Can You Remove an AI Watermark? What the Research Actually Shows

Key Pointers

• Published research shows a single round of paraphrasing drops detection on every tested watermarking method below 30%, and OpenAI’s own figures show detection falling from about 92% to 17% when a quarter of the words are swapped.
• The more useful finding is the one nobody advertises: in one 2026 evaluation, the detectors failed on 70% to 83% of their own untouched watermarked text before any attack was attempted.
• Most tools selling “AI watermark removal” for text are scanning for invisible Unicode characters. That’s a different thing entirely, and it has nothing to do with how textGrain, SynthID-Text or Claude’s watermark work.
• “No watermark detected” is close to meaningless. So is “watermark detected,” as a standalone claim. One preprint assessed three methods against courtroom evidence standards and none passed more than two of the five criteria.
• None of this is what gets student work flagged. Statistical AI detectors reading writing style are what schools actually run, and they’re unaffected by any of the above.
• Quetext’s AI Humanizer is a clarity tool. It is not a watermark remover and we don’t position it as one.

Three different things people mean by this question

The question gets asked about three unrelated technologies, and the answers run in opposite directions. Sorting them out first saves a lot of confusion.

A visible watermark on an image. The Meta AI logo in a corner, a stock-photo overlay. This is pixels. Plenty of tools crop or inpaint it, and most of the search results for watermark removal are about exactly this. It has nothing to do with text.

Invisible Unicode characters in copied text. Zero-width spaces, narrow no-break spaces, directional marks. These genuinely do turn up in text copied from some web apps, and a plain-text editor will strip them in seconds. Here’s the thing worth knowing: this is not what the AI labs are doing. Nearly every tool advertising a “ChatGPT watermark remover” is scanning for these characters and finding nothing, because nothing is there.

A statistical watermark in the word choices. This is the real one. OpenAI’s textGrain, Google’s SynthID-Text, and the mark Anthropic applies to Claude all work by biasing which word the model selects at each position, keyed to a secret the lab holds. Nothing is inserted. The words themselves carry the signal. We’ve broken down how AI text watermarking works in detail if you want the mechanism.

Only the third one makes this question interesting. The rest of this piece is about that.

The short answer, with numbers

Statistical watermarks are fragile, and the companies that built them have published how fragile.

OpenAI’s figures for textGrain, measured on 400-token passages at a 1% false positive rate:

What happens to the text	Detection rate
Nothing	about 92%
10% of words replaced with synonyms	about 66%
25% of words replaced with synonyms	about 17%

Length matters as much as editing. The same report puts detection at roughly 80% for a 200-token passage and 95% at 400 tokens, and notes it ran “substantially lower” on mathematics than on psychology content. Short text and formulaic text never carry much signal to begin with.

Google reported the same pattern for SynthID-Text in Nature in 2024: it survives light edits, degrades when text is rewritten or translated, and the paper lists scrubbing, spoofing and stealing as known attack classes. Anthropic’s documentation says plainly that heavy editing, paraphrasing, translation or very short passages can all leave no detectable mark.

So the answer to the headline question is yes, and nobody’s hiding it. The labs published the numbers themselves.

What the independent research adds

Vendor figures describe one system under conditions the vendor chose. Two academic evaluations tested the category more aggressively, and both are worth knowing about.

Paraphrasing beats essentially everything

Liang and colleagues at Stony Brook, NUS and Zhejiang ran a systematic evaluation across 10 watermarking methods and 12 attack types, covering lowercasing, misspelling, synonym swaps, token shuffling, copy-paste mixing, translation round-trips and model-driven rewriting.

Their headline result: a single round of ChatGPT paraphrasing pushed detection below 0.3 for every method tested. A gradient-guided attack using a surrogate detector drove most below 10%.

Individual methods varied a lot. One widely used scheme fell from 0.993 detection on clean text to 0.485 after heavier paraphrasing, and to 0.222 under a translation attack. Another collapsed to roughly 0.025. A couple held up considerably better.

The paper also names the tradeoff that explains why this keeps happening: the methods that preserve writing quality best tend to be the easiest to strip, and the ones that survive rewriting degrade the text. You can have a watermark readers can’t feel, or one that survives rewriting. Not comfortably both.

The finding that changes the question

Here’s where it gets genuinely interesting, and where almost nobody has looked.

