STATISTICAL
It lives in word choice
At each step the model has several reasonable next words. The watermark tilts the pick toward a hidden subset, so the text reads normally while the choices carry a pattern.
TEXT WATERMARKS, OCTOBER 2026
AI watermarking explained: how text is marked and detected
Three of the biggest AI companies now watermark the text their models write. None of them add a visible mark or a hidden character. Here is how the signal hides in word choice, how a detector reads it, how long it lasts, and what the law asks for.
Scan my text free Updated
chatgpt.com
Today
Write a two sentence update about the storm closures.
Message ChatGPT
MacBook Pro
9:41
ClaudeCleanLocal scanPASTED FROM CHATGPT
SCANNING
…hidden characters
U+200Bzero-width space2
U+202Fnarrow no-break space1
Hidden characters cleaned. A statistical watermark lives in word choice, so only a rewrite changes it.
9:41
ClaudeCleanLocal scanPASTED FROM CHATGPT
SCANNING
…hidden characters
U+200Bzero-width space2
U+202Fnarrow no-break space1
Hidden characters cleaned. A statistical watermark lives in word choice, so only a rewrite changes it.
Short answer
AI watermarking for text is a statistical pattern a model leaves in its word choices, steered by a secret key. A detector holding the same key counts how often the text follows the pattern and returns a likelihood score. Anthropic (Claude, worldwide), OpenAI (ChatGPT and Codex in the EU) and Google (Gemini) use it in 2026. It needs a few hundred words to read reliably and fades as the words are rewritten.
THE SHORT VERSION
What is AI watermarking?
An AI watermark is a mark a model leaves on its output so its maker can recognize it later. For images that can be metadata or pixels. For text, it is the words themselves.
KEYED
Only the key can read it
The hidden subset changes word by word and depends on a secret key. Without that key the pattern looks like ordinary chance, which is why outside tools cannot check for it.
INVISIBLE
Nothing is added to the text
Anthropic says its watermark adds nothing to the text and no hidden characters. Copy, paste or retype it and the pattern comes along, because the pattern is the wording.
The demo below runs a real, small version of the method from Kirchenbauer et al. (2023), the paper most text watermarks build on. Flip the watermark off and the same sentence slots fill with the model's plain favorites, about half of which happen to be green.
Toy green list watermark
Watch a green list tilt word choice
Next word 1 of 26
- The2.0
- This3.4
- A3.0
- That0.6
Grey is the model's own score. Green words get the +2 bonus, so a green word usually wins.
Green words: 0 of 0
z = 0.00
04
Each green word pushes z up. Human text hovers near zero.
UNDER THE HOOD
How does AI watermarking work in text?
The green list method in five steps. SynthID Text and textGrain differ in how they tilt the pick, but they follow the same outline.
- 01
Seed from the recent words
Before choosing token number t, the model hashes the previous token (SynthID uses the last four) together with a secret key. The result seeds a random generator. - 02
Split the options
That seed splits the vocabulary into a green list, a share γ of all tokens, and a red list. In the paper γ is often 0.25 or 0.5. - 03
Tilt the odds
Green tokens get a bonus δ added to their scores before sampling. A bigger δ makes a stronger mark and a slightly bigger change to the text. - 04
Pick and repeat
The model samples as usual, now leaning green, and moves on. Each new word reshuffles the lists, so no single word gives anything away. - 05
Detect with the same key
A detector rebuilds every green list with the key, counts the green tokens and runs a one-proportion z-test. A high z means the text could not have hit green that often by chance.
Why entropy matters
A watermark can only tilt choices the model has. When the next word is nearly forced, as in code, math, dates or a fixed phrase, there is nothing to tilt. The paper calls this low entropy, and it is why code carries little of Claude's watermark and why short factual answers are hard to check.
THE PART YOU CAN SEE
The watermark hides in word choice. Stray characters don't.
Zero-width spaces and no-break spaces are a separate problem from AI watermarks, and they are the part you can fix in seconds. Paste any AI draft and ClaudeClean flags and strips them in your browser.
