September 22, 2026
The SynthID watermark changes agent behavior: tool calling went off track in 6 of 7 models
Lasso Security ran BFCL v4 with and without a watermark: tool-call verdicts differed by 6,5% on average.
Andrea Siposova from Lasso Security enabled a watermark on phi-4 and ran the same benchmark twice.
At temperature 1.0, every sixth tool-call verdict diverged: 16,8%. Accuracy fell by 2,87 points, meaning answer quality held steady while the agent's decisions changed.
Watermarks exist for one question: was it written by a machine or a human? Lasso's measurement from 17.09.2026 added a second effect. The mark also changes how an agent calls tools.
The count used the BFCL v4 benchmark, 21 “model × temperature” combinations. The metric is simple: the share of calls where the model with and without the mark decides differently. On average, 6,5% of calls diverged; Llama-3.1-8B reached 9,9% with an accuracy loss of 0,87 points.
Stronger than temperature. Variability in agent behavior is usually blamed on temperature. On 4 models out of 6, the watermark shook up calls more: gemma-3-27b showed 26,0% divergence versus 13,5% from raising the temperature. Granite-3.2-8B and Llama-3.1-8B showed the same pattern.
Worse under prompt injection. For gemma-3-27b, the share of divergent refusals rose from 6,0% on bare harmful prompts to 23,5%. The decision itself shifted too: without the mark, the model complied with harmful requests 1,0 points less often; with the mark, 12,5 points more often. For gemma-3-12b, the same shift was milder, 9,0 points.
Reproduce it yourself. The same mark is supported out of the box in Hugging Face transformers: SynthIDTextWatermarkingConfig(keys=[...], ngram_len=5) goes into model.generate through the watermarking_config parameter. That switch is enough to build a paired run of your own agent with and without the mark, on identical inputs.
Lasso's configuration used 30 tournament layers, a 2^16 sampling table, a context history of 1024, and temperatures of 0.001, 0.7 and 1.0. Refusals were measured on 200 harmful behaviors from HarmBench and 100 harmless controls from JailbreakBench.
On 14.08.2026, Anthropic announced that future Claude models will watermark text outputs to meet EU AI Act requirements. The impact is structurally weaker for code: the company says code is marked substantially less than other text, and the watermark appears where there is freedom of word choice, such as comments.
The same paired measurement cannot be assembled for closed models: Anthropic's detection API is available only to regulators, media, fact-checkers and researchers.
