Provenance method changes token selection
A study released on September 26 by Lasso Research reports that a text-watermarking system can change how language models handle tool calls and safety refusals, even when the model weights and prompts remain the same. The researchers tested Google DeepMind’s SynthID-Text approach, which embeds a detectable signal during generation by influencing token selection.
The work focuses on a practical consequence of that process. A watermark may be designed to preserve the model’s overall token distribution when averaged over watermark randomness, but a fixed key can still produce a different sequence for an individual request. In ordinary prose, that difference might amount to alternative wording. In an agent, it can affect a tool name, a file path, a recipient, a search query or another argument that software may execute.
Researchers used paired runs in which the seed, prompt, batch composition and order were held constant. The watermark processor was the only change within each pair. Tool use was evaluated with BFCL v4 single-turn tasks, while refusal behavior was tested with 200 harmful requests from HarmBench and 100 benign controls from JailbreakBench. Harmful prompts were tested both directly and with a fixed prompt-injection technique.
Aggregate scores can hide changed outcomes
The study says tool-call accuracy declined on six of seven tested models and that four of those reductions were statistically significant. The authors also measured “churn”: the share of individual tasks whose pass-or-fail verdict changed between watermarked and unwatermarked runs. This revealed larger behavioral shifts than net accuracy alone.
At a temperature of 1.0, 16.8% of Phi-4 call verdicts differed between the two conditions, although the net accuracy decline was 2.87 percentage points. Llama 3.1 8B showed 9.9% disagreement alongside a net loss of 0.87 points. Across 21 model-and-temperature combinations, average churn was 6.5%, according to the report. A failure that becomes a success can offset a success that becomes a failure in an aggregate score, despite both individual behaviors changing.
The findings do not establish that every watermark or deployment will reduce agent reliability. The reported effects varied by model and watermark key, and the evidence comes from benchmarks rather than production systems. They do, however, suggest that developers evaluating model-level watermarking should inspect paired behavior, argument correctness and refusal robustness rather than relying only on average quality scores. For agents allowed to take consequential actions, even a well-formed call with the wrong argument can matter more than a malformed response that fails to execute.
