Securing the Language of Life: Inheritable Watermarks from DNA Language Models to Proteins

Dear reviewer, thank you for your insightful feedbacks and suggestions! As for your questions:

Q1：Missing References on DNA Watermarking History

R1: We agree that a more comprehensive review of DNA watermarking's history in synthetic biology is essential. While our paper focuses on watermarking in the context of AI-generated DNA sequences from language models, we overlooked some foundational works in traditional synthetic biology. In the revised paper, we will add a subsection on this, citing related works including but not limited to:

[1] Heider and Barnekow (2008) "DNA watermarks: A proof of concept" [BMC Mol Biol]
[2] Heider and Barnekow (2007) "DNA-based watermarks using the DNA-Crypt algorithm" [BMC Bioinformatics]
[3] Heider et al. (2009) "DNA watermarks in non-coding regulatory sequences" [BMC Res Notes]

Q2: DNA Watermarking Concept Not New; Innovation Point 2 Does Not Hold

R2: We concur that the idea of DNA watermarking, particularly using synonymous substitutions on the third codon base, dates back to works like Heider and Barnekow (2008). However, our claimed innovation point 2 (synonymous codon substitutions in DNAMark) holds in the novel context of watermarking AI-generated DNA from language models, where sequences must remain functional under generation instability and biological attacks (e.g., indels, sequencing errors). Traditional methods focus on manual GMO tagging, but ours integrates with autoregressive LMs like Evo2, using adaptive strength and entropy guidance to embed robust, detectable watermarks without degrading quality (Figure 2).

Q3: Not Fully Using Genetic Code Structure

R3: For DNAMark, we prioritized third-base alterations to minimize impacts on translation efficiency and codon usage bias, as third-base synonyms align with the wobble hypothesis and have the least effect on RNA structure and protein expression, consistent with prior works [Heider 2008]. During rebuttal, we conducted further ablation experiments. Results show that incorporation first/second-base variants increases detection F1 by 1.2% but seriously degrades sequence quality (e.g., -10.1% similarity to ground truth, +18.6% degeneracy score).

Similarly, for CentralMark, second-base alterations were chosen based on ESM embeddings minimizing semantic loss in proteins. New ablations confirm: First-base yields severe degradation (-15.2% sequence similarity, +20.8% degeneracy). We will incorporate these results in our revised paper

Q4：incorrectly claim "unbiased distribution" is the second property of SIR

R4: We apologize for the confusion but we did not claim "unbiased distribution" is the second property of SIR (line 161). Actually, we describe our watermark logits as having“no systematic preference for any nucleotide or codon and maintaining a balanced distribution of positive and negative values,”enhancing security against statistical attacks. The term “unbiased distribution” may cause confusing and mixed with other works. We will change this property of DNAMark to “unbiased token preference” in the revised paper.

Q5: Max Logit Selection

R5: DNAMark uses continuous watermark logits (δ × watermark_logits, akin to SIR’s δ × P_W) for autoregressive sampling, with synonymous substitutions and entropy guidance to ensure quality. CentralMark integrates continuous logits with ESM embeddings. We do not select max logits or discard distributions. We will update our paper in the final version to make it clearer.

Q6: Distortion-Free Alternatives

R6: We agree that distortion-free methods [1-4] could adapt to DNA, offering distribution guarantees. However, our methods focusing on addressing bio-specific challenges (e.g., robustness to sequencing errors and mutations, CentralMark’s inheritable watermark etc.,). During rebuttal, we conduct further experiments to compare with [3] and [4]

The distortion-free watermarking methods from Hu et al. [3] and Dathathri et al. [4], while effective for large-vocabulary language models in text domains, underperform in DNA sequence watermarking due to the inherent constraints of DNA's small four-nucleotide alphabet and the unique biological attacks it faces, such as synonymous codon substitutions, nucleotide substitutions, and insertion-deletions (indels).

