A modulation-based encryption framework integrating channel and artificial noise for DNA storage

Summary

DNA storage has emerged as a promising solution for long-term, large-scale data archiving. However, ensuring data confidentiality remains a key challenge. The error-prone nature of DNA storage channels hinders reliable information retrieval but also provides opportunities for encryption. In this work, we propose a modulation-based encryption framework that leverages inherent channel noise and injected indel errors to enhance confidentiality in DNA storage. Simulations demonstrate high authorized decoding accuracy under realistic noise and resistance to brute force, ciphertext-only, chosen-plaintext, and partial key-leakage settings. We further interpret the security effect using intra-cluster entropy and KL divergence between normal and decoy reads. A proof-of-concept wet-lab experiment demonstrates feasibility in a real synthesis-sequencing workflow. Finally, comparisons with other DNA encryption methods and existing modulation-based schemes demonstrate that the proposed design provides an easily achievable and practical approach for data security by DNA storage.

Graphical abstract

Highlights

• •Dual-noise modulation offers a practical approach to DNA storage security
• •Natural channel noise creates confusion while artificial noise enhances confidentiality
• •High decoding accuracy and attack resistance coexist under realistic channel conditions

Biocomputational method; bioinformatics; biotechnology; data encryption; nucleic acids

Introduction

As global digital data grows exponentially,¹ traditional storage technologies—such as hard drives and magnetic tapes—face growing limitations in power efficiency, physical scalability, reliability, and long-term durability.^2,3 DNA, the natural carrier of genetic information, has emerged as a promising alternative medium for data storage due to its exceptional storage density, long lifespan, low maintenance costs, and high parallelism.^4,5 As DNA storage systems move closer to real-world deployment, ensuring the confidentiality and integrity of stored data has become increasingly important. Given the inherently sensitive and error-prone nature of biological processes, cryptographic techniques must be not only secure but also compatible with biochemical constraints.⁶ To address this challenge, researchers have explored the inherent mechanisms of DNA storage as potential foundations for practical encryption solutions.⁶

Existing DNA encryption approaches can be roughly divided into three levels. The first is in base level to design DNA coding and operation rules. For example, dynamic base-mapping strategies construct a changing conversion table between digital symbols and bases.⁷ Image-oriented schemes encode digital symbols (e.g., pixel values) into DNA sequences and apply nucleotide-level operations.^8,9 Related DNA information hiding embeds secret data through insertion/substitution strategies, such as mapping bits to synonymous codons without changing the expressed amino acid sequence,¹⁰ or inserting short secret motifs into low-salience regions so that the carrier sequence appears innocuous.¹¹ The second is in primer level which utilizes the selective amplification and retrieval of information by PCR.^12,13 This idea can be strengthened by combining primers with conventional cryptography or segmentation/ordering strategies, for example, encrypting the payload (e.g., RSA) before DNA encoding,¹⁴ splitting the message into multiple oligos whose recovery requires the correct primer set and assembly order,¹⁴ or using a pre-key activation step to conceal true primers until enzymatic cleavage.¹⁵ The third takes advantage of the confusing combination of DNA interactions. DNA chips encode data by spotting short probes on a solid surface and require the complementary strand for decryption,^15,16,17,18 whereas DNA origami encodes data within nanostructure folding patterns and relies on binding tags or staple strands as keys.^19,20,21

More recently, researchers have begun to exploit the inherent noise of DNA storage channels as a source of cryptographic confusion. Specifically, DNA data storage can be modeled as an insertion-deletion-substitution (IDS) noise channel,^22,23 due to imperfections in synthesis and sequencing. Reads originating from the same stored strand typically form a cluster with IDS errors scattered across positions.^24,25 Among these errors, insertions and deletions are particularly challenging because they introduce synchronization shifts, making it difficult to align reads and infer the original binary message without indel-aware decoding.^26,27 A recent modulation-based storage architecture addresses this challenge by introducing a modulation carrier that serves as an intrinsic synchronization reference during both encoding and decoding, enabling highly robust correction of indel errors (reported up to ∼40% IDS errors).²⁸ This strong indel tolerance makes modulation a natural substrate for noise-enabled encryption: alignment and demodulation depend on the carrier, so hiding it compels unauthorized users to reconstruct the carrier from noisy reads. As errors accumulate, this inference becomes more ambiguous. Existing modulation-based image encryption therefore shows strong security at sufficiently high error rates (e.g., ≥20%) (Figure 1A).²⁹ In parallel, deniable modulation-based encryption introduces decoy information as interference to enable protection under moderate noise (e.g., ∼10%).³⁰ However, both lines still benefit from non-negligible channel noise to blur the carrier structure, and their protection may weaken as practical sequencing pipelines operate at lower effective error rates.

Figure 1.

