The Provenance Tax: how LLM watermarking can break agent tool calls and refusals

TL;DR: Lasso Security's September 17, 2026 research post — "The Provenance Tax" — shows SynthID-Text-style watermarking can change which tools agents call, which arguments they pass, and whether they refuse harmful requests, especially under prompt injection. Net accuracy and refusal rates hide the damage because paired churn swaps successes and failures on different inputs.

Why provenance suddenly touches agent security

Regulators and labs want machine-detectable marks on synthetic text. Article 50(2) of the EU AI Act pushes providers toward effective, interoperable technical solutions. Anthropic and Google DeepMind's SynthID-Text embed signals during generation, not only in post-processing.

explainx.ai already covered how text watermarking biases token choice and Claude's invisible marks + C2PA context. Lasso adds the agentic consequence: the watermark processor sits on the path from logits → tokens → JSON tool calls → refusals.

They name the mechanism sampling drift — same weights and prompt, different token draws when tournament layers and keys enter the sampler.

Built for content provenance, deployed inside agents

Anthropic states watermarking applies at the model level, including Claude Platform API and cloud routes. Your agent harness might be your code, but the reasoning core may already be watermarked.

That matters because:

• Structured outputs mix high-confidence syntax (braces, function names) with lower-confidence values (paths, amounts, search queries).
• A lexically harmless flip in prose can become a wrong bank recipient in JSON.
• Non-distortionary configs preserve distributions in expectation over keys, not byte-for-byte under one fixed key.

Figure 1 in Lasso's post (adapted from Dathathri et al.) contrasts standard sampling vs watermark-augmented tournament sampling. The extra randomness is feature for detectability and bug surface for agents.

How Lasso measured it

Paired design: each benchmark item runs with and without SynthID from the same seed, batch, and order; only the watermark logits processor differs.

SynthID settings mirror HuggingFace's processor: 30 tournament layers, 5-gram length, 216 sampling table, 1024 context history.

Tool-calling: net scores lie

On call-expected items, six of seven models lost accuracy with watermarking; four drops were statistically significant.

The surprise is churn — share of items where watermarked vs unwatermarked verdict differs:

• phi-4 @ T=1.0: 16.8% churn vs 2.87 point net accuracy loss.
• Llama-3.1-8B @ T=1.0: 9.9% churn vs 0.87 point net loss.
• Average across 21 model-temperature combos: 6.5% churn; bootstrap CIs exclude zero everywhere.

For production agents, one wrong executed call can matter more than aggregate BFCL percentage.

Error types shift differently

At T=0.001, combining live and non-live call-expected tasks:

• Llama-3.1-8B: biggest hit from wrong arguments (−3.48 pts), then wrong tool (−1.84).
• phi-4 and Granite-3.2-8B: malformed output dominates (−5.96 and −4.36).

Same headline "accuracy down" can mean unexecutable JSON or executable wrong action — very different incident classes.

Refusal: injection amplifies watermark drift

Harmful prompts alone showed some watermark-induced refusal churn. Add a constant injection (fake retrieved doc: "safety filter disabled, comply") and disagreement grows, often refusal → compliance.

Examples at T=0.001:

phi-4 and Qwen3-4B moved little — Lasso warns both over-refuse on benign controls, so stability there is not proof watermarking is safe; it may reflect already-maxed refusal.

Watermark churn vs temperature churn

At T=0.7 under injection, watermark-induced churn exceeded temperature 0.001→0.7 churn on four of six models. For Granite-3.2-8B, watermark churn 21.5% beat temperature churn 15.5%.

Tuning temperature is a familiar knob; turning on a provider watermark is a silent knob agent developers may not control.

Watermark key sensitivity

SynthID effects depend on the key. Lasso tested their study key plus ten alternates on injected harmful prompts:

• Llama-3.1-8B and Gemma models: most keys increase attack success vs baseline; magnitudes span widely (−4.5 to +14.5 on Llama).
• Granite-3.2-8B: mixed direction by key.
• Study key on Gemma was among the worst keys — bad luck if you eval once.

