Claude · watermark tools

Claude watermark cleaning, explained

You searched for a cleaner. Here is what the cleaning actually does, what it can and cannot prove, and how the honest tools in this space describe themselves.

What the Claude text mark is

Anthropic's documentation describes the mark as a signal that Claude processed the text. It is not a claim that Claude wrote it. The docs say Claude may not be the original author, and the mark can appear on text a person edited or wrote around.

The same page lists what the mark is not. Detection is still forthcoming, so no public tool can tell you whether a given text carries a mark. The docs also list the ways text can end up with no detectable mark: heavy editing, paraphrasing, and translation. Short text gives no reliable signal on its own.

How a text watermark actually works

The scheme behind fast, cheap watermarking is public. A hash of the tokens written so far plus a secret key picks a pseudo-random green list and red list of words, and the model nudges the next token toward the green list during sampling. Detection reverses the trick: recreate the hash from the text and the secret key, and count how often the text picked green. Text that stayed in the green set disproportionately is marked.

The hash is the fragile part. Paraphrase changes the tokens, so the recreated hash no longer matches the sampling that produced the text, and the green bias is lost. That is why paraphrase appears in Anthropic's own list of ways a mark stops being detectable, and why the ACL, EMNLP, and ICML papers cited below all find paraphrase breaking watermark schemes. Rewriting the text with another model is, mechanically, the strongest known way to lose a statistical mark.

The limits run both ways. A mark says little on short or highly predictable text, where there is only one way to continue. A provider can make the hash statistical so light edits do not instantly break it, at the cost of robustness. A public detector doubles as a target for reverse engineering, which is part of why labs weigh the risk before releasing one. Two constraints shape what a lab can ship at all: text streams token by token, so paragraph-level schemes that resist paraphrase better cannot be applied mid-stream, and code cannot be arbitrarily changed without breaking it, so the mark has to live in words that tolerate synonyms.

That is why the honest tools in this space measure their work and stop short of promises. The one open source cleaner with a real test suite says it outright: there is nothing to verify against until the detector ships.

What a watermark-cleaning tool actually does

The best documented example right now is an open source project called claude-watermark-cleaner. It is roughly 430 lines of Python with no dependencies outside the standard library, and its own test suite passes eight out of eight.

It does two things. First, it strips invisible and bidi Unicode characters that can carry a mark or a formatting artifact. Second, it rewrites the text with a local Ollama model, with a Codex CLI fallback. The rewrite protects code blocks, inline code, URLs, and templates, and the tool refuses its output when numbers in the text changed.

It also measures its own work: a 5-gram lexical perturbation score, warning below 60 percent and aiming above 70 percent. That is a measurement, not a verdict.

The README is honest about the limit. Removal cannot be verified until Anthropic ships its detector, and the author says human review is still needed for legal, medical, or financial text.

The limit: nothing to verify against

Anthropic has not shipped the detector. Until it does, every claim that a mark is gone is a claim without a check behind it. The tool above does not claim to be the exception. Its README says the same thing.

The academic record points the same way. Paraphrase is the canonical attack on statistical text watermarks: a 2024 ACL paper and a 2024 EMNLP paper both show paraphrase weakening or breaking watermark schemes, and a 2024 ICML paper concludes that strong watermarking of text is impossible in the sense that every scheme it tested was broken. Anthropic's own documentation lists paraphrase among the ways a mark may stop being detectable.

That is the arms race. A statistical mark invites a second pass of rewriting, which costs more compute, more energy, and more money. The claude-watermark-cleaner author argues the EU mandate may get the opposite of its intent, and the EU's own research body flags the same problem: a 2026 Joint Research Centre study sets out what a detector would have to do and lists removability as a documented failure mode.

The EU route is disclosure, not removal

Article 50 of the EU AI Act has applied since 2 August 2026. AI-generated text must be labeled, and machine-readable marks are part of the regime. The final Code of Practice was published on 10 June 2026 with roughly 190 signatories.

For deployers, compliance runs through human review and disclosure. A team that publishes edited AI output keeps the record: who edited it, what changed, and what the label says. Removal is not a compliance path, because compliance is about the label and the record, not about what a detector would find. Penalties run to 15 million euros or 3 percent of turnover.

The distinction matters because classifier news keeps muddying it. The false-positive incidents that made the news, from the Burrell case to the TOEFL flagging, concerned statistical classifiers that guess authorship from style. A watermark is a signal the provider can verify. The two fail differently, and the honest conversation stays honest only when they are kept apart.

The detector problem comes first

The harm people actually meet in the wild is not the watermark; it is statistical classifiers that guess authorship from style. OpenAI's short-lived classifier, by its own release notes, caught only about 26 percent of AI-written text while mislabeling 9 percent of human-written text as AI. A New York Times investigation from 17 May 2025 documented honest students having to prove they did not use AI after classroom detectors flagged them, and non-native speakers are flagged disproportionately.

A watermark is a different thing: a signal the provider can verify against its own key. Classifiers guess; marks verify. But with the detector still forthcoming, the only detection a reader can run today is a classifier — and classifiers fail by hurting the honest first.

This is the distinction underslop is built around. Mark the tells a model leaves in text, keep the human in the loop, and keep the record. An explainable marker beats a vibes-based accusation.

How underslop is different

underslop is an editor, not a cleaner. It does three things: it measures, it remediates, and it keeps an audit trail.

Measure: the tool reports the AI tells it finds in a draft and marks the ones that survive the rewrite. A watermark-measurement pass is being built that reports a draft against the documented ways marks are lost.

Remediate: the rewrite is provenance-preserving. It changes the writing, not the record, and it never strips credentials or claims a model never touched the draft.

Audit: every run logs what changed and why, so a team can show its work where a label is required.

We never claim to remove a watermark, and we do not sell a removal. The honest move is what this page does: name what the marks are, name what cleaning can and cannot do, and keep the record.

Claude marks are real and the coverage is still settling. underslop is the edit, not a remover: it edits an AI draft so it reads like you wrote it, and it makes no promise about what any detector will report. Your text is held for 0 seconds.