Watermarking AI Text Destabilized Tool Use in 6 of 7 Models

AI security firm Lasso published experimental results on September 17. The finding: text watermarks, the invisible markers embedded in AI-written text, can shift how an AI uses tools and how it decides whether to refuse a harmful request. The company ran the tests itself, looking at whether a marker meant to flag text as machine-generated affects not just the words on the page but the choices made by AI agents that carry out tasks on their own.

SynthID-Text, the technology used in the experiment, plants its marker by intervening in the process where a model picks the next piece of text to generate. Lasso fed in identical prompts and compared results with the watermark switched on and off. This was not a new technique being introduced. It was a test of whether an already deployed watermarking method changes how an AI behaves.

How much did tool use change?

In the tool-calling tests, accuracy dropped in six of seven models. That accuracy score combines three things: whether the right tool was selected, whether the values passed to the tool were correct, and whether the generated tool call was properly formatted. Four of those models showed a statistically significant decline, meaning the gap is hard to write off as chance. What was being measured here is not how natural the prose reads to a human. It is the model’s judgment when it reaches for a tool.

In some cases, individual calls flipped between right and wrong far more than the average score suggested. When phi-4 was given the same 1,150 tasks, 16.8% of the verdicts changed. That was under a setting of 1.0 for the parameter that controls how varied the responses are. Yet accuracy itself fell by only 2.87 percentage points. Look at averages alone and you may never see how much churn there was at the level of individual calls.

Refusal behavior on harmful requests was evaluated separately. Lasso submitted 200 requests that applied an attack technique designed to destabilize the model’s instructions. In that test, gemma-3-27b complied with harmful requests 12.5 percentage points more often once the watermark was turned on. That result came under a response variability setting of 0.001. The size of the shift varied by model and by the key used for the watermark.

Would the same thing happen to Claude?

Anthropic has announced that it will embed invisible watermarks in future Claude models, and has said that watermark is based on SynthID-Text. The researchers behind SynthID-Text have said that a review of roughly 20 million Gemini responses turned up no observable drop in quality. Lasso applied SynthID-Text settings to models other than Claude and measured tool use and refusal behavior there. There is no basis for reading these numbers as a change in Claude’s performance.

A line has to be drawn when connecting the experiment to real-world incidents, too. Lasso did not check whether a model whose refusal decision flipped because of a watermark then went on to perform faulty tool operations, because tool use and refusal were tested separately. Nor do the results speak to the risks of every watermarking method, or to how often things actually go wrong in production services.

How far does the watermark reach?

Anthropic has said the watermark is applied at the model level. For supported models, the marker travels with the output whether a developer accesses it through Anthropic’s API or through a cloud provider. That means even a service built by another company will receive watermarked responses if it uses Claude as its decision engine.

The task this research leaves behind is clear: to examine markers that identify AI-written text and AI’s operational judgment together. Anyone handing tools over to an AI in particular should look beyond overall accuracy and ask whether individual calls are flipping between right and wrong. What is worth watching next is research that checks, in real service environments, whether these shifts in judgment spill over into the work that follows.