SynthID watermarking can weaken AI safety, Siposova finds

The research builds on SynthID's tournament sampling, a method that uses a secret key to score and select next-word tokens. Siposova tested the "non-distortionary" configuration through Hugging Face's unmodified SynthIDTextWatermarkLogitsProcessor, feeding harmful prompts to six open-weight models with and without watermarking. The comparison showed that watermarking changed refusal behavior, especially when prompts included injection techniques. The study also found that changing the secret key altered behavior, with some keys increasing harmful compliance and others reducing it.

The findings suggest that watermarking can affect not just what a model says but also what an AI agent does, since the same sampled tokens can determine which tool is called and what arguments are passed. This means safety behavior could become less predictable when watermarking is active, particularly in agentic settings where a weakened refusal can have real consequences.

The research has limitations: it did not test Claude models and used Hugging Face's implementation rather than the specific one Claude will use. Still, the results indicate that at least some watermarking approaches may influence model and agent safety, making it important for red-team exercises to stress-test platforms before SynthID is deployed.