How Text Watermarking Works and When Cleanup Helps

Some AI providers now embed a statistical pattern in their models' word choices. Google documents SynthID Text for Gemini. Anthropic documents a keyed text watermark it is rolling out for Claude. OpenAI documents textGrain for eligible ChatGPT and Codex text in the EU and as an opt-in for API customers. Removing strange spacing or swapping a few obvious words won't touch that kind of pattern.

If you've pasted one of these drafts into a client document, publishing system, or submission, the workable approach is to separate the two kinds of signal (hidden characters you can see with an inspector, and statistical patterns you can't), rewrite the wording without changing the substance, and check every factual detail before publication. This guide covers how watermarking works and how to use cleanup tools responsibly on text you're authorised to reuse.

Table of Contents

• Why Watermarked AI Text Is a Real Problem
  • The visible problem is usually the small one
• How Modern Text Watermarks Actually Work
  • Why token entropy changes the result
• Running a Watermark Cleanup in Simple Unmark
  • Follow the paste, clean, copy workflow
• Rewriting Versus Surface Edits for Watermark Reduction
• Keeping Meaning, Facts, and Tone Intact
  • Compare versions as an audit step
• What Detectors Can and Cannot Catch
  • Use detection as a review signal
• Practical Checklist Before You Publish Cleaned Text

Why Watermarked AI Text Is a Real Problem

Text watermarks create a provenance question because they live inside the model's word-selection process rather than in visible formatting. Google DeepMind's SynthID-Text was published in Nature in October 2024 and described as the first deployment of a generative text watermark at scale. It had already been used with Gemini and Gemini Advanced, and a live experiment covering nearly 20 million Gemini responses found no statistically significant difference in user ratings between watermarked and unwatermarked output. The SynthID-Text paper in Nature shows that watermarking can operate in a live, high-volume language-model product.

That raises practical questions for writers, editors, researchers, and compliance teams. A client deliverable can trigger a platform review, a submitted assignment can raise a provenance question, and a marketplace that scores text automatically can reject marketing copy. Most such checks today use generic AI classifiers, which guess from style. Reading a provider's watermark requires that provider's key and detector, and none of the three providers offers a general public checker for arbitrary text.

The visible problem is usually the small one

Invisible characters still matter. Unicode includes non-printing characters such as U+200B ZERO WIDTH SPACE, which marks a possible word break, along with U+200C, U+200D, U+2060, and U+FEFF. They can interfere with copying, searching, text comparison, and downstream processing. This Unicode inspector reference documents the ones commonly found in pasted text. None of the providers above uses hidden characters as its watermark, and finding them doesn't show that AI wrote the text; they usually come from the copy path. To check a draft, paste it into the free invisible character remover, which runs in the browser and doesn't change your wording.

The harder signal sits in the wording. A watermark can bias token probabilities while keeping the text natural to readers, so cosmetic cleanup leaves it alone.

Practical rule: If the watermark lives in token selection, removing characters won't remove it. Only rewriting the wording can weaken it.

A few synonym swaps, punctuation changes, or inserted invisible characters leave most of the pattern intact. To weaken a probabilistic watermark, a rewrite has to change enough vocabulary, syntax, and token sequence while keeping the meaning.

How Modern Text Watermarks Actually Work

A modern text watermark generally operates during generation. Large language models produce text one token at a time, assigning probability scores to candidate tokens. A watermark adjusts that selection with a keyed function so that, across many tokens, the choices lean in a direction only the key holder can test for, while the output stays readable. Google DeepMind describes this probability-shaping approach in its SynthID technical overview.

Nothing is inserted after generation. SynthID-Text works by shaping token choice, and detection aggregates a score across a block of text. Weakening the signal means rewriting the passage; stripping characters does nothing. An independent technical analysis also describes the process as sequence-dependent, with token scores influenced by preceding tokens, which explains why superficial edits can leave part of the pattern intact. This analysis of AI text watermarks is useful background for understanding that distinction.

Why token entropy changes the result

Not every token carries the same amount of watermark evidence. When the next word is nearly forced, as in a fixed phrase, the model has little room to lean toward one choice. The ACL 2024 EWD method assigns greater weight to higher-entropy tokens and reports improved detection performance in low-entropy scenarios. That matters because templated language, deterministic phrasing, and short passages can weaken the usable signal even when a watermark is present. The EWD research paper explains entropy-aware scoring and the limits of uniform token weighting.

