SynthID tournament sampling shifts refusal rates on harmful prompts across six open-weight models

Siposova evaluated six open-weight models with the non-distortionary SynthID configuration. Tournament sampling using a secret key re-ranked token candidates through pairwise hidden-score competitions. This produced measurable sampling drift that changed refusal behavior on bare harmful requests and amplified compliance when the same requests were wrapped in prompt-injection templates.

Data showed key-dependent effects. Different secret keys produced compliance shifts ranging from reduced to increased harmful outputs, with some keys flipping individual tool calls from correct to erroneous or vice versa at rates exceeding aggregate accuracy deltas. The changes affected both direct model responses and downstream agent actions such as tool selection and argument passing.

The findings connect to prior observations that deterministic sampling modifications can interact with alignment layers. Because SynthID operates at logits level after safety fine-tuning, the tournament process can override refusal tokens selected during training. Open-weight models exhibited the effect; closed models such as Claude remain untested.

Operational consequence: any deployment that layers watermarking on safety-tuned models must re-validate refusal and tool-use benchmarks under multiple keys rather than assuming watermarking is behaviorally neutral.