Whether you can remove Claude's watermark depends entirely on which method you pick, and the honest answer exists only because someone ran the experiment instead of guessing. Kirill Balakhonov reproduced Google DeepMind's published SynthID Text algorithm from scratch, generated a controlled corpus of marked and clean text pairs, and tested five removal methods against a detector built from the same scheme. Two of the five removed the mark. Only one of those two left the text usable, and it was not the tool built for the job.
Key takeaways
- A full paraphrase by an unmarked model cleared all ten test texts and kept all 100 pre-registered facts.
- DIPPER, built specifically for this, also cleared all ten and altered 23 of the 100 facts.
- Neither round trip translation cleared a single text, which is the opposite of the common assumption.
- Whatever phrasing survives a rewrite, the watermark survives inside it.
Why Testing How to Remove Claude's Watermark Needed a Simulation#
Anthropic has not released its production key or a public detector, so nobody outside the company can test removal against the real thing. According to Balakhonov (2026), the workable alternative was to model the mechanism honestly rather than approximate it.
Using the reference SynthID Text implementation, he generated ten fictional reports of 500 to 600 words with a Qwen2.5-14B model on a rented A40, applied his own key, and produced matched clean and marked pairs from identical prompts and seeds. That design is what makes the comparison meaningful, because every method could be measured against a known ground truth instead of a guess. The detector found the mark in all ten marked texts and in none of the clean ones.
Two early mistakes shaped the final method, and both are easy to repeat. A first corpus built with a much smaller model produced broken, repetitive text that the rewriter copied verbatim in places, which inflated how much signal appeared to survive and nearly produced the conclusion that no remover was possible. A first panel of AI judges, shown five candidate rewrites of one document in a single prompt, cross-contaminated its own scoring and attributed one method's errors to another. Both were caught and fixed, including a full rerun of all 200 judged comparisons one at a time. The corpus, prompts and judge decisions are published, which is why these numbers are worth more than the confident claims circulating alongside them.
The Five Methods, Head to Head#
Ten texts went through each of five treatments. Light synonym replacement, a full paraphrase, a round trip through German, a round trip through Chinese, and DIPPER, an 11 billion parameter paraphrase model built specifically to evade watermark detectors.
| Method | Mark removed | Facts preserved | Usability | Overall |
|---|---|---|---|---|
| Light synonym edits | 20% | 100% | 98% | 49.6% |
| Full paraphrase | 100% | 100% | 98% | 93.6% |
| Round trip via German | 0% | 98% | 97% | 63.2% |
| Round trip via Chinese | 0% | 87% | 83% | 61.6% |
| DIPPER | 100% | 77% | 73% | 71.0% |
Table: results across ten texts per method. The overall score is the worst of four measures per text, averaged across ten texts, so a method that removes the mark and wrecks the facts scores badly. Those four measures are share of signal removed, facts preserved, readability and usability, which is why a method can clear zero of ten texts and still score above 60 percent by having stripped most of the signal. Source: Kirill Balakhonov, 22 August 2026.
Facts were scored against 100 pre-registered claims, ten per document, covering names, dates, quantities, causal links and recommendations. Four models from four different companies judged every result blind, and a claim counted as preserved only when at least three agreed. Each judge first passed a canary test on an identical text, a text with five corrupted facts, and an empty text.
The Result Nobody Expected#
The surprise was not that paraphrase beats translation. It is how completely translation failed. Neither the German nor the Chinese round trip removed the mark from a single one of the ten texts.
The explanation runs against the common assumption. Translating text away and back restores the same familiar English phrasing that was there in the first place, because there are only so many natural ways to say a given thing. In this test, 45 percent of five word sequences in the German output matched the original exactly, and 36 percent for Chinese, so the original word choice came back and the mark came back inside it. A full paraphrase left under 10 percent of such sequences.
A plain full paraphrase, run through a model that does not apply its own watermark, removed the mark from all ten texts and kept all 100 pre-registered claims intact. DIPPER, validated in December 2024 work from Martin Vechev's group at ETH Zurich, also removed the mark from all ten, and it charged for the privilege.
Removing the Mark Is the Easy Half#
DIPPER altered 23 of the 100 verifiable claims, close to one in four, and the judges rated the usability of its output at 73 percent. The manual review afterwards found a consistent pattern in what breaks and in what order.
Numbers and dates drift first. DIPPER turned a tablet cost of about $7,500 into $7,000 and turned "nearly 85%" into a falsely precise 84.9 percent. Names and roles shift next, with a middle school becoming a high school after the Chinese round trip and a head librarian becoming a library director after the German one. Cause and effect get scrambled last and least visibly, with DIPPER attributing a 40 percent saving to renting radio equipment when the source was about maintaining audio guides.
None of this shows up if the only check is whether a detector still fires. It shows up when someone compares the rewrite against the source claim by claim, which is the part almost nobody does. It is the same failure mode described in our piece on AI hallucination, where a fluent output saying something slightly different is harder to catch than an obviously broken one.
Worth naming here is a trap that most removal advice misses entirely. The rewriting model matters. Paraphrase marked text with a model that also applies a watermark, and you have washed one mark off and stamped a fresh one on. The clean option is a model that marks nothing, which today includes open weight models of the kind covered in our guide to free local AI models.
What This Does and Does Not Prove#
This is a test of the published SynthID Text algorithm with a reference key, on ten fictional reports in one length range. It is not a test of Anthropic's production detector, which nobody outside the company can run. Ten out of ten describes this sample and nothing wider.
What it does show is that the mechanism Anthropic has confirmed it uses cannot resist a full rewrite by an unrelated model. The mark lives entirely in specific word choices, so once those choices come from a different process, there is nothing left for the original key to recognise. That is a property of the design rather than a flaw in the implementation, and it is why what a detected mark proves was always going to be a narrower claim than the coverage suggested. The most sophisticated tool in the test lost a quarter of the facts. The simplest one lost none.
Common questions#
Does light editing remove the mark?
Rarely. Light synonym edits cleared two texts out of ten in this test, and Anthropic's own wording is that a mark may persist through some editing.
Does the model doing the rewriting matter?
Yes, and it is the step most removal advice misses. Paraphrasing with a model that also applies a watermark washes one mark off and stamps a fresh one on in the same pass.
Do these results apply to Anthropic's real watermark?
Not directly. The test reproduces the published SynthID Text scheme with the researcher's own key, because Anthropic's production key and detector are both private. What it shows is a property of the design rather than a measurement of the deployed system.
Sources#
- An affordable AI text watermark remover (Kirill Balakhonov, 22 Aug 2026)
- Corpus, code, prompts and judge decisions (GitHub)
- Probing Google DeepMind's SynthID-Text Watermark (SRI Lab, ETH Zurich)
- Paraphrasing evades detectors of AI-generated text (Krishna and others, DIPPER, 2023)
- A Watermark for Large Language Models (Kirchenbauer and others, 2023)
- Scalable watermarking for identifying large language model outputs (Nature, 2024)
- How Claude's text watermark works (Anthropic, 14 Aug 2026, updated 1 Sep 2026)
Last reviewed: 3 September 2026. Every figure here comes from a simulation of the published scheme with the researcher's own key, on a ten-document corpus. Nothing in it has been verified against Anthropic's production watermark, and it cannot be until the detection API opens. Re-checked quarterly.