Text watermarking designed to identify AI-generated content can also alter how large language models behave, including the tools AI agents select and the arguments they pass to them, according to new research from AI security firm Lasso Security.
The study examined Google DeepMind's SynthID-Text watermarking technique, which embeds a detectable signal into AI-generated text by influencing token selection during generation. While such systems are primarily intended to establish content provenance, researchers found that the same process can produce behavioural differences when language models are used to power AI agents.
Lasso Security researcher Andrea Siposova described the effect as "sampling drift." The research compared watermarked and unwatermarked outputs under controlled conditions, including tests of tool calling and model responses to harmful prompts.
For tool-use testing, researchers used the Berkeley Function Calling Leaderboard, or BFCL, and found that watermarking reduced tool-call accuracy in six of the seven models evaluated, with statistically significant declines in four. The study also found cases where watermarking changed the tool selected by a model, altered arguments passed to a tool or resulted in malformed outputs.
The differences were more visible when researchers examined individual decisions rather than overall accuracy. Across 21 model and temperature combinations, the average rate at which tool-call outcomes differed between watermarked and unwatermarked runs was 6.5%.
At a temperature setting of 1.0, 16.8% of Phi-4's tool-call verdicts changed between the two conditions, even though its overall accuracy declined by 2.87 percentage points. Llama 3.1 8B recorded a 9.9% disagreement rate while its net accuracy declined by 0.87 percentage points.
Researchers also examined whether watermarking affected model safety behaviour. Using harmful prompts and benign controls, the study found that watermarking could change whether a model refused or answered certain requests. Under the prompt-injection method tested, several models became more likely to respond to harmful requests they had refused without watermarking.
However, the findings do not establish that watermarking will consistently make AI systems less safe. The effects varied across models, configurations and watermark keys, while some behavioural changes moved in the opposite direction. The research also evaluated refusal behaviour and tool calling separately rather than testing a complete agent performing harmful actions.
The findings suggest developers may need to evaluate watermarking as part of agent testing rather than treating it solely as a content-provenance mechanism, particularly when AI systems are connected to external tools and actions.
Disclaimer: This article may include information derived from interviews, press releases, public statements, research, company communications and other publicly available or third-party sources. Such material may be summarised, paraphrased or contextualised for journalistic and editorial purposes. All rights in third-party content remain with their respective owners.