0.928 at 1% FPR versus 0.774 TPR for the best KGW baseline (KGW-4, F1 0.868).
- Under Indels attack, DNAMark achieves F1 0.878 at 1% FPR while KGW-1 reaches 0.675, and all proposed methods keep F1 above 0.85 across attacks as claimed.
- The CRISPR-Cas9 case study designed with Evo and CentralMark reaches a TM-score of 0.6802 against wild-type SpCas9 and a z-score of 5.41.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use DNAMark or CentralMark instead of KGW baselines | DNA watermark detection with Evo2-7B · Therapeutic DNA under synonymous codon substitutions, nucleotide substitutions, and indels | F1 | Helped |
| Add adaptive watermark strength with EMA (ablation) | DNAMark · Therapeutic DNA watermark detection | F1 | Helped |
| Add the trained watermark model (ablation) | DNAMark · Therapeutic DNA watermark detection | F1 | Helped |
| Remove entropy guidance (ablation) | DNAMark · Generated DNA sequence quality | Sequence Identity and Degeneracy Score | Mixed |
| Remove alignment loss (ablation) | DNAMark watermark model · Therapeutic DNA watermark detection | F1 | Mixed |
| Remove normalization loss (ablation) | DNAMark watermark model · Therapeutic DNA watermark detection | F1 | Mixed |
| Increase watermark strength beyond a suitable range (ablation) | DNAMark · Generated DNA sequence | Degeneracy Score | Hurt |
| Use watermarking rather than no-watermark generation | DNAMark and CentralMark · 128-nucleotide DNA generation on Evo | generation time | Hurt |
Surprising findings
- KGW baselines reach only about 70-80% TPR on DNA versus near 100% on natural text, attributed to the four-letter vocabulary and DNA model brittleness.
- Excessive watermark strength causes DNA models to collapse into repetitive motifs such as AAAAA.
Limitations
- Relies on green/red list partitioning, which the authors note should be replaced by schemes independent of green/red lists.
- Indels and nucleotide substitutions degrade detection (e.g., CentralMark TPR near 76% under Indels at 1% FPR).
- No wet-lab validation of the watermarked sequences.
Experimental setup
Datasets: RefGen human coding sequences NCBI RefSeq UniProt secondary structure annotations
Benchmarks: Therapeutic DNA benchmark (400 sequences)
Metrics: TPR at 1% FPR TPR at 10% FPR F1 sequence identity degeneracy score generation time TM-score
Baselines: KGW-1 KGW-2 KGW-4
Builds on: KGW watermark Evo2 ESM SIR
Closest papers by meaning
- BEND: Benchmarking DNA Language Models on Biologically Meaningful Tasks (ICLR 2024 · similarity 0.84)
- LEMON-ZEST: Evolution-Informed Tokenization for Efficient Protein Language Modeling (NeurIPS 2026 · similarity 0.83)
- DART-Eval: A Comprehensive DNA Language Model Evaluation Benchmark on Regulatory DNA (NeurIPS 2024 · similarity 0.83)
- Steering Protein Language Models (ICML 2025 · similarity 0.83)
- Break the Trade-off Between Watermark Strength and Speculative Sampling Efficiency for Language Models (ICLR 2026 · similarity 0.83)
- A Watermark for Order-Agnostic Language Models (ICLR 2025 · similarity 0.82)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.