Encryption strategies leveraging noisy DNA storage channels

(A) Image encryption method using inherent IDS errors of the DNA storage channel.²⁹

(B) Proposed method combining channel and artificial injected errors.

(A) is adapted from Zan et al.,²⁹ Frontiers in Bioengineering and Biotechnology (2023), under the Creative Commons Attribution License (CC BY).

To address this low-noise regime, we propose a dual-noise modulation encryption framework that combines natural channel noise with artificially injected indel errors (Figure 1B). Specifically, the plaintext is encoded into two versions of DNA sequences using similar modulation keys (carriers). One set remains unaltered (upper path in Figure 1B), while the other is perturbed by irreversible indel errors (lower path). Both sets are then passed through an error-prone channel for storage or data retrieval. Only with the correct pair of modulation keys can users distinguish recoverable reads from misleading ones and accurately reconstruct the original message. Otherwise, the mixed pool remains inseparable, making unauthorized recovery unreliable. Simulation results show that the proposed framework maintains high authorized decoding accuracy under realistic channel noise conditions (5%–15%) while reducing unauthorized recovery under brute force, ciphertext-only, chosen-plaintext, and partial key-leakage settings. To better interpret the security effect of the two noise sources, we analyze within-cluster uncertainty using entropy and quantify the distribution shift between normal and decoy reads using Kullback–Leibler (KL) divergence. A proof-of-concept wet-lab experiment further demonstrates feasibility in a standard synthesis-sequencing workflow. Finally, comparisons with representative modulation-based schemes and other DNA encryption approaches suggest that integrating channel noise with injected indel perturbations can provide a simple and practical direction for secure DNA data storage.

Results

The proposed encryption framework consists of three stages: encryption, storage, and decryption (Figure 2). During the encryption stage, the original message is encoded into two versions of DNA sequences using two similar modulation keys k_nand k_m. One version is used to generate decoy sequences by injecting position-specific indel errors with an injected error (IE) rate p_ie, while the other remains unchanged and serves as correctable normal sequences. All sequences are synthesized and mixed into a single pool for storage. Because the DNA storage channel is inherently noisy and the two keys are close, the sequenced normal and decoy reads are difficult to distinguish from reads alone, which provides the basis for confidentiality. Upon decryption, amplification and sequencing introduce natural channel noise (characterized by an effective channel error (CE) rate p_ce), and the receiver obtains a read pool R that contains both normal and decoy reads. With access to both keys, the receiver can filter out decoy reads and retain the normal subset, after which the original message can be accurately retrieved.

Figure 2.

Overview of the proposed framework

(A) Encryption. The message is encoded into normal and misleading DNA sequences using two modulation keys. Indel (insertion/deletion) errors are injected to generate misleading variants, and all sequences are synthesized and mixed into a single pool for storage.

(B) Decryption. Sequenced reads are clustered and filtered based on their relative similarity to the two keys, enabling removal of misleading reads and accurate message recovery.

Experimental setup

Unless otherwise stated, all simulation experiments use 100-nt DNA sequences, including a 4-nt index and a 96-nt payload. The modulation keys k_nand k_m are binary carriers of length l = 100. In the main experiments, we use a default key distance d = 5 and a normal-to-decoy mixing ratio of 1:3. We vary the CE rate p_ce, the injected indel rate p_ie, and sequencing depth to evaluate correctness and security. In simulations, both p_ce and p_ie are modeled as i.i.d. random IDS errors for controlled benchmarking. The injected indels p_ie are introduced by deliberately editing decoy templates before synthesis, so their distribution is a design choice rather than a property of the sequencing channel. We evaluate security in an offline retrieval setting, where the adversary only observes the sequenced read pool and does not obtain any decryption feedback or adaptive decryption access. Besides ciphertext-only attacks, we also analyze a stronger chosen-plaintext setting as an upper bound, where an attacker can obtain read pools for chosen messages under the same keys. Software versions and hardware configuration are listed in STAR Methods.

Correctness

In DNA storage, correctness refers to recovering the original message accurately in the presence of channel noise. In our scheme, normal reads containing CEs are mixed with decoy reads containing both CEs and IEs. Since IEs are synchronized across reads and thus difficult to correct via consensus, correctness is primarily ensured by identifying and extracting the normal-read subset R_n for authorized decoding. Authorized decoding maintains high accuracy across realistic channel conditions. Figure 3 shows the decoding accuracy of R_n as a function of the IE rate p_ie at different sequencing depths under two representative CE rates. When the CE rate is low (p_ce = 0.05, Figure 3A), decoding accuracy remains consistently high (typically ≥0.99). When the CE rate increases to p_ce = 0.15 (Figure 3B), the overall trend remains similar, with only a slight degradation under harsher noise settings. This is expected because stronger channel noise blurs the boundary between normal and decoy reads, increasing the chance that decoy reads are mixed into the extracted R_n (Figures S1A and S1B). In practice, coverage can be uneven across clusters, and some clusters may have insufficient usable reads. As shown in Figure 3, low-depth cases (e.g., depth = 10) can lead to a moderate accuracy drop, with the worst case reaching 0.96 (p_ce = 0.15, p_ie = 0.20). In these cases, decoy reads can provide supplementary signals to refine residual errors (Figure S1C). Overall, our scheme achieves robust correctness under practical noise conditions with moderate sequencing depth (e.g., depth ≥20), while remaining usable even when some clusters have low effective depth. Full sweeps over p_ce∈[0.05,0.2] are provided in the supplemental information.

