Google’s SynthID Watermarking Can Alter AI Safety Responses

Research by Lasso Security indicates that SynthID-Text, a system designed to watermark AI-generated text, can alter how some language models respond to harmful or adversarial prompts. The system subtly changes token selection using a secret key, allowing people who possess the key to assess whether text was generated by a participating platform. Anthropic has said future Claude models will use SynthID-Text, which was developed and open-sourced by Google.

Andrea Siposova, an AI security researcher at Lasso Security, tested the non-distortionary configuration of Hugging Face’s SynthIDTextWatermarkLogitsProcessor with six open-weight models. Compared with unwatermarked responses, watermarking changed refusal behaviour, with the effect more pronounced when harmful requests were combined with prompt-injection techniques. In several models, requests that would normally have been refused were answered after watermarking was applied.

The researchers also found that watermarking could change which tools an AI agent called and the arguments it supplied, a behavioural effect they called “sampling drift”. Results varied according to the secret key used, and tool-call accuracy could change even when overall accuracy appeared similar.

The study did not test Claude or the implementation planned for Anthropic’s models. It examined only open-weight models and the Hugging Face implementation, allowing token sampling to be enabled or disabled while other settings remained fixed. The findings therefore show a potential safety impact rather than confirmed exploitation in deployed Claude systems. Lasso Security said developers should use red-team testing to assess model and agent behaviour before deploying SynthID-Text.