> ## Content Index
> Fetch the complete content index at: https://www.metatalks.ai/llms.txt
> Use this file to discover other available public pages before exploring further.

# Google's SynthID watermark, which Claude will carry, made open models easier to jailbreak in a security firm's tests
- URL: https://www.metatalks.ai/synthid-watermark-claude-open-models-easier-to-jailbreak/
- Published: 2026-09-21T13:28:00.000Z
- Updated: 2026-09-21T13:28:00.000Z
- Author: Al
- Tags: News, AI Detection, AI Security, #newswire

**On plain harmful requests the watermark changed little, but once a prompt injection was added, some models went along with the attack noticeably more often.**

[Lasso Security](https://www.lasso.security/blog/the-provenance-tax-understanding-the-impact-of-llm-watermarking-on-ai-agent-behavior?ref=metatalks.ai), an AI security firm, ran seven open models, among them Google's gemma-3 and Meta's Llama-3.1-8B, with and without SynthID-Text. Google released the watermark openly, and Anthropic says its future Claude models will carry it. SynthID lets a secret key steer which word a model picks next, so the text can later be checked for that pattern. Claude itself was not tested.

Six of the models went through the refusal test: 200 harmful requests from the HarmBench benchmark, first as written and then wrapped in one fixed prompt injection. With the study's own watermark key, the share of harmful requests a model carried out barely moved on the plain versions, falling one percentage point for gemma-3-27b and half a point for gemma-3-12b. Under the injection it rose by 12.5 and 9 points.

The researchers then repeated the injected test with ten more keys, and the result depended on both model and key. For the two gemma models and Llama-3.1-8B, most keys raised that share, though by very different amounts: Llama's results ran from 4.5 points lower to 14.5 points higher. Granite-3.2-8B moved in both directions, and phi-4 and Qwen3-4B, which already refuse the most, stayed close to their unwatermarked results.

Tool use changed as well. On the Berkeley function-calling benchmark, six of the seven models called tools less accurately with the watermark, four of them by a statistically significant margin. The net figures understate how much moved: phi-4 made 16.8% of its tool-call decisions differently, while its accuracy fell by 2.87 points.

Anthropic, which adopted SynthID to meet new EU rules on labeling AI output, [said in August](https://www.anthropic.com/news/claude-text-watermark?ref=metatalks.ai) that internal tests found no effect on the content, creativity or readability of Claude's text. Lasso tested behavior instead: refusals and tool calls.

The authors caution that they measured refusals by the model rather than the behavior of a complete agent, and used a single simple injection technique.