Figure 3.

Decryption performance under different noise conditions

Decoding accuracy of the extracted normal-read subset R_nunder varying injected error rates p_ie and sequencing depths, shown for (A) p_ce = 0.05 and (B) p_ce = 0.15. Accuracy remains high across the tested range, with depth ≥20 serving as a practical default for subsequent experiments. Full heatmaps over p_ce∈[0.05,0.2] and additional analyses are provided in Figure S1.

Security analysis

In this section, we evaluate the security of our scheme under adversarial settings relevant to DNA storage. We first study two multiple sequence alignment (MSA)-based ciphertext-only attacks (direct alignment and key inference), then quantify brute-force resistance via the effective key space. Next, we examine partial key leakage by revealing a fraction of key positions to the attacker, and finally discuss chosen-plaintext attacks, where channel randomness and pseudo-random IEs reduce stable patterns across repeated encryptions.

Brute force attack

The secret key consists of two components: a random binary sequence $k_n\in {\left\{0,1\right\}}^l$ of length l and another binary sequence k_m that differs from k_n by exactly d bit flips (i.e., Hamming distance d, with length fixed). Following Kerckhoffs’s principle, we conservatively assume the adversary knows the scheme and the distance parameter d, and only the concrete key values are unknown. The number of possible k_n is 2^L. Given a fixed k_n, specifying a k_m at Hamming distance d is equivalent to choosing which d positions to flip, yielding $\left(\begin{array}{l}l\\ d\end{array}\right)$ possibilities. Therefore, the key-pair space is

$$S_t=2^l\left(\begin{array}{l}l\\ d\end{array}\right)\text{.}$$ (Equation 1)

Equivalently, the security level in bits is

$${\log }_2{S}_t=l+{\log }_2\left(\begin{array}{l}l\\ d\end{array}\right)\text{.}$$ (Equation 2)

Under our default setting l = 100 and d = 5, S_t ≈ 2^126.2, which is already prohibitive for brute-force enumeration.³¹ Increasing l (or using a larger d) rapidly enlarges the search space, as summarized in Table 1. Optionally, if dis unknown and sampled from a set/range D, the effective space becomes $2^l{\sum }_{d\in D}\left(\begin{array}{l}l\\ d\end{array}\right)$, which provides an additional log⁡₂|D| bits at most.

Table 1.

Key space for different sequence lengths (with d = 5)

Length of sequences l	Key space St
100	2126
150	2179
200	2231
300	2334

Ciphertext-only attack

Ciphertext-only attacks represent a fundamental security challenge in DNA storage, where the adversary has access only to noisy sequenced reads without the keys or the original message. We evaluate robustness against two representative MSA-based attacks using MAFFT (multiple alignment using fast Fourier transform, v7.505).³² The first strategy (direct decoding) applies MSA directly to reads to obtain a consensus sequence for decoding.³³ The second strategy (key inference) reconstructs a consensus modulation carrier from aligned reads as inferred keys and then uses it to correct reads before decoding. To strengthen ciphertext-only recovery, the adversary may first cluster the ciphertext reads R into two groups, denoted $R_n^{\prime }$ and $R_m^{\prime }$, and apply either attack to R as well as to each clustered group. In the key-inference attack, the inferred carriers are denoted $k_n^{\prime }$ and $k_m^{\prime }$ when reconstructed from $R_n^{\prime }$ and $R_m^{\prime }$, respectively. To model a conservative adversary, we allow the attacker to apply clustering and select the most favorable clustered read group for attack; we therefore compare the non-clustered read pool R with the “best clustered” result. All results are evaluated at sequencing depth 60 to favor the adversary. As shown in Figure 4, clustering can improve ciphertext-only attacks compared to directly attacking the non-clustered pool R, which also supports the necessity of read filtering in authorized decoding. Nevertheless, ciphertext-only recovery degrades rapidly as noise increases. In particular, when p_ie≥0.15, both direct MSA and key-inference attacks drop to a low recovery accuracy, remaining unreliable even under the best clustered setting.

Figure 4.