Q7: Lack of Technical Novelty

R7: While DNAMark and CentralMark adapt elements from SIR [38] and KGW [33], our novelty lies in DNA-specific innovations: (1) Synonymous substitutions with adaptive/entropy guidance for LM stability; (2) CentralMark's inheritable watermarks from DNA to proteins via ESM, enabling cross-dogma detection (unique to biology); (3) A therapeutic DNA benchmark and bio-attacks (e.g., indels). Experiments show superior performance over adapted distortion-free baselines like Hu et al. [3] and Dathathri et al. [4] (new Table: e.g., TPR 0.875 vs. 0.790 under no attack).

Q8: Insufficient Evidence for Preserving Function; Limited to One Case Study

R8: We agree that the original CRISPR-Cas9 case study provides strong but limited evidence. To address this, we performed additional structural and functional evaluations on 10 diverse proteins from our therapeutic DNA benchmark (e.g., cytokines like IL-2, enzymes like Cas12a, and antibodies like Herceptin; selected for variety in length and function). Using AlphaFold3 for structure prediction, we computed TM-scores between watermarked and ground-truth proteins. Results (new Table in revisions) show average TM-scores of 0.72 ± 0.05 for DNAMark and 0.68 ± 0.06 for CentralMark, indicating preserved folds. For function, we simulated in silico assays: e.g., binding affinity via docking scores (AutoDock Vina) for antibodies (average <5% loss in binding affinity). These confirm functional retention across categories.

Q9: Unclear Functional Metrics; TM-Score's Connection to Function

R9:You correctly note that TM-score primarily measures structural similarity, not direct function. However, literature shows TM-score >0.5 typically indicates similar folds, often correlating with functional similarity, as proteins with shared topology (>0.5 TM-score) are likely in the same SCOP fold family and retain core functions [5]. Scores >0.3 signify significant similarity beyond random. For CRISPR-Cas9, our TM-score of 0.6802 (>0.5 threshold) suggests preserved nuclease domain topology, implying retained gene-editing capability, supported by prior studies where TM-score >0.6 correlates with >90% functional homology in endonucleases.

[5] Xu, Y., & Zhang, Y. (2010). How significant is a protein structure similarity with TM-score = 0.5? Bioinformatics, 26(7), 889–895.

Q10: Increased Degeneracy and Sequence Identity Indicating Degradation

R10: While our methods show slight increases in degeneracy and minor drops in identity (Figure 2a-b), these are minimal compared to baselines (e.g., <5% degradation vs. >10% for KGW), and additional experiments confirm no significant functional impact (as above).

Q11:Low TPR (70-80%) vs. Text Watermarking (>0.99)

R11: Our TPR (e.g., 0.875 under no attack, Table 1) is lower than text due to DNA's inherent low entropy (4 nucleotides vs. ~50k tokens in text LMs), leading to reduced signal strength and vulnerability to bio-noise. This direction is apt for biosecurity, as it addresses the growing risks posed by AI-driven DNA design tools that could democratize access to synthetic biology, potentially enabling malicious actors to engineer novel pathogens, viruses, or bioweapons with unprecedented. By embedding traceable watermarks in AI-generated DNA sequences, our methods facilitate provenance tracking, allowing regulators, researchers, and biosecurity organizations to verify origins and detect unauthorized syntheses.

Thanks for your comment! Following the paper, Sequence Identity to Ground Truth and Degeneracy Score are used to evaluate the sequence quality quantitatively:

We thank the reviewer for the valuable suggestions and appreciation!

As for your questions:

Q1: How does the watermark affect biological function beyond sequence similarity? While computational results are very promising, the paper lacks wet-lab validation.

