Claude watermark: how it works, detectors, and removal

The process described in this guide requires some effort. You will need to rewrite text, run it through detectors, and possibly iterate. But the payoff goes beyond removing the watermark: the same steps that break the statistical token signature also eliminate the stylistic patterns that AI detectors flag as machine-generated. By the end, your text passes both cryptographic and heuristic checks.

How the Claude text watermark works

Starting August 2, 2026, Anthropic marks text generated by Claude to comply with the EU AI Act. The watermark has nothing to do with invisible characters, hidden whitespace, or HTML metadata. It is a statistical pattern embedded in the word choices themselves.

The technology is based on SynthID-Text, published by Google DeepMind in Nature in 2024. The core idea goes back to Scott Aaronson’s 2022 proposal.

The mechanism

When generating text, the model picks each next word from a list of candidates. Often several options work equally well: grey or overcast, shows or demonstrates. In normal mode, the model resolves these ties with a random number. With watermarking, the source of that randomness changes: instead of an arbitrary generator, the model uses a cryptographic key held by Anthropic, combined with the context of preceding words.

At each generation step, the key and context split the vocabulary into two pseudorandom groups: a preferred group (green list) and a disfavored group (red list). The model receives a slight bias toward green-list tokens. Over one or two sentences, this bias is indistinguishable from noise. Over 200 to 300 words, it accumulates into a statistical signature that can be verified by anyone who holds the key.

The reader cannot tell the difference. Anthropic reported no measurable change in quality ratings between watermarked and unwatermarked text in their internal tests. Google ran the same experiment on a portion of Gemini traffic in 2024 and found no statistically significant difference in user satisfaction.

What breaks the watermark

The watermark depends on the original token sequence staying intact. Changing word choices and sentence structure disrupts the statistical pattern. Anthropic says this directly: light editing probably will not remove the watermark entirely, but a thorough rewrite will.

Minimum text length

The watermark needs volume to work. On fragments shorter than 150 to 200 words, the statistical signal is too sparse for reliable detection. This creates a practical workaround: generating content in short, independent segments (each under the detection threshold) and then assembling them manually produces text where the token-level pattern never accumulates into a readable signature.

This is not a theoretical trick. Each segment is generated in a separate context window, with a separate random seed, so the green-list bias does not chain across segments. When a human then edits the transitions and adjusts the flow, the resulting text has no continuous statistical thread for a detector to follow.

Other methods, from most to least reliable

Second-pass rewrite through another model. Feed the text into a different LLM (DeepSeek, Llama, Mistral, GPT) with instructions to rephrase. The second model generates its own token chain with its own probability distribution, unrelated to Anthropic’s key. This is the most reliable automated method.

Manual stylistic editing. Replace synonyms, restructure sentences, merge or split paragraphs. The higher the share of rewritten words, the weaker the residual signal. Community estimates on r/ClaudeAI suggest that reworking 40 to 50 percent of the text will likely destroy the detectable signature.

Round-trip translation. Translate into an intermediate language and back, then clean up the result. Each translation pass generates a new token sequence. The method works, but it tends to flatten the style, and the output usually needs manual polish.

Light editing. Swapping individual words, fixing typos, adding a sentence or two. Probably not enough to fully remove the watermark, though it reduces detector confidence.

How to check text: detectors and checkers

Two categories of tools exist, and they answer different questions.

Anthropic’s watermark verification

Anthropic has announced a Watermark Detection API. This is the only tool that can check text against the real cryptographic key. It counts the share of green-list tokens and compares it to the expected distribution for the given key and context. If the share is statistically above chance, the text was likely generated by Claude.

The API is not yet publicly available. When it launches, it will be the definitive check for SynthID-Text watermark presence.

Commercial AI detectors: the practical option

While Anthropic’s API is pending, commercial AI detectors are the working tools for checking whether text reads as AI-generated. They do not verify the cryptographic watermark, but they analyze text style and structure, and they provide a concrete, actionable score right now.

GPTZero is the most widely used detector. It measures perplexity (how predictable each next word is) and burstiness (variation in sentence lengths). It provides sentence-level highlighting, so you can see which parts of the text triggered the flag. Reported accuracy on unedited AI output is around 88 to 92 percent, but it drops on edited text. Free tier available.

Copyleaks is strong in multilingual detection (30+ languages) and offers API integration. Used by enterprise teams and academic institutions. Provides a percentage score with per-sentence breakdown.

Pangram focuses on minimizing false positives (cases where human text is wrongly flagged as AI). This matters in professional and academic settings where a wrong accusation is costly. Their threshold guidance: scores below 20% typically reflect normal digital writing assistance; scores above 60% suggest further review.

All three tools share a limitation: they are probabilistic classifiers, not cryptographic verifiers. False positives happen, especially with non-native English speakers or heavily edited text. No AI detector should be treated as proof on its own.

Research framework: MarkLLM

MarkLLM is an open-source framework for experimenting with text watermark schemes (Kirchenbauer KGW, SynthID) in controlled conditions. It can generate watermarked test text and verify it with the same key. This is useful for testing whether a specific rewrite method breaks the watermark pattern, but it cannot replace verification against Anthropic’s closed key.

How to remove the watermark: tools and practice

watermarks-remover

watermarks-remover is an open-source project that automates the text rewriting process for watermark removal. It installs as a skill in Claude Code, Antigravity, or Cursor, and works by routing text through a second language model to generate a new token sequence that breaks the original statistical pattern.

The project supports multiple rewrite backends: local models via Ollama, remote APIs (DeepSeek, OpenAI-compatible endpoints), or a prompt-only mode that outputs a ready-made rewrite instruction for manual use. The skill invocation (/remove-ai-marks) runs the rewrite within the development environment.

Effectiveness depends on the rewrite strength setting and the backend model. A full paraphrase-strength pass through a capable model (Llama 3.2, DeepSeek) typically produces text that commercial AI detectors no longer flag as AI-generated.

Manual rewrite via prompt

If installing a tool is not an option, run the text through any other model with a prompt designed to break predictable token sequences:
Rewrite the text below. Restructure sentences: vary lengths, merge or split
fragments, reorder arguments within paragraphs. Replace predictable AI
transitions and filler phrases with natural wording. Preserve all facts,
numbers, and technical details without distortion. Do not add new claims.
Return only the rewritten text.

How to verify the result

The practical question is not “has the SynthID cryptographic watermark been removed?” (only Anthropic can answer that, and their API is not yet live). The practical question is: will this text pass the AI detection checks that actually matter?

The verification workflow:

1. Before rewriting: run the original Claude output through one or more commercial detectors (GPTZero, Copyleaks, Pangram). Record the AI probability score and note which sentences are flagged.
2. After rewriting: run the rewritten text through the same detectors. Compare scores. A successful rewrite should bring the AI probability below the detector’s threshold (typically under 20% on GPTZero, under the “likely human” category on Copyleaks).
3. Check flagged segments: if specific sentences still score high, those are the ones where the rewrite did not change enough word choices. Rework those segments and re-check.

This approach gives a concrete, repeatable answer. It does not guarantee that the SynthID watermark is gone at the cryptographic level, but it confirms that the text passes the same checks that publishers, educators, and reviewers actually use. In practice, a thorough rewrite that drops commercial detector scores to human-level ranges has also changed enough tokens to make the statistical watermark signature unreadable.