- 300 rewrite credits a month
- 20,000 characters per request
- .txt, .docx and .pdf files
FOUR METHODS
Green list, distortion-free, SynthID Text, textGrain
Every deployed text watermark is a variation on one idea: let a key decide which choices count. They differ in how hard they push and what that does to the writing.
| Method | How it marks | Effect on text | How it is detected | Origin and use |
|---|---|---|---|---|
| Green list (KGW) | Hash of the previous token picks a green share γ of the vocabulary; green tokens get a bonus δ before sampling | Shifts word probabilities a little; strength set by δ | Count green tokens, compute a z-score | Kirchenbauer et al., ICML 2023 (research) |
| Distortion-free sampling | A keyed random sequence replaces the sampler's dice, so the pick looks random but is reproducible with the key | Output distribution unchanged on average | Align the text with the key sequence and test the match | Aaronson's 2022 proposal; Kuditipudi et al. 2023 |
| SynthID Text (tournament) | Candidate tokens compete in a knockout of keyed scoring functions, seeded by the last 4 tokens | No significant change in ratings across about 20 million Gemini responses | Average the keyed scores over the text | Google DeepMind, Nature 2024; Gemini app; Claude uses a version of it |
| textGrain | Entropy-calibrated statistical signal in word choice, keyed by OpenAI | OpenAI has not published a quality figure in the coverage we read | OpenAI's restricted detector | OpenAI, EU ChatGPT and Codex since Oct 5, 2026 |
Swipe to compare →
Sources: Kirchenbauer et al. (2023), Kuditipudi et al. (2023), Dathathri et al. in Nature (2024), Anthropic's August 2026 post, BleepingComputer on OpenAI's October 2026 rollout.
Distortion-free methods keep
- The same output distribution. Averaged over keys, the model writes exactly what it would have written unmarked.
- Edit tolerance. Kuditipudi et al. detected marks from about 35 tokens even after 40 to 50% of tokens were randomly edited.
- A route to production. SynthID Text, which offers a non-distortionary mode, reported 0.57% added latency in the Nature paper.
Biased green lists trade
- Some quality for strength. A bigger δ is easier to detect and changes word choice more.
- Visible shifts at high strength. Pushed hard, a watermark can favor odd synonyms on low-entropy text.
- Simplicity for openness. The method is easy to run and to explain, which also makes it easier to study and attack.
DETECTION
How is an AI watermark detected?
With a z-score. The detector does not need the model, the prompt or the original output. It needs the text and the key.
z = (G - γT) / √(T · γ · (1 - γ)) T = tokens checked G = tokens that landed on the green list γ = share of the vocabulary that is green (0.25 or 0.5 in the paper) z > 4 ⇒ false positive chance ≈ 3 in 100,000 (one-sided)
Human text, written without the key, lands on green at about the rate γ, so its z hovers near zero. Watermarked text lands on green more often, and because z grows with the square root of length, every extra sentence adds evidence. That single fact explains most of the limits you will read about below.
1.6%
At most this share of watermarked 200-token texts missed at δ = 2, z = 4 (8 of 500)
Length decides everything
Slide the text length, watch the z score
Detector says
z = 5.4
Watermark detected
Tokens needed for z = 4
34 tokens
At 55% green words against a 25% baseline.
Real deployments do not publish their thresholds
The paper's numbers come from research models with known settings. Anthropic gives no false positive rate for Claude and says detection doesn't work well on small samples. OpenAI's published figures use a 1% false positive rate. Treat any vendor result as a likelihood, never a verdict.
ROBUSTNESS
Do AI watermarks survive paraphrasing and translation?
Partly. Light edits leave most of the signal. Heavy rewording, translation and full rewrites wear it down, and the published numbers show how fast.
Published numbers
Swap a few words and detection drops fast
- No editsabout 92% of watermarked passages caught92%
- 10% of words swapped for synonymsabout 66%66%
- 25% of words swapped for synonymsabout 17%17%
| Edit or attack | Effect on the watermark | Published result |
|---|---|---|
| Light human edits | Most of the signal survives on longer text | Anthropic: light editing probably won't remove its watermark completely |
| Synonym swaps | Detection falls with every word changed | OpenAI: about 92% caught, 66% at 10% swapped, 17% at 25% swapped (400 tokens, 1% FPR) |
| Strong human paraphrase | Signal thins out but can still add up over long text | Kirchenbauer et al.: detected after about 800 tokens on average at a 1e-5 false positive rate |
| Model paraphrase (DIPPER) | Rewords whole passages; weakens watermarks and detectors | Krishna et al.: DetectGPT accuracy fell from 70.3% to 4.6% at 1% FPR |
| Translate and translate back | One of the strongest attacks in the literature | He et al., ACL 2024: AUC dropped to random-guessing level |
| Full rewrite, every word replaced | Removes the pattern, by definition | Anthropic: a complete rewrite where every word is replaced will remove it |
Swipe to compare →
Each result comes from a different method, model and threshold. They show direction and size, not a single scale. More on edit depth in our paraphrasing guide.
