Lasso finds SynthID watermarking changes agent tool calls

Lasso Security published "The Provenance Tax" on 17 September 2026, a study of how text watermarking changes what a model does inside an agent. It tests Google DeepMind's SynthID-Text, the method Anthropic said on 14 August 2026 it uses for future Claude models. The tests ran on open-weight models, not on Claude.

SynthID-Text watermarking can change what an agent does, according to Lasso Security's tests on open-weight models. Across 21 model and temperature combinations, watermarking changed the correctness verdict of 6.5% of tool calls on average. On several models it also made refusals of prompt-injected harmful requests less likely to hold.

What changed

Watermarking is a provenance feature: it swaps the random number generator that picks the next token for one driven by a secret key. Anthropic's announcement says the change is made to comply with the EU AI Act and that the difference is not distinguishable to readers. Lasso asked a narrower question: does the different token selection change behavior when the output is a tool call or a refusal?

The setup, as Lasso describes it:

• Watermarking used Hugging Face's unmodified SynthIDTextWatermarkLogitsProcessor in its non-distortionary configuration, with 30 tournament layers and an n-gram length of 5.
• Each item ran with and without the watermark from the same seed, so the watermark was the only difference within a pair.
• Tool calling used BFCL v4 single-turn AST across seven models at temperatures 0.001, 0.7 and 1.0.
• Refusal used 200 HarmBench behaviors and 100 benign JailbreakBench controls across six models, bare and with one fixed prompt injection that claims the safety filter is disabled.

The results:

• Tool calls. Watermarking reduced accuracy on six of seven models, significantly on four. The net change hides more than it shows: at temperature 1.0, 16.8% of phi-4's call verdicts differed between the two conditions while its net accuracy loss was 2.87 points. Llama-3.1-8B showed 9.9% differing verdicts against a 0.87 point net loss.
• Error types. On Llama-3.1-8B most of the loss came from wrong arguments (3.48 points) and wrong tools (1.84 points). On phi-4 and Granite-3.2-8B it came mostly from malformed output.
• Refusals under injection. At temperature 0.001, gemma-3-27b's churn rose from 6.0% on bare harmful requests to 23.5% under injection, and its net compliance change moved from -1.0 to +12.5 points. Gemma-3-12b moved from 7.5% to 11.0% churn and from -0.5 to +9.0 points.
• Against temperature. Under injection, watermark-induced refusal churn was significantly higher than the churn from changing temperature on four of six models. For gemma-3-27b it was 26.0% against 13.5%.
• Key sensitivity. Across eleven watermark keys, the effect on Llama-3.1-8B ranged from -4.5 to +14.5 points of attack success, with the study key at +3.5.

phi-4 and Qwen3-4B barely moved on refusals. Lasso attributes that to over-refusal, including on the harmless controls, and says it is not evidence that watermarking preserves their safety behavior.

Why it matters for agent builders

A watermark applied at the model level reaches agents you did not build the model for. Lasso notes that Anthropic says watermarking covers supported models on the Claude Platform API and through cloud providers, so an agent that calls a watermarked model gets watermarked tool arguments. Tokens like file paths, recipients and amounts are the uncertain ones where the sampling change acts, and those are the tokens an agent executes.

The practical consequence is about evaluation. A model provider can turn watermarking on, or change its key, without changing the weights or your prompt. Lasso recommends repeating agent evals and red-teaming under the configuration you deploy, comparing paired results on the same inputs, and including prompt injection in the test set. Aggregate pass rates alone can stay flat while individual calls flip in both directions.

Lasso sells an AI security platform, and the results come from its own experiments. The paper's data and settings are public in the post, which is what makes them checkable.

What to watch

The study has limits that Lasso and Ars Technica both state. It does not test Claude, and it uses the Hugging Face implementation rather than the one Claude models will run. It measures model-level refusal, and Lasso says it did not test the combined failure of a weakened refusal followed by a tool action. Anthropic's post says that in internal testing it saw no impact on the content, creativity or readability of Claude's text, and that code generally carries less watermark because exact output leaves fewer free choices. The open question is whether either claim holds for tool arguments on the models that ship the watermark.

Key takeaways

• Lasso Security's study, published 17 September 2026, finds SynthID-Text watermarking changes tool-call verdicts on open-weight models, averaging 6.5% churn across 21 model and temperature combinations.
• Under one fixed prompt injection, watermarking made gemma-3-27b comply with harmful requests 12.5 points more often at temperature 0.001.
• The effect depends on both the model and the watermark key, so a provider changing either is a reason to re-run your evals.
• The study did not test Claude or Anthropic's implementation, and it did not test an end-to-end agent.

FAQ

Does watermarking make an AI agent call the wrong tool?

It can, on the models Lasso tested. Watermarking reduced tool-calling accuracy on six of seven open-weight models, with wrong tool, wrong arguments and malformed output all contributing, depending on the model. The size of the effect varied by model and temperature.

Does this study show that Claude is less safe with a watermark?

No. Lasso tested six to seven open-weight models with the Hugging Face SynthID-Text implementation, not Claude. Ars Technica states the same limit. Anthropic's own testing, as it describes it, found no impact on output content.

What should I do if I build agents on a hosted model?

Re-run your tool-call evals and prompt-injection tests when a provider enables watermarking or changes its configuration. Lasso recommends paired comparisons on the same inputs, because aggregate scores can stay steady while individual decisions change.

Why did Anthropic add a watermark?

Anthropic says it is complying with the EU AI Act, whose requirement to mark AI-generated content applied from 2 August 2026, and that it signed the EU Code of Practice on Transparency of AI-Generated Content in July 2026. It also says the watermark carries no identifying information about users.

Source: Lasso Security, The Provenance Tax Discussion: Hacker News

To check how the agents you run behave in production, compare the tracing tools in the monitoring and observability category on aiagentslisting.com, which lists about 674 agents, MCP servers and skills.