Anthropic’s Claude Text Watermark Sparks a Wave of Removal Tools
Anthropic has begun explaining how it will mark text generated by future Claude models so that AI involvement can be detected later. The watermark is deliberately invisible to read
Anthropic’s Claude Text Watermark Sparks a Wave of Removal Tools
Introduction
Anthropic has begun explaining how it will mark text generated by future Claude models so that AI involvement can be detected later.
The watermark is deliberately invisible to readers. It does not add a label, hidden Unicode string, tracking ID, or extra metadata to ordinary text. Instead, Claude slightly changes how it makes otherwise low-stakes word choices, creating a statistical pattern that can be checked with a secret key.
Anthropic says it is introducing the system to comply with the European Union’s AI Act transparency requirements, which became applicable on August 2, 2026.
The announcement immediately triggered pushback from some developers and professional users. Their concern is not only fully AI-generated writing. They also worry about what happens when Claude is used for translation, rewriting, summarization, or editing human-authored material.
Within days, several developers had published tools marketed as “AI watermark removers.”
The resulting debate is not simply about whether a watermark can be deleted. It is about what the mark actually proves, how robust statistical text watermarking can be, and where the legal responsibility sits when users deliberately alter AI provenance signals.
Anthropic’s Watermark Is a Statistical Pattern, Not Hidden Characters
The most important technical point is also the easiest one to misunderstand.
Claude’s new text watermark does not work by inserting invisible characters.
Anthropic says nothing extra is appended to the text. Instead, the model uses a watermarking key when it has several similarly good choices for the next word.
Imagine that Claude could naturally choose either “grey” or “overcast” in a sentence without changing the meaning.
In a normal model response, that choice may be influenced by ordinary randomness.
With watermarking enabled, the random choice is instead derived from a secret key and the preceding text. Repeating this process across many eligible word choices leaves a statistical pattern in the final passage.
A detector that knows the key can estimate how consistent the passage is with Claude’s watermarked generation process.
Anthropic says its implementation is based on the SynthID-Text approach published by Google DeepMind.
The watermark is therefore fundamentally different from:
- Invisible Unicode characters
- HTML comments
- Document properties
- EXIF fields
- C2PA metadata
- Visible image watermarks
Those mechanisms can often be removed without rewriting the underlying prose.
A statistical text watermark lives in the wording itself.
What the Claude Watermark Can—and Cannot—Prove
Anthropic is careful about the meaning of a positive detection result.
A detected watermark does not prove that Claude authored the entire document.
It only suggests that Claude was likely involved in producing some of the wording.
That distinction matters for workflows such as:
- Editing
- Rewriting
- Translation
- Summarization
- Draft polishing
- Collaborative writing
For light proofreading, Anthropic says there may be too few changed words for the watermark to register reliably.
For translation, the situation is different. Claude chooses essentially every output word, so Anthropic says translated text can carry the watermark.
Longer passages are also easier to evaluate than short passages because they contain more word-choice decisions.
Code is another special case. Exact syntax leaves fewer low-stakes choices, so code generally provides less room for watermarking than prose, although comments and discretionary naming may still carry a signal.
Why Anthropic Is Adding the Watermark
Anthropic says the change is being made to comply with the European Union’s AI Act.
Article 50 transparency obligations apply from August 2, 2026.
The European Commission’s guidance requires providers of generative AI systems to add machine-readable marks that make AI-generated or manipulated content detectable.
The accompanying Code of Practice says marking systems should be effective, interoperable, robust, and reliable as far as technically feasible.
Anthropic signed the EU Code of Practice on Transparency of AI-Generated Content along with many other organizations.
The company says it is applying the watermark globally when supported models launch because it does not currently have a durable way to restrict the marking system by geography.
Older models launched before August 2 receive a transition period, and Anthropic says watermarking will be added to them over the following months.
User Pushback Focuses on Mixed Human–AI Authorship
The announcement generated immediate controversy.
Some users are comfortable with clear disclosure when a model generates an article from scratch.
The harder cases are mixed workflows.
A professional may write the original document and then ask Claude to:
- Correct the grammar
- Rewrite a few paragraphs
- Translate the document
- Tighten the style
- Summarize research
- Reformat a proposal
A binary label such as “AI-generated” can fail to capture how much human authorship remains.
That is one reason some users objected to the idea that an invisible provenance signal could follow text into later workflows.
Anthropic itself emphasizes that the watermark is not an authorship detector.
A positive result means Claude was likely involved at some point. It does not establish whether the final text was mostly human-written, mostly AI-written, or heavily edited by both.
Watermark-Removal Tools Appeared Almost Immediately
The backlash created an obvious developer opportunity.
Several tools appeared within days of Anthropic’s announcement.
Watermarks Remover
Paris-based founder Guillaume Meyer released the open-source project Watermarks Remover.
The repository quickly became popular and had roughly 14.6K GitHub stars by August 19, 2026.