R1: During rebuttal, we performed additional structural and functional evaluations on 10 diverse proteins from our therapeutic DNA benchmark (e.g., cytokines like IL-2, enzymes like Cas12a, and antibodies like Herceptin; selected for variety in length and function). Using AlphaFold3 for structure prediction, we computed TM-scores between watermarked and ground-truth proteins. Results (new Table in revisions) show average TM-scores of 0.72 ± 0.05 for DNAMark and 0.68 ± 0.06 for CentralMark, indicating preserved folds. For function, we simulated in silico assays: e.g., binding affinity via docking scores (AutoDock Vina) for antibodies (average <5% loss in vina score). These confirm functional retention across categories.

We appreciate the reviewer’s interest in wet-lab validation for our computational and algorithmic contributions presented in this NeurIPS paper. To complement our work, we are actively collaborating with partners to conduct comprehensive wet-lab experiments to validate DNAMark and CentralMark. However, due to the time constraints of the rebuttal period, these experimental results are not yet available. We plan to include these findings in future publications to further substantiate the practical applicability of our watermarking methods.

Q2: Why were no DNA-native watermarking techniques used as baselines?

R2: DNAMark and CentralMark represent the first watermarking methods specifically designed for DNA generative language models, as no prior DNA-native watermarking techniques for such models exist in the literature. The referenced work by Chen et al. (2025) focuses on watermarking protein language models, which operate on amino acid sequences and are not directly comparable due to the fundamental differences in alphabet size (four nucleotides vs. 20 amino acids) and model architecture.

Q3: Do you see other technologies playing a complementary role to your solution, such as privacy privacy-preserving methods or cryptographic methods?

R3: We agree that complementary technologies, such as privacy-preserving methods and cryptographic techniques, can significantly enhance the applicability of DNAMark and CentralMark, particularly for future deployment on a secure platform. For instance, privacy-preserving methods like differential privacy could be integrated to protect sensitive genomic data during watermark generation, ensuring compliance with data privacy regulations in therapeutic or clinical applications. Cryptographic methods, such as RSA or homomorphic encryption, could further strengthen security by enabling secure key distribution and multi-party watermark verification without exposing the secret key, as outlined in our planned revisions (Appendix A). We envision a future platform where these methods are combined: DNAMark and CentralMark could watermark sequences, differential privacy could safeguard input data, and cryptographic protocols could ensure secure watermark detection across stakeholders (e.g., researchers, regulators). Additionally, blockchain-based tracking could complement our approach by providing an immutable ledger for watermark verification, enhancing traceability in synthetic biology applications. These ideas will be explored in future work to create a robust, secure ecosystem for DNA sequence management.

We thank the reviewer's valuable suggestions and appreciation! As for the questions:

Q1: Performance in Highly Conserved or Low-Degeneracy Regions

R1: DNAMark and CentralMark are designed to handle variability in DNA sequences, including highly conserved or low-degeneracy regions where synonymous codon substitutions may be limited. In low-degeneracy or conserved regions, where options for substitutions are scarce, the approach minimizes watermark application to avoid sequence corruption. As detailed in Section 4.1.3 (Adaptive Watermark Strength and Entropy-guided Watermark), DNAMark uses entropy-guided watermarking to selectively apply the watermark only in high-entropy positions (i.e., flexible codons with multiple synonymous options). This dynamically adjusts the watermark strength (δ) based on local sequence entropy, ensuring that conserved regions are largely untouched. The adaptive strength, updated via Exponential Moving Average (EMA) on the z-score, further balances detectability while preserving sequence quality, preventing over-watermarking in stable motifs that could lead to invalid outputs.

Q2: Sensitivity to Natural Sequencing Noise or Synthesis Errors

R2: The watermark detection in both DNAMark and CentralMark is evaluated under simulated attacks that encompass common errors, including nucleotide substitutions and indels (Table 1). The 5% mutation simulations used in the experiments (Section 5.2, under "Nucleotide Substitutions" and "Indels" attacks) are designed to exceed typical real-world error rates, providing a conservative assessment of robustness.

