How to Address AI Text Watermarks and Hidden Unicode

A lot of advice on how to remove watermarks from AI text treats every watermark as hidden characters you can delete with find and replace. That works for invisible characters. It doesn't work for statistical signals spread across a model's word choices, which is how Google's SynthID Text and Anthropic's Claude watermark work. OpenAI announced textGrain provenance marking for eligible ChatGPT and Codex output in the EU on 5 October 2026; API customers can opt in globally, and it is off by default.

The two problems have different fixes and different limits. Clean the string when the issue is Unicode. Rewrite the passage when the concern is a probabilistic signal. Don't trust any vendor promising permanent, guaranteed undetectability: research shows rewriting can reduce detection sharply, but outcomes stay probabilistic and vary with the text, model, and test setup. Simple Unmark, mentioned below, is our product.

Table of Contents

• Two Watermark Problems Hidden Behind One Question
  • The practical difference
• A 60-Second Triage Before You Touch Anything
  • Step one, inspect the actual string
  • Step two, run a detector
  • Step three, choose the branch
• Cleaning Invisible Unicode the Right Way
  • Pick the simplest safe path
  • Verify before publishing
• Removing Probabilistic Watermarks Through Rewriting
  • Start with a baseline
  • Why one pass often fails
• What Tools Can and Cannot Promise You
  • Read the claim beside the mechanism
  • What a practical tool should do
• Legal and Ethical Boundaries You Should Know
  • A detector is evidence, not authorship proof
  • Platform and publication risks

Two Watermark Problems Hidden Behind One Question

People use "AI watermark" for two unrelated things.

The first is invisible Unicode. A pasted passage may contain zero-width characters, bidirectional controls, a byte-order mark, or unusual spacing code points. They have no visible glyph but stay in the string and can interfere with parsing, search, copy-paste behavior, and string comparison, as documented in this overview of invisible Unicode characters. Strictly, these aren't watermarks: none of the major providers documents hidden characters as its text watermark, and they usually arrive through the copy path. Their presence doesn't show that AI wrote the text.

The second is a statistical text watermark. Systems such as Gemini's SynthID-Text influence token selection during generation. The signal isn't sitting in one hidden character. It's distributed through patterns of word choices, so deleting characters won't touch it. Research on SynthID probing tests such watermarks by paraphrasing the text ("scrubbing"), not by deleting characters, because the signal lives in the wording.

The practical difference

Unicode cleanup is deterministic. Find the unwanted code points, remove them, and verify that the visible text stayed intact. A competent text editor, script, or dedicated cleaner can handle this.

Statistical cleanup is adversarial. You have to change enough phrasing and sentence structure to disturb the token-choice pattern while keeping the meaning. Even then you can't confirm the result, because providers' detectors aren't available to the general public.

One widely cited analysis tested recursive paraphrasing against a research watermark on passages of about 300 tokens. At a 1% false-positive rate, the detector's true-positive rate fell from above 99% to 80.7% or 54.6% after one paraphrase round, depending on the paraphraser, and below 20% after five rounds. The authors describe the quality loss as slight. See the analysis of recursive paraphrasing and watermark detection.

Practical rule: If you haven't identified the watermark type, you don't yet know which tool to use.

For a short comparison of both categories, see this guide to hidden Unicode versus statistical watermarks. It helps avoid the most common mistake: removing harmless formatting artifacts and assuming the model-level signal went with them.

A 60-Second Triage Before You Touch Anything

Check whether there's anything to fix before you rewrite. A quick triage tells you whether you're dealing with dirty text, a detector result, or both.

Step one, inspect the actual string

Paste the text into a Unicode inspector, such as our free invisible character remover, which runs in the browser and lists each hidden character by name and code point. In a terminal or editor, search with this pattern:

[\u200B-\u200F\u2028-\u202F\u2060-\u206F\uFEFF]

That range catches common zero-width, formatting, directional, and related characters. It also matches U+200C and U+200D, which some scripts and emoji sequences need, and U+202F NARROW NO-BREAK SPACE, which French typography and some number formats use, so review matches before deleting. Compare the visible character count with the underlying string length.

Step two, run a detector

If a detector result is what prompted the question, run the untouched passage through the same detector, such as GPTZero or Originality.ai, and save the result. These are classifiers that estimate from writing style. They can't read a provider's watermark, which requires the provider's key, and they can flag human text. Treat the score as a signal, not a verdict.

Step three, choose the branch

Use the outcome, not the label someone gave the file:

• Hidden characters found: Clean the Unicode first. Don't paraphrase unless you have a separate reason.
• No hidden characters, classifier flags the text: That's a style estimate, possibly a false positive. It isn't evidence of a watermark. If the text came from a provider that documents a watermark and you have a legitimate reason to rewrite it, move to controlled rewriting.
• Both: Remove the Unicode artifacts first and keep the original. Removing them won't change a watermark, and usually won't change a classifier score either.
• Neither, and no watermark concern: Stop. More processing can reduce quality without solving anything.

