Statistical Watermark in AI Text

A statistical watermark is not a character. It is a pattern in which words a model chose while it was writing — invisible on the page, and by definition impossible to reach by editing text without rewriting it word for word. That is a very different claim from "invisible characters," which the cleaner below removes in one click, and mixing the two up is how a text-cleaning tool ends up promising something it cannot do. Below: what a statistical watermark actually is, which of the major AI providers have one live today and since when, how well it survives being edited according to independent research, and exactly where this page's own tool stops.

The cleaner runs in your browser — nothing you paste is uploaded, and there is no account or daily limit. Rewrite is the one exception: it sends your text to our server to change the wording, which the section below explains in full.

How the cleaner works

1. Paste text in the box above. Nothing uploads — the scan runs the moment you stop typing, entirely on your own machine.
2. See exactly what is inside. A running total and a table name every invisible or typographic character found, and the preview shows each one in place as its code point so you can see where it sits.
3. Clean it, then copy the result. Press Clean text and the box is replaced by a version that gets checked again on its own output, not just counted once on the input — that second pass is what "verified clean" actually means here.

What "statistical watermark" actually means

People use "AI watermark" for two very different things, and almost every explanation of the term blurs them together. The first is a byproduct: a model trained on professionally typeset text picks up characters a person rarely types by hand — an em dash, a curly quote, an occasional non-breaking space. That is a writing habit, not a watermark, and it is exactly what the invisible characters this site's cleaner removes come from. The second is a genuine statistical watermark: a pattern in which words a model selects, not which characters it uses, invisible to a reader but recoverable by whoever holds the detection key.

A statistical text watermark is added during generation, not afterwards. The model scores several candidate next-words with a function only the watermark's owner knows, and consistently leans toward one candidate over other, equally fluent choices. Repeated across a whole reply, that lean becomes a measurable statistical signal — but no single word, sentence or character carries it on its own, which is exactly why it survives things that would destroy a hidden character: reformatting, copy-pasting, even translation to a point.

Who has actually turned one on, and since when

Of the three largest text providers, only one has published how its watermark works.

Google's SynthID Text is the one with an actual technical paper behind it: candidate tokens are scored in rounds the researchers call "tournament sampling," and the winning token is emitted with no extra character attached. It has run live in the Gemini app and on the web since May 2024, was described in a Nature paper, and the reference implementation has been open source under Apache 2.0 since October 2024 — see also Google's own SynthID documentation.

Anthropic has marked Claude's output the same way — statistically, not with visible characters — since 2 August 2026, across the Claude app, the API, Claude Code and its other surfaces, to comply with the EU AI Act's Code of Practice on Transparency. Anthropic's own explanation confirms the mark exists and warns that detection can fail on text that has been heavily edited, translated or mixed with other writing — but it does not publish the mechanism itself. That means it cannot honestly be described as "the same as SynthID," only as addressing the same regulatory requirement; only Anthropic knows whether the underlying method matches.

OpenAI applies nothing of the kind to text. Checked directly on OpenAI's own content-provenance page on 10 September 2026, the documented coverage is SynthID plus C2PA for images (since 19 May 2026) and for audio (since 31 July 2026) — text is not listed. OpenAI is reported to have built a working cryptographic text watermark years ago and never switched it on, reportedly because it measurably hurt quality for other languages and penalised non-native writers (interview, ex-OpenAI safety team).

How well it survives being edited — independently measured

The robustness numbers worth trusting are the ones nobody selling the watermark produced. Independent researchers testing SynthID Text found that a single paraphrase pass — running the watermarked text back through another model to reword it — dropped the true-positive detection rate from 0.998 on clean, unedited text to 0.498 on the paraphrased version (arXiv:2508.20228). Read that plainly: paraphrasing roughly halves the odds a detector correctly flags the text, but it does not erase them. That is a real weakening, not a removal, and it only happens because paraphrasing changes the actual words — the exact thing a character cleaner, ours included, never touches.

Why "strip the watermark" quietly changes its subject

A pattern shows up across text-cleaning tools generally: a feature promises to remove "the statistical watermark," described in one short line next to a list of characters it also removes. Read closely, and what that feature actually does is scan and delete Unicode characters — exactly the invisible and typographic set this page's own cleaner catches. A statistical watermark is not one of those characters. It cannot be, by how it is built: it is distributed across a model's word choices at the moment of generation, and nothing about deleting a zero-width space or straightening a curly quote touches word choice at all. A tool that lists "strip statistical watermarks" as a feature next to a character count is describing what it does to characters while letting the reader assume it reaches something else — the word choice a detector actually looks at.

This is not a small technicality. It is the entire gap between the two kinds of "AI watermark" explained above: one is a character, removable by any competent cleaner; the other is a statistic over an entire reply, removable only by changing enough of the words that the statistic itself stops holding — which is rewriting, a different and much bigger action than cleaning. Nobody has published a character-level trick that reaches the second kind, because none exists.

What this means for a tool like ours

The honest version of this page's own claim is narrow on purpose. The cleaner above finds and removes named invisible and typographic characters — the paste-debris kind of "AI watermark" — and then checks its own output to prove none of them are left, rather than just reporting a count from before it ran. It does not touch a single word. The separate Rewrite button does change your wording, using a language model on our server, and independent research above shows that kind of rewriting is the only thing that measurably weakens a statistical watermark — from 0.998 down to 0.498, not to zero, and only because it changes words, which the cleaner deliberately never does on its own.

Questions

Related tools

Same cleaner behind every page here — the same named characters, the same button. This one only explains the kind of watermark none of them touch.

• Clean text — the main tool, with the full list of everything it removes.
• Invisible characters, explained — the character kind of "AI watermark," named and counted.
• AI watermark checker — see what's hiding in a piece of text before you decide to clean it.
• ChatGPT watermark remover for text copied out of ChatGPT.
• Claude watermark remover for text copied out of Claude.
• Gemini watermark remover for text copied out of Gemini.
• Pricing — what stays free and what a pass adds, and who builds this.