Robustness against ciphertext-only MSA-based attacks under different channel conditions

(A) Direct MSA attack accuracy and (B) key-inference attack accuracy as the injected error rate p_ieincreases, shown for p_ce = 0.05 (left) and p_ce = 0.15 (right). “Best clustered” denotes the highest attack accuracy over $R_n^{\prime }$ and $R_m^{\prime }$ across all clustering methods tested (full results in Figure 1, Figure 2, Figure 3, Figure 4, Figure 5, Figure 6, Figure 7, Figure 8).

Key-leakage attack

Key leakage refers to the scenario where an adversary learns a fraction of the secret key in addition to ciphertext reads. This threat is closely related to the key-inference attack, which attempts to reconstruct the modulation carrier from aligned reads. Figure 5 reports the accuracy of the key-inference attack under the best-clustered setting for two injected-error rates (p_ie = 0.15 and p_ie = 0.20). First, leakage increases attack accuracy overall. Second, the gain is moderate within the tested range: even at 50% leakage, the attack accuracy increases by only ∼0.10 (from ∼0.45 to ∼0.55) at p_ie = 0.15, and remains below 0.45 at p_ie = 0.20. Third, stronger injection consistently reduces attack accuracy across all leakage rates, indicating an additional safety margin under leakage. Overall, partial key leakage degrades security but does not eliminate the protection provided by IEs.

Figure 5.

Robustness to partial key leakage

Attack accuracy under different key leakage rates λ (percentage of key positions revealed, randomly selected). Results are shown for p_ce = 0.05 at depth = 60, with p_ie = 0.15and p_ie = 0.20. Each point is averaged over 50 trials.

Chosen-plaintext attack

In a chosen-plaintext attack (CPA), an adversary can submit selected messages for encryption and compare the resulting ciphertexts, hoping to uncover key-dependent structures or encoding regularities.³⁴ In this setting, a practical defense is to avoid producing stable, reusable patterns across repeated encryptions of the same or related plaintexts. Our method mitigates CPA mainly through two sources of stochasticity: (1) intrinsic randomness from the DNA storage channel³⁵ and (2) pseudo-random IEs applied at randomly selected positions with varying types. First, an attacker may encrypt the same plaintext multiple times and compare the resulting read pools. Although many bases remain unchanged, the positions and types of errors vary across reads and across runs, making the perturbation patterns inconsistent and limiting cross-run alignment cues. Second, an attacker may launch differential queries by encrypting plaintexts with controlled differences and searching for systematic changes in the ciphertext. In our case, the combined channel randomness and injected perturbations disrupt the correspondence between plaintext differences and observable read-level patterns, reducing the effectiveness of differential inference. Moreover, each plaintext induces its own decoy read population, further increasing structural diversity across ciphertexts. As a result, even under repeated or adaptive CPA queries, the attacker is left with limited stable structure that can be exploited for reliable key inference in our framework.

Operating region and parameter trade-offs

In this section, we summarize a practical operating region by balancing authorized recoverability and ciphertext-only security. Figure 6 shows decoding accuracy under a representative channel condition (p_ce = 0.05) at sequencing depth 60 as the IE rate p_ie increases. Authorized decoding remains near-perfect across the tested range. The strongest ciphertext-only recovery among all tested attack variants shows a clear drop when p_ie increases from 0.05 to 0.10 and continues to decrease for larger p_ie. Based on this trend, we use p_ie≥0.15 (e.g., 0.15 or 0.20) as a conservative recommended range that preserves reliable authorized decoding while making ciphertext-only recovery unreliable. We report results at depth 60 to strengthen the attacker; in practice, authorized decoding remains stable at much lower depth (≥20). We then study how key edit distance and mixing ratio affect the previous trade-off in the supplemental information. Figure S3 sweeps the key edit distance d between k_n and k_m and shows a feasible region at moderate distances. When d is too small, the strongest attacks remain effective. When d is too large, authorized decoding can degrade in our setting. We therefore adopt d = 5 (0.05L) as a practical default. It maintains near-perfect authorized accuracy and suppresses the strongest attacks once p_ie ≥ 0.15. Figure S4 further shows how IEs shift the alignment outcome of the key-inference attack. Under the default d = 5, decoy dominance becomes strong at p_ie = 0.15, meaning that the inferred carrier is more often closer to k_m than to k_n. Figure S5 evaluates different normal-to-decoy mixing ratios and shows that 1:3 already pushes all tested attack variants below the 0.5 accuracy level, while larger ratios provide only marginal additional gains.

Figure 6.

Security-recoverability trade-off under a representative channel condition

Decoding accuracy of the legitimate user and the strongest ciphertext-only result among all tested attacks versus p_ie, evaluated at p_ce = 0.05 and sequencing depth 60.

