Lasso Security published a study titled “The Provenance Tax”: SynthID-Text watermarks, a Google DeepMind technology that Anthropic implements in Claude models, change LLM agent behavior — the authors called the effect “sampling drift.” In paired experiments, tool-calling accuracy decreased in six of seven models, and agent verdicts diverged by an average of 6.5%, reaching 16.8% for phi-4. The main conclusion of the work: labeling synthetic text is no longer a free compliance feature and becomes a “provenance tax” for agentic products.
What happened
Lasso Security researchers ran models in pairs with the same seed, where the only variable was the SynthIDTextWatermarkLogitsProcessor watermark processor with a configuration of 30 tournament layers, n-gram length of 5, and a table size of 2^16. On the BFCL v4 tool-calling benchmark, watermarks reduced accuracy in six of seven models. The average share of “churn” — verdict discrepancies between paired runs — was 6.5% across 21 model-temperature combinations; for phi-4 at T=1.0, 16.8% of verdicts diverged with a net loss of only 2.87 points. Degradation profiles were model-specific: Llama-3.1-8B more often passed incorrect arguments (minus 3.48 points), while phi-4 and Granite-3.2-8B more often produced invalid output (minus 5.96 and minus 4.36 points, respectively). On refusal tests using HarmBench, the watermark additionally weakened the model's refusal under injections.
Context
SynthID-Text works differently from post-processing finished text: the watermark intervenes in token sampling during generation and can replace a token exactly where the model is uncertain — in argument values, paths, sums, or recipients. This leads to a characteristic failure type: the agent makes a syntactically correct call to the correct tool but with an incorrect argument, and such a failure does not produce visible errors on the tool side. The paired design with a fixed seed provides clean attribution of discrepancies to the watermark rather than sampling noise, making it difficult to dismiss the result as chance. According to the study, Anthropic applies watermarking at the Claude model level, meaning the watermark is already part of the production configuration that users do not control. The regulatory backdrop is set by Article 50(2) of the EU AI Act, which requires labeling of synthetic text, turning watermarking from an optional feature into a mandatory deployment element.
Why this matters for the industry
For the industry, the central observation of the work is methodological: average accuracy loss and average churn measure different things, and verdict divergence between “with watermark and without” pairs is invisible in aggregate metrics. The average churn of 6.5% coexists with a net loss of less than three points, so familiar average metrics create an illusion of stability while a noticeable portion of requests actually shifts to different solutions. A watermark is a change to the live sampling configuration, not a free compliance feature, and it must be accounted for in threat models for agentic platforms, because labeling affects the model's protective behavior, not just text quality. An expected consequence, which the authors and the review formulate as an interpretation rather than an established fact: paired churn metrics will become a standard part of regression test suites for agentic stacks, and watermark status will appear in model release checklists alongside weight version, quantization, and sampling parameters.
Why this matters for users
If you are building agents on Claude or other models with SynthID-Text, other people's numbers are not transferable: the effect depends on the specific model and key. A practical step is available immediately and at no cost: run your own tool-calling and safety tests in “with watermark and without” pairs on fixed seeds and multiple keys, comparing pairwise verdict discrepancies rather than average metrics. Record the watermark state in your deployment configuration and include it in your model update checklist. Discrepancies of this kind are only visible in paired comparison, and it is precisely the paired run that finds them before they reach production.
What is still unknown / limitations
Measurements in the study were performed on models at the level of Llama-3.1-8B, phi-4, and Granite-3.2-8B; there is no direct measurement on Claude with built-in SynthID-Text in the material, so extrapolating the 6.5–16.8% figures to frontier models remains a hypothesis, not a result. The effect itself is plausible, but has not yet been independently reproduced. Because the nature and scale of degradation depend on the model and key, there is no universal “watermark penalty.”
Sources
- Lasso Security: The Provenance Tax — Understanding the Impact of LLM Watermarking on AI Agent Behavior
- Hacker News: The Provenance Tax — How LLM Watermarking Changes AI Agent Behavior (discussion)
Author
Look at AI, editorial team