The Pulse
Lasso Finds AI Watermarks Can Alter Agent Tool Calls and Refusals
Lasso Security reports that SynthID-Text watermarking can change AI-agent tool calls, refusal behavior and responses to prompt injection, with effects varying by model and watermark key.
AI.info Team ·
Watermarks Change More Than What Agents Say
A study published by Lasso Security on September 17 finds that language-model watermarking can alter the decisions made by AI agents, even when the watermark is designed to preserve output quality. The effects appear in tool selection, tool arguments, refusal behavior, and responses to prompt injection.
The research examines SynthID-Text, the watermarking method developed by Google DeepMind and adopted for Claude’s newer models by Anthropic. SynthID-Text changes how the model samples tokens during generation so that a hidden statistical pattern can later be detected. Lasso’s analysis argues that the same token-level changes can affect an agent’s actions because tool calls are also generated as text.
Anthropic says its watermark applies at the model level and covers supported models accessed through Claude’s own products, its API, and cloud providers. That means an independently built agent can receive watermarked model output even when the agent developer did not add the watermarking system.
Six of Seven Models Show Lower Tool-Call Accuracy
Lasso tested tool calling with BFCL v4 single-turn tasks, comparing paired generations with and without SynthID-Text. The researchers used the same seed, batch order, and temperature within each comparison, leaving the watermark processor as the only change. Tests covered expected tool calls as well as cases where the correct behavior was to make no call.
On tasks where a tool call was expected, watermarking reduced accuracy on six of the seven models tested, with statistically significant decreases on four. Aggregate accuracy did not fully capture the change because some calls moved from incorrect to correct while others moved in the opposite direction.
Lasso therefore measured “churn,” the share of individual verdicts that changed between the watermarked and unwatermarked runs. Across 21 model-temperature combinations, churn averaged 6.5%. At a temperature of 1.0, 16.8% of phi-4’s call verdicts changed even though its net accuracy loss was 2.87 percentage points. Llama 3.1 8B showed 9.9% churn with a net loss of 0.87 points.
The type of mistake also varied. On Llama 3.1 8B, incorrect arguments accounted for a 3.48-point accuracy loss and wrong-tool calls accounted for another 1.84 points. On phi-4 and Granite 3.2 8B, malformed output was the largest source of decline, at 5.96 and 4.36 points respectively.
Prompt Injection Amplifies Refusal Changes
The second experiment tested 200 harmful behaviors from HarmBench and 100 benign controls from JailbreakBench. Harmful requests were run both by themselves and with a fixed prompt-injection technique that claimed the safety filter was disabled and instructed the model to comply.
Watermarking changed refusal behavior on ordinary harmful prompts, but the effect became larger under injection. At a temperature of 0.001, Gemma 3 27B’s churn rose from 6.0% on bare harmful requests to 23.5% with the injection. Its net compliance change moved from a 1.0-point decrease to a 12.5-point increase.
Gemma 3 12B showed a similar pattern: churn rose from 7.5% to 11.0%, while net compliance moved from a 0.5-point decrease to a 9.0-point increase. Llama 3.1 8B reached 14.0% churn at a temperature of 0.001 and 17.5% at 0.7, although its net change was not individually significant.
Lasso says the refusal experiment measured model behavior rather than a combined end-to-end agent failure. The implication for agents is conditional: if a watermarked model changes from refusal to compliance and has access to tools, the altered response could affect subsequent actions.
The Watermark Key Matters
The study also tested 11 watermark keys at a temperature of 0.7. The results did not move consistently in one direction. Different keys produced different levels of attack success, and some keys reduced attack success while others increased it.
For Llama 3.1 8B, the study key increased attack success by 3.5 points. The other ten keys averaged a 4.4-point increase, but ranged from a 4.5-point decrease to a 14.5-point increase. The two Gemma models generally showed higher attack success under most keys, while Granite 3.2 8B showed a mixed response.
Those findings distinguish watermarking from an ordinary quality setting. A change in the key can alter token choices without changing the model weights or the prompt, and a provider may control that configuration outside the agent developer’s direct reach.
Provenance and Behavioral Stability Are Separate Tests
Lasso does not argue that watermarking should be abandoned. The study’s narrower finding is that successful provenance detection does not establish that a model will make the same tool calls or preserve the same safety behavior after watermarking is enabled.
The researchers recommend repeating agent evaluations whenever watermarking is introduced or its key or configuration changes. Those tests should compare paired runs on identical inputs, inspect individual tool calls rather than only aggregate accuracy, and include adversarial prompt-injection conditions.
For developers building agents on provider-hosted models, the practical issue is control. A model update, watermark rollout, or key change can alter the exact tokens that specify a tool, path, recipient, query, or refusal. Lasso’s results place watermarking inside the deployed security configuration, not only inside a content-provenance pipeline.