---
title: 'DNAMark: Watermarking for DNA Language Models'
url: https://www.emergentmind.com/topics/dnamark
type: topic
---

# DNAMark: Watermarking for DNA Language Models

Searching arXiv for DNAMark and closely related papers to ground the article in current literature.
DNAMark is a DNA watermarking method introduced for tracking sequences generated by DNA language models through synonymous codon substitutions that preserve the encoded amino-acid sequence. In the formulation reported in "Securing the Language of Life: Inheritable Watermarks from DNA Language Models to Proteins" [2509.18207], DNAMark operates on protein-coding DNA, derives watermark signals from semantic embeddings, and biases nucleotide generation only at codon positions where at least one synonymous alternative exists. The stated motivation is biosecurity: DNA language models enable therapeutics, synthetic biology, and gene editing, but also create dual-use risks, including the potential for creating pathogens, viruses, and bioweapons. DNAMark is paired with CentralMark, which extends watermark inheritance from DNA to translated proteins, but DNAMark itself is defined at the DNA-sequence level [2509.18207].

## 1. Conceptual scope and biosecurity rationale

DNAMark is designed for the setting in which a protein-coding DNA language model, such as Evo or Evo2, generates a coding sequence and a watermark must be embedded without changing the biological function encoded by the protein sequence. The method therefore uses synonymous codon substitutions, rather than arbitrary nucleotide edits, to insert binary information into the generated DNA. In the reported framework, the watermark is not imposed as a fixed barcode sequence; instead, it is produced from position-dependent semantic embeddings and injected into the model’s next-token distribution as additional logits [2509.18207].

The biosecurity framing is central to the method’s definition. The paper states that DNA language models have enabled increasingly precise DNA understanding and design, while also posing dual-use risks. DNAMark is presented as one response to that problem: a mechanism for reliably tracking designed DNA under natural mutations, synthesis errors, and adversarial attacks. The associated paper reports that DNAMark and CentralMark achieve F1 detection scores above 0.85 under various conditions, while maintaining over 60% sequence similarity to ground truth and degeneracy scores below 15% [2509.18207].

A common misconception is to treat DNAMark as a generic “DNA marking” or molecular barcoding scheme. In the cited formulation, it is specifically a watermarking procedure for generated coding DNA, not a sequencing-time label, not a methylation assay, and not a connectomic barcode system. Its operative signal is embedded during generation through codon-choice bias, not appended as an external tag [2509.18207].

## 2. Embedding pipeline and bit encoding

The embedding pipeline is defined stepwise. At each generation step, the DNA language model provides original logits over the next nucleotide. For the current codon position $i$, a semantic embedding vector $\mathbf{e}_i$ is extracted by feeding the preceding sequence into Evo2. A small trained watermark network $g(\cdot)$ maps $\mathbf{e}_i$ to watermark logits $\mathbf{w}_i$ over the four nucleotides. These watermark logits are scaled by a strength factor $\delta_t$, which may be adaptive via EMA, and are then added to the original DNA-language-model logits. The next nucleotide is sampled, or greedily selected, from this biased distribution [2509.18207].

The crucial biological constraint is that, in the coding region, DNAMark only modifies the third base of a codon, and only if there is at least one synonymous alternative, so that the encoded amino acid remains unchanged. For a codon prefix consisting of the first two bases $b_1,b_2$, the method defines the synonymous set
$$
\mathcal{S}=\{\,b_3\in\{A,C,G,T\}\mid\text{translate}(b_1,b_2,b_3)=\text{same amino acid}\}\, .
$$
If $|\mathcal{S}|\ge 2$, the set is partitioned into a green singleton $\{b_g\}$ and a red set $\mathcal{R}=\mathcal{S}\setminus\{b_g\}$. Selecting the green base encodes bit $1$, while selecting any red base encodes bit $0$ [2509.18207].