Invisible Unicode removal is exact: you can verify it by examining code points. Statistical watermark reduction can't be verified by you or by any publicly available third-party tool.

Cleaning Invisible Unicode the Right Way

Invisible Unicode cleanup is the easy case, though careless removal can still damage legitimate text. Work from a copy, preserve the original, and remove only characters your workflow identifies as unwanted.

Common artifacts include the zero-width space, U+200B, zero-width non-joiner, U+200C, zero-width joiner, U+200D, soft hyphen, U+00AD, word joiner, U+2060, and BOM, U+FEFF. Some format controls may be intentional in multilingual text, so don't delete every non-printing character blindly.

Pick the simplest safe path

For developers, use a targeted regular expression. The range above is a reasonable starting point for common artifacts, but inspect the match list before deletion. A broad “remove all control characters” rule can alter line breaks or language-specific behavior.

For non-technical users, a browser-based inspector or a Unicode-aware editor such as BabelPad makes hidden marks visible. Reveal the code points, select the unwanted characters, remove them, and export or copy the cleaned result as plain text. A visual editor is safer than blindly pasting content into an unknown online form when the material is confidential.

For batch processing, use Python's unicodedata module. Build an explicit list of the code points to remove, rather than assuming every character with a control category is malicious. That gives you an auditable process and lets you preserve intentional formatting.

Verify before publishing

Re-run the Unicode inspector after cleaning and confirm that the targeted character count is zero. Then compare the cleaned output with the original in a hex viewer or another byte-aware diff tool.

The visible text should stay the same. Check headings, punctuation, line breaks, non-Latin text, links, and copied identifiers. If visible content changed, restore the original and narrow the cleanup rule. The invisible character remover keeps the joiners and direction marks that scripts and emoji need, but checking the result is still your job.

Unicode cleanup doesn't remove a statistical watermark. It only removes characters that were in the string.

Removing Probabilistic Watermarks Through Rewriting

Weakening a probabilistic watermark has nothing to do with deleting characters. The signal sits in token selection across the passage. You can't tell which words carry it by reading the text, so replacing a few synonyms rarely helps. Treat this as controlled rewriting.

Start with a baseline

Save the untouched passage with its source and date. If a classifier result prompted the work, save that result and the detector settings too. Without a record, you can't tell a useful rewrite from a change in the detector.

Then write a deep, meaning-preserving paraphrase. Change sentence structure, clause order, transitions, rhythm, and word choice. Keep facts, numbers, proper nouns, legal qualifiers, and the writer's intended conclusion.

A controlled rewrite pipeline, with a tool such as our AI watermark remover or your own process, followed by human review:

1. Record the baseline. Save the original and any detector output before editing.
2. Paraphrase. Use a capable model or rewriting tool. If you control sampling temperature, a setting above about 0.7 gives more varied wording.
3. Change cadence. Mix sentence lengths, remove repetitive transitions, and break predictable paragraph patterns.
4. Edit manually. Rewrite roughly 10% of sentences, especially those with templated or highly predictable phrasing.
5. Re-test and compare. Use the same detectors again if you need to, and keep a side-by-side record of the original and the rewrite. A classifier score here tells you about style, not about a watermark.

The temperature and sentence-editing figures are working suggestions meant to create broader wording variation, not tested thresholds. Try them on your own material.

Why one pass often fails

A single paraphrase may keep the same common synonyms and sentence skeleton, so enough of the original token pattern can survive. The recursive-paraphrasing research above found detection falling sharply as paraphrase depth increased.

A separate 2026 study tested open-source implementations of SynthID-Text, KGW and Unigram on short 50-token texts. Meaning-preserving paraphrase removed the watermark from 98.3% of initially detected SynthID texts, and the SynthID configuration also flagged 5.4% of paraphrased human-written controls as watermarked. The authors note the sample was small and the SynthID result may not transfer to Google's production system (SynthID and watermark scrubbing study). Separately, the ETH Zurich probing work linked above reported scrubbing success above 90% with an off-the-shelf paraphraser for some SynthID-style configurations, even without first stealing the watermark.

These findings don't support a universal bypass claim. Longer passages may still be detected, model families respond differently, and detectors flag some clean text before any editing. Anthropic's announcement says light editing probably won't remove Claude's mark completely, while a complete rewrite where every word is replaced will. Google says thorough rewriting can greatly reduce SynthID detector confidence. Neither provides a general public checker: Anthropic offers restricted detection API access in private preview to eligible organizations, and Google's public reference implementation is configuration-specific rather than a Gemini checker.

