What is a text watermark?
A text watermark is a deliberate, machine-detectable signal embedded in generated text to mark where it came from. Unlike an image watermark, it has to survive in plain characters — so every scheme in existence falls into one of two families, and the difference between them decides everything about detection and removal.
1. Character-level marks
Special Unicode characters hidden in the text itself: narrow no-break spaces (U+202F), zero-width characters (U+200B), tag characters (U+E0000–U+E007F), variation selectors. They travel with copy-paste, are trivially detectable in the bytes — and are deterministically removable.
2. Statistical watermarks
No characters are added. The model's word choices are subtly biased with a secret key, so the text itself carries a statistical signature only the key holder can test for. Character cleaning cannot touch this layer; only heavy rewording or translation degrades it.
Character-level watermarks and artifacts
The canonical episode is dated precisely. On April 16, 2025, OpenAI launched o3 and o4-mini. Within days, the academia startup Rumi reported that these models were embedding narrow no-break spaces (U+202F) where ordinary spaces belong in longer outputs like essays — a pattern absent from their GPT-4o tests, and removable with find-and-replace. OpenAI told Rumi the characters were not a watermark but "a quirk of large-scale reinforcement learning," and by late April they were gone from output. Whatever the intent, the episode proved the point: hidden characters do appear in AI text, they can fingerprint it, and knowing how to remove ChatGPT watermark characters is basic hygiene.
The same character layer supports true steganography. Unicode tag characters (U+E0000–U+E007F) encode an invisible copy of ASCII, and variation selectors (U+FE00–U+FE0F, U+E0100–U+E01EF) offer 256 invisible values — one hidden byte after any visible character, as Paul Butler demonstrated in his February 2025 post "Smuggling arbitrary data through an emoji". Anyone — a model vendor, a paste site, a colleague — could tag text this way, which is why a transparent character-level report matters. The complete invisible-characters list covers every code point in this layer, including the security research on each.
Statistical watermarks: SynthID-Text and Claude
A statistical watermark adds nothing to the text — it changes how the text is written. Google DeepMind's SynthID-Text, published in Nature in October 2024 (Nature 634:818–823), works by "tournament sampling": as the model picks each next word, candidate words compete in small tournaments scored by a function seeded with a secret key, and the winner is chosen. Repeated over a full answer, the output subtly prefers tournament-winning words — a signature invisible to readers but testable by anyone holding the key. Google live-tested it on roughly 20 million Gemini responses, has deployed it in Gemini since 2024, and open-sourced the scheme.
As of August 2026, Claude is watermarked the same way. On August 11, 2026, Anthropic announced that Claude models launched on or after August 2, 2026 embed a SynthID-Text-style statistical watermark in generated text, worldwide — plus C2PA provenance metadata for generated files, with a third-party detection API planned (TechCrunch, August 11, 2026). Anthropic is explicit that no Unicode characters are embedded, that detection needs longer samples, and that heavy editing or paraphrasing strips the mark.
OpenAI, meanwhile, built one and shelved it. The Wall Street Journal reported on August 4, 2024 that OpenAI had held back a ChatGPT text watermarker it judged about 99.9% effective, after roughly two years of internal debate — nearly 30% of surveyed users said they would use ChatGPT less. In its own explainer, OpenAI calls circumvention "trivial," naming translation, rewording, and even "asking the model to insert a special character in between every word and then deleting that character."
Why is everyone watermarking now? The EU AI Act
Because since August 2, 2026, EU law requires it. Article 50(2) of the EU AI Act obliges providers of generative AI systems to ensure outputs are "marked in a machine-readable format and detectable as artificially generated." The obligation took effect on August 2, 2026; under the May 2026 provisional agreement, systems already on the market get a grace period until December 2, 2026. Non-compliance carries fines of up to €15 million or 3% of worldwide turnover. Anthropic's August 2026 watermark launch, nine days after the deadline, is the clearest sign of where the industry is heading: statistical marking as the default, with character-level tricks explicitly avoided.
Can you remove a text watermark?
Honest answer: it depends entirely on which layer the mark lives in.
Character-level: yes
Hidden Unicode is deterministic data, so removal is deterministic too. The AI text cleaner strips special spaces, zero-width characters, tag characters, and directional controls in your browser and names every character it found by code point — your visible wording stays byte-for-byte identical.
Statistical: no character tool can
SynthID-style marks are the word choices. No character cleaner — ours included — can remove them, and any tool claiming otherwise is misleading you. They degrade only under substantial rewording or translation, and short or fact-constrained text barely holds a mark in the first place.
Transparency-first cleaning still matters in the statistical era: it strips the trackable character layer (privacy), makes AI text behave like typed text in editors and CMSs (hygiene), and — because it shows you exactly which characters were found — tells you the truth about what is and is not in your text. For the layers of baggage that actually ride along in AI output, beyond the watermark question, see what's inside AI text.