FoldMark: Protecting Protein Generative Models with Watermarking

TL;DR

FoldMark introduces a novel watermarking method for protein generative models, embedding identifiable information into generated structures to ensure copyright protection and traceability without compromising structural quality.

Contribution

The paper presents a two-stage watermarking strategy, FoldMark, that effectively embeds and recovers watermarks in protein structures across various generative models with minimal impact on quality.

Findings

Effective watermark embedding and recovery demonstrated across multiple models

Minimal impact on protein structure quality

Robust against post-processing and adaptive attacks

Abstract

Protein structure is key to understanding protein function and is essential for progress in bioengineering, drug discovery, and molecular biology. Recently, with the incorporation of generative AI, the power and accuracy of computational protein structure prediction/design have been improved significantly. However, ethical concerns such as copyright protection and harmful content generation (biosecurity) pose challenges to the wide implementation of protein generative models. Here, we investigate whether it is possible to embed watermarks into protein generative models and their outputs for copyright authentication and the tracking of generated structures. As a proof of concept, we propose a two-stage method FoldMark as a generalized watermarking strategy for protein generative models. FoldMark first pretrain watermark encoder and decoder, which can minorly adjust protein structures to embed user-specific information and faithfully recover the information from the encoded structure. In the second step, protein generative models are fine-tuned with watermark-conditioned Low-Rank Adaptation (LoRA) modules to preserve generation quality while learning to generate watermarked structures with high recovery rates. Extensive experiments are conducted on open-source protein structure prediction models (e.g., ESMFold and MultiFlow) and de novo structure design models (e.g., FrameDiff and FoldFlow) and we demonstrate that our method is effective across all these generative models. Meanwhile, our watermarking framework only exerts a negligible impact on the original protein structure quality and is robust under potential post-processing and adaptive attacks.