Why Unicode Cleaners Do Not Remove Claude Watermarks

Unicode cleaners strip invisible characters — zero-width spaces, soft hyphens, directional marks, non-breaking spaces. That is genuinely useful. It is also, for Claude's watermark, the wrong layer entirely.

Anthropic's announcement is unambiguous on the point: nothing is added to the text and there are no hidden characters. The watermark lives in which words were chosen, not in anything sitting between them.

What a Unicode cleaner actually does

Text you copy out of a chat interface, a PDF or a word processor often carries characters you cannot see. Zero-width joiners left behind by emoji sequences. Non-breaking spaces from a web page. Smart quotes and en dashes that a plain-text pipeline chokes on. Occasionally a genuine tracking marker inserted by some tool in the chain.

A cleaner walks the string and removes or normalises those code points. It is a character-level operation, and it is worth running — invisible characters break diffs, search and CSV imports, and a few of them really have been used to fingerprint documents.

What it cannot do is change your word choices, because it does not touch them. Run a cleaner on a watermarked paragraph and every word remains exactly where it was.

What a statistical watermark actually is

At each position a language model has many acceptable continuations. A statistical watermark biases that choice with a keyed source of randomness, so that across hundreds of positions the sequence carries a measurable signature — one that only a party holding the key can test for. Read the result and you see ordinary prose; there is no marker to find.

This is the same family as the green-list construction described in what an AI text watermark is, and Google's SynthID-Text uses a related idea. The mechanism differs between vendors; the layer does not.

The two layers, side by side

So why do so many tools advertise it that way?

Partly because "invisible watermark" is an intuitive phrase and hidden characters are the intuitive implementation. Partly because character-stripping is trivial to build and easy to demonstrate — you can show a before-and-after byte count. And partly because until 2026 there was very little public information about what the major providers were actually doing.

The claim to be sceptical of is any tool that runs a character-level clean and then reports that a watermark has been "removed". Those are two different statements, and only the first one was tested.

What actually affects a statistical watermark

Editing the words. Rewriting a passage changes which tokens appear, which is the only input the detector reads. How much it moves the statistic depends on how much you changed and how long the document is — see does paraphrasing remove an AI watermark for the honest version of that answer.

What nobody outside Anthropic can currently do is check the result against Claude's detector, because the detection API has not been released. FreeAIText's score is a local research estimate of watermark pressure; it reproduces the published mathematics with a key that is not Anthropic's, so it is not the same test. We track the API's availability on the status page.

The practical summary

• Run a Unicode cleaner. It fixes real problems and costs nothing.
• Do not treat the result as evidence about a statistical watermark. Different layer.
• Claude's watermark, per Anthropic, adds no hidden characters at all.
• Only editing the words moves a statistical signal — and no third party can currently confirm by how much.

Sources

• Anthropic, Watermarking Claude's text output — statistical word selection, no hidden characters, detection API still to come.
• Kirchenbauer et al., A Watermark for Large Language Models (2023).