The short answer is simple: Guillaume Meyer’s open-source watermarks-remover project can clean certain characters and file metadata and attempt substantial rewriting, but no supplied evidence proves that it defeats Anthropic’s production detector. A rewrite that looks different is not the same thing as a verified watermark removal.
That distinction matters because Claude’s provenance system has two separate layers. One is a statistical signal woven into text during generation. The other is signed C2PA metadata attached to certain supported files. They leave different traces, weaken in different ways, and neither one proves who wrote a document.
The short answer: a workaround is not a verified bypass
The project associated with Guillaume Meyer separates its work into distinct functions:
- deterministic cleanup of invisible Unicode and related characters;
- cleanup of file metadata; and
- optional model-assisted rewriting intended to alter statistical patterns in prose.
Those functions do not have the same purpose. Character and metadata cleanup address visible or file-level remnants introduced by software. Statistical rewriting changes the wording itself in an attempt to weaken a model-level signal. The project’s own documented architecture describes that rewriting as best effort, not as a certified way to defeat Anthropic’s private detector.
Copying text into another document is not enough, either. Anthropic says its text signal may survive copying and some editing. Heavy editing, paraphrasing, translation, short passages, and mixing with other text can make detection unreliable, but that is a statement about possible detectability—not a guarantee that a particular transformation produces a clean result.
Claude has two provenance layers
The first layer is the Claude text watermark. It is embedded through token and word choices while the model generates text. There is no visible label for the reader and no ordinary hidden-character string that can simply be deleted.
The second is C2PA file provenance. C2PA is a standard for signed provenance metadata that can travel with supported files, including certain images and documents. Re-saving, converting, taking a screenshot, or stripping metadata can affect that file-level record. None of those actions, however, directly removes a statistical signal that was created during text generation.
| Provenance layer | Where the signal lives | What it can indicate | What can weaken it | Does it prove authorship? |
| Claude text watermark | Token and word-selection patterns | That Claude may have processed the text | Heavy editing, paraphrasing, translation, short passages, or mixing with other text | No |
| C2PA file provenance | A signed manifest attached to a supported file | That Claude processed a supported file and whether the signed file changed | Re-saving, conversion, screenshots, unsupported formats, or metadata stripping | No |
| Ordinary AI detector or classifier | Statistical or linguistic properties inferred after generation | That text resembles a model-generated sample | Paraphrasing, model changes, domain differences, and false positives | No |
The useful rule is almost comically unglamorous: different evidence requires different analysis. Deleting metadata is not statistical rewriting. Rewriting prose is not editing a C2PA manifest.
How the invisible text mark works
Anthropic says its approach is based on SynthID-Text, a method developed by Google DeepMind. In plain English, the model makes tiny changes to its token-selection process. Across enough words, those choices can form a statistical pattern that a detector can score later.
This is not a fixed list of forbidden words. The published SynthID-Text research describes context-dependent sampling and statistical scoring. That matters because the mark is distributed across many choices rather than stored in one obvious location.
The underlying research reported negligible quality impact in its tested Google Gemini configurations, including an evaluation of approximately 20 million responses. Those results describe the tested SynthID-Text setup; they are not an independent benchmark of Claude’s implementation. Anthropic has said that its watermark should not change the quality of Claude’s output, but the available research does not turn that statement into a separate Claude performance test.
Code is a special case. Programming syntax leaves fewer opportunities to choose among equivalent words than ordinary prose does. The more flexible parts—such as comments and discretionary terms—offer more room for a statistical signal, while the executable structure offers less.
What rewriting changes—and what it risks
Substantial rewriting can weaken a statistical watermark because it replaces the word choices that helped form the pattern. That is the technical reason the workaround debate exists. It is also where the practical trade-off becomes unavoidable: changing enough wording to disrupt a signal can change the voice, formatting, precision, or meaning too.
A second model can paraphrase Claude text, but that still does not guarantee a clean result. The rewrite may leave enough of the original pattern for detection, introduce factual errors, damage precise technical language, or add a provenance mark associated with the second system. A fluent rewrite is not a detector result.
The same caution applies to the project’s reported workaround. Its existence shows that developers can automate cleanup and rewriting steps. It does not establish that the tool has defeated Anthropic’s production watermark. The supplied current official documentation places Claude text detection in private preview for eligible organizations and enterprises, rather than describing a generally available consumer detector. Without a result from the relevant production system, “removed” remains too strong a word.
Why a mark is not an authorship verdict
A positive result can indicate that Claude may have processed material. It cannot, by itself, establish that Claude wrote every word, created the original ideas, or supplied the complete document.
That distinction covers ordinary AI-assisted workflows. Anthropic’s explanation includes cases such as proofreading, translation, summarization, and reformatting. A person may have written the underlying material, then used Claude for one of those tasks. The statistical mark can reflect model processing without answering the larger question of authorship.
The reverse is also important: a negative result does not prove human authorship. Unsupported models, short passages, heavy editing, translation, format conversion, and other transformations may leave too little detectable signal. “Not detected” is not the same as “written entirely by a person.”
The same logic applies to C2PA. Signed file provenance can provide useful information about a file’s history, but it is not a complete biography of the people who contributed to the content. A mark identifies a kind of processing or file history; it does not settle the entire authorship question.
A safer workflow for writers and organizations
If provenance matters, treat the document’s history as evidence rather than relying on a single detector result.
- Keep drafts and version history. Earlier drafts can show how an idea and its wording developed. They are more informative than a bare positive or negative classifier result.
- Separate text from file provenance. Check whether the question concerns Claude’s statistical text signal, C2PA metadata, or an ordinary AI classifier. They are not interchangeable.
- Preserve accuracy after any rewrite. A transformation that changes meaning or introduces errors is a poor trade, even if it makes detection less reliable.
- Describe AI assistance precisely. Proofreading, translation, co-writing, and full generation are different kinds of use. A single mark cannot distinguish them by itself.
- Follow the rules that apply to the work. Disclosure and usage requirements can depend on the relevant organization, platform, school, employer, contract, or other policy. Removing a provenance mark does not answer those separate questions.
The European Union AI Act is part of the broader policy context around machine-readable AI-content marking, but technical behavior and policy obligations should not be treated as the same issue.
The bottom line
Claude’s watermark workaround is best understood as a plausible signal-disruption approach, not a proven bypass. Unicode and metadata cleanup target different layers from statistical rewriting, copying alone is not a reliable removal method, and no detection result—positive or negative—proves complete authorship.
For writers, developers, educators, and publishers, the useful protection is not chasing a magic “clean” score. Preserve the work’s history, understand which provenance layer is being discussed, and treat Claude’s mark as one piece of evidence—not a verdict.