· Natural sequencing noise (e.g., from NGS platforms) and DNA synthesis errors typically occur at rates of ~0.1% (1/1000 bases) or lower, far below the 5% threshold tested. Our methods demonstrate high F1 scores (e.g., around 0.9 F1 score for DNAMark and CentralMark under substitution/indels attacks), indicating low sensitivity to such noise. Detection relies on z-score calculations (Equation 3, Section 4.3), which are statistical and tolerant to sparse errors, as they measure overall green-token proportions.

· For unmodeled errors (e.g., specific sequencing artifacts like homopolymer slips), the sparse watermark design (e.g., codon-level in DNAMark) and protein-level inheritance in CentralMark add redundancy, allowing detection even with partial sequence degradation.

Q3:  fixed watermark strength

R3: DNAMark and CentralMark, employ dynamic watermark strength instead of fixed watermark strength to address this issue, as detailed in Section 4.1.3 (Adaptive Watermark Strength and Entropy-guided Watermark). Specifically, DNAMark uses an adaptive watermark strength strategy, where the watermark logit strength (δ) is dynamically adjusted using an Exponential Moving Average (EMA) based on the z-score of the watermark signal. This approach ensures that watermark application is modulated according to local sequence characteristics, prioritizing regions with higher entropy (more flexible codons) to minimize disruptions to biological functionality.

Q4: Generalization of Evo2 Embeddings Across Species and Domains

R4: Evo2 is pretrained on the OpenGenome2 dataset, comprising ~9.3 trillion nucleotides from over 128,000 genomes spanning nearly all domains of life, including bacteria, archaea, eukaryotes (e.g., human, plant), and viruses/phages, as well as 41,253 metagenomes from diverse sources like Tara Oceans and animal gut samples. This extensive dataset, curated with rigorous deduplication and contig filtering, ensures Evo2’s embeddings capture universal DNA sequence features, enabling robust generalization across species and novel domains without retraining, as demonstrated in our watermarking experiments (Section 5.5).

Q5: The paper does not address the method's resistance to forgery or adversarial embedding, specifically, whether an attacker could imitate or fabricate a valid watermark by leveraging knowledge of the codon selection strategy.

R5: We appreciate the reviewer’s insight into the risks of forgery and adversarial embedding in our watermarking methods. To address this, DNAMark and CentralMark integrate a pseudorandom function seeded with a random key, akin to KGW [33], dynamically partitioning codons into green/red lists for synonymous substitutions (Section 4.1). This ensures that even with public knowledge of the codon selection strategy, forging or imitating a valid watermark is computationally infeasible without the secret key. The watermark model’s training, with alignment and normalization losses (Appendix G), further obscures predictable patterns, enhancing resistance to statistical attacks. To bolster security, we plan to incorporate advanced cryptographic techniques, such as RSA for key generation and distribution, to enable secure, verifiable multi-party detection without key exposure. In revisions, we will expand Appendix A (Broad Impacts) with a dedicated subsection detailing these defenses and outlining future empirical evaluations of forgery resistance to comprehensively address biosecurity concerns.

We thank the reviewer for the appreciation and valuable feedbacks! As for the questions:

Q1: More recent watermarking methods for a broader comparison

R1: Thanks for the suggestions! Here we compared with recent watermarking methods from ICLR 2024 and Nature 2024, while effective for large-vocabulary language models in text domains, underperform DNAMark and CentralMark in DNA sequence watermarking due to the inherent constraints of DNA's small four-nucleotide alphabet and the unique biological attacks it faces, such as synonymous codon substitutions, nucleotide substitutions, and insertion-deletions (indels).

[1] Hu et al. Unbiased watermark for language models. ICLR 2024

[2] Dathathri et al. Scalable watermarking for identifying large language model outputs. Nature 2024.

Q2: Could the authors evaluate their method with these alternative tokenizations and provide experimental results?