A July 2026 preprint by Tamim and Khan assessed three watermarking methods against the standards courts apply to forensic evidence. They tested KGW, Unigram and a research implementation of SynthID-Text through the MarkLLM toolkit, ran 846 valid trials, and scored the results against the Daubert admissibility factors.

Removal worked about as expected: paraphrasing eliminated the mark in 100% of KGW cases, 100% of Unigram cases, and 98.3% for SynthID.

But look at what happened before any attack:

Method	False negatives on pristine, unattacked watermarked text
KGW	70%
Unigram	83%
SynthID (research implementation)	80%

The detectors missed their own untouched watermarked text most of the time. The SynthID implementation returned an uncertain result on 80% of the clean watermarked passages it was given.

False positives showed up too. That same implementation flagged 10 of 184 paraphrased human-written controls, about 5.4%, including a standard typing-test sentence.

None of the three methods satisfied more than two of the five Daubert factors. The authors’ conclusion is blunt: these configurations “do not meet the evidentiary bar that courts require.”

The caveats are real and the authors state them. This is a preprint, not peer-reviewed. It tested research implementations through a toolkit, not Google’s production system, which may behave very differently. The texts were short at 50 tokens, which is exactly the condition where watermarks are weakest, and the pristine sample was small. Treat it as a serious warning about the category rather than a measurement of any shipped product.

Even heavily discounted, it reframes the question. If a detector misses most of its own unmodified watermarked text, then removing the watermark is solving a problem that was barely working against you in the first place.

So what are the “watermark remover” tools actually doing?

Mostly scanning for invisible Unicode characters.

Search for a ChatGPT watermark remover and you’ll find a cluster of sites offering to strip zero-width spaces and hidden formatting marks from pasted text. Those characters are a real artifact of copying from some applications. They are not textGrain, they are not SynthID, and they are not Claude’s mark.

A tool that finds and removes nothing will still report success. That’s not necessarily deception, since it genuinely removed every invisible character it found, which was zero. But it leaves people believing they’ve done something they haven’t.

It’s worth noting one more thing about this corner of the web. Some pages in it assert that paraphrasing is the least effective removal method. The published research says the opposite: paraphrasing is the single most effective attack across the methods tested. If a page gets that backwards, it’s a decent sign nobody checked it against the literature.

Is removing a watermark illegal?

That’s a question for a lawyer, not a blog post, and we’re not one. What we can do is point at what the rules currently say.

The EU AI Act’s Article 50 places marking duties on providers and deployers of generative AI systems. Providers must mark synthetic output in a machine-readable format; certain deployers must disclose AI-generated content. The obligations became enforceable on 2 August 2026, with a grace period to 2 December 2026 for systems already on the market and an interoperability deadline of 2 February 2027.

Those duties sit with the companies building and deploying the systems. The Act is not written as a general prohibition on individuals editing text they possess.

Separately, and more practically for most people reading this: academic integrity policies are their own thing. Whether a watermark survives has no bearing on whether submitting AI-generated work breaches your institution’s rules. Those are independent questions, and the second one is the one that actually carries consequences.

What actually gets work flagged

This is the part worth sitting with, because it’s where the real risk lives and it has nothing to do with watermarks.

No school is checking watermarks. They can’t. As of today there’s no public detector for AI text watermarks from any of the three labs. OpenAI’s is application-only for approved researchers. Anthropic’s is in private preview. Google’s SynthID Detector went public in October 2026 and reads images, video and audio, not text.

What schools run is statistical detection: software that reads your writing and returns a probability score based on how predictable the word choices are. Turnitin, GPTZero, Copyleaks and our own AI content detector all work this way. No secret key, no inside knowledge, just pattern analysis after the fact.

Those tools are completely unaffected by everything above. Strip every Unicode character you like; a statistical detector never looked at them.

They also have well-documented problems of their own, which we’ve written about rather than around: AI detector false positives, detector bias against ESL students, and whether AI detectors are accurate. Several universities have switched detection off entirely, and we’ve covered why some universities restricted AI detectors too.

If you want to see what a reviewer will see before you submit, run your draft through the detector yourself and pair it with a plagiarism check. Read the number as information about how your writing reads, not as a verdict on who wrote it. That applies to our score as much as anyone’s.

Where we stand on this

Quetext sells an AI humanizer, so we should be straight about what it is and isn’t.

