AI 与机器学习

AI 模型水印会改变 Agent 行为

Lasso Security 发现，模型在工具处理和拒绝回答方面存在差异

欧盟法律要求为 AI 生成内容添加水印以确立其来源，但这可能需要付出代价。

据 Lasso Security 称，AI 模型水印会改变 AI Agent 处理工具和安全拒答的方式。这种行为变化并不一定更糟，但在对抗性提示注入的情况下，可能带来负面影响。

随着《欧盟 AI 法案》的实施，AI 模型提供商必须以机器可读代码标记其软件输出。Google DeepMind 的 SynthID-Text 是实现这一目标的方法之一，目前已被 Anthropic 采用，也被 OpenAI 采用。

这类数字标记的好处在于，操纵性或欺骗性的 AI 生成内容能够更容易被检测出来，尽管它也可能给 AI 的使用带来污名化风险。

Anthropic 对其如何为 Claude 输出应用水印的解释涉及干预模型对特定词语的预测。例如，如果 Claude 正在生成句子“今天天气寒冷，而且……”（"The weather today was cold and…"），它可能会优先选择一个统计上可能的候选词（如“阴沉的”，"overcast"），而非另一个备选词（如“灰暗的”，"gray"）。

这些添加内容或许可以被检测出来。

“水印的设计目的是实现溯源，但 SynthID-Text 改变了模型生成每一个后续 token 的过程，”Lasso 在一篇提供给 The Register 的博客文章中解释道。“在模型层面，这可能改变安全行为，包括模型是否拒绝有害请求，以及这种拒绝在提示注入下是否仍然有效。”

“水印利用了这类低风险选择——它们会在一段生成文本中多次出现——从而在 Claude 的回复中留下模式，”Lasso Security 补充说。“这种模式对读者不可见，但任何拥有编码该模式密钥的人都可以检测到它。”

读者或许不会注意到这种用词偏好，但 AI Agent 可能会对词汇差异产生微妙的敏感反应。

Lasso 发现，这类数字内容标记会影响工具调用和拒答行为。该公司表示，水印会影响“模型说什么，以及 Agent 做什么”。

而且，这一影响会延伸至并非由实施水印实体开发的 AI Agent。因此，基于 OpenClaw 的 Agent，或调用 Anthropic 模型的 API 客户端，都会处理由 Anthropic 水印机制带来的输出差异。

在工具调用方面，基于名为 BFCL v4 single-turn AST 的基准测试，水印降低了 7 个受测模型中 6 个模型的准确率。这些模型包括 phi-4、Llama-3.1-8B、Qwen3-32B、Qwen3-4B、gemma-3-12b、gemma-3-27b 和 Granite-3.2-8B。

“不过，准确率的净变化并不能说明，在有水印和无水印情况下，相同的单个调用是否会成功，”Lasso 表示。“一次原本正确的调用可能变得错误，同时另一次原本错误的调用可能变得正确；即使模型在两项任务中的行为都发生了变化，汇总结果仍可能几乎保持不变。”

工具调用准确率下降意味着，Lasso 测试的 AI Agent 为当前任务选择了错误工具，或为正确工具提供了错误参数，并因输入格式错误或解析失败而无法完成任务。

至于拒答——即模型出于安全原因拒绝响应提示——基于使用 HarmBench 和 JailbreakBench 进行的测试，水印对处理明显有害请求的影响较小。但在涉及提示注入的对抗性场景中，其影响更为明显。

“水印会改变模型对直接有害请求的拒答行为，但在提示注入条件下，这种影响会更加显著，”Lasso 研究人员在报告中指出。

在涉及提示注入的交互中——即一种要求模型忽略安全过滤器、声称安全过滤器已被禁用并要求其遵从的对抗性指令——当存在水印时，攻击成功率显著上升。这使受影响的模型更不可能拒绝有害请求。

据 Lasso 称，这些发现并不一定意味着水印缺乏合理性。相反，该公司认为，在评估 Agent 部署时，安全评估和红队测试需要将带水印内容纳入范围，从而确保能够权衡 Agent 行为上的差异。®

ai and ml

AI model watermarking changes agent behavior

Lasso Security sees differences in tool handling and model refusals

Watermarks that European law requires be added to AI-generated content to establish provenance may come at a cost.

According to Lasso Security, AI model watermarking changes how AI agents handle tools and safety refusals. The altered behavior isn't necessarily worse but can be, particularly under adversarial prompt injection.

With the implementation of the EU AI Act, providers of AI models must mark the output of their software with machine-readable code. Google DeepMind's SynthID-Text is one method for doing so, and has been adopted by Anthropic and by OpenAI.

The benefit of this sort of digital labeling is that manipulative or deceptive AI-generated content can be more easily detected, even if it does have the potential to stigmatize the usage of AI.

Anthropic's explanation of how it applies watermarks to Claude output involves intervening in the prediction that results in specific words. For example, if Claude were emitting the sentence "The weather today was cold and…" then it might favor one statistically likely candidate (e.g. "overcast") over an alternative (e.g "gray").

It may be possible to detect those additions.

"Watermarking is designed for provenance, but SynthID-Text changes the process by which the model generates each next token," Lasso explained in a blog post provided to The Register. "At the model level, this can change safety behavior, including whether the model refuses a harmful request and whether that refusal holds under prompt injection."

"Watermarking uses low-stakes choices like these – which occur many times over a piece of generated text – to leave a pattern in Claude’s responses," Lasso Security added. "That pattern is undetectable to the reader, but is detectable to anyone who has a key that encodes it."

While a reader might not notice the word choice bias, AI agents can be subtly sensitive to vocabulary differences.

Lasso found that this sort of digital content tagging can affect tool calling and refusal behavior. Watermarking, the company says, can affect "both what the model says and what an agent does."

And this extends to AI agents from organizations other than the entity doing the watermarking. Thus an agent based on OpenClaw or an API client that calls an Anthropic model would process whatever output variation follows from Anthropic's watermarking.

In terms of tool calling, based on a benchmark called BFCL v4 single-turn AST, watermarking reduced the accuracy on six of seven models tested (phi-4, Llama-3.1-8B, Qwen3-32B, Qwen3-4B, gemma-3-12b, gemma-3-27b, and Granite-3.2-8B).

"The net change in accuracy, however, does not show whether the same individual calls succeed with and without the watermark," Lasso said. "A call that becomes incorrect can be offset by another that becomes correct, leaving the aggregate result nearly unchanged even though the model behaves differently on both items."

Less accurate tool calling means the AI agents Lasso tested chose the wrong tool for the task at hand, or the wrong arguments for the correct tool, and failed due to malformed input or parsing.

As for refusals – when models refuse to respond to a prompt for safety reasons – watermarking had a small effect on the handling of obviously harmful requests, based on test runs using HarmBench and JailbreakBench. And it had a more pronounced impact in an adversarial scenario involving prompt injection.

"Watermarking changes refusal behavior on bare harmful requests, but the effect becomes more pronounced under prompt injection," Lasso researchers observed in their report.

For interactions involving prompt injection – an adversarial instruction that the safety filter has been disabled and that compliance is required – the attack success rate went up significantly when watermarks were involved. This made affected models less likely to refuse harmful requests.

According to Lasso, the findings don't necessarily argue that watermarking is unwarranted. Rather, the biz contends, security evaluations and red-teaming need to include watermarked content when assessing agent deployment. This ensures that differences in agent behavior can be weighed. ®