We keep filing text watermarking under “labeling” — a provenance signal stapled onto the output. The Lasso Security writeup reframes it as something that lives on the sampling path, which means it can change what your agent actually does. SynthID-Text biases token selection during generation, and once you change which token gets picked, you’ve changed which tool the agent invokes and what arguments it passes.
The number that should worry anyone running production agents isn’t the net accuracy delta — it’s the churn. Across 21 model-and-temperature combinations, paired verdicts disagreed 6.5% of the time, and on the BFCL tool-calling benchmark watermarking hurt six of seven open-weight models. Net loss stayed small (phi-4 lost under 3 points) while churn hit 16.8%, which is the tell: individual calls are flipping in both directions, so aggregate metrics hide it. Under prompt injection it gets worse — Gemma-3-27b’s churn jumped from 6% to 23.5%, and watermark-induced churn beat temperature-induced churn on four of six models. Your safety refusals are part of the sampled distribution too, so the guardrail you red-teamed isn’t the guardrail you ship.
The operational takeaway is uncomfortable but simple: watermark configuration is a deployment variable, not a neutral post-processing step. Every eval and injection test you ran on the un-watermarked model measured a system you won’t actually run. The fix is to re-run agent evals and red-teaming under the exact watermark config headed for production, with paired comparisons on identical inputs. The HN discussion has people realizing their compliance checkbox has a behavioral price tag.
Reception has been steady and cautious rather than alarmist. The Register and Unite.AI both report the finding straight — a hidden behavioral variable to re-test, not a reason to drop watermarking — and Analytics India Magazine stresses that the effect swings by model and temperature. TechRadar pushes the sharper angle: if provenance rules mandate watermarking and watermarking makes guardrail adherence less predictable, EU AI Act compliance and safety evidence start pulling against each other.