SynthID watermarks reduce the robustness of models to malicious queries

Researchers at Lasso Security discovered that implementing text watermarking mechanisms, such as SynthID, makes language models more vulnerable to bypassing security filters. During testing, it was found that models using watermarks more often agree to execute malicious instructions that are normally blocked by built-in protection systems. Analysis showed that token labeling algorithms alter the distribution of token probabilities, which unintentionally weakens the "refusal" mechanisms. In experiments with various LLM architectures, researchers recorded a statistically significant decrease in the effectiveness of security systems when watermarks were activated. In some scenarios, the probability of successfully bypassing restrictions increased by 15-20% compared to the base model versions without labeling. The watermarking technology, which is being actively implemented to identify AI content, requires introducing statistical distortions into the output. These distortions, according to experts, create "noise" that attackers can use to mask malicious prompts. As a result, the model perceives the attacking request as acceptable, since the statistical structure of the response is shifted towards generation rather than blocking. This study highlights the conflict between regulatory requirements for AI transparency and the need to ensure model security. Developers will have to find a balance where content identification methods do not reduce the overall resilience of systems to "jailbreak" attacks and other forms of neural network behavior manipulation.