Mechanism analysis

In this section, we analyze a Kullback–Leibler (KL) metric and within-cluster entropy to interpret the security gains brought by CEs and IEs. Reads are first grouped into K clusters using a clustering algorithm (e.g., k-means). Within each cluster, we compute the average positional entropy from column statistics of the cluster-level MSA, which reflects within-cluster randomness and weaker positional consistency for consensus recovery. We then compute the KL divergence between the normal-read subset R_n and the decoy-read subset R_m by aligning the two subsets with MAFFT and calculating a column-wise symmetric KL divergence from base-frequency distributions over {A,C,G,T,-}, where “-” denotes gaps. This KL metric serves as a proxy for how separable the two populations remain under different CE/IE settings. Figures 7A and 7B show that CE and IE influence distinguishability in opposite ways. With p_ie fixed (Figure 7A), introducing a small amount of CE quickly blurs the boundary between R_n and R_m: the KL divergence drops sharply when p_ce increases from 0 to 0.05. Further increasing p_ce yields only modest additional change, and attack accuracy decreases slowly. This suggests that CE mainly provides statistical concealment, and increasing p_ce alone offers limited marginal security gain. With p_ce fixed (Figure 7B), increasing p_ie enlarges the distribution shift between R_n and R_m, while attack accuracy drops rapidly. This is consistent with IE introducing structured distortions in the decoy population that undermine MSA-based alignment and key inference, even though the attacker does not know which population is normal. Figures 7C and 7D report the corresponding entropy trends. With fixed p_ie (Figure 7C), adding a small amount of CE substantially increases entropy, while further increases in p_ce provide diminishing returns. With fixed p_ce (Figure 7D), increasing p_ie raises entropy more mildly compared to CE, yet still leads to a strong reduction in attack accuracy. Taken together, these results highlight a complementary mechanism: IE provides strong decoy structures that directly suppress ciphertext-only recovery, while CE blurs the boundary between R_n and R_m and makes the decoy population harder to isolate from reads alone.

Figure 7.

Distinguishability and within-cluster uncertainty under different channel noise and injected errors

(A and B) Column-averaged symmetric KL divergence between R_n and R_m, computed from MAFFT columns using base frequencies over {A,C,G,T,-} (gap “-” included).

(C and D) Average positional entropy within Kclusters from cluster-level MSA column statistics. Red curves show ciphertext-only attack accuracy. (A) and (C) fix p_ie = 0.05 and vary p_ce; (B) and (D) fix p_ce = 0.05 and vary p_ie.

Practicality analysis

We further evaluate the practicality of the proposed framework from both computational and biochemical perspectives. We report the runtime overhead under longer payloads and validate feasibility with a proof-of-concept wet-lab experiment.

Runtime evaluation with longer payloads

We evaluate the computational efficiency of the proposed method when extending sequence length. Experiments are conducted under a fixed operating setting (p_ie = 0.15, p_ce = 0.05, depth = 20). We vary the sequence length from 100 nt to 300 nt and 500 nt, and report the runtime of three steps: encoding, read clustering (k-means), and authorized decoding with the keys. As shown in Table 2, encoding remains fast across all tested lengths. In contrast, both clustering and authorized decoding become slower as sequence length increases. This is expected because longer reads increase the cost of distance computation and alignment during clustering and decoding. Overall, the results show that the method remains executable for longer payloads, while longer sequences introduce a measurable runtime overhead in the clustering and decoding stages.

Table 2.

Runtime of the proposed pipeline for longer sequences with p_ie = 0.15, p_ce = 0.05, depth = 20

Total length (nt)	Encoding time (s)	k-means time (s)	Decryption time (s)	Total time (s)	Decryption accuracy
100	0.72	8.74	8.37	17.82	1.00
300	1.14	14.05	50.61	65.80	1.00
500	1.34	23.91	132.60	157.85	1.00

Wet-lab validation

To validate feasibility under real biochemical conditions, we conducted a proof-of-concept wet-lab experiment using synthetic DNA sequences (Figure 8). The original message was encoded into two 100-nt normal sequences m₁ and m₂ using k_n, and into six decoy sequences using k_m. Each decoy sequence was injected with 15% insertion/deletion errors, forming $\left\{m_1^{\prime },m_1^{″},m_1^{‴},m_2^{\prime },m_2^{″},m_2^{‴}\right\}$. All eight sequences were synthesized and individually cloned into the EcoRV site of pUC57 plasmids, and the constructs were sequence-verified by the provider before pooling. The mixed plasmid pool was sequenced on a nanopore platform, yielding 6,965 raw reads with an effective channel noise around p_ce ≈ 0.05. The bar chart in Figure 8 shows the raw numbers of full-length reads assigned to each construct and reveals noticeable coverage imbalance, which is consistent with common biases in cloning, amplification, and sequencing. We then performed authorized decryption and two MSA-based ciphertext-only attacks on the full read pool R as well as its k-means clustered subsets $R_n^{\prime }$ and $R_m^{\prime }$. Table 3 compares wet-lab results against simulations under matched noise settings (p_ie = 0.15, p_ce = 0.05). Authorized decryption achieved 100% accuracy, while both attacks remained below 50%, consistent with the simulation trend. Overall, the wet-lab results support that the proposed scheme remains effective under practical biochemical conditions.

