Lasso Security Finds Text Watermarking Can Change AI Agent Actions

Lasso Security has published research finding that SynthID-Text watermarking changed not only the words generated by tested models, but also their tool calls and safety refusals. In several cases, the watermark made harmful prompt-injection requests more likely to succeed—a consequential result for agents that can turn model output into actions.

A provenance signal enters the generation process

Text watermarking is meant to establish provenance: to make generated material detectable as AI-made. SynthID-Text does that during generation, using a secret key to influence which plausible next token the model selects. The signal may be invisible to a reader, but it changes the sampling process that produces the response.

That distinction becomes more important when a model sits inside an agent. A small wording variation in ordinary prose may be harmless. In structured output, however, a different token can alter a tool name, a path, a recipient, a query, or another argument that an agent might execute.

The paired tests found a tool-calling cost

Researcher Andrea Siposova compared watermarked and unwatermarked outputs while holding the seed, batch composition and item order constant. For tool calling, the study used the BFCL v4 single-turn AST benchmark. Watermarking reduced accuracy on six of seven tested models, according to the research.

The headline accuracy measure did not capture the full change. Lasso compared each watermarked result with its unwatermarked counterpart and called the share of changed verdicts “churn.” Across 21 model-and-temperature combinations, churn averaged 6.5%, even when aggregate accuracy shifts could look modest because newly correct and newly incorrect calls offset one another.

Different models failed in different ways

The study separates a tool call that cannot run from one that runs but does the wrong thing. A malformed output can stop an intended action. A valid-looking call with the wrong argument may be more dangerous because it can execute successfully while targeting the wrong destination or operation.

The tool-call changes Lasso tracked

• The model chose the wrong tool for the task.
• It selected the right tool but supplied incorrect arguments.
• It produced malformed output that could not be parsed.

Those are not interchangeable errors. Lasso found that incorrect arguments were the largest contributor to accuracy loss for Llama-3.1-8B, while malformed output dominated the losses for phi-4 and Granite-3.2-8B. The watermark key also mattered: changing it could change the direction and size of observed behavioral effects.

Prompt injection made the safety result sharper

Lasso also tested 200 harmful behaviors and 100 benign controls, first as ordinary requests and then with one fixed prompt-injection technique. Watermarking changed refusal behavior on bare harmful requests, but the effects became more pronounced when the same requests included the adversarial instruction.

For gemma-3-27b at a temperature of 0.001, the share of harmful prompts whose refusal verdict changed rose from 6.0% without the injection to 23.5% with it. The net compliance change moved from minus 1.0 point to plus 12.5 points. Several models became more likely to answer requests they otherwise would have refused.

A warning for evaluations, not a verdict on watermarking

The research has clear limits. It tested open-weight models through Hugging Face’s unmodified SynthIDTextWatermarkLogitsProcessor, not Claude or Anthropic’s planned implementation. Its refusal evaluation measured model behavior rather than an end-to-end agent executing tools after a successful injection.

So the result does not establish that every watermarked model will become less safe, or that a prompt injection will produce an unsafe tool action in deployment. It does establish that watermarking can be an intervention worth testing in its own right. Lasso’s recommendation is to include watermarked outputs in agent security evaluations and red-teaming rather than treating provenance as behaviorally neutral.