A Claude watermark can persist on a document long after the task that introduced it. A writer drafts an article, requests tightening on three sentences, and receives a file whose provenance signal indicates only that Claude wrote it.
For content you own, removing a Claude watermark is a three-stage process: strip suspicious Unicode code points, rewrite the prose with a non-Claude model, and remove hard-bound provenance metadata from supported files. To do this, you can use the open-source remove-ai-marks skill, Haimaker’s model api, and a model of your choice. Two of the three stages are directly verifiable. Unfortunately the rewrite is not because Anthropic keeps the detector private.
Claude now watermarks text and files
Claude operates at least two confirmed provenance channels on outputs. Text gets an invisible mark applied at the model level, and supported files receive digitally signed C2PA metadata. Anthropic states that models introduced on or after August 2, 2026 ship with marking enabled by default; rollout to older models continues.
The marking boundary extends beyond the Claude web app. Anthropic’s announcement covers Claude Platform, Claude, Claude Code, Claude Cowork, Claude Tag, cloud partners, and every region where Claude is available. Text marks can survive copy-paste and light editing. File marking activates when both the product and format support it, with .svg, .png, and .jpg among the formats Anthropic cites.
Anthropic has not published the text-marking algorithm or a detector. That gap leaves any removal guide with an unresolved dependency. A phrase like “woven into the text” does not reveal whether the mark relies on zero-width characters, token-selection bias, semantic structure, or a combination of techniques.
Some transformations are known to weaken detection. Anthropic enumerates heavy editing, paraphrasing, translation, combination with other text, short extracts, format conversion, re-saving, and screenshots. These justify a layered cleanup pipeline. However, they do not guarantee that the output is undetectable.
Detection shows processing, not authorship
A detected Claude watermark supports one narrow inference: a compatible Claude model may have processed the material. It does not mean that Claude produced every word, idea, fact, or design choice. Anthropic explicitly calls out proofreading, translation, summarization, and file conversion as operations that can leave a mark on human-created work.
Consider a writer who drafts an article and asks Claude to edit three sentences. The machine-readable result cannot distinguish that request from full-document generation. That attribution gap has produced a large response: our current 30-day sample found 15 relevant Reddit threads with 8,138 upvotes and 2,633 comments, many centered on ownership and the inferences a generic label might invite.
The inverse is the same. A document with no detected mark is not necessarily human-authored. Unsupported or older models may not mark output, and ordinary editing can reduce detectability. A detector supplies one clue; it is not a plagiarism test or a final call on authorship.
Cleanup also preserves the underlying facts. If a contract, school policy, platform rule, or law requires disclosure of AI assistance, it persists. This pipeline serves privacy and hygiene on content you own, especially when a broad “Claude processed this” hides the division of work.
Each watermark layer needs a different cleanup job
Text behavior, container metadata, and content-level signals occupy different locations and produce different evidence. A Unicode scan can enumerate exact code points. A C2PA tool can display a signed manifest. No independent tool can verify the removal of Claude’s statistical text mark until Anthropic publishes a detector and technical specification.
| Layer | Where it lives | Cleanup action | Confidence after cleanup |
|---|---|---|---|
| Invisible Unicode | Text characters and spacing | Normalize zero-width, bidi, tag, and exotic-space characters | Verifiable by rescanning code points |
| Model-level text pattern | Word and token choices, exact method undisclosed | Rewrite every prose sentence with a non-Claude model | Best-effort only |
| Hard-bound C2PA and metadata | PNG, JPEG, SVG, PDF, DOCX, ODT, HTML, or Markdown containers | Remove supported C2PA, EXIF, XMP, document properties, and AI metadata | Verifiable for removed fields and manifests |
| Soft-bound or pixel signal | Content itself or a remote manifest link | Outside this pipeline | Residual risk remains |
The Unicode row is deliberately conservative. Anthropic has never stated that its new text watermark uses hidden characters. Invisible-character cleanup still fixes real problems: broken diffs, failed searches, and paste bugs, and it removes characters introduced by other software. It is deterministic hygiene, not proof that Claude’s private mark has vanished.
File metadata provides stronger evidence. Anthropic states that supported generated files receive signed metadata based on the C2PA open standard, which independent tools can inspect. Even there, the boundary matters: a C2PA manifest can be embedded, stored in a sidecar, or referenced remotely. Removing an embedded manifest says nothing about a sidecar or content-level signal the tool never touched.
Three-stage cleanup pipeline
This pipeline removes known character-level noise, regenerates text through a non-Claude model, cleans the model output, and then strips supported file metadata. Each stage has a single responsibility. This keeps deterministic cleaning separate from the rewrite. The latter cannot be certified against Anthropic’s unreleased detector.
Guillaume Meyer’s open-source watermarks-remover repository provides the foundation. remove-ai-marks skill partitions the work into
- Layer A - Unicode cleanup
- Layer B - statistical rewriting
- Lyaer C - format-specific metadata removal
The repository does not contain vendor detectors and keys. It cannot guarentee bypassing detection.
For Layer B, we recommending routing the prose through Haimaker to a configured non-Claude model. Haimaker exposes hundreds of models outside that Claude watermarking path through one OpenAI-compatible endpoint, so you can switch the rewrite model without altering the cleanup pipeline.