Figure 8.

Wet-lab validation of the proposed scheme

(A) Encryption and storage: the message was encoded into normal and decoy DNA sequences using k_n and k_m. The sequences were synthesized and cloned into the EcoRV site of pUC57 plasmids, and the resulting plasmids were pooled for storage.

(B) Decryption: the pooled plasmids were sequenced on a nanopore platform, yielding 6,965 raw reads. Full-length plasmid reads were extracted for downstream clustering and decoding. The bar chart shows the raw numbers of full-length reads assigned to each construct recovered from the pooled nanopore sequencing experiment, illustrating coverage imbalance in the wet-lab data.

Table 3.

Accuracy comparison between simulation and wet-lab conditions

Conditions	Authorized decryption	Direct MSA attack (Rn’/Rm’/R)a	Key inference attack (Rn’/Rm’/R)a
Simulationb	1.00	0.03/0.24/0.16	0.04/0.33/0.20
Wet-labb	1.00	0.00/0.34/0.13	0.00/0.22/0.08

^aRis the full read pool and $R_n^{\prime }$, $R_m^{\prime }$ are the two subsets obtained by k-means clustering.

^bBoth simulation and wet-lab settings use injected indel errors at p_ie = 0.15. The simulation uses p_ce = 0.05; the wet-lab condition reflects nanopore sequencing under our pipeline (approximately characterized by an effective p_ce≈0.05).

Comparison with other methods

DNA cryptography is still developing, and many schemes rely on biochemical procedures, making it difficult to quantify and compare their security within a unified framework. For this reason, we discuss representative methods mainly from a practical perspective. Encoding-rule-based schemes are easy to integrate with sequence synthesis and sequencing, but their security is bounded by manually designed mappings and operations. PCR-based encryption is simple to implement, yet the key space is constrained by the number of usable orthogonal primers and may be vulnerable to exhaustive search or primer leakage. DNA chips and DNA origami can provide strong physical-layer protection through probe hybridization or nanostructure assembly, but they typically require more specialized preparation and stricter experimental control, and their information density and throughput are limited by the readout design. In contrast, our method is designed to stay within the standard DNA storage pipeline of synthesis, amplification, and sequencing, while taking advantage of the noisy IDS channel as part of the security mechanism. It keeps sequence-level information density and uses simple operations (generating a recoverable population and a decoy population in one pool), aiming to provide sequence-level confusion without requiring specialized substrates or complex biochemical instrumentation.

Table 4 summarizes the differences among three modulation-based encryption methods across several aspects. High-noise encryption mainly counts on very strong channel noise. It often assumes error rates around or above 20%,²⁹ which is beyond the typical error rates of current sequencing technologies. Deniable encryption was proposed to work under more moderate channel noise (around 10%) by introducing fake information to support deniability under coercion. It encodes a true and a fake message using similar modulation keys and hides the true one behind a large number of fake reads. This design reduces the need for extreme channel noise, but deniability relies on a narrower channel-noise window and often requiring deeper sequencing (≥60×). Our framework integrates channel noise with artificial noise and focuses on standard confidentiality rather than deniability. We keep the dual-key structure but encode a single message into a recoverable normal population and a decoy population created by injected indels. In this design, the IEs are the primary source of confusion, while channel noise mainly helps blur the boundary between normal and decoy reads. This reduces the dependence on unusually high channel noise and makes the security mechanism more controllable within a practical DNA storage workflow.

Table 4.

Comparisons of the three modulation-based encryption schemes

Method	Channel noise level	Encoded info	Key setting	Core confusion strategy	Practicality and cost
High-noise encryption29	≥20%	single message	single key	overwhelming channel noise	× unrealistic noise level
Deniable encryption30	∼10%	two distinct messages (true & fake)	two similar keys	channel noise + large amounts of fake messages	√ practical but costly
Dual-noise encryption (Ours)	5%–15%	same message (two versions)	two similar keys	channel noise + strongly misleading injected errors	√ practical and low cost

Discussion

In this paper, we propose a modulation-based encryption scheme that combines natural channel noise with artificially IEs, reducing reliance on high channel noise levels while enhancing cryptographic strength. Simulation results show that the scheme maintains high decoding accuracy under realistic noise conditions by leveraging both normal and decoy reads. Across the evaluated threat models, the scheme is robust to brute-force enumeration, partial key leakage, ciphertext-only reconstruction, and chosen-plaintext attacks. To interpret the security mechanism, we calculate intra-cluster entropy and the KL divergence between the filtered normal-read subset and the decoy-read subset. These results support a dual-layer protection mechanism: CEs mainly provide statistical confusion, while IEs introduce targeted disruptions that can mislead reconstruction algorithms. A proof-of-concept wet-lab experiment further supports the feasibility of the method under real biochemical conditions. The qualitative agreement between simulation and wet-lab results is consistent with moderate position- or context-dependent bias not changing the overall effectiveness of our scheme in the low-noise regime around p_ce ≈ 0.05. Finally, a comparative analysis with representative DNA encryption schemes highlights the simplicity and practicality of our method within the standard DNA storage workflow.

