DNAMark: Watermarking for DNA Language Models

• DNAMark is a DNA watermarking method that embeds binary signals through synonymous codon substitutions to preserve the encoded protein function.
• It modifies third codon bases using semantic embeddings and watermark logits, ensuring traceability while maintaining biological integrity.
• Empirical evaluations demonstrate robust detection (F1 > 0.85) and high sequence similarity (>60%) even under moderate sequence modifications.

Searching arXiv for DNAMark and closely related papers to ground the article in current literature. DNAMark is a DNA watermarking method introduced for tracking sequences generated by DNA LLMs through synonymous codon substitutions that preserve the encoded amino-acid sequence. In the formulation reported in "Securing the Language of Life: Inheritable Watermarks from DNA LLMs to Proteins" (Zhang et al., 20 Sep 2025), DNAMark operates on protein-coding DNA, derives watermark signals from semantic embeddings, and biases nucleotide generation only at codon positions where at least one synonymous alternative exists. The stated motivation is biosecurity: DNA LLMs enable therapeutics, synthetic biology, and gene editing, but also create dual-use risks, including the potential for creating pathogens, viruses, and bioweapons. DNAMark is paired with CentralMark, which extends watermark inheritance from DNA to translated proteins, but DNAMark itself is defined at the DNA-sequence level (Zhang et al., 20 Sep 2025).

1. Conceptual scope and biosecurity rationale

DNAMark is designed for the setting in which a protein-coding DNA LLM, such as Evo or Evo2, generates a coding sequence and a watermark must be embedded without changing the biological function encoded by the protein sequence. The method therefore uses synonymous codon substitutions, rather than arbitrary nucleotide edits, to insert binary information into the generated DNA. In the reported framework, the watermark is not imposed as a fixed barcode sequence; instead, it is produced from position-dependent semantic embeddings and injected into the model’s next-token distribution as additional logits (Zhang et al., 20 Sep 2025).

The biosecurity framing is central to the method’s definition. The paper states that DNA LLMs have enabled increasingly precise DNA understanding and design, while also posing dual-use risks. DNAMark is presented as one response to that problem: a mechanism for reliably tracking designed DNA under natural mutations, synthesis errors, and adversarial attacks. The associated paper reports that DNAMark and CentralMark achieve F1 detection scores above 0.85 under various conditions, while maintaining over 60% sequence similarity to ground truth and degeneracy scores below 15% (Zhang et al., 20 Sep 2025).

A common misconception is to treat DNAMark as a generic “DNA marking” or molecular barcoding scheme. In the cited formulation, it is specifically a watermarking procedure for generated coding DNA, not a sequencing-time label, not a methylation assay, and not a connectomic barcode system. Its operative signal is embedded during generation through codon-choice bias, not appended as an external tag (Zhang et al., 20 Sep 2025).

2. Embedding pipeline and bit encoding

The embedding pipeline is defined stepwise. At each generation step, the DNA LLM provides original logits over the next nucleotide. For the current codon position $i$, a semantic embedding vector $\mathbf{e}_i$ is extracted by feeding the preceding sequence into Evo2. A small trained watermark network $g(\cdot)$ maps $\mathbf{e}_i$ to watermark logits $\mathbf{w}_i$ over the four nucleotides. These watermark logits are scaled by a strength factor $\delta_t$, which may be adaptive via EMA, and are then added to the original DNA-language-model logits. The next nucleotide is sampled, or greedily selected, from this biased distribution (Zhang et al., 20 Sep 2025).

The crucial biological constraint is that, in the coding region, DNAMark only modifies the third base of a codon, and only if there is at least one synonymous alternative, so that the encoded amino acid remains unchanged. For a codon prefix consisting of the first two bases $b_1,b_2$, the method defines the synonymous set

$$\mathcal{S}=\{\,b_3\in\{A,C,G,T\}\mid\text{translate}(b_1,b_2,b_3)=\text{same amino acid}\}\, .$$

If $|\mathcal{S}|\ge 2$, the set is partitioned into a green singleton $\{b_g\}$ and a red set $\mathbf{e}_i$0. Selecting the green base encodes bit $\mathbf{e}_i$1, while selecting any red base encodes bit $\mathbf{e}_i$2 (Zhang et al., 20 Sep 2025).

This design makes the watermark sparse and codon-aware. Because the green/red assignment is defined only over synonymous alternatives, the protein sequence is preserved by construction. This suggests that DNAMark’s payload is intrinsically linked to codon degeneracy and to the local sequence contexts in which synonymous alternatives are available, rather than being uniformly distributed across all nucleotide positions.

3. Mathematical formulation and training objective

The method formalizes semantic conditioning through an embedding map

$\mathbf{e}_i$3

where $\mathbf{e}_i$4 is the embedding of the prefix ending at codon position $\mathbf{e}_i$5. The watermark network

$\mathbf{e}_i$6

produces

$\mathbf{e}_i$7

For bit value $\mathbf{e}_i$8, the method defines

$\mathbf{e}_i$9

with $g(\cdot)$0 and $g(\cdot)$1 (Zhang et al., 20 Sep 2025).

Generation is then biased by combining the original language-model logits with watermark logits:

$g(\cdot)$2

In this form, watermarking is not an external post-processing step; it is integrated directly into token selection during sequence generation (Zhang et al., 20 Sep 2025).