R2: Thank you for suggesting we adapt DNAMark and CentralMark to DNA language models based on different tokenization methods. Since DNABERT-2 is focusing on sequence understanding/prediction tasks and cannot be used for sequence generation, here we mainly did additional experiments on GENERATOR with 6-mer tokenization. To adapt DNAMark, we align synonymous codon substitutions to 6-mer tokens, perturbing logits within synonymous 6-mers to embed watermarks while preserving protein function. For CentralMark, we recalibrate ESM-based embeddings to map 6-mer tokens to protein-level watermarks, ensuring cross-dogma detectability. The new table (above) shows robust performance with GENERATOR (e.g., TPR 0.860 for CentralMark-DNA under no attack), slightly lower than Evo2-7B (0.875, Table 1) due to 6-mer’s coarser granularity and indel sensitivity, but still strong due to adaptive strength and entropy guidance.

Q3: Could the authors expand the related work discussion to include additional DNA language models, such as HybriDNA and GENA-LM?

R3: Thanks for mentioning these recent critical progress in DNA language models. We will revise our paper to include these models, highlighting their relevance to our watermarking approach for AI-generated DNA. HybriDNA, a decoder-only model with a hybrid Transformer-Mamba2 architecture, excels at processing ultra-long DNA sequences (up to 131kb) with single-nucleotide resolution, achieving state-of-the-art performance in understanding and generating cis-regulatory elements. GENA-LM, a family of transformer-based models, handles sequences up to 36kb using a masked language modeling approach and recurrent memory mechanisms, demonstrating strong performance in tasks like promoter and enhancer prediction.

We thank the reviewer for the helpful feedback and suggestions! As for the questions:

Q1: Limited experimental verification:

R1: We agree that the original CRISPR-Cas9 case study (Appendix H) provides strong but limited evidence. To address this, we performed additional structural and functional evaluations on 10 diverse proteins from our therapeutic DNA benchmark (e.g., cytokines like IL-2, enzymes like Cas12a, and antibodies like Herceptin; selected for variety in length and function). Using AlphaFold3 for structure prediction [2], we computed TM-scores between watermarked and ground-truth proteins. Results (new Table in revisions) show average TM-scores of 0.72 ± 0.05 for DNAMark and 0.68 ± 0.06 for CentralMark, indicating preserved folds. For function, we simulated in silico assays: e.g., binding affinity via docking scores (AutoDock Vina) for antibodies (average <5% loss in affinity). These confirm functional retention across categories.

Q2: Jargon and Logic Jumps in Embedding-Based Logit Perturbation

R2: To improve accessibility, we will revise these sections to include a high-level explanation: “Our watermarking adds subtle biases to DNA LM outputs, akin to digital signatures, using codon embeddings to preserve biological function while ensuring traceability.” We will also add a glossary in the appendix defining terms like “logit perturbation,” “codon-aware biasing,” and “ESM embeddings,” with intuitive analogies to text watermarking. A new figure will illustrate the perturbation process, mapping embeddings to codon choices, to bridge logic jumps.

Q3: Lack of Description for ESM2-35M Choice (Appendix G)

R3: We selected ESM2-35M for its balance of computational efficiency and robust protein embeddings, suitable for inheritable watermarks across the central dogma (Page 5). Compared to larger models like ESM2-650M or ESM3, ESM2-35M offers faster inference (10x speedup) with comparable semantic accuracy for proteins in our benchmark. We tested ESM2-650M in new experiments, finding marginal F1 improvement (+2%) but 5x higher latency, unsuitable for large-scale watermarking.

Q4: Detection Strategies and Z-Score Thresholds Lacking Biological Context

R4: Our detection strategy using z-scores (Page 7) is inspired by text watermarking but needs better biological framing. The z-score measures watermark signal strength against sequencing noise (e.g., indels, substitutions), reflecting codon bias preservation. For example, a z-score >2 ensures >95% confidence in detecting watermarks despite bio-noise, aligning with error rates in DNA synthesis (~1/1000 bases). We will revise: “Z-scores quantify watermark detectability under biological perturbations like sequencing errors; thresholds (e.g., 2) match synthesis error rates [1].”