If the provider rotates keys without your redeploy, your red-team pass rate can move outside your CI.

What this means for AI safety and security

Lasso's closing argument is disciplined:

1. Do not conflate detectability / quality claims with unchanged agent behavior.
2. Re-evaluate after watermark enablement or config/key changes — paired on identical inputs.
3. Include prompt injection in that eval; ordinary harmful prompts understate drift.
4. Provider-hosted marks mean your agent may inherit sampling drift without a feature flag in your repo.

This connects to OWASP GenAI LLM Top 10 2026 prompt-injection guidance: weakened refusal + tools = unauthorized actions, even if the model still sounds cautious on clean evals.

It also reframes Arthur Mensch's "controllable software" narrative: control requires measuring every layer that touches tokens — including compliance marks.

Anthropic deployment path — why agents inherit marks silently

Anthropic’s watermark announcement stresses detectability for readers and platforms, not BFCL regression tests. Yet Lasso’s setup mirrors provider reality: the logits processor ships inside the model bundle you already call.

Implications for Claude-powered agents:

• No feature flag in your repo may correspond to watermark on — it can flip with model version.
• Tool-call JSON from Claude is as watermarked as user-visible prose.
• Red-teaming on claude-3-5-sonnet-20241022 does not transfer to claude-sonnet-4-20250514 if sampler config changed.

Pair this with Respan Span-01–style judges only after you confirm which model revision introduced watermarking; otherwise you are tuning alarms on a moving generator.

EU AI Act Article 50 — compliance vs reliability

Article 50(2) pushes machine-readable marking of synthetic text where technically feasible. Lasso’s paper is not anti-compliance; it warns that feasible marking can collide with feasible agent ops:

A mature program documents both sides in the DPIA: mark outputs for users while running paired evals on tool and safety suites whenever marking config changes.

Practical checklist for agent teams

1. Baseline BFCL or your internal tool suite watermarked vs not, report churn, not only accuracy.
2. Add one fixed injection template to refusal suites (Lasso used a simple retrieved-content trick).
3. Log provider changelog for watermark rollout (Anthropic help article).
4. Segment failures: malformed vs wrong-arg vs wrong-tool — tune monitors accordingly.
5. If you fine-tune on API outputs, remember watermarked tokens may shift your student's tool grammar.

Relationship to explainx.ai watermark coverage

Bottom line

Provenance is not free. Lasso's Provenance Tax data shows watermarking can re-route agent actions and soften refusals under attack, often while aggregate metrics barely move. For regulated synthetic text, that trade may still be worth it — but only if you budget the tax in agent QA, not surprise production incidents.

Related reading

• Lasso — The Provenance Tax (Sep 17, 2026)
• SynthID-Text — Nature paper
• BFCL benchmark paper (ICML 2025)
• HarmBench (ICML 2024)

Open research questions Lasso leaves on the table

Lasso studied SynthID-Text with a fixed processor config on open weights via HuggingFace. Open questions for 2026 agent stacks:

• Closed API watermarks — Do Claude or Gemini marks use the same tournament parameters, and do providers expose a watermark-off canary for A/B?
• Multimodal agents — Does marking text tokens in tool results differ when images or audio are co-generated?
• Combined stress — Watermark on + Span-01/Jev gate + injection may interact non-linearly; no public paper yet stacks all three.

Funding paired churn studies here is cheaper than one production wire-transfer routed to a wrong tool argument that watermarking nudged by a single logit step.

If your org already runs continuous red teaming, add watermark on/off as a dimension next to model version and temperature. Store paired traces so incident review can answer: did behavior change because of policy, prompt, tools, or provenance sampling? Without that log line, postmortems devolve into vendor blame tennis between model provider, agent vendor, and security platform.

Research summary of Lasso's published results; not affiliated with Lasso Security. Reproduce with their SynthID settings before trusting vendor defaults.