Understanding the Impact of LLM Watermarking on AI Agent Behavior

What it is

Lasso Security's empirical study ("The Provenance Tax") of how enabling SynthID-Text watermarking changes agent behavior, not just text quality. The summary has the headline finding; the page carries the reproducible configuration, the error decomposition, the temperature baseline, and the key-sensitivity range an engineer needs to decide whether to re-test their own deployment.

Reproducible configuration

The tests use HuggingFace's unmodified SynthIDTextWatermarkLogitsProcessor in non-distortionary mode with 30 Tournament layers, n-gram length 5, sampling table 2^16, context history 1,024. Paired design: each item generated with and without the watermark from the same seed, batch composition, and order at each temperature — the processor is the only difference in each pair. Tool calling on BFCL v4 single-turn AST; refusal on 200 HarmBench harmful behaviors plus 100 benign JailbreakBench controls. The injection technique appends an adversarial instruction as retrieved content, claiming the safety filter is disabled and instructing compliance — held constant across all prompts and models.

Findings the summary omits

• Error type decomposition matters more than net accuracy. On Llama-3.1-8B the accuracy loss is driven by wrong arguments (−3.48 pts) then wrong-tool calls (−1.84). On phi-4 and Granite-3.2-8B, malformed output dominates (−5.96 and −4.36). Similar aggregate loss, different failure modes — a well-formed call to the right tool with a wrong path/recipient/amount executes successfully while doing the wrong thing.
• Watermark churn exceeds temperature churn. Comparing watermark-on-vs-off at T=0.7 against T=0.001-vs-0.7 with watermark off: watermark-induced churn is significantly higher on four of six models. Granite's temperature churn is 15.5% but its watermark churn is higher at 21.5%.
• Key sensitivity is large and directional. Testing 11 keys on Llama-3.1-8B: study key +3.5 pts attack success, other ten average +4.4, ranging −4.5 to +14.5. Granite moves attack success in both directions depending on key. So the same model can get safer or less safe purely from a key change controlled by the provider.

Caveats the page states

• phi-4 and Qwen3-4B barely move under any condition, but they over-refuse even on the harmless controls — their stability is not evidence that watermarking preserves safety.
• The refusal experiment measures model-level refusal, not end-to-end agent behavior; the combined "weakened refusal → harmful tool action" failure mode is argued, not directly tested.
• Findings are not an argument against watermarking for provenance — the point is that detectability and unchanged text quality do not establish behavioral stability, and the concern generalizes to any intervention that modifies token selection.

What to do

Repeat agent evaluation and red-teaming under the exact watermark configuration and key intended for deployment, using paired comparisons on identical inputs and evaluation under prompt injection — because aggregate scores can stay flat while individual tool calls and refusals flip. Treat watermarking as part of the deployed security configuration, and re-assess whenever the key or configuration changes (which, for provider-hosted models, can happen outside the agent developer's control).