This design makes the watermark sparse and codon-aware. Because the green/red assignment is defined only over synonymous alternatives, the protein sequence is preserved by construction. This suggests that DNAMark’s payload is intrinsically linked to codon degeneracy and to the local sequence contexts in which synonymous alternatives are available, rather than being uniformly distributed across all nucleotide positions.

## 3. Mathematical formulation and training objective

The method formalizes semantic conditioning through an embedding map
$$
\mathbf{e}_i = \mathrm{Evo2Embed}(x_{1:i-1})\in\mathbb{R}^{d},
$$
where $\mathbf{e}_i$ is the embedding of the prefix ending at codon position $i$. The watermark network
$$
g: \mathbb{R}^d\to\mathbb{R}^4
$$
produces
$$
\mathbf{w}_i = g(\mathbf{e}_i)\in\mathbb{R}^4.
$$
For bit value $b\in\{0,1\}$, the method defines
$$
\ell_i(b)=\max_{b'\in\mathcal{G}_b}\mathbf{w}_i^{(b')},
$$
with $\mathcal{G}_1=\{b_g\}$ and $\mathcal{G}_0=\mathcal{R}$ [2509.18207].

Generation is then biased by combining the original language-model logits with watermark logits:
$$
\log p(x_i=c)\propto \log p_{\rm LM}(x_i=c\mid x_{<i})+\delta_t\cdot \mathbf{w}_i^{(c)} .
$$
In this form, watermarking is not an external post-processing step; it is integrated directly into token selection during sequence generation [2509.18207].

Training of $g(\cdot)$ is reported to use two objectives on a corpus of human CDS embeddings. The alignment loss matches watermark-logit similarities to Evo2-embedding similarities:
$$
\mathcal{L}_a
= \sum_{i,j}\Bigl\lvert
\frac{\mathbf{w}_i\!\cdot\!\mathbf{w}_j}{\|\mathbf{w}_i\|\|\mathbf{w}_j\|}
-\tanh\!\Bigl(k\bigl(\frac{\mathbf{e}_i\!\cdot\!\mathbf{e}_j}{\|\mathbf{e}_i\|\|\mathbf{e}_j\|}
-\mathrm{mean}_{k,l}\frac{\mathbf{e}_k\!\cdot\!\mathbf{e}_l}{\|\mathbf{e}_k\|\|\mathbf{e}_l\|}\bigr)\Bigr)\Bigr\rvert .
$$
The normalization loss forces zero mean and roughly constant magnitude of logits:
$$
\mathcal{L}_n
= \sum_i\Bigl|\sum_j \mathbf{w}_i^{(j)}\Bigr|
+ \sum_j\Bigl|\sum_i \mathbf{w}_i^{(j)}\Bigr|
+ \lambda\sum_{i,j}\bigl|R-\mathbf{w}_i^{(j)}\bigr| .
$$
The full objective is
$$
\mathcal{L}=\mathcal{L}_a+\mathcal{L}_n .
$$
The reported intent of this formulation is to couple watermark preferences to semantic structure while preventing pathological logit drift [2509.18207].

## 4. Constrained optimization and detection rule

The embedding problem is explicitly cast as a constrained optimization over bit assignments:
$$
\max_{b_1,\dots,b_N}\;\sum_{i=1}^N \ell_i(b_i)
$$
subject to
$$
\text{Sim}(S_{\rm wm},S_{\rm orig}) \ge \tau,\quad
D_{\rm deg}(S_{\rm wm}) \le \delta .
$$
Here, $\text{Sim}(\cdot)$ is sequence identity to the original, requiring at least $\tau$, with a typical value $\tau\approx 60\%$, and $D_{\rm deg}$ is the degeneracy score, defined as the percentage of long $(>4)$ repeats in the generated DNA, requiring at most $\delta$, with a typical value $\delta\approx 15\%$ [2509.18207].

