Lasso: AI Watermarks Change How Agents Act

Lasso Security found that watermarking large language models changes AI agent behavior, with six of seven tested models scoring lower on tool-call tasks and four of those declines statistically significant, according to its report "The Provenance Tax." Testing seven models on the Berkeley Function Calling Leaderboard v4 single-turn AST benchmark at temperatures 0.001, 0.7 and 1.0, Lasso reported that at temperature 1.0 Phi-4 changed its tool-call verdict on 16.8% of tasks despite only a 2.87% net accuracy decline, while Llama-3.1-8B changed its verdict on 9.9% of tasks with a 0.87% accuracy loss, for an average paired disagreement rate of 6.5% across 21 model-and-temperature tests. Lasso examined Google DeepMind's SynthID-Text watermarking in non-distortionary mode, which Google uses for Gemini and Anthropic adopted for Claude models released after Aug. 2, 2026, and warns that small sampling variations can compound in multistep workflows where models generate actions rather than just text.

AI text watermarks are supposed to answer a simple question: Did a machine write this? Makes sense, right? However, it’s not that simple. Lasso Security has found that watermarked LLMs also change how the model acts. Whoops. In a new research report, Lasso Security https://www.lasso.security/ ‘s “The Provenance Tax https://www.lasso.security/blog/the-provenance-tax-understanding-the-impact-of-llm-watermarking-on-ai-agent-behavior ,” the company found that watermarking can change the decisions made by AI agents. The differences can include tool choice, arguments, and the large language model’s LLM ability to deal with malicious requests. This isn’t what we wanted from what sounded like a simple fix to show whether AI wrote something That is a much bigger issue than a chatbot choosing a slightly different adjective. An agent that substitutes one word for another may be harmless. An agent that substitutes one account ID, file path, search query, or recipient for another may not be. Most current text-watermarking systems don’t tag a finished answer like a copyright notice. Which, by the way, is another serious issue in itself for open-source code being used in LLMs https://devops.com/us-district-court-decision-in-ais-favor-worries-open-source-developers/ . Getting back to AI watermarking, these influence token selection as the model generates its output, creating a statistical pattern that a holder of the detection key can later identify. Lasso examined Google DeepMind’s SynthID-Text watermarking https://deepmind.google/models/synthid/ technology in a so-called non-distortionary mode. Google uses SynthID to watermark text generated by Gemini, while Anthropic has adopted a version of SynthID-Text for Claude models released after Aug. 2, 2026. It’s also available as open source in Hugging Face Transformers. In theory, that approach preserves output quality while embedding a machine-detectable signal. In practice, Lasso notes, the guarantee is statistical and applies across many possible watermarking outcomes. It does not mean that every response generated with a particular key will match its unwatermarked counterpart. That gap is where agents get interesting—and troublesome. LLMs operate probabilistically. If a model is close to choosing between two plausible next tokens, a small nudge in sampling can take it down a different path. For a normal answer, the difference may amount to “overcast” instead of “cloudy.” For an agent producing JSON or a function call, it may mean calling the wrong tool or passing it the wrong argument. Lasso calls this effect “sampling drift.” The company’s essential point is sound: Even small variations can compound in a multistep workflow. The system is no longer just generating text; it is generating actions. Lasso tested seven models on the Berkeley Function Calling Leaderboard v4 single-turn AST benchmark https://gorilla.cs.berkeley.edu/leaderboard.html . It compared watermarked and unwatermarked runs using the same inputs, seed, batch composition and ordering, at AI temperatures https://www.ibm.com/think/topics/llm-temperature of 0.001, 0.7 and 1.0. The company said six of seven models scored lower on tasks that expected a tool call. Four of those declines were statistically significant. The more useful number, though, was not the overall score. It was how often the same task produced a different call/no-call outcome once watermarking was enabled. At temperature 1.0, Lasso reported that Phi-4 changed its tool-call verdict on 16.8% of tasks, despite a net accuracy decline of only 2.87%. Llama-3.1-8B changed its verdict on 9.9% of tasks while losing just 0.87% of aggregate accuracy. Across 21 model-and-temperature tests, Lasso found an average paired disagreement rate of 6.5%. That’s troubling. Worse still, that is exactly the sort of result that a dashboard can hide. A model may get some tasks right that it previously got wrong and vice versa, leaving a modest score change. But an agent builder cares about whether the model behaves consistently on a particular task, not just whether its average score still looks respectable. Lasso also found that the failure mode was model-dependent. Llama-3.1-8B’s largest decline came from incorrect tool arguments, followed by wrong-tool selection. For Phi-4 and Granite-3.2-8B, malformed tool output was the main problem. The more uncomfortable part of Lasso’s work is that safety can be compromised when watermarks are used. With AI models getting into hot water for making one security blunder after another https://www.theregister.com/columnists/2026/08/28/unsafe-at-any-speed-ai-optimists-are-turning-cautious-as-safety-concerns-mount/5292853 , the last thing AI companies need is an “improvement” that leads to more security mistakes. The company tested 200 harmful requests from HarmBench https://www.harmbench.org/ and 100 benign controls from JailbreakBench https://jailbreakbench.github.io/ . It then compared ordinary harmful prompts with versions that included a fixed prompt-injection payload intended to push the model past its safety rules. Specifically, Lasso reported that watermarking changed refusal behavior even without injection. Under prompt injection, the differences became larger for several models. Gemma-3-27B, at a temperature of 0.001, showed refusal/compliance changes on 6% of bare harmful requests and 23.5% of injected prompts. Its net compliance result shifted from 1 point lower without the injection to 12.5 points higher with it. Gemma-3-12B’s churn rose from 7.5% to 11%, and its compliance change moved from -0.5 points to +9 points. Llama-3.1-8B also changed behavior frequently under injection: 14% of prompts at temperature 0.001 and 17.5% at 0.7. Lasso said its net compliance changes were not statistically significant. Phi-4 and Qwen3-4B moved less, but both also refused benign requests, which makes “stable” less impressive. The study didn’t show a complete exploit chain in which a watermark directly causes a dangerous agent action. Instead, Lasso measured tool calling and refusal behavior separately. Still, the combination is worth taking seriously. If watermarking can change a model’s decision to comply, and the system has access to useful tools, we need to test watermarked LLMs thoroughly before we start using them. Lasso also tested 11 watermark keys and found that results differed by key. For Llama-3.1-8B, its main key increased injection attack success by 3.5%. The additional keys averaged a 4.4% increase, but the individual outcomes ranged from a 4.5% drop to a 14.5% increase. Watermarking can be a real security concern. For example, an agent developer may not be able to control the watermark key or the precise configuration. A hosted-model provider can make that choice at inference time while the developer’s prompt, tools and application code remain unchanged. Adding fuel to the watermarking fire, the EU AI Act requires machine-readable detection of synthetic text https://digital-strategy.ec.europa.eu/en/policies/code-practice-ai-generated-content where technically feasible. Everyone thought watermarking would be the answer. So much for that idea. Let me make this clear. Lasso is not making the case against watermarking. It is making the case against assuming that a marked model is behaviorally identical to an unmarked one. They’re right to do so. Much more work needs to be done on watermarks’ effects on safety and accuracy. https://aclanthology.org/2025.findings-emnlp.1148.pdf