Red-green-list detectors, a widely studied research design, replay a keyed token partition, count tokens from the favoured list, and compare the result with what chance would predict. Heavy editing, paraphrasing, reordering, or translation can break token alignment and increase false negatives. For provenance work, preserve the exact sequence. For authorised reuse where you need to reduce the signal, rewrite the sequence itself.

For a broader look at ChatGPT and online identity, see this ChatGPT and AI identity guide. Our guide to how AI text watermarks work covers each provider's documented method in more detail.

Running a Watermark Cleanup in Simple Unmark

Simple Unmark is our product; this section describes how to use it. Start with the original draft, not a version that has already been through several paraphrasers. Keep the source open in another window so you can compare the output with the material you're allowed to reuse.

Follow the paste, clean, copy workflow

1. Paste the draft: Put the text into the input panel. Guests get three free cleans of up to 100 words each. Accounts can clean up to 5,000 words or 60,000 characters at a time, and longer material can be split into chunks. Be careful with tables, citations, or formatting that must stay exact.

2. Pick a privacy mode: Private mode costs 0.1 credit per started 100 words and sends plaintext through the app and rewriting workload to DeepInfra. Confidential mode costs twice as much and encrypts the text from your browser to the workload, bypassing the web backend, though DeepInfra still reads it for the rewrite.

3. Run the cleaner: It removes hidden Unicode artifacts, then rewrites sentence structure, transitions, and vocabulary. The rewrite aims to keep meaning, facts, numbers, proper nouns, tone, and intent while changing the wording. It can't guarantee identical meaning.

4. Inspect the result: Compare it against your source. Check every changed sentence, especially technical definitions, product names, legal language, citations, and numbers. If a sentence comes out awkward, fix it by hand instead of accepting it.

5. Copy only after review: Once the output matches the source in substance and reads naturally, copy it into your working document.

Simple Unmark's AI watermark remover is built around this paste, rewrite, compare, and copy workflow. Treat it as an editing aid. It doesn't grant permission to reuse text, and because we have no access to providers' watermark detectors, we can't measure how much of a watermark remains or predict what any detector will return.

Rewriting Versus Surface Edits for Watermark Reduction

Surface edits change the appearance of text without changing enough of its statistical structure. Replacing “important” with “significant” may alter one token, but the surrounding choices, clause order, sentence rhythm, and sequence-dependent relationships can remain almost identical. Inserting zero-width spaces is even weaker because those characters don't replace the biased word choices that a detector scores.

Deep rewriting changes how the sentence is built. It picks different vocabulary, moves clauses, varies transitions, and sometimes splits or combines sentences. A detector then sees a new token sequence, while the claim stays the same.

Take this illustrative sentence:

The report provides a detailed overview of the system and explains how users can improve their workflow.

A surface edit might become:

The report offers a thorough overview of the system and shows how users can enhance their workflow.

That version changes synonyms, but its structure is nearly untouched. A structural rewrite might say:

Users can improve their workflow by following the system guidance outlined in the report.

The second version changes the clause order and grammatical shape. It still needs a factual review, but it disrupts more of the original sequence.

Factor	Surface Edits, synonyms, ZWSP	Deep Rewriting
Vocabulary	Changes a small number of words	Reconsiders word selection across the passage
Syntax	Usually preserves sentence structure	Rearranges clauses and sentence construction
Hidden characters	Inserting ZWSP adds artifacts; a separate cleanup removes them	Depends on the tool; Simple Unmark runs a Unicode cleanup first
Watermark signal	Can leave much of the original distribution intact	Changes more of the sequence-dependent token choices
Main risk	False confidence after cosmetic cleanup	Meaning, tone, or factual drift if review is skipped
Best use	Formatting hygiene and minor edits	Weakening a probabilistic watermark signal

Paraphrasing isn't automatically deep rewriting. A weak paraphraser can keep the same cadence and information order while making the prose worse. Change the wording, then verify the substance line by line.

Keeping Meaning, Facts, and Tone Intact

A low detector score is worthless if the text no longer says what the source said. Treat watermark cleanup as a controlled editorial pass and don't let the tool improvise.

