Watermarking Claude with SynthID-Text measurably shifts agent tool calls, study finds

Anthropic is bringing watermarked Claude outputs to the API

Anthropic has announced that future Claude models will embed an invisible watermark in their output, and later confirmed the technique is Google DeepMind's SynthID-Text, according to Lasso Security, whose analysis of the deployment recently reached Hacker News' front page. Because Anthropic applies the watermark at the model level, it covers supported models served through the Claude Platform API and via cloud providers. A developer using Claude as the reasoning component of an agent inherits watermarked generations even though the agent itself is a separate application.

Lasso Security's question is what switching that watermark on does to how the model behaves, not just to the provenance signal.

A provenance mechanism that alters sampling

Text watermarks are built to mark output as machine-generated. Generation-time approaches like SynthID-Text work by changing how each next token is chosen — in this case through tournament sampling — rather than by post-processing finished text. Lasso Security used the non-distortionary configuration, which preserves the original token distribution in expectation over the watermark's randomness, and notes that Dathathri et al. found no measurable quality degradation across nearly twenty million Gemini responses.

The catch is that non-distortionary does not mean identical. The guarantee holds across the watermark's randomness, while any particular key changes token selection during generation, and the size of the effect varies by model and by key. Lasso Security calls the resulting behavioral change sampling drift.

The stakes are higher inside agents than in chat. In structured output such as JSON, braces, keys and function names are usually predictable, while values — queries, numbers, file paths, recipients — are not, and that is exactly where tournament sampling has the most room to change token choice. A variation that reads as phrasing in prose can become a different argument that an agent then executes.

Regulatory pressure behind the rollout

Deployment is not purely a product decision. Article 50(2) of the EU AI Act requires providers of AI systems that generate synthetic text to mark outputs in a machine-readable format, making them detectable as artificially generated, with technical solutions that are effective, interoperable, robust and reliable as far as technically feasible. Watermarking is the obvious candidate, which is why its side effects on behavior now matter to anyone shipping agents in or into the EU.

How the effect was measured

Lasso Security ran a paired design: every prompt was generated with and without SynthID from the same seed, batch composition and order, with the watermark processor as the only difference. Tool calling was evaluated on BFCL v4 single-turn AST tasks at temperatures of 0.001, 0.7 and 1.0. Refusal was tested on 200 HarmBench harmful behaviors plus 100 benign JailbreakBench controls at 0.001 and 0.7, with harmful requests presented both bare and under one fixed prompt injection technique. The implementation was HuggingFace's unmodified SynthIDTextWatermarkLogitsProcessor, configured with 30 tournament layers, n-gram length 5, a sampling table of 2^16 entries and a context history of 1,024, and multiple watermark keys were tested rather than one.

Churn is larger than the headline numbers

On items where a tool call was expected, watermarking reduced accuracy on six of the seven models tested, significantly so on four. But net accuracy hides what happens to individual prompts: a call that becomes incorrect can be offset by another that becomes correct, leaving the aggregate nearly unchanged.

So Lasso Security also measured churn — the share of items whose verdict differs between the watermarked and unwatermarked runs. On BFCL's fixed set of 1,150 non-live call-expected tasks, churn was substantially larger than the net accuracy change. At temperature 1.0, 16.8% of phi-4's call verdicts changed while its net accuracy loss was only 2.87 points; Llama-3.1-8B showed 9.9% of verdicts changing against a 0.87-point net loss. Across the 21 model-temperature combinations, churn averaged 6.5%, and its bootstrap interval excluded zero in every case. The study reports that drift also appeared in refusal behavior, not only in tool calling, though the published figures focus on the tool-calling results.

Prompt injection ties the two settings together. Whether a model refuses a harmful request — and whether that refusal holds under injection — is decided by the same sampled tokens the watermark biases, and a weakened refusal becomes more consequential when the model can also act through tools.

Why it matters

Anthropic's move shows that provenance compliance is about to reshape model behavior in production. A watermark introduced for regulatory detectability changes which tools agents call and with what arguments, and a well-formed call to the correct tool with the wrong path, recipient or amount can execute successfully while doing the wrong thing. Aggregate benchmarks can read as near-zero impact while roughly one in fifteen prompts behaves differently under the watermark. Teams building agents on watermarked APIs should reproduce the paired, per-item comparison Lasso Security describes before trusting that nothing changed, and watermark designers should treat refusal robustness under injection as part of the evaluation, not an afterthought.