How AI Model Watermarking Affects Agent Accuracy, Refusals, and Security Testing

The Mechanism Is Subtle, the Effects Are Not

Watermarking works by nudging token selection during generation. When a model is choosing between statistically similar words—”overcast” versus “gray”—a watermarking system like SynthID-Text can steer that choice to embed a detectable pattern. Readers won’t notice. Agents might.

Anthropic’s approach to watermarking Claude output operates on this same principle: low-stakes word choices, repeated across a response, accumulate into a pattern that’s invisible to humans but readable by anyone holding the right key.

The problem is that AI agents are sensitive to vocabulary in ways humans aren’t. A slightly different word can change which tool gets called, which argument gets passed, or whether a safety filter holds.

What Lasso Actually Found

Lasso tested watermarking effects across seven models—phi-4, Llama-3.1-8B, Qwen3-32B, Qwen3-4B, gemma-3-12b, gemma-3-27b, and Granite-3.2-8B—using the BFCL v4 single-turn AST benchmark for tool calling accuracy.

Watermarking reduced accuracy on six of the seven models tested.

The nuance worth noting: aggregate accuracy numbers can be misleading. A call that breaks under watermarking can be offset by one that accidentally improves, leaving the headline number nearly flat while the underlying behavior has shifted on both items. The model is behaving differently—the scoreboard just doesn’t show it cleanly.

Failures showed up as:

• Choosing the wrong tool for the task
• Passing wrong arguments to the correct tool
• Malformed inputs that caused parsing failures

Refusals and Prompt Injection

On safety refusals, watermarking had a modest effect on straightforward harmful requests tested via HarmBench and JailbreakBench. The effect became more pronounced under adversarial conditions.

When prompt injection was introduced—an instruction telling the model its safety filter had been disabled and compliance was required—the attack success rate increased significantly for watermarked models. Affected models became less likely to refuse harmful requests under that pressure.

Lasso’s framing is careful here: this isn’t an argument against watermarking. It’s an argument that watermarking changes the conditions under which agents operate, and security evaluations need to account for that.

The Cross-Vendor Wrinkle

This gets more complicated when you consider that watermarking effects don’t stay inside one organization’s stack. An agent built on OpenAI’s API that calls an Anthropic model will process whatever output variation Anthropic’s watermarking produces. The downstream agent didn’t choose to be watermarked—it just inherited the behavior.

That’s a meaningful consideration for teams building multi-model pipelines or using third-party model APIs as components in larger systems.

What This Means for Security Testing

The practical implication is straightforward: if your red-teaming and security evaluations don’t include watermarked content, you may be testing a version of your agent that doesn’t match what runs in production.

Lasso’s position is that watermarked content should be a standard input condition during agent security assessments—not an afterthought. Given that watermarking is increasingly positioned as a default feature of responsible AI deployment, that’s a reasonable baseline to set now rather than after something breaks.

The takeaway isn’t “watermarking is dangerous.” It’s “watermarking is a variable, and untested variables in agent pipelines tend to surface at the worst possible time.”