AI Watermark in Text: How It Is Removed and Why That Is Not Enough

There are two pieces of news about watermarks in AI text, and it is more honest to start with the bad one: there is currently no reliable public detector for these marks. The good news is that the mark can be removed for free on your own hardware, and the model for doing so weighs less than a gigabyte. Below is an explanation of how the mechanism works, what the July experiment of 2026 showed, and why the mark itself turned out to be the least of the problems.

The Mechanism: The Sampler, Not the Model, Applies the Mark

A watermark in text is a bias in word selection. At each step, the model selects the next token from a probability distribution, and the marking algorithm nudges this choice toward a predetermined subset of tokens. The detector then calculates statistics over the text and checks whether its “own” subset appears more often than it should under random selection.

The original source for the mechanism: a Google DeepMind paper on SynthID-Text (Scalable watermarking for identifying large language model outputs, Nature 634, pp. 818–823, October 2024). The key detail from it: the scheme does not affect model training and changes only the sampling procedure. It also describes the first large-scale deployment of this kind of marking—in Gemini.

Two conclusions follow from the mechanism, and they determine everything else.

First: only the model whose sampler produced the final set of words leaves a trace. Which services the text passed through beforehand does not matter—nothing verifiable remains in the finished wording from Gemini, ChatGPT, or Claude used at intermediate stages. Only the final pass requires control.

Second: since the mark lives in the wording, it is removed by changing the wording. Hence the practical technique: rewriting.

Why Detectors Are Currently Unreliable

Checking for a watermark requires the secret key used to apply the mark. Third-party checkers do not have this key, so they cannot confirm the presence of a specific watermark and instead guess the text’s origin from its style, while also selling a subscription.

As of 2 August 2026, Anthropic began marking Claude’s text globally, across all products; SynthID-Text is forthcoming, in response to the EU AI Act’s requirements for transparency in AI content. Models released after this date support marking immediately, while it is being added to older ones during a transition period. An API for detection has been promised but has not yet been released: the help documentation says that detection mechanisms are in progress and that details will appear in separate documentation.

The same documentation, in its own help section, also lists the method’s limits: the mark may disappear through intensive editing, paraphrasing, translation, or mixing with other text, and it cannot be applied at all to very short passages. In other words, the limitation is acknowledged by the party that applies the mark.

What the Paraphrasing Experiment Showed

In July 2026, a paper titled AI Watermark Evidence Fails Forensic Readiness was published (arXiv:2607.16010, Tamim and Khan). The authors did not test the resilience of marks as such, but their suitability as evidence in court, using the Daubert factors and the NIST SP 800-86 digital forensics process.

Protocol: 15 prompts for each method, drawn from everyday, technical, news, professional, and creative domains, with two generation seeds—that is, 30 baseline marked texts per method. Each text was attacked with paraphrasing at three temperatures and five template variants; after filtering, 846 valid runs remained: 304 for KGW, 306 for Unigram, and 236 for SynthID. The texts were paraphrased by Qwen2.5-1.5B.

The result of a single rewrite pass on texts in which the mark was initially detected:

• KGW and Unigram: 100% mark loss;
• SynthID: 98,3%.

One figure is especially striking: before any attack, the detectors failed to find the mark in 70% of clean marked texts for KGW, 83% for Unigram, and 80% for SynthID. The SynthID configuration additionally classified 5,4% of paraphrased human texts as machine-generated, while 80% of its own unattacked marked output fell into the zone of uncertainty.

The point is not that rewriting works miracles, but that detection worked poorly even without rewriting. None of the three methods passed more than two of the five Daubert factors.

Two methodological details matter in practice. The paraphrased texts passed a three-part validity filter: cosine similarity of at least 0,75, normalized Levenshtein distance of at least 0,15, and a length ratio from 0,5 to 2,0. The median similarity among the retained samples was 0,83–0,84, meaning that the meaning was genuinely preserved rather than lost along with the mark.

The second detail: for SynthID, the generator was Gemma-2-9b-it, while Qwen2.5-1.5B served as the attacking model from a different family. This is closer to reality than a “rewrote itself” test: someone removing the mark does not need access to the original model. The Qwen runs fit within Colab’s free tier on T4.

Why Rewrite Instead of Generating from Scratch with a Local Model

A logical question is: if a local model does not apply the mark, why use the cloud at all? You could just write locally from the start. That is indeed possible, but the result will suffer noticeably: paraphrasing and writing from scratch are different classes of task.

Paraphrasing receives the structure, logic, and factual content ready-made: they are already specified by the source, and the task is reduced to choosing different words for the same meaning. On this task, the gap between a 14B model and a leading cloud model is small. Writing from scratch requires building all of this independently, and there the gap is enormous—neither 14B nor 30B can close it.

Hence the division of roles: the cloud flagship provides the meaning, structure, and factual content, while the model on your own hardware assembles the final wording. Tellingly, in the experiment the mark was removed by a model with 1,5B parameters: that was enough to choose different words, whereas it would not have been able to write an original text of that level.

Why Local Execution Does Not Leave a Mark

Marking is applied at the token-selection stage. With a cloud service, this stage runs on its side: you cannot look inside and check whether the marking algorithm is enabled. With local execution, token selection is entirely under your control, and the marking scheme does not activate by itself; it must be deliberately enabled.

What to Install Locally

Model sizes in Ollama as of the end of August 2026:

Qwen3 14B is generally sufficient for rewriting. With 24 GB of RAM, it makes sense to go straight for a model in the 27–32B range: the paraphrasing result will be better. The one-and-a-half-billion-parameter model runs on practically any laptop, but it represents the lower bound of what is possible, not the optimum for production. Models can be found in the Ollama library and on Hugging Face.

The Mark as One of Several Traces

A watermark can be removed in a single pass, but the other traces of machine-generated text remain:

• invisible Unicode characters;
• default typography: em dashes where a person would not use them, angled quotation marks, and the letter ë in every word;
• leftover markdown in the body of the text: asterisks, hashes, and fragments of lists;
• vocabulary to which models gravitate.

Typography should be treated more carefully than the rest: ë and angled quotation marks also occur in polished human writing, so they work as indicators only in combination with other signs. Invisible characters and fragments of markup remain unambiguous traces.

This can be cleaned up after rewriting, but it is easier to specify it in the prompt from the outset: do not use invisible Unicode characters, do not insert em dashes everywhere they might fit, and do not leave markup behind. It is also worth remembering that file marking takes a different route—through signed provenance metadata under the C2PA standard—and text rewriting has nothing to do with images.

What Follows from This

There are still two ways to obtain “clean” content:

1. An author who writes by hand, without AI, and you have a way to verify it.
2. Rewriting a high-quality cloud-model text with a local model, followed by cleaning up the remaining traces.

The process for the second option: a large model writes according to the structure and brief, a local model rewrites it in a single pass, Unicode, typography, and leftover markup are then cleaned up, and only afterward is the text read by eye for machine-like vocabulary.

Removing the mark is not a problem: a local model handles it for free, and the research shows that detectors in their current form also fall short of evidentiary reliability. The problem is that the watermark is just one of the traces of AI, and it is also the easiest one to remove. The other traces have not gone anywhere.