The project supports several kinds of provenance cleanup, including:
- Invisible Unicode cleanup
- File metadata removal
- C2PA-related metadata handling
- Best-effort rewriting of text
- Research-oriented watermark evaluation
Meyer said the first version took about five hours to build.
However, the project documentation includes an important disclaimer: it cannot currently guarantee that text will fail Claude’s future official watermark detector.
That is because Anthropic has not yet released the detection API or its secret key.
Sabrina Ramonov’s Browser Tool
AI educator Sabrina Ramonov also promoted a free browser-based watermark-removal utility.
The tool is marketed as being able to clean hidden AI marks from several content types, including:
- Text
- PDFs
- Word documents
- Web pages
- Images
- Data files
These categories should not be confused with one another.
Removing document metadata is technically different from weakening a statistical text watermark.
A file can be stripped of metadata while the wording inside it still retains a statistical signal.
MarkScrub
Tokyo-based developer Ansh Aneja released a Claude-focused cleaner and later published a local open-source version called MarkScrub.
Its GitHub description presents it as a CLI and agent skill for scrubbing AI provenance marks from text and files.
Aneja said an earlier version reached thousands of users within a day, although that user count was not independently verified by the reporting cited in the original article.
Why These Tools Cannot Promise 100% Removal
The phrase “watermark remover” sounds more definitive than the underlying technology allows.
For ordinary file metadata, removal can often be verified directly.
A tool can inspect a PDF, image, or DOCX file before and after processing and confirm that a particular metadata field disappeared.
Statistical text watermarks are different.
To weaken that signal, a tool generally has to change the wording.
The more aggressively it rewrites, the more likely it is to disrupt the original pattern.
But aggressive rewriting can also change:
- Tone
- Precision
- Style
- Terminology
- SEO language
- Factual nuance
The Watermarks Remover project itself describes statistical rewriting as best effort.
Until Anthropic releases a public detector, a third-party tool cannot honestly certify that its cleaned text will pass the official Claude check.
That limitation is central to evaluating every current “Claude watermark remover.”
Light Editing May Not Be Enough
Anthropic openly acknowledges that its watermark is not indestructible.
The company says light editing may leave enough of the pattern intact to remain detectable.
A complete rewrite can destroy the signal because the original token choices have been replaced.
This is not unique to Claude.
Robust text watermarking has always faced a difficult trade-off: the mark must survive ordinary edits without noticeably degrading the quality of the text, yet sufficiently extensive paraphrasing can replace the linguistic choices that carry the signal.
The stronger the rewriting attack, the less meaningful it becomes to say that the final wording is still the same generated text.
File Provenance Uses a Different Mechanism
Anthropic is also adding provenance information to supported files.
For formats such as PNG, JPEG, and SVG, the company says Claude can attach C2PA Content Credentials.
C2PA is an open provenance standard that stores cryptographically signed information about how a file was created or processed.
This is not the same as Claude’s statistical text watermark.
A useful distinction is:
| Provenance Method | Where the Signal Lives | Typical Use |
|---|---|---|
| Claude statistical text watermark | Word-selection pattern | Detecting likely Claude involvement in text |
| Invisible Unicode | Hidden characters in text | Edit-based marking schemes |
| C2PA Content Credentials | Signed file metadata | File provenance and processing history |
| Visible watermark | Pixels or rendered content | Human-visible attribution |
A tool that removes one layer does not automatically remove the others.
Anthropic Plans to Release a Detection API
Users currently cannot independently check Claude’s watermark with Anthropic’s official key.
Anthropic says it plans to release a watermark detection API.
The company has not yet published the final API design, access policy, thresholds, pricing, or rollout date.
That forthcoming detector will matter because today’s third-party tools can only test against approximations, open research implementations, or generic statistical-watermark classes.
Once the official API is available, claims about removal effectiveness can be evaluated against the actual Anthropic system rather than a substitute detector.
The EU AI Act Does Not Make the Technical Problem Disappear
The legal framework does not solve the robustness problem.
The EU transparency rules require providers to implement machine-readable marking and require certain deployers to disclose AI-generated or manipulated content in specified situations.
The Commission’s Code of Practice also expects provider-side techniques to be robust and reliable as far as technically feasible.
But the existence of a legal requirement does not mean the signal will survive every transformation.
Rewriting, translation, re-encoding, screenshots, metadata stripping, and other content transformations can all affect provenance mechanisms differently.
The regulations therefore create an incentive for stronger marking and detection, while attackers and tool developers have an incentive to find transformations that weaken those signals.
That is why watermarking is likely to remain an ongoing technical contest rather than a one-time feature launch.
Is Removing an AI Watermark Illegal?
There is no simple universal answer.
The EU AI Act provisions discussed here primarily define transparency obligations for providers and certain deployers. They do not amount to a general statement that every end user is categorically forbidden from editing marked content.