Detection is based on a z-score decision rule. After generation, or after an attacker’s mutations, the suspect DNA is scanned and the number $r$ of observed green-list tokens is counted over $T$ watermarkable positions. Given the expected green ratio $\gamma$ under no watermark,
$$
\gamma = E[r]/T,\quad \mathrm{Var}[r]=T\,\gamma(1-\gamma),
$$
the detection statistic is
$$
z = \frac{r - T\gamma}{\sqrt{T\,\gamma(1-\gamma)}}.
$$
A watermark is declared present if $z \ge \tau_{\rm detect}$ [2509.18207].

The robustness argument in the paper is semantic rather than purely combinatorial. Because watermark logits are generated from semantic embeddings, minor nucleotide substitutions or synonymous codon changes are reported to leave embeddings, and hence logit preferences, largely intact. This suggests that the method is intended to withstand moderate perturbations without requiring the exact original watermarked sequence to remain unchanged.

## 5. Reported empirical behavior

The reported evaluation uses a therapeutic DNA benchmark of 400 human CDS spanning 12 categories. On that benchmark, DNAMark yields F1 approximately 0.91 without attack at 1% FPR and approximately 0.91 at 10% FPR. Under 5% synonymous codon substitutions, the reported F1 is approximately 0.90. Under 5% random nucleotide substitutions or 5% indels, the reported F1 remains at least 0.85. DNA sequence identity to ground truth is reported to stay above 60–70%, and degeneracy remains below 15% [2509.18207].

These results are presented as evidence that detection remains viable under both biologically plausible noise and adversarial modification. The abstract further states that DNAMark and CentralMark achieve F1 detection scores above 0.85 under various conditions while preserving substantial sequence similarity. A case study on the CRISPR-Cas9 system is reported specifically to underscore CentralMark’s utility in real-world settings, which places DNAMark within a broader family of watermarking mechanisms rather than as a standalone detector [2509.18207].

The empirical framing also clarifies what the method is not optimizing for. The objective is not exact nucleotide reproduction of the unwatermarked sequence; instead, it balances detectability against sequence identity and repeat-related degeneracy constraints. A plausible implication is that evaluation must be interpreted as a multi-objective trade-off among watermark strength, biological plausibility, and resistance to perturbation.

## 6. Relation to adjacent “marker” paradigms and boundary conditions

The term “marker” appears in several adjacent literatures, but DNAMark occupies a distinct technical niche. In "Network cloning using DNA barcodes" [1611.00834], individual DNA sequences called markers represent single neurons, and pairs of markers, called barcodes, contain information about connections. That framework relies on a one-marker–one-cell rule, a quadratic cost function, and Monte Carlo–based simulated annealing to clone network connectivity into a tabula rasa network. DNAMark does not use DNA barcodes to represent graph edges or neuronal identities; it uses synonymous codon substitutions to embed a statistical watermark into generated coding DNA [1611.00834].

A different line of work uses DNA methylation markers for computational deconvolution. In "Discovery and optimization of cell-type-specific DNA methylation markers for in silico deconvolution" [2304.05756], discriminative regions are derived from pairwise DMR calling, aggregated into uniquely (de)methylated regions, selected by a set-cover procedure, and used in beta-value-based or read-level deconvolution models. That use of “markers” refers to endogenous methylation regions that distinguish cell types, not to watermark bits inserted into a generated coding sequence [2304.05756].

These contrasts matter because they delimit DNAMark’s scope. DNAMark assumes protein-coding DNA, a language-model generation process, and codon positions with synonymous alternatives. It is therefore not a general-purpose marker-discovery framework and not a universal molecular provenance system for all genomic substrates. At the same time, the stated robustness to natural mutations, synthesis errors, and adversarial attacks indicates that it is intended for deployment in environments where exact-sequence matching would be insufficient. Within that framing, DNAMark is best understood as a semantics-guided, function-preserving watermarking mechanism for DNA language model outputs, with CentralMark extending the same security logic across the central dogma [2509.18207].

Source: https://www.emergentmind.com/topics/dnamark