Lasso’s findings arrive weeks after the European Union’s AI Act transparency obligations took effect on August 2, 2026. Article 50 requires providers of systems that generate synthetic content to make that content machine-readable and detectable as artificially generated or manipulated, subject to technical feasibility and specified exemptions. But the law does not dictate one universal implementation, and it does not specifically require every provider to use a token-level text watermark.
That distinction is important because the technique Lasso examined is not a label appended after a model finishes writing. SynthID-Text influences the probability distribution used when a language model chooses its next token. Google describes its implementation as a logits processor applied during generation: it nudges otherwise plausible choices in a pseudorandom pattern that can later be detected with the appropriate key.
For a person reading an answer, choosing “overcast” rather than “gray” may be immaterial. For a tool-using agent, tiny differences in token selection can cascade into a different function name, malformed JSON argument, or a change in whether the model follows an adversarial instruction. That is the issue Lasso calls “sampling drift.”
Lasso Tested Open Models, Not Anthropic’s Production Claude Service
The most important limitation is also the one most likely to get lost in simplified coverage: Lasso did not report a direct test of Anthropic’s deployed Claude watermarking system. Its September 17 report says researchers used Hugging Face’s unmodified SynthIDTextWatermarkLogitsProcessor with seven open-weight models, including Microsoft Phi-4, Meta Llama 3.1 8B, Qwen3 variants, Google Gemma 3 variants, and IBM Granite 3.2 8B.
That is a useful controlled experiment because the researchers held the model, prompt, seed, batch composition, and generation order constant, changing only whether the watermark processor was active. But it is not evidence that Claude, ChatGPT, Microsoft Copilot, or any particular hosted service now behaves in precisely the same way. Each provider can use different models, decoding settings, system prompts, tool schemas, guardrail layers, watermark keys, and deployment controls.
Anthropic has said that its Claude text watermark is a version of Google DeepMind’s SynthID-Text approach and that watermarking operates by changing the source of randomness among word choices rather than changing the intended meaning for readers. Anthropic also says it saw no measurable decline in output quality in its internal testing. Lasso’s study does not directly rebut that claim about prose quality. It identifies a different measurement target: repeatability of actions and safety decisions under controlled, sometimes hostile inputs.
The gap matters. A model can produce text that humans rate as equally readable while still taking a different action when an agent framework parses its output into a tool call.
Tool Calling Changed Even When Aggregate Scores Barely Moved
For the agent portion of its work, Lasso used the Berkeley Function Calling Leaderboard’s BFCL v4 single-turn AST tasks. BFCL is specifically designed to assess whether a model can select tools and supply valid, correct arguments—a closer approximation to enterprise agent work than a general chat benchmark.
Lasso reports that enabling the watermark reduced aggregate tool-calling accuracy on six of its seven tested models, with four showing statistically significant declines. The more revealing result, according to the company, was disagreement on individual tasks. A model could get one request right only in the watermarked condition and a different request right only without it; those shifts can offset in a single headline accuracy score.
For operators, aggregate parity is therefore not a sufficient acceptance test. Consider an agent that can look up an employee record, create a support ticket, alter a SharePoint permission, run a script, or submit a purchase request. A call that remains syntactically valid but switches a recipient, path, amount, filter, or identifier can execute successfully while doing the wrong thing.
This is where a token-level change becomes an operations concern. A model’s answer may look normal in a transcript while the structured payload passed to a connector changes. Existing monitoring that focuses on success rates—whether the API returned HTTP 200, whether the JSON parsed, whether a workflow completed—will not necessarily identify that kind of behavioral movement.
The Berkeley benchmark confirms why Lasso selected this test category: function calling is the core mechanism by which language models interact with external systems, and BFCL v4 includes agentic scenarios such as web search, persistent state, error recovery, and format sensitivity. Still, Lasso’s work is a single-vendor study, not a broad replication. Organizations should treat its percentages as a signal to validate their own configurations rather than as a universal estimate of breakage.