A rewrite can lower the odds of detection. It can't bring them to a verified zero.

Validate every pass like an editor. Compare numbers, names, quotations, technical terms, and instructions against the source. If the rewrite becomes less accurate or no longer sounds like the intended author, it failed, even if the detector score dropped.

What Tools Can and Cannot Promise You

Tools can remove invisible Unicode reliably: identify a zero-width character, delete it, and let you verify the result. Statistical watermarks are different. The signal is probabilistic, depends on the model family and attack type, and is detected from patterns by whoever holds the key.

So absolute vendor claims are a credibility test. If a product promises 100% bypass, guaranteed invisibility against future detector versions, or permanent protection from enterprise classifiers, don't believe it.

Read the claim beside the mechanism

Claim	Unicode Watermarks	Probabilistic Watermarks
“Remove it instantly”	Plausible when the tool identifies and deletes specific code points	Misleading, because rewriting is required
“No visible change”	Testable with a character and byte-level diff	Not guaranteed, because semantic rewriting can change tone or meaning
“Works against every detector”	Mostly irrelevant to deterministic cleanup	Not credible without a defined corpus, detector, and test method
“Guaranteed undetectable”	Excessive marketing	False certainty

A sensible vendor should publish its methodology, explain what it changes, and state what it can't control. Look for a test corpus, detector conditions, preservation checks, and an explanation of whether text is stored. Be suspicious of missing methodology pages, no test corpus, and refund policies tied to detector scores rather than output quality.

The same scepticism applies to AI tools generally; this piece on what surface-level AI tools measure looks at the gap between a tool's headline output and what it actually measures.

What a practical tool should do

A useful tool scans for hidden characters, rewrites the whole passage rather than swapping a few words, tries to keep facts and proper nouns, and gives you the result to review alongside the original.

Simple Unmark, our product, is one option. Its cleaner combines invisible-character cleanup with a rewrite aimed at weakening probabilistic signals such as SynthID-style patterns, and it aims to keep meaning, facts, numbers, proper nouns, tone, and intent. We have no access to providers' detectors, so we can't measure how much of a watermark remains afterwards. Its methodology page describes how it works and what it can't do. It's an editing aid, not proof that any detector will return a particular result.

Ask any tool: What exactly does it remove, what does it rewrite, how can you check that meaning survived, and what evidence supports its claims?

Legal and Ethical Boundaries You Should Know

Watermark removal isn't automatically misconduct, and watermark presence isn't proof of misconduct. Invisible Unicode characters can enter text through copying, formatting, accessibility tools, or ordinary processing. Removing artifacts you didn't add from a document you own is usually a cleanup task, not an attempt to deceive anyone.

The ethical line appears when the purpose changes. A student who launders AI-written work to submit it as their own has violated an academic rule whether the text contains a watermark or not. An employee who conceals prohibited AI use may breach an internal policy. A publisher may have disclosure requirements for AI-assisted material, and platform terms for ChatGPT, Claude, and Gemini may restrict deceptive or abusive uses.

A detector is evidence, not authorship proof

Detector output is a classification signal. It isn't a chain of custody, an authorship record, or a reliable answer to who wrote the passage. The 2026 study above, in which a SynthID configuration flagged 5.4% of paraphrased human-written controls, shows that unwatermarked text can be flagged under a particular test setup. Rewriting doesn't fix that weakness; it only changes the text being tested.

Don't use a lower score as a clean bill of origin. If authorship matters, preserve drafts, revision history, prompts, source notes, editorial changes, and disclosures. Those records provide context that a detector score can't supply.

Platform and publication risks

An API provider can terminate an account for violating its terms. A school can reject work that violates its academic-integrity rules. A publisher can require disclosure even when no detector identifies the text. Regulatory duties may also depend on jurisdiction, sector, audience, and the final use of the material, including emerging European Union rules around AI transparency and labeling.

A safe working policy:

• Personal notes and accessibility: Cleaning copied text for readability or compatibility is reasonable.
• Editorial preparation: Remove hidden formatting artifacts, then disclose AI assistance when your publisher or client requires it.
• Research: Preserve the original, document every transformation, and report detector conditions.
• Assessment or employment: Don't use rewriting to misrepresent AI output as human-authored work.
• Public content: Follow the platform, client, publisher, and applicable legal requirements.

Removing a marker doesn't change the origin of the text, the policy governing its use, or your responsibility for what you publish.

Use cleaning tools for formatting hygiene and legitimate editorial work, and rewriting to improve clarity and voice. Neither should be used to invent an authorship story. Preserve the source, validate the rewrite, and decide on disclosure from the context rather than a detector score. If you use Simple Unmark or any other rewriter, compare the result with your original before using it.