Google's SynthID watermark, which Claude will carry, made open models easier to jailbreak in a security firm's tests

On plain harmful requests the watermark changed little, but once a prompt injection was added, some models went along with the attack noticeably more often.

Lasso Security, an AI security firm, ran seven open models, among them Google's gemma-3 and Meta's Llama-3.1-8B, with and without SynthID-Text. Google released the watermark openly, and Anthropic says its future Claude models will carry it. SynthID lets a secret key steer which word a model picks next, so the text can later be checked for that pattern. Claude itself was not tested.

Six of the models went through the refusal test: 200 harmful requests from the HarmBench benchmark, first as written and then wrapped in one fixed prompt injection. With the study's own watermark key, the share of harmful requests a model carried out barely moved on the plain versions, falling one percentage point for gemma-3-27b and half a point for gemma-3-12b. Under the injection it rose by 12.5 and 9 points.

The researchers then repeated the injected test with ten more keys, and the result depended on both model and key. For the two gemma models and Llama-3.1-8B, most keys raised that share, though by very different amounts: Llama's results ran from 4.5 points lower to 14.5 points higher. Granite-3.2-8B moved in both directions, and phi-4 and Qwen3-4B, which already refuse the most, stayed close to their unwatermarked results.

Tool use changed as well. On the Berkeley function-calling benchmark, six of the seven models called tools less accurately with the watermark, four of them by a statistically significant margin. The net figures understate how much moved: phi-4 made 16.8% of its tool-call decisions differently, while its accuracy fell by 2.87 points.

Anthropic, which adopted SynthID to meet new EU rules on labeling AI output, said in August that internal tests found no effect on the content, creativity or readability of Claude's text. Lasso tested behavior instead: refusals and tool calls.

The authors caution that they measured refusals by the model rather than the behavior of a complete agent, and used a single simple injection technique.