AI Watermarking Can Alter Language Model Safety Behavior

New research suggests that AI watermarking methods, such as Google's SynthID-Text, may alter the behavior of large language models (LLMs) in unexpected ways. While intended for traceability of AI-generated content, these techniques could potentially compromise model safety features, particularly when faced with harmful or adversarial prompts.

Anthropic recently announced its upcoming Claude models will employ Google's SynthID-Text approach. This method subtly modifies the text generation process using a secret key, allowing content to be identified as AI-generated by those aware of the key. The implementation aligns with new European Union regulations requiring such identification mechanisms.

The research indicates that watermarking can influence not only word selection but also the tools a model invokes and its adherence to safety protocols. In scenarios involving prompts designed to elicit harmful actions, such as revealing sensitive information, models with watermarking enabled may be more likely to comply with instructions that would typically be blocked.

"Compared to the same models without watermarking, it is definitely going to change their behavior, especially when we place it under adversarial conditions, or we make these models call tools when they’re powering an agent," said Andrea Siposova, an AI security researcher at Lasso Security. "Watermarking is made to not be perceptible to a reader, but we know that when we are changing anything about what the model is generating, it is going to cause some tradeoffs, it’s going to show up somewhere."

The findings highlight the need for thorough testing of AI models and agents when watermarking technologies are active. Developers must ensure that safety mechanisms remain robust and are not inadvertently weakened by the implemented traceability features.