However, the purpose of the editing matters.
Removing provenance for benign document hygiene is different from deliberately misrepresenting synthetic content in a context where disclosure is legally, contractually, academically, or professionally required.
Other rules may also apply, including:
- Platform terms
- Employment policies
- School policies
- Publishing rules
- Contractual disclosure requirements
- Fraud or misrepresentation law
- Sector-specific regulation
Anyone dealing with regulated or high-stakes content should treat watermark removal as a compliance question, not merely a technical one.
What the Debate Really Exposes
The controversy reveals a deeper problem with AI authorship.
Most modern knowledge work is no longer cleanly divided into “human-written” and “AI-written.”
A document can begin as a human draft, be translated by Claude, edited by a colleague, summarized by another model, and then rewritten again by the original author.
A watermark can indicate model involvement.
It cannot explain the entire creative history.
That does not make watermarking useless.
It makes provenance one signal among several.
Good disclosure systems may eventually need to combine:
- Statistical text marks
- File credentials
- Platform-level disclosure
- Editing history
- Human declarations
- Context-specific policies
The current conflict over removal tools is therefore partly a technical argument and partly an argument over what AI provenance should mean in mixed-authorship workflows.
常见问题
What is Claude’s invisible text watermark?
Claude’s text watermark is a statistical pattern created through otherwise low-stakes word-selection decisions during generation. Anthropic says no hidden characters are added to the text.
Does Claude add invisible Unicode characters to watermarked text?
Anthropic says its new statistical text watermark does not rely on hidden characters. Some third-party cleanup tools remove invisible Unicode because other provenance schemes can use it, but that is a different mechanism.
Can Claude’s watermark survive copy and paste?
Yes. Because the signal is carried by the wording itself rather than file metadata, ordinary copy and paste does not remove it.
Can a watermark remover guarantee that Claude’s watermark is gone?
Not currently. Anthropic has not yet released its official detection API, so third-party tools cannot conclusively prove that processed text will fail Anthropic’s detector.
Does proofreading human-written text add a Claude watermark?
Anthropic says light proofreading may create too few changed word choices for reliable detection. Heavier rewriting creates more opportunities for the watermark to appear.
Are Claude translations watermarked?
Yes. Anthropic says translated output can carry the watermark because Claude chooses the words in the translated text.
Is C2PA the same as Claude’s text watermark?
No. C2PA stores signed provenance information in supported file metadata, while Claude’s text watermark is a statistical pattern in the wording.
Is removing an AI watermark illegal under the EU AI Act?
The AI Act establishes transparency duties for providers and certain deployers, but the legal effect of removing a mark depends on context and purpose. Misrepresenting AI-generated material can still create contractual, platform, professional, or legal problems even where watermark removal itself is not separately prohibited.
相关工具
- Anthropic Claude: Anthropic’s consumer AI assistant where future supported models will use the new text-marking approach.
- Watermarks Remover: An MIT-licensed open-source toolkit for inspecting and cleaning multiple classes of AI provenance signals.
- MarkScrub: A local CLI and agent skill for inspecting and cleaning AI provenance marks from text and files.
- C2PA: The open provenance standard Anthropic uses for Content Credentials in supported files.
- SynthID-Text: Google DeepMind’s open research implementation of statistical text watermarking.
Related Links
- Anthropic: How Claude’s Text Watermark Works: Anthropic’s official explanation of the statistical watermark, limitations, translations, code, and planned detector API.
- EU AI Act Transparency Guidelines: European Commission guidance on Article 50 transparency duties for AI providers and deployers.
- EU Code of Practice on AI-Generated Content: The voluntary compliance framework covering machine-readable marking and disclosure.
- Watermarks Remover GitHub Repository: Source code, documentation, limitations, and licensing for Guillaume Meyer’s project.
- MarkScrub GitHub Repository: Ansh Aneja’s local open-source provenance-cleaning project.
- C2PA Specification and Resources: Official information about Content Credentials and cryptographically signed media provenance.
- SynthID-Text Research Repository: Reference implementation and research materials for the watermarking family Anthropic says it uses.
Summary
Anthropic’s new Claude text watermark does not hide extra characters in a document. It changes the statistical pattern of word selection so that a detector with the correct key can estimate whether Claude was involved in generating the text.
The announcement quickly produced a new category of watermark-removal tools. These projects can reliably clean some forms of metadata and invisible characters, but weakening Claude’s statistical watermark requires rewriting, and no third-party tool can currently prove that the official Anthropic detector will fail.
The EU AI Act is pushing providers toward more robust provenance systems, while users and developers are testing how easily those signals can be altered. The result is likely to be an ongoing contest between marking, detection, editing, and disclosure.
The key distinction is simple: a Claude watermark is evidence of likely model involvement, not proof of complete AI authorship—and removing provenance does not automatically remove the obligation to disclose AI use where rules require it.