Training of $g(\cdot)$3 is reported to use two objectives on a corpus of human CDS embeddings. The alignment loss matches watermark-logit similarities to Evo2-embedding similarities:

$g(\cdot)$4

The normalization loss forces zero mean and roughly constant magnitude of logits:

$g(\cdot)$5

The full objective is

$g(\cdot)$6

The reported intent of this formulation is to couple watermark preferences to semantic structure while preventing pathological logit drift (Zhang et al., 20 Sep 2025).

4. Constrained optimization and detection rule

The embedding problem is explicitly cast as a constrained optimization over bit assignments:

$g(\cdot)$7

subject to

$g(\cdot)$8

Here, $g(\cdot)$9 is sequence identity to the original, requiring at least $\mathbf{e}_i$0, with a typical value $\mathbf{e}_i$1, and $\mathbf{e}_i$2 is the degeneracy score, defined as the percentage of long $\mathbf{e}_i$3 repeats in the generated DNA, requiring at most $\mathbf{e}_i$4, with a typical value $\mathbf{e}_i$5 (Zhang et al., 20 Sep 2025).

Detection is based on a z-score decision rule. After generation, or after an attacker’s mutations, the suspect DNA is scanned and the number $\mathbf{e}_i$6 of observed green-list tokens is counted over $\mathbf{e}_i$7 watermarkable positions. Given the expected green ratio $\mathbf{e}_i$8 under no watermark,

$\mathbf{e}_i$9

the detection statistic is

$\mathbf{w}_i$0

A watermark is declared present if $\mathbf{w}_i$1 (Zhang et al., 20 Sep 2025).

The robustness argument in the paper is semantic rather than purely combinatorial. Because watermark logits are generated from semantic embeddings, minor nucleotide substitutions or synonymous codon changes are reported to leave embeddings, and hence logit preferences, largely intact. This suggests that the method is intended to withstand moderate perturbations without requiring the exact original watermarked sequence to remain unchanged.

5. Reported empirical behavior

The reported evaluation uses a therapeutic DNA benchmark of 400 human CDS spanning 12 categories. On that benchmark, DNAMark yields F1 approximately 0.91 without attack at 1% FPR and approximately 0.91 at 10% FPR. Under 5% synonymous codon substitutions, the reported F1 is approximately 0.90. Under 5% random nucleotide substitutions or 5% indels, the reported F1 remains at least 0.85. DNA sequence identity to ground truth is reported to stay above 60–70%, and degeneracy remains below 15% (Zhang et al., 20 Sep 2025).

These results are presented as evidence that detection remains viable under both biologically plausible noise and adversarial modification. The abstract further states that DNAMark and CentralMark achieve F1 detection scores above 0.85 under various conditions while preserving substantial sequence similarity. A case study on the CRISPR-Cas9 system is reported specifically to underscore CentralMark’s utility in real-world settings, which places DNAMark within a broader family of watermarking mechanisms rather than as a standalone detector (Zhang et al., 20 Sep 2025).

The empirical framing also clarifies what the method is not optimizing for. The objective is not exact nucleotide reproduction of the unwatermarked sequence; instead, it balances detectability against sequence identity and repeat-related degeneracy constraints. A plausible implication is that evaluation must be interpreted as a multi-objective trade-off among watermark strength, biological plausibility, and resistance to perturbation.

6. Relation to adjacent “marker” paradigms and boundary conditions

The term “marker” appears in several adjacent literatures, but DNAMark occupies a distinct technical niche. In "Network cloning using DNA barcodes" (Shuvaev et al., 2016), individual DNA sequences called markers represent single neurons, and pairs of markers, called barcodes, contain information about connections. That framework relies on a one-marker–one-cell rule, a quadratic cost function, and Monte Carlo–based simulated annealing to clone network connectivity into a tabula rasa network. DNAMark does not use DNA barcodes to represent graph edges or neuronal identities; it uses synonymous codon substitutions to embed a statistical watermark into generated coding DNA (Shuvaev et al., 2016).

A different line of work uses DNA methylation markers for computational deconvolution. In "Discovery and optimization of cell-type-specific DNA methylation markers for in silico deconvolution" (Krsmanovic, 2023), discriminative regions are derived from pairwise DMR calling, aggregated into uniquely (de)methylated regions, selected by a set-cover procedure, and used in beta-value-based or read-level deconvolution models. That use of “markers” refers to endogenous methylation regions that distinguish cell types, not to watermark bits inserted into a generated coding sequence (Krsmanovic, 2023).

These contrasts matter because they delimit DNAMark’s scope. DNAMark assumes protein-coding DNA, a language-model generation process, and codon positions with synonymous alternatives. It is therefore not a general-purpose marker-discovery framework and not a universal molecular provenance system for all genomic substrates. At the same time, the stated robustness to natural mutations, synthesis errors, and adversarial attacks indicates that it is intended for deployment in environments where exact-sequence matching would be insufficient. Within that framing, DNAMark is best understood as a semantics-guided, function-preserving watermarking mechanism for DNA LLM outputs, with CentralMark extending the same security logic across the central dogma (Zhang et al., 20 Sep 2025).