How AI Text Watermarks Work: The Three Kinds, and What Each One Survives
Updated September 2026
An AI text watermark is a signal that lets a model's maker recognize its own output later. There are three ways to plant one, they behave completely differently, and most arguments about whether watermarks can be removed come from mixing them up.
Quick answer
Three kinds of mark, three different answers:
- 1Edit-based marks plant invisible or look-alike characters in the text. Deterministic to find and remove.
- 2Statistical marks bias which words the model chooses. Invisible, keyed, survive copy and paste, weakened only by rewriting.
- 3Provenance metadata such as C2PA sits in the file around the text, not in the text. Stripped by any metadata tool.
StripShot removes the first and third kinds and tells you plainly that it cannot remove the second.
1. Edit-based marks: characters you cannot see
The oldest trick is also the simplest. Take finished text and sprinkle it with characters that render as nothing: a zero-width space after a comma here, a word joiner between two words there, a soft hyphen inside a long word. The pattern of where they sit encodes a message. Give each recipient a different pattern and a leaked copy tells you who leaked it. Swap Latin letters for identical-looking Cyrillic ones and you get the same effect with letters instead of spaces.
Google's SynthID-Text paper calls this family edit-based watermarking and lists it alongside synonym substitution. It is cheap, it needs no access to the model, and it survives copy and paste, which is why it keeps appearing in document leak investigations and, more recently, in text that passes through chat interfaces and web pages.
It is also the only kind that can be removed with certainty. A cleaner that walks the text code point by code point can list every carrier, remove it, and prove by re-scanning that none remain. The only skill involved is knowing which invisible characters are load-bearing (the joiner inside a family emoji, the non-joiner inside a Persian word) and leaving those alone.
2. Statistical marks: the words themselves
A language model produces text by choosing one token at a time from a probability distribution. A statistical watermark nudges those choices. Kirchenbauer and colleagues described the clean version in 2023: at every step, use a secret key and the previous token to split the vocabulary into a green list and a red list, then push the model gently toward green words. Any single sentence looks normal. Across a few hundred tokens, a detector holding the key counts how many words landed on green and finds far more than chance would allow.
Google's SynthID-Text, published in Nature in October 2024 and deployed in Gemini products, refines the idea with tournament sampling so the quality cost is negligible, and its detector needs only the key and the text, not the model. Anthropic's help center describes model-level text watermarks for Claude models launched on or after August 2, 2026, without publishing the algorithm; the description matches this class. OpenAI has said it built a text watermarking method and has not deployed it publicly.
| Property | What it means for you |
|---|---|
| Invisible in the text | No character or formatting reveals it. Reading the text tells you nothing. |
| Needs a key to read | Only the vendor, or a partner the vendor gives the key to, can score it. Public detectors cannot. |
| Survives copy and paste | The mark is in the words, so moving the words moves the mark. |
| Weakened by rewriting | Paraphrase, translation and heavy editing lower the score. Short texts carry too little signal either way. |
| Cannot be removed by a character tool | Cleaning code points changes nothing about which words were chosen. |
Where the honest boundary is
A character cleaner does not touch a statistical watermark. The only thing that does is changing the words, and the only way to know it worked is the vendor's detector. Any product that promises to make watermarked text undetectable is selling a rewrite plus a guess. StripShot does not rewrite text and does not make that promise.
3. Provenance metadata: the file around the text
When AI output is saved as a file rather than pasted, the file itself can carry a signed record of where it came from. C2PA Content Credentials do this for images, and increasingly for documents and video. A Word file lists ChatGPT as its author in docProps/core.xml. A PDF names its producer. None of this is in the text; all of it is in the container, and a metadata tool removes it completely.
The industry increasingly describes provenance as a two-layer stack: a hard-bound manifest inside the file that is easy to strip, and an imperceptible watermark inside the content that is not, with the watermark able to point back to a copy of the manifest kept online. For text, the second layer is the statistical mark above. For images it is a pixel watermark such as SynthID.
What survives what
| Action | Edit-based (characters) | Statistical (words) | Metadata (file) |
|---|---|---|---|
| Copy and paste as plain text | Survives | Survives | Gone |
| Screenshot | Gone | Gone (until OCR) | Gone |
| Light editing | Mostly survives | Survives | Survives |
| Paraphrase or translation | Gone | Weakened | Survives |
| Character cleaning (StripShot) | Gone, verified | Unchanged | Unchanged |
| Metadata stripping (StripShot) | Unchanged | Unchanged | Gone, verified |
Why this matters beyond detection
- Privacy. A fingerprint of invisible characters in a document you share can identify you, whichever tool planted it.
- Hygiene. Hidden characters break search, spellcheck, diffs and code. Cleaning them is ordinary text maintenance.
- Security. Unicode tag characters can smuggle instructions into text that a person never sees and a language model reads. Finding them is a defensive step.
- Disclosure. Where a law, platform or institution requires you to disclose AI assistance, removing a mark does not remove that duty. The EU AI Act's Article 50 rules on machine-readable disclosure took effect in August 2026.
Check a piece of text
Find hidden carriers and writing tells in any text
Runs in your browser. Nothing is uploaded.
Options
Need unlimited strips?
Scans are free. Pro is unlimited.
Images, video, audio, documents, PDF and text in one tool. Pro adds unlimited strips, whole-folder batches and zip download with a JSON report.
Frequently asked questions
Can you see an AI text watermark?
Not the statistical kind. A token-sampling watermark such as SynthID-Text changes which words the model picks in a way that reads as ordinary prose. Only a detector holding the key can score it. Character-level carriers, by contrast, are invisible on screen but plainly visible to any tool that lists code points.
Does copying and pasting remove an AI watermark?
It removes nothing that lives in the words. Statistical watermarks survive copy and paste by design. Hidden characters also survive copy and paste, which is exactly why they work as carriers. Only a deliberate cleaning step removes them.
Does paraphrasing remove a text watermark?
It weakens it. Published research and the vendors themselves say heavy editing, translation and paraphrase reduce detection confidence, and short texts carry too little signal to score at all. No tool can certify a vendor detector will return negative without the vendor's key, and rewriting with another watermarked model can stamp the text again.
Is an AI text watermark the same as an AI detector?
No. A watermark is planted by the model at generation time and read back with a key. A detector such as the ones schools use guesses from style and statistics with no key at all, which is why detectors produce false positives on human writing and watermarks do not.
What does StripShot remove?
Character-level carriers: zero-width and format characters, directional marks, Unicode tag characters, unusual spaces and look-alike letters. Each removal is listed and verified by a re-scan. StripShot does not rewrite text and does not claim to remove statistical watermarks.