It’s a clarity tool. It rewrites repetitive or mechanical phrasing, adjusts tone, and improves how text reads. It is designed to improve writing, not to defeat detection, and we don’t market it as a way around a watermark or a detector score. Anyone promising guaranteed evasion is promising something the published research says nobody can deliver reliably in either direction.

We’d rather be the page that tells you the detectors are shakier than the marketing suggests, including ours, than the page that sells you a fix for a problem you may not have.

What to take away

Three things, in order of how much they should change what you do.

Removal works, and it’s not a secret. Paraphrasing degrades every published method substantially, often below the point of usefulness. The labs documented this themselves.

Detection was already unreliable. The forensic evaluation found detectors missing 70% to 83% of their own pristine watermarked text. A negative result tells you very little, and a positive one isn’t proof on its own.

Watermarks aren’t your actual exposure. Nobody can check them. The thing reading student work is a statistical detector that never sees a watermark at all, and the honest way through that is process evidence: drafts, version history, notes, and being able to talk about your own argument.

The technology that was supposed to settle authorship arguments has turned out to be too fragile to settle anything on its own. Which means the old answer still holds: show your work.

Frequently asked questions

Can you remove an AI watermark from text?

Yes. Published research shows paraphrasing degrades every tested method substantially, with one evaluation finding a single round of rewriting pushed detection below 30% across all 10 methods it tested. OpenAI’s own figures show detection on a 400-token passage falling from about 92% to 17% when 25% of words are replaced with synonyms. Translation and heavy editing have similar effects.

• Paraphrasing is the most effective attack in the literature
• 25% synonym replacement drops detection to roughly 17%
• Very short passages may never carry a detectable mark

Do AI watermark remover tools actually work?

Most text-focused ones aren’t doing what buyers think. They scan for invisible Unicode characters such as zero-width spaces, which are a real artifact of copying from some applications but are not how textGrain, SynthID-Text or Claude’s watermark function. Those use statistical biases in word selection, so there are no characters to strip and nothing for a Unicode scanner to find.

• Unicode scanners and statistical watermarks are unrelated
• A tool finding nothing may still report success
• Image watermark removers are a different product entirely

Is it illegal to remove an AI watermark?

We’re not lawyers and this isn’t legal advice. What’s documented: the EU AI Act’s Article 50 places marking and disclosure duties on providers and deployers of generative AI systems, enforceable from 2 August 2026, rather than prohibiting individuals from editing text. Academic integrity rules are separate and independent, and breaching those carries consequences regardless of any watermark.

• Article 50 duties fall on providers and deployers
• Institutional policies are a separate matter
• Check your own jurisdiction and institution

Does a missing watermark prove a human wrote something?

No, and this is the most common error. OpenAI states directly that absence of a detected watermark does not prove human authorship. The text may be too short, edited, translated, produced by an older model, or generated by a provider that doesn’t watermark at all. One evaluation found detectors missing 70% to 83% of their own unattacked watermarked text.

• No mark does not mean no AI
• A detected mark isn’t conclusive either
• Treat both results as weak signals, not proof

Can schools check my work for an AI watermark?

Not today. No public detector exists for AI text watermarks from OpenAI, Anthropic or Google. OpenAI’s is limited to approved researchers and expert organisations by application, Anthropic’s sits in private preview, and Google’s public SynthID Detector covers images, video and audio rather than text. Schools run statistical AI detectors instead, which never examine a watermark.

• No classroom-ready watermark checker exists
• Statistical detectors are what institutions actually use
• Those read writing style, not hidden marks

Does paraphrasing also beat AI detectors?

Different technology, different answer. Paraphrasing degrades watermarks because it disrupts the word choices carrying the signal. Statistical detectors analyse style, structure and predictability instead, so heavy rewriting changes what they measure without guaranteeing any particular score. It can also make writing worse, and detectors already misfire on clear, formal prose from careful writers.

• Watermarks and statistical detectors work differently
• Rewriting changes the input, not the method
• Good academic writing is already over-flagged

Why would a lab publish how to weaken its own watermark?

Transparency about limits is the point. OpenAI, Google and Anthropic all document where detection fails, because overstating reliability would be worse than admitting fragility. If institutions treated a watermark result as proof, the error rates in the published data would produce serious wrong calls in both directions. Stating the limits is what makes the signal usable at all.

• Published limits prevent misuse of the signal
• All three labs disclaim what a result proves
• Fragility cuts in both directions