Conceptually, our method could serve as a security component for future DNA storage. However, several issues remain for large-scale deployment. First, security analysis in DNA storage is still evolving, and future work should evaluate stronger attacker baselines beyond MSA-driven pipelines, for example indel-aware probabilistic decoders or learning-based clustering and reconstruction. Second, practical DNA storage typically uses primer/barcode-assisted partitioning and selective retrieval rather than processing a fully mixed pool at once. Integrating our scheme with realistic partitioned pools at scale is an important direction for future work.

Limitations of the study

There are several limitations to our study. First, our evaluation focuses on offline DNA storage scenarios, and interactive oracle-style threat models are not explicitly tested. Second, the attacker benchmarks are not exhaustive, and stronger indel-aware or learning-based decoding pipelines may further improve reconstruction in some regimes. Third, simulations use an idealized i.i.d. channel model for p_ce, while real synthesis-to-sequencing channels can be position- and context dependent. Fourth, the wet-lab experiment is intended as a feasibility demonstration, and broader replication across batches and parameter sweeps will be needed to quantify robustness against experimental variability and potential laboratory-side side channels.

Resource availability

Lead contact

Requests for further information and resources should be directed to and will be fulfilled by the lead contact, Wenbin Liu (wbliu6910@gzhu.edu.cn).

Materials availability

This study did not generate new unique reagents.

Data and code availability

• •Raw Nanopore sequencing data supporting the findings of this study have been deposited in the NCBI Sequence Read Archive (SRA) and are publicly available as of the date of publication. NCBI SRA: SRR37904830. BioProject: PRJNA1447402. The same dataset has also been deposited at Mendeley Data: https://doi.org/10.17632/r27znt4xrr.1.
• •All original code has been deposited at GitHub and is publicly available as of the date of publication at https://github.com/Carol-zz/dual_noise_encryption.git.
• •All other data reported in this manuscript will be available from the lead contact upon request.

Acknowledgments

This work was supported in part by the National Natural Science Foundation of China (no. 62573143, 62002079, and 62272112), the Natural Science Foundation of Guangdong Province of China (no. 2023A1515011401), the National Key R&D Program of China (grant 2019YFA0706338402), the Municipal School Joint Fund of Guangzhou Science and Technology Bureau (SL2022A03J00935), and the Open Project of Guangdong Provincial Key Laboratory of Artificial Intelligence in Medical Image Analysis and Application (no. 2022B1212010011). This paper is supported by the GenScript project for biological science.

Author contributions

Conceptualization, L.C. and W.L.; methodology, L.C. and Y.S.; software, L.C. and Z.C.; validation, X.Y.; formal analysis, L.C. and Z.C.; investigation, L.C., Y.S., and X.Y.; resources, P.X. and W.L.; data curation, L.C.; writing – original draft preparation, L.C.; writing – review and editing, P.X. and W.L.; visualization, L.C.; supervision, P.X. and W.L.; project administration, W.L.; funding acquisition, P.X. and W.L.

Declaration of interests

The authors declare no competing interests.

STAR★Methods

Key resources table

REAGENT or RESOURCE	SOURCE	IDENTIFIER
Deposited data
Raw Nanopore sequencing data	This paper; NCBI SRA	NCBI SRA: SRR37904830; BioProject: PRJNA1447402
Oligonucleotides
Synthetic DNA sequences (100 nt payload)	GenScript (Order #C214NPHTG0)	N/A
Recombinant DNA
pUC57 plasmids containing encoded messages	GenScript (Order #C214NPHTG0)	N/A
Software and algorithms
Python (v3.10.18)	Python	https://www.python.org/
MAFFT (v7.505)	Katoh et al.32	https://mafft.cbrc.jp/alignment/software/
Simulation codes	This paper; Github	Github: https://github.com/Carol-zz/dual_noise_encryption.git
Other
DNA Synthesis and Cloning Service	GenScript (China)	Order #C214NPHTG0

Method details

Key generation

In our method, the encryption keys are two modulation carriers, k_nand k_m, which are random binary sequences of length l(equal to the length of the encoded DNA sequences), with a small edit distance maintained between them (set to d = 0.05L). These two keys are used to encode the same plaintext into two sets of DNA sequences via a modulation rule. Specifically, for each position i, the carrier bit k[i]and the message bit b[i]form a pair (k[i],b[i]), which is mapped to a nucleotide²⁸: if k[i] = 0, then b[i] = 0→A and b[i] = 1→T; if k[i] = 1, then b[i] = 0→Cand b[i] = 1→G. Concretely, k_nis used to generate the set of normal DNA sequences, and k_mis used to generate the decoy DNA sequences.

