--- title: Anthropic's Claude watermark, and why the 'removal... description: Anthropic began invisibly watermarking Claude's text output to comply with the EU AI Act's Article 50 disclosure rules, embedding a statistical bias in token... canonical: https://daily.dev/posts/anthropic-s-claude-watermark-and-why-the-removal-tools-popping-up-are-mostly-snake-oil-q2dsoophl twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Anthropic's Claude watermark, and why the 'removal tools' popping up are mostly snake oil | daily.dev og:description: Anthropic began invisibly watermarking Claude's text output to comply with the EU AI Act's Article 50 disclosure rules, embedding a statistical bias in token... og:url: https://daily.dev/posts/anthropic-s-claude-watermark-and-why-the-removal-tools-popping-up-are-mostly-snake-oil-q2dsoophl og:image: https://api.daily.dev/og/posts/q2dsOoPHL.png og:image:alt: Anthropic's Claude watermark, and why the 'removal tools' popping up are mostly snake oil og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Anthropic's Claude watermark, and why the 'removal tools' popping up are mostly snake oil **[Collections](https://daily.dev/sources/collections)** · 5 min read · 4 upvotes · 0 comments ## Summary Anthropic began invisibly watermarking Claude's text output to comply with the EU AI Act's Article 50 disclosure rules, embedding a statistical bias in token choices rather than file metadata. A wave of 'watermark removal' tools has emerged in response, including a popular open source project with 4,500+ GitHub stars and paid services like StealthGPT and Human Writes, but none can be independently verified since Anthropic hasn't published a detector or technical details. These tools mostly strip superficial metadata (C2PA, EXIF, hidden Unicode) rather than the actual statistical watermark, which only a full rewrite through a second model can destroy - and even the leading tool's author admits that capability doesn't work yet. The bigger concern raised is that these unaudited removal tools are being wired into agent pipelines handling sensitive documents, creating risk from unverifiable claims on both sides of the AI-detection arms race. ## Content Anthropic started invisibly watermarking Claude's text output to comply with the EU AI Act's Article 50 transparency rules. Within days, developers had already built tools to remove it. I think that timeline alone tells you most of what you need to know about how this is going to play out. ## How the watermark actually works The technique isn't new. It's based on the same family of approaches as Google DeepMind's SynthID-Text and the Kirchenbauer et al. "green/red token" scheme. At each position in the generated text, a secret key combined with the previous token biases which of the near-equally scoring candidate words gets picked. Do this enough times and you get a statistical pattern that a detector holding the key can spot, without the output looking any different to a human reader. A few things follow from that design: - It doesn't degrade quality, because the model is choosing between words that were already close contenders. - It requires no retraining. It happens at inference time, swapping one pseudo-random sampler for a different pseudo-random one. - Code carries almost no watermark, since correctness limits how much freedom there is in word choice. - Light paraphrasing dilutes the signal but doesn't erase it — Anthropic says it should survive minor edits, and one technical breakdown notes the mark is typically recoverable after roughly 800 tokens even with paraphrasing. Full meaning-based rewriting by a second model, though, does erase it, since the evidence depends on intact runs of the original wording. Anthropic based its approach on Google DeepMind's SynthID-Text method and says it plans to release a detection API. Google has watermarked Gemini's app and web output since 2024. Anthropic started marking new Claude models in August 2026. Neither company has released a public detector people can actually test against, which is the part that makes everything downstream so murky. ## The removal tools showed up almost immediately Guillaume Meyer's open-source Watermarks Remover passed 14,000 GitHub stars. Other tools — Sabrina Ramonov's browser-based cleaner, Ansh Aneja's MarkScrub, and various paid AI-detection-evasion services like StealthGPT and Human Writes — arrived within the same window. One widely shared open-source project (MIT licensed, distributed as Python scripts and as an "AI agent skill" you can trigger with `/remove-ai-marks`) operates on three levels: 1. **Deterministic text cleaning** — strips invisible Unicode characters: zero-width spaces, bidi control characters, tag characters, homoglyph spaces. 2. **Statistical watermark evasion** — generates multiple rewrites and keeps whichever one has the greatest lexical distance from the original. 3. **File metadata cleanup** — removes C2PA, EXIF, and XMP manifests from images and documents (PNG, JPEG, SVG, PDF, DOCX, ODT, HTML, Markdown). Here's the thing though: the deterministic cleaning and metadata stripping genuinely work, because those are simple, verifiable operations. Hidden Unicode characters and EXIF tags either exist in the file or they don't. But the actual watermark — the one baked into word-choice probabilities — is a different beast entirely, and the tool's own author admits the rephrasing approach doesn't reliably work yet. The README is refreshingly honest about this: until vendors release public detectors and keys, no tool can guarantee content will pass a watermark check. There's no ground truth to test against. An independent code review of one popular cleaner found it failed to strip a common hidden-payload technique entirely. So even the "easy" layer isn't uniformly solved. ## Nobody can actually verify these claims This is the part that bugs me. Anthropic hasn't published a detector or technical documentation, so there's no way to check whether any removal tool does what it says. Paid services market themselves as reliable AI-detection evasion with zero independent verification behind the claim. You're trusting vendor marketing copy for a market that's already sizable and growing fast — the EU AI Act's compliance requirements alone touch a market Techdirt estimated at sixty billion dollars. And there's a supply-chain angle that's easy to miss in all the watermark discourse: these removal tools are getting wired directly into agent pipelines and fed sensitive documents, often built on unaudited code from repos that went viral over a weekend. That's a real risk sitting underneath a debate that's mostly framed as being about detection and free expression. ## Is