By Claude Watermark Research · Updated
Anthropic's text watermark is distributional: a secret key biases the model's choice among near-equivalent next tokens, so the mark is carried by word choice itself. Tools that advertise removal by deleting zero-width Unicode characters are operating on a completely different mechanism — invisible characters — which Anthropic's mark does not use. Deleting those characters cannot affect a distributional watermark any more than changing a document's font can change its wording. Separately, no such watermark exists in production yet, and Anthropic has not published a detector, so no tool can currently verify removal either.
What the tools actually do #
Open any of them and paste text. They scan for U+200B, U+200C, U+200D and friends, strip them, and report a count. That is a legitimate, useful operation — those characters are real, they do survive copy-paste, and they are trivially greppable. It is just not watermark removal.
The confusion is understandable, because for years the folk theory of “AI watermarking” was invisible characters. Several tools were built on that theory, ranked for it, and have now relabelled themselves for the Claude news without changing what they do.
Why character stripping cannot touch a distributional mark #
A distributional watermark does not add anything to the text. It changes which words get chosen. At each generation step the model has a set of near-equivalent candidates; a keyed pseudo-random function nudges the sampler toward a particular subset. Over a long enough passage, the pattern of those choices is statistically detectable by whoever holds the key.
Because the signal is the word choice, the text contains no extra characters to remove. Strip every zero-width character, normalise every space, replace every em dash, and the words are still the words the key selected. The mark is untouched.
This is also why the mark survives copy-paste, which Anthropic states directly. Formatting is discarded on copy; word choice is not.
What would actually remove it #
Resampling. If the signal lives in word choice, the only way to destroy it is to choose different words — which means rewriting the passage with a model that is not itself watermarked. The research literature calls this a paraphrase attack, and it is the best-documented removal vector there is.
There is a constraint people miss: the rewriting model must not carry its own watermark. Google's Gemini embeds SynthID in its text output, so paraphrasing Claude text through Gemini would swap one lab's mark for another's. Open-weight models are the safe choice.
And right now there is nothing to remove #
Anthropic's marking applies to Claude models launched on or after 2 August 2026. No shipped model meets that condition yet. Any tool claiming to have removed a Claude watermark from text you generated this week has removed something that was not there.
Anthropic has also not published detection details. Until it does, nobody outside Anthropic can verify whether a passage is marked — which means nobody can verify a removal worked either, including us. We would rather say that than imply otherwise.
Questions #
- So the zero-width character tools are useless?
- No — they solve a real and separate problem. Copy-paste artifacts genuinely do expose AI use, and stripping them genuinely helps. The objection is only to describing that as watermark removal, because it is not.
- How can I check what a tool actually does?
- Paste text containing an em dash and no invisible characters, then paste text with a zero-width space and no unusual wording. If the tool reports one and not the other, it is a character scanner. Nothing wrong with that — just know what you bought.
Check your own text. Free, unlimited, no account, and it runs in your browser so nothing is uploaded.