Understanding the Impact of LLM Watermarking on AI Agent Behavior
Lasso Security finds SynthID-Text watermarking can alter LLM refusals and agent tool calls through sampling drift.
Lasso Security reports that Anthropic's planned Claude watermark, based on Google DeepMind's SynthID-Text, can change behavior even in a non-distortionary configuration. Paired tests on BFCL v4 tool calling and HarmBench refusals, including a fixed prompt-injection setup, found model- and key-dependent disagreement between watermarked and unwatermarked runs. The authors say this sampling drift can change which tool an agent calls and the arguments it passes, and whether refusals of harmful requests hold. They also note EU AI Act Article 50(2) requires machine-readable marking of synthetic text.
- Anthropic will watermark Claude outputs using DeepMind's SynthID-Text tournament sampling.
- Non-distortionary watermarking can still change tokens under a fixed key.
- Paired BFCL v4 and HarmBench tests found model- and key-dependent drift.
- Drift can change tool choice, arguments, and refusals under prompt injection.
- EU AI Act Article 50(2) requires detectable marking of synthetic text.
- Organizations
- Lasso SecurityEuropean Union
- AI models
- Claude
From the original article
13 min read at lasso.security
Recently, Anthropic announced that future Claude models would embed an invisible watermark in their output [1], [2], and subsequently disclosed that the watermark is based on Google DeepMind’s SynthID-Text [2], [3]. Text watermarking itself is not new, but its deployment now has regulatory relevance.
By nisosguy · lasso.security
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.