Prompt Injection Produced the More Serious Result
Lasso’s safety experiment tested 200 harmful behaviors from HarmBench alongside 100 benign controls from JailbreakBench. It then repeated the harmful prompts with a fixed prompt injection appended as simulated retrieved content. The injected text falsely asserted that the safety filter was disabled and instructed the model to comply.
The company found relatively small changes in refusals for bare harmful prompts, but larger effects under the injected condition for several models. In the most striking examples reported by Lasso at a near-deterministic temperature setting, Gemma 3 27B’s net harmful-compliance rate increased by 12.5 percentage points with watermarking enabled; Gemma 3 12B rose by 9 points. The same report says Phi-4 and Qwen3-4B moved little in this test, though both over-refused even on benign controls, making them poor evidence that a watermark preserves safety behavior.
Prompt injection is already listed by OWASP as LLM01 in its 2026 Top 10 for LLM Applications. The concern is not merely that a chatbot prints a bad answer. In an agent, untrusted material from an email, ticket, document, website, Teams message, or retrieved knowledge base can contain instructions designed to override the task a user intended. When an agent has tools, a successful injection can become an unauthorized action, data exposure, or misleading workflow result.
Lasso did not test the entire chain in one experiment: it separately tested tool-call correctness and refusal behavior. It did not show an injected, watermarked model using a real tool to perform a harmful action. That keeps the findings short of a demonstrated end-to-end exploit. Yet the two results point in the same operational direction: safety and action selection cannot be assumed to stay fixed when a provider changes generation-time sampling.
Article 50 Does Not Require SynthID-Text Everywhere
The EU rules are a major reason providers are racing to add provenance signals, but the submitted claim that European law simply requires “watermarks” is too broad. The European Commission’s Article 50 guidance calls for machine-readable marking that enables detection; its published guidance discusses several possible approaches, including watermarks, metadata, cryptographic provenance methods, fingerprints, and logs.
There are also exclusions. The Commission says the requirement does not apply to standard editing assistance, and it identifies certain outputs that may fall outside the obligation, including source code and content intended exclusively for machine-to-machine communication without human exposure. A narrow business-to-business or industrial-context exemption is also contemplated when stated conditions are met.
That means enterprise teams should not infer that every API response, agent trace, or Copilot-style workflow necessarily needs text watermarked in the same way as public-facing generated copy. Legal compliance depends on the system’s purpose, output, exposure, and applicable exceptions—not a blanket decision to turn on a particular library.
The other commonly repeated detail needs correction as well. OpenAI has adopted SynthID with Google for generated images and later supported audio, according to OpenAI’s own provenance announcement. The public documentation found here does not establish that OpenAI has deployed Google’s SynthID-Text approach for its text outputs. Anthropic’s public documentation does identify Claude text watermarking as a SynthID-Text variant.
What Enterprise Agent Teams Should Test Now
Organizations deploying Azure AI Foundry agents, Copilot Studio workflows, custom model gateways, or local open-model agents should add watermark state to their change-management records. A model version, system-prompt revision, temperature adjustment, safety-policy change, and watermark configuration can all alter behavior even if the application code is untouched.
A practical regression suite should include the exact tool schemas and high-impact workflows used in production, rather than relying exclusively on generic leaderboard scores. The test should compare paired runs with the same prompts and controlled decoding conditions, then review which individual calls changed, not merely the final accuracy average.
Teams should also retain adversarial test cases that place malicious instructions in realistic untrusted inputs: documents, emails, support tickets, web pages, and retrieved snippets. Tool permissions should remain narrowly scoped, with explicit confirmation gates or policy checks for irreversible actions. Provenance tagging may be valuable for compliance and detection, but it does not replace least privilege.
The immediate consequence is that watermarking belongs in the same deployment checklist as model upgrades and connector changes. Before enabling a token-level provenance mechanism—or accepting one imposed by a hosted model provider—security teams need evidence that their agent still refuses the right requests, calls the right tools, and confines any changed behavior within the permissions it was supposed to have.