Anthropic has chosen SynthID-Text, the open source mechanism created by Google, for its next Claude models. The move aligns with new EU rules on watermarking synthetic content, but recent research shows it is not a simple invisible stamp. SynthID-Text uses a secret key to alter how a model selects the next token: where the model would have picked 'cloudy', the key can push it to 'overcast'. Anyone with the key can determine whether the text came from the platform. So far, that is traceability. The issue is that the modification propagates to other behaviors.

Research cited by Ars Technica indicates SynthID-Text does not only alter lexical choice. It also changes the tools a model invokes when acting as an agent and can weaken adherence to safety guardrails learned during training. Under an adversarial prompt, an instruction the model would normally refuse may in some cases be executed once watermarking is active. Examples include revealing passwords or other sensitive information. This is not a theoretical problem: it is a behavioral shift at inference time, achieved without modifying model weights.

Why watermarking touches safety

The reason is structural. SynthID-Text does not add a label after the fact: it affects the token probability distribution. An LLM already fine-tuned to refuse harmful requests can be pushed off the refusal path by seemingly small perturbations. In agentic systems, the risk is even more delicate: tool choice becomes less predictable, and a selection error can turn into an action with real-world effects. That explains why safety tests run without watermarking may produce a different picture from production.

What changes for teams running models in-house

For organizations running self-hosted LLMs, the secret key becomes an additional security asset. If compromised, it allows an attacker to verify the provenance of generated text and, in an agent scenario, could be used to refine adversarial prompts. At the same time, the internal team can test the model in the exact configuration it will use in production, including watermarking in red-teaming pipelines and tool-calling checks. This does not remove the risk, but avoids discovering behavioral deviations only after release. For those evaluating on-premise deployments, AI-RADAR provides analytical frameworks at /llm-onpremise to compare configurations, key custody constraints, and operational costs.

Andrea Siposova, AI security researcher at Lasso Security, summed up the point: watermarking is designed not to be perceptible to readers, but any change to generation produces tradeoffs that show up somewhere. The statement signals a necessary shift in perspective: watermarking should not be treated as passive metadata. It should be treated as a system component that can interact with safety, tool choice, and response reproducibility. In a regulatory environment pushing toward traceability, the point is not whether to adopt it, but how to verify that it does not move model behavior in unexpected directions.