Our tested model preferences
Which model should you use? We recommend running the same body of text through multiple models until you find one that fits your editorial style and taste. At this time, these are the models we found did the best job. Reminder, this is not a detector score and does not mean that one model removes a private watermark more effectively than another.
| Rank | Haimaker model ID |
|---|---|
| 1 | z-ai/glm-5.2 |
| 2 | qwen/qwen3.7-plus |
| 3 | moonshotai/kimi-k3 |
| 4 | deepseek/deepseek-v4-pro |
| 5 | minimax/minimax-m3 |
| 6 | deepseek/deepseek-v4-flash |
A rewrite can damage Markdown even when the prose reads well. Before the model call, the project wrapper masks YAML frontmatter, headings, fenced and inline code, HTML, tables, links, URLs, and numeric facts. It also loads the project’s voice print so the rewrite alters statistical patterns without collapsing into generic prose. After the call, the wrapper rejects missing or reordered placeholders, new code fences, empty output, and drastic length changes. The original file stays untouched when any check fails.
Installing and configuring the cleanup skill
Install the remove-ai-marks folder under .claude/skills, then point its OpenAI-compatible rewrite hook at Haimaker and select a non-Claude model available to your account. Keep the API key in an environment variable or secret manager. A key embedded in SKILL.md, committed to the repository, or passed visibly on the command line turns a cleanup step into a credential leak.
git clone https://github.com/guillaumemeyer/watermarks-remover.git
mkdir -p .claude/skills
cp -R watermarks-remover/skills/remove-ai-marks .claude/skills/
export WATERMARKS_REWRITE_BACKEND=openai-compatible
export WATERMARKS_REWRITE_BASE_URL=https://api.haimaker.ai/v1
export WATERMARKS_REWRITE_MODEL=provider/model-id
export WATERMARKS_REWRITE_API_KEY="$HAIMAKER_API_KEY"
Inspect the input before modifying it. The baseline records what was actually present and prevents a successful command from being mistaken for evidence that the file contained a mark:
SCRIPTS=.claude/skills/remove-ai-marks/scripts
python3 "$SCRIPTS/inspect_file.py" --json draft.md
python3 "$SCRIPTS/clean_file.py" draft.md -o draft.layer-a.md
python3 "$SCRIPTS/rewrite_text.py" draft.layer-a.md \
-o draft.rewritten.md --strength paraphrase \
--voice-print .claude/reference/voice-print.md
python3 "$SCRIPTS/clean_file.py" draft.rewritten.md -o draft.cleaned.md
python3 "$SCRIPTS/inspect_file.py" --json draft.cleaned.md
Production Markdown should pass through a wrapper with placeholder protection instead of the generic rewrite hook shown above. Source code should stop after deterministic Unicode cleanup and then run through its language formatter. Rewriting code to attack an uncertain statistical mark creates a larger, more immediate risk: a behavior change that a fluent-looking diff can hide.
A remote rewrite sends the document’s prose to the configured API. Submit only material your organization permits that provider to process; local-only content should stay with an approved self-hosted model. Choosing a different model family reduces re-stamping risk. It does not override the data-handling policy.
RUN THE REWRITE THROUGH A NON-CLAUDE MODEL
Verification has three confidence levels
A useful verification report separates three outcomes: Unicode and embedded metadata that were verifiably removed, prose that underwent a best-effort statistical rewrite, and provenance channels the pipeline could not inspect. Merging those findings into a single “watermark removed” result would claim more than the evidence supports.
Before-and-after inspection provides a record. The scripts count suspicious code points, report removed EXIF or XMP fields, and identify supported C2PA segments. If c2patool is available, it can inspect manifest data on supported assets. A clean rescan has meaning for those exact fields and no others.
Text requires a weaker conclusion. Anthropic has not released the detector, and modern watermark designs may survive attacks that defeat simple token-bias schemes. A 2025 WaterPark evaluation tested 10 watermarking methods against 12 attacks and found that robustness changes materially with the design. Earlier ICLR research showed that aggressive human paraphrasing can leave a detectable signal in sufficiently long text. Rewriting proves that the text changed. It does not prove that the signal is gone.
Record the model, rewrite strength, processed files, protected-region count, character counts, applied voice print, and deterministic cleanup steps. Then list the residual risk explicitly: Claude’s secret-key detector, soft-bound provenance, pixel or media watermarks, and future detector changes remain outside the result.
Frequently asked questions
Can Claude mark text that a human originally wrote?
Yes. Anthropic states that a detected mark can mean Claude processed the content, not that Claude wrote every idea or sentence. Proofreading, translating, summarizing, or converting human material can produce marked output when a supported model is used.
Does stripping C2PA metadata remove Claude’s text watermark?
No. They are separate channels. C2PA is signed provenance metadata attached to supported files, while Claude’s text watermark is embedded at the model level. A complete cleanup workflow treats file metadata and prose as different layers.
Can a rewrite guarantee that Claude’s watermark is undetectable?
No. Anthropic has not published its detector or marking algorithm. Heavy rewriting with a non-Claude model is a reasonable best-effort response, and Anthropic lists heavy editing and paraphrasing as reasons a mark may not remain detectable, but no third-party tool can certify removal against an unreleased detector.