[1]Kosuri, S., & Church, G. M. (2014). Large-scale de novo DNA synthesis: technologies and applications. Nature Methods, 11(5), 499–507

Q5: The Adoption path is not seriously addressed

R5: To incentivize adoption, we propose leveraging patent and intellectual property (IP) protection, regulatory mandates, and additional strategies tailored to synthetic biology stakeholders. First, watermarking protects IP by embedding verifiable signatures in AI-generated DNA, enabling biotech firms and researchers to prove ownership in patent disputes or licensing agreements for therapeutics and enzymes (e.g., CRISPR designs). Second, regulatory mandates from governments (e.g., NIH, WHO) could require watermarks for all AI-generated DNA ordered through synthesis providers, aligning with biosecurity regulations like the International Gene Synthesis Consortium’s screening protocols. Non-compliance could result in synthesis denial or penalties, ensuring adoption. Third, synthesis providers could offer economic incentives, such as discounts or expedited processing for watermarked sequences, appealing to cost-sensitive users. Additionally, collaboration with organizations like IBBIS could standardize watermarking protocols, integrating them into synthesis pipelines as a default practice to reduce liability and enhance market trust. Researchers could be incentivized by ethical transparency, as watermarks demonstrate responsible design, boosting credibility in publications and funding applications.

Q6: Doesn’t propose a governance model or standardization path.

R6: Thank you for your suggestion on a governance model and standardization path. We agree and propose a framework involving regulatory mandates (e.g., NIH/WHO requiring watermarks in AI-generated DNA) and incentives like IP protection for patenting. For standardization, we envision an open-source toolkit integrated with biosecurity platforms like IBBIS's Common Mechanism, ensuring uniform protocols.

For companion publications, we already have some and also have perspectives under submission. We are also organizing workshops to reach consensus across communities. Due to double blind policy, we cannot talk too much about them here.

Q7: It remains unclear if watermarking would withstand selection in evolving systems or under strong selective pressure

R7: Thank you for raising the concern about watermark robustness under evolutionary selection pressure, such as in microbial systems where sequences may mutate over generations. Our current experiments simulate biological perturbations like nucleotide substitutions and indels (Table 1), showing robust TPR (e.g., 0.795-0.840 at 1% FPR for DNAMark/CentralMark under indels), which mimic some aspects of selection-induced changes. However, due to limited time during the rebuttal period, we will further explore simulated selective evolution (e.g., multi-generation codon optimization in E. coli models) in future versions.

Q8: On model choices and detection strategy: Can you clarify your rationale for choosing ESM2-35M for CentralMark?

R8:We selected ESM2-35M for its balance of computational efficiency and robust protein embeddings, suitable for inheritable watermarks across the central dogma (Page 5). Compared to larger models like ESM2-650M or ESM3, ESM2-35M offers faster inference (10x speedup) with comparable semantic accuracy for proteins in our benchmark. We tested ESM2-650M in new experiments, finding marginal F1 improvement (+2%) but 5x higher latency, unsuitable for large-scale watermarking.

Q9: Can you please align your generated sequence to the reference and not the other way around? 

R9: Sure, we will align the generated sequence to the reference and change the figures in the appendix. Because we cannot submit or revise figures/pdfs during rebuttal, we promise to update the alignment in our camera-ready version.

Q10: More discussions of related works such as of Related Works like Chen et al. (2025)

R10: Is brief. Chen et al.’s approach embeds watermarks in protein sequences, focusing on structural integrity but not inheritable DNA-to-protein traceability. To improve, we will expand the related works section (Page 2) to compare our methods explicitly: DNAMark leverages codon redundancy for DNA-level watermarking, while CentralMark extends to proteins via ESM embeddings, unlike Chen et al.’s protein-only focus. We will include more discussions in the revised paper.

Dear reviewer,

We hope our latest response has resolved your issue. If you are now satisfied, we would appreciate it if you would consider updating your support rating. Thank you for your feedback!

Bests,
Authors