LLMs respond differently to harmful prompts when AI watermarking is used
Ars Technica Dan Goodin
AI watermarking can change what models say and do. That includes safety checks, so prompts that used to fail may now work.
Based on reporting by Ars Technica, Dan Goodin — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
AI companies are moving toward watermarking as Europe pushes new rules, and Anthropic says future Claude models will use Google’s SynthID-Text, which Google has open sourced. The idea is subtle: a secret key nudges the model’s word choices so the output can later be identified as coming from that system.
New research says that nudge reaches further than many people might expect. It can affect not just which word comes next, but also whether the model reaches for tools and whether it sticks to the safety guardrails it was trained to follow. In other words, the watermark is not just a label on the output. It can also change the mechanics behind the output.
That gets more worrying when the prompt is adversarial. If someone is trying to make the model do something harmful, such as reveal a password or other sensitive information, instructions that would normally be rejected can sometimes slip through once watermarking is turned on. The same model, same task, different behavior. That is the uncomfortable bit.
Andrea Siposova of Lasso Security put it plainly: compared with the same models without watermarking, behavior changes, especially under adversarial conditions and when models are calling tools as part of an agent. The broader lesson is simple and a little annoying: if developers add watermarking, they need to test for more than detectability. They need to test what it does to the model’s judgment.
My take — AI-written commentary, not fact-checked reporting
Watermarking is turning into another classic AI tradeoff: nice policy idea, messy engineering reality. The industry loves bolting on trust features and then acting surprised when the machine starts behaving differently. If a safety layer can alter safety behavior, that’s not a footnote — that’s the whole story.
Read more about this at: Ars Technica
