Found first: a primary source the press has not covered yet.
Researchers at ETH Zurich and the Berlin Institute of Health at Charité tested five watermarking schemes across 11 language models and seven vision-language models on clinical reasoning tasks, finding that watermarking can silently corrupt medical outputs in ways that standard accuracy benchmarks do not detect. The paper, led by Melanie Rieff and co-authored by Robin Staab, Thibaud Gloaguen, Stefan Hegselmann, and Martin Vechev, used a physician-validated audit pipeline covering 650 annotated completions across unimodal and multimodal clinical tasks.
What the source says
Under SynthID watermarking, Phi-4-14B's rate of faulty-but-correct answers rose from 11.4% to 26.3% while measured accuracy fell by only 3.2 percentage points; OpenBioLLM-70B's faulty-but-correct rate more than doubled, from 12.9% to 27.5%. Fabricated medical entities reached up to +39.2 per 100 questions in Lingshu-7B under SynthID. Reasoning trace watermarking inflated output length by up to 69% at maximum strength across four reasoning models tested. In pairs where both the watermarked and baseline model chose correct answers, up to 40% of those pairs relied on mutually exclusive diagnostic statements. Domain-specialized models including OpenBioLLM-70B and UltraMedical-70B, along with smaller models, proved most vulnerable; general-purpose large models such as Llama-3.1-70B remained stable across all five schemes.
Why it matters
Watermarking is now mandated in some jurisdictions and increasingly deployed in production systems, including for medical applications. This paper shows it can degrade clinical reasoning while leaving top-line accuracy figures intact, meaning the failure mode is invisible to the evaluations most deployment teams run. The vulnerability is concentrated in domain-specialized and smaller models, which are also the models most likely to be deployed in cost-sensitive clinical settings. A clinician relying on a watermarked output that scores correctly on a benchmark but contains fabricated terminology or mutually exclusive reasoning has no signal from the benchmark that anything went wrong.