Before running the rewrite, mark the elements that must survive exactly:

• Proper nouns: Keep people, organisations, products, places, and named systems unchanged unless the source itself contains an error you're authorised to correct.
• Numbers and dates: Compare every figure and date against the original source after cleaning. A changed number is a red flag, especially in technical, financial, academic, or legal material.
• URLs and citations: Preserve links, references, identifiers, and citation text. Don't let a stylistic rewrite turn a precise reference into a vague summary.
• Direct quotations: Keep quoted language verbatim when quotation accuracy matters. Rewritten wording isn't a quotation anymore.
• Tone and reading level: Match the original audience. Tone comes from sentence length, vocabulary, formality, and rhythm, not from forcing casual words into professional copy.

Compare versions as an audit step

Keep the original and cleaned versions side by side. Read for omissions first, then additions, then changed implications. If a sentence now makes a stronger claim, sounds more certain, or assigns responsibility differently, revert it or rewrite it manually.

Don't spend credits on short fragments you can edit safely by hand. Longer passages benefit more from a coherent pass, split into sections when they exceed the limit. If a result reads awkwardly, edit it by hand rather than stacking paraphrases.

Editorial rule: If a fact changed, the cleanup failed, regardless of how natural the paragraph sounds.

For client work, save the original, the cleaned version, and your final human-edited copy. That record protects the content process and makes later fact checking possible.

What Detectors Can and Cannot Catch

Two different kinds of tool get called detectors. A watermark detector uses the provider's key to check text for that provider's pattern. Access is limited: OpenAI's detector is restricted to approved researchers and expert organisations, Anthropic's detection API is in restricted private preview, and Google's public reference implementation only works for matching watermark configurations rather than as a general Gemini checker. A generic AI classifier, the kind most platforms use, guesses from style and has no access to any watermark. Neither gives certainty.

For keyed watermark detection, entropy-aware methods give more weight to informative token choices, and longer passages give the pattern more room to show. Short fragments often produce unclear results. A long passage with only light edits can keep enough of the original token bias to be detected. A rewritten passage may fall below one detector's threshold without proving that no watermark remains.

Treat any detector output as one signal. A positive result doesn't prove authorship, and a low score from a generic classifier doesn't show that a watermark was removed or that a person wrote the text.

Use detection as a review signal

Run checks only after the text has been fact checked and manually reviewed. If the result is unclear, inspect the passage for repetitive syntax, formulaic transitions, and low-information phrasing before making another rewrite. If it's flagged, rewrite the structure rather than inserting invisible characters or swapping isolated synonyms.

A watermark is a generation-time statistical pattern. A detector is an inference system that tries to recognise patterns, and its reliability depends on text length, editing, token alignment, entropy, and the method used. This comparison of AI watermarks and AI detectors explains why the two shouldn't be treated as interchangeable.

Your publishing decision should also account for disclosure rules, platform policies, academic requirements, licensing, and the actual origin of the draft. Reducing a signal doesn't remove those responsibilities.

Practical Checklist Before You Publish Cleaned Text

Review cleaned text as an editor would. Chasing a detector score leads to worse prose. Use this checklist:

1. Read it aloud. Listen for stiff transitions, repeated sentence patterns, missing context, and sudden tone changes. Awkward rewrites are easier to hear than spot on screen.

2. Verify claims against source material. Confirm every factual statement against the original documents, references, product documentation, or approved brief. Cleaning text must not change what the source supports.

3. Check numbers and names character by character where accuracy matters. Compare dates, measurements, statistics, organisation and product names, URLs, and quoted language.

4. Treat detector flags as review prompts. If a passage is flagged, identify the structural problem before running another paraphrasing pass. Rewriting blindly to improve a score usually damages clarity and meaning.

5. Check the length. Confirm that each passage fits the per-clean limit and that you have enough credits for the whole document before you start. Current limits and credit costs are on Simple Unmark.

6. Save both versions. Keep the source draft beside the cleaned output. For client, academic, compliance, and legal work, preserve the review trail.

7. Publish only after a final human check. No rewrite guarantees a particular score from any detector. Accuracy, natural wording, licensing, attribution, and disclosure obligations still belong to the publisher.