This modulation mechanism also explains why the biological constraints are preserved. Because k[i]directly determines whether the nucleotide at position i must come from {A,T}or {C,G}, the encoded sequences naturally follow a balanced AT/GC pattern, which helps maintain stable GC content. In addition, by constraining the percentage of 1s and the maximum run length of consecutive 1s/0s in the keys, long homopolymers are suppressed in the resulting DNA sequences.²⁸ Therefore, the standard synthesis constraints (GC content: 45%–55%; homopolymer runs: ≤3 nt)³⁶ are satisfied by design, and sparse and random indel injection (applied only to decoy sequences at rate p_ie) does not materially change the overall GC balance or create long homopolymers.

Encryption

Given the keys k_nand k_m, the encryption process in Figure 2A consists of the following four steps.

• Step 1: Binary Conversion. The original message is converted into binary format and segmented into Nindexed bit sequences. Each sequence is padded or truncated to a fixed length l.

• Step 2: DNA Encoding. Each bit sequence is separately encoded using k_nand k_m, resulting in two versions of DNA sequences. The one encoded with k_nserves as the normal sequence, and the one encoded with k_mserves as the decoy sequence.

• Step 3: Error Injection. We construct a position set E = {e₁,e₂, …,e_n}on the original template, where n = ⌊l·p_ie⌋and the positions are sampled uniformly without replacement from [0,l). Injected indel events are applied only to the decoy sequences using Eas anchor positions. At each selected position, the edit type is sampled uniformly from substitution, insertion, and deletion, and each position is edited at most once. Unless otherwise stated, we generate tdecoy variants per block by applying different edit types at the same set E, increasing both the quantity and diversity of decoy sequences. For insertion events, the inserted nucleotide is sampled from {A,T}when the corresponding carrier bit is 0 and from {C,G}when the carrier bit is 1, so that the AT/GC pattern imposed by modulation is minimally disturbed.

• Step 4: DNA Synthesis and Storage. The unchanged normal sequences and the tdecoy sequences are synthesized and mixed together to form the final DNA pool.

Decryption

After sequencing, the receiver obtains a pool of reads Rcomposed of both normal and decoy sequences. All reads are affected by channel noise, characterized by an effective CE rate p_ce, while only the decoy ones additionally contain the IEs. The decryption consists of the following three steps (Figure 2B).

• Step 1: Read Clustering. The noisy reads Rare grouped into Nclusters using k-means, where N equals the number of indexed message blocks (known from the encryption stage). This step aggregates reads originating from the same underlying block before filtering and decoding. In our implementation, we compute the pairwise Levenshtein edit distance matrix and represent each read by its distance vector to all reads. k-means is applied in this distance-vector space with fixed settings for reproducibility.

• Step 2: Key-Based Filtering. Within each cluster, reads are separated using the modulation keys k_nand k_m. Each read is first converted into a carrier-bit string by mapping A/T→0 and C/G→1. We compute its Levenshtein distances to both keys and assign the read to R_nor R_mbased on which key yields the smaller distance (ties are assigned to R_n).

• Step 3: Modulation Decoding.²⁸ The filtered normal reads R_nare decoded using k_n. We first align the observed carrier-bit strings to the template carrier k_nto correct synchronization shifts caused by indels. Indel correction uses a simple global alignment scoring scheme (match +1, mismatch/gap −1), followed by majority voting across aligned positions to obtain a consensus sequence. Finally, the consensus is demodulated back into the binary sequence using the inverse modulation rule under k_n(if k_n[i] = 0: A→0, T→1; if k_n[i] = 1: C→0, G→1). All recovered bit sequences are reassembled based on their indices to reconstruct the original message.

Quantification and statistical analysis

Simulation experiments were implemented in Python 3.10.18 in Visual Studio Code. Sequence alignment was performed using MAFFT (v7.505). Raw data processing, analysis, and visualization were carried out using Python, Origin, and Microsoft PowerPoint. Unless otherwise stated, reported simulation results were obtained by averaging repeated runs under the corresponding parameter settings. No formal statistical hypothesis testing was performed. Experiment-specific details are provided in the corresponding figure legends, results, and method details where appropriate.

Biological safety

The DNA sequences designed and synthesized in this study do not code for any known toxins or pathogenic proteins. All wet-lab experiments were conducted in accordance with standard biosafety level 1 (BSL-1) guidelines.

Published: April 29, 2026