this even a big deal? Depends who you ask, and the disagreement itself is revealing. One argument says no: the watermark doesn't degrade quality, doesn't make AI text meaningfully more detectable than it already is through style cues or tools like Pangram, and doesn't encode personal data — it's just a probabilistic single-bit signal. Under this view, every major AI lab will adopt some form of watermarking this year, because Article 50 requires AI outputs to be detectable as artificially generated, and opting out effectively means exiting the EU market. Anthropic says other labs that signed the same Code of Practice will implement similar schemes. So the whole thing normalizes fast and stops being interesting. Anthropic's official line, quoted in one thread, is that ## Questions this post answers ### How does Anthropic's Claude watermark actually work? It embeds a statistical signal directly into word choices during text generation rather than attaching file metadata, live as of August 2026. The scheme is undisclosed, but works similarly in spirit to Kirchenbauer et al.'s green/red token list approach or Google SynthID's tournament-based method, biasing the model toward certain tokens so the resulting skew is detectable by statistical analysis even though the text reads normally. _Track how AI vendors handle watermarking and disclosure requirements as they evolve, right on daily.dev._ ### Can watermark removal tools actually strip AI text watermarks like Claude's? Mostly no. These tools can reliably strip superficial layers like hidden Unicode characters and file metadata (C2PA, EXIF, XMP), but that has nothing to do with the actual statistical watermark embedded in word choice. Only a full meaning-preserving rewrite through a second model destroys the real signal, and even the leading removal tool's own author has admitted that capability doesn't work yet. _Developers evaluating AI-detection tooling can follow verified takes on daily.dev before trusting vendor claims._ ### Does paraphrasing remove an AI text watermark? Light paraphrasing dilutes the watermark signal but usually doesn't erase it, since the statistical evidence depends on chunks of original wording surviving intact; runs of 800+ tokens of intact text can still show a detectable skew. Only a full rewrite that changes the wording entirely, done through a second model, leaves nothing left for the watermark detector to find. _Keep up with how AI content-detection methods hold up under real-world editing on daily.dev._ ## Community take How the wider developer community reacted, aggregated from 1 discussion across lobsters (as of 2026-08-20). **TL;DR:** There isn't enough discussion content provided to characterize what the community thinks about this explainer. **Sentiment:** 0% positive · 100% mixed · 0% skeptical **By community** - lobsters (mixed): No substantive comments were available to gauge reaction beyond a single point registered on the story. **Source threads** - [lobsters](https://lobste.rs/s/5odlru/how_ai_text_watermarking_works_visual) · 1 points · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#llm](https://daily.dev/tags/llm), [#claude](https://daily.dev/tags/claude) [View this post on daily.dev](https://daily.dev/posts/anthropic-s-claude-watermark-and-why-the-removal-tools-popping-up-are-mostly-snake-oil-q2dsoophl) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Anthropic's Claude watermark, and why the 'removal tools' popping up are mostly snake oil","url":"https://daily.dev/posts/anthropic-s-claude-watermark-and-why-the-removal-tools-popping-up-are-mostly-snake-oil-q2dsoophl","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/anthropic-s-claude-watermark-and-why-the-removal-tools-popping-up-are-mostly-snake-oil-q2dsoophl"},"datePublished":"2026-08-14T00:48:57.635Z","dateModified":"2026-08-20T03:32:19.250Z","description":"Anthropic began invisibly watermarking Claude's text output to comply with the EU AI Act's Article 50 disclosure rules, embedding a statistical bias in token...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/12b34c4a61b192402a244a6f30d6e170?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/12b34c4a61b192402a244a6f30d6e170?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/anthropic-s-claude-watermark-and-why-the-removal-tools-popping-up-are-mostly-snake-oil-q2dsoophl","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":4},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,llm,claude","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Anthropic's Claude watermark, and why the 'removal tools' popping up are mostly snake oil"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/anthropic-s-claude-watermark-and-why-the-removal-tools-popping-up-are-mostly-snake-oil-q2dsoophl#faq","mainEntity":[{"@type":"Question","name":"How does Anthropic's Claude watermark actually work?","acceptedAnswer":{"@type":"Answer","text":"It embeds a statistical signal directly into word choices during text generation rather than attaching file metadata, live as of August 2026. The scheme is undisclosed, but works similarly in spirit to Kirchenbauer et al.'s green/red token list approach or Google SynthID's tournament-based method, biasing the model toward certain tokens so the resulting skew is detectable by statistical analysis even though the text reads normally. Track how AI vendors handle watermarking and disclosure requirements as they evolve, right on daily.dev."}},{"@type":"Question","name":"Can watermark removal tools actually strip AI text watermarks like Claude's?","acceptedAnswer":{"@type":"Answer","text":"Mostly no. These tools can reliably strip superficial layers like hidden Unicode characters and file metadata (C2PA, EXIF, XMP), but that has nothing to do with the actual statistical watermark embedded in word choice. Only a full meaning-preserving rewrite through a second model destroys the real signal, and even the leading removal tool's own author has admitted that capability doesn't work yet. Developers evaluating AI-detection tooling can follow verified takes on daily.dev before trusting vendor claims."}},{"@type":"Question","name":"Does paraphrasing remove an AI text watermark?","acceptedAnswer":{"@type":"Answer","text":"Light paraphrasing dilutes the watermark signal but usually doesn't erase it, since the statistical evidence depends on chunks of original wording surviving intact; runs of 800+ tokens of intact text can still show a detectable skew. Only a full rewrite that changes the wording entirely, done through a second model, leaves nothing left for the watermark detector to find. Keep up with how AI content-detection methods hold up under real-world editing on daily.dev."}}]} ```