How AI text watermarks work—and what “removed” can mean.

1. Literal Unicode channels

Zero-width characters, Unicode Tags, variation selectors, unusual spacing, bidirectional controls, and lookalike characters can encode information without an obvious visual change. They are inspectable directly from code points, but context matters: the same joiner or selector may be necessary for emoji, Persian, Arabic, Indic scripts, or ideographic variation.

dewatermark uses a versioned contextual safe policy. Lossy compatibility folding and cross-script confusable replacement stay behind a separate aggressive profile.

2. Green-list statistical watermarks

KGW-style methods bias generation toward a pseudorandom “green” subset of model tokens determined by prior context. A compatible detector reconstructs those subsets and tests whether the green-token count is unexpectedly high. Unigram variants use a fixed partition. Detection depends on the exact tokenizer, key, seeding rule, threshold, and effective number of scored tokens.

Primary sources: Kirchenbauer et al., A Watermark for Large Language Models and Zhao et al., Provable Robust Watermarking for AI-Generated Text.

3. Distortion-free and tournament schemes

Other schemes change sampling using keyed random variables while preserving the target distribution under stated assumptions. SynthID Text uses tournament-based sampling and a learned or Bayesian detector in its published reference stack. This project can seal one exact operator-controlled public-research configuration and expose numeric contribution ranges, but that does not reveal a private production key or prove equivalence to any product surface.

Primary sources: Kuditipudi et al., Robust Distortion-free Watermarks for Language Models and the Google DeepMind SynthID Text reference repository.

4. Semantic and retrieval provenance

Semantic schemes can bind signals to sentence meaning rather than literal characters or a simple token partition. Retrieval provenance can compare submitted text with a provider-held generation corpus. Rephrasing may change a detector score, but provider-held history is not stored in the text and cannot be “removed” from it.

A package should report these as separate threat models rather than implying that Unicode deletion, paraphrasing, and provider-side provenance are interchangeable.

Primary semantic-watermark sources: Hou et al., SemStamp and Liu et al., A Semantic Invariant Robust Watermark for Large Language Models.

5. Private provider schemes

Anthropic describes marking for supported Claude models as a version of SynthID-Text and says detector guidance is forthcoming. Until the deployed configuration, keys, calibrated thresholds, and a compatible detector contract are public, an independent tool cannot substantiate a Claude-removal result. The detection outcome is unsupported; capability metadata records status unsupported_pending_spec.

Provider statement: Claude and text watermarking.

A credible mitigation benchmark

1. Use disjoint calibration, development, and final-test populations.
2. Pair watermarked outputs with same-generator unwatermarked controls and independently sourced human controls.
3. Pre-register keys, thresholds, attacks, prompts, languages, tasks, and detector-token length bins.
4. Keep failures, detector errors, quality rejections, and abstentions in the denominator.
5. Report source and candidate TPR at fixed empirical FPRs with confidence intervals, plus false insertion and cross-detector confusion.
6. Require semantic, factual, entity, number, citation, structure, and task-specific preservation—not generic similarity alone.
7. Publish content-addressed manifests, aggregate no-text score tables, resource telemetry, and an independent replication record.

Benchmark context: WaterBench (ACL 2024) and the repository's DewatermarkBench protocol.

Rewrite-attack sources: Hwang et al., LLM Watermark Evasion via Bias Inversion (BIRA) and Cheng et al., Self-Information Rewrite Attacks (SIRA). The package contains approximations, not the authors' reference implementations or published efficacy results.

The practical rule

A string is not universally “watermark free.” The strongest defensible result is narrower: a named compatible detector was positive on the source, clear at its frozen decision boundary on the candidate, all required quality checks passed, and the evidence can be reproduced from a content-addressed manifest.