OpenAI's 2024 statement, reported by Engadget, said its method held up against local tampering such as paraphrasing but was weaker against global changes: translation, rewording with another model, or inserting a character between every word and deleting it afterward. For a Claude-specific walkthrough of edit depth, see does paraphrasing remove Claude's watermark.
THREE KINDS OF MARK
AI watermark vs C2PA metadata vs hidden characters
People use one word for three unrelated things. They live in different places, need different tools to see, and come off in different ways.
Three different marks
Metadata, hidden characters, word choice
Pasted into a doc
Crews hauled fallen trees from the local roads.
Metadata (C2PA)
A signed manifest attached to a file: image, video, audio, document.
Not presentNo file, no manifest. Plain copied text carries none.
Hidden characters
Invisible code points inside the string, such as U+200B or U+00A0.
Still thereRide along with the copied text.
Statistical watermark
Which words were picked. Nothing is added to the text.
Still thereTravels along. The mark is the wording itself.
| Mark | Where it lives | Who uses it | Who can see it | What removes it |
|---|---|---|---|---|
| Statistical watermark | The choice of words | Anthropic, OpenAI (EU), Google Gemini | Only with the vendor's key | Real rewording; light edits leave most of it |
| C2PA metadata | A signed manifest attached to a file | Images, video, audio and files; Anthropic uses it for Claude images and files | Any C2PA reader, if the manifest is still attached | Can be lost when a file is re-saved, screenshotted or its content copied out |
| Hidden Unicode | Invisible code points inside the string | Nobody announces these; they come from copy paths, editors and quirks | Any character scanner | Delete them; the visible text does not change |
Swipe to compare →
C2PA is the open Content Credentials standard for signed file metadata. Anthropic says Claude images and files carry C2PA metadata only, while Claude text carries the statistical watermark.
Hidden characters get blamed for being a watermark because they are the one thing you can find yourself. Our guide on Claude watermark vs hidden characters lists the usual code points, and the zero-width space guide shows where U+200B comes from. You can also paste text into the ClaudeClean scanner to see them highlighted.
WHO DOES IT
Who watermarks AI text in October 2026?
Three of the big chat assistants, each with its own key and its own detector access. The full vendor table, with regions and defaults, lives in our comparison guide.
May 2024
Google: Gemini text gets SynthID
DeepMind extended SynthID to text from the Gemini app and web, then published the method in Nature that October. Our SynthID guide covers Google's side in depth.Aug 14, 2026
Anthropic: Claude text, worldwide
New Claude models watermark their text with a version of SynthID Text, and Anthropic applies it globally because it cannot scope the mark by region yet. Details in the Claude watermark hub.Oct 5, 2026
OpenAI: ChatGPT and Codex text in the EU
OpenAI started adding textGrain to eligible EU output, with an API opt-in worldwide, per BleepingComputer and TechCrunch.
The full vendor comparison is one click away
This page explains the method. For which models are covered, which regions, whether you can opt out and who can check, see ChatGPT vs Claude watermark, which also covers Meta, Mistral and others.
THE LAW
What does the EU AI Act require for AI text?
Machine-readable marking that can be detected. The law does not name a technique; for text, the providers that have shipped so far chose statistical watermarks.
Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, shall ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated.
Rules and rollouts
From a Google pilot to an EU deadline
rules.example/ai-marking
Rollout · Google DeepMind
May 14, 2024
Gemini text gets SynthID
Google DeepMind extends SynthID to text from the Gemini app and web experience.
Legend
Law or rule
Company rollout
Still ahead
MacBook Pro
rules.example/ai-marking
Rollout · Google DeepMind
May 14, 2024
Gemini text gets SynthID
Google DeepMind extends SynthID to text from the Gemini app and web experience.
| Where | Rule | Covers text? | In force |
|---|---|---|---|
| European Union | AI Act Article 50(2): machine-readable, detectable marking of synthetic outputs | Yes, text is named | Aug 2, 2026; Dec 2, 2026 for systems already on the market |
| China | Labeling Measures from CAC, MIIT, MPS and NRTA: explicit labels plus implicit labels in metadata | Yes, explicit labels cover text | Sep 1, 2025 |
| California | AI Transparency Act (SB 942, amended by AB 853) for services with over 1 million monthly users | No. The law says it does not apply to AI-generated text | Aug 2, 2026 |
Swipe to compare →
Article 50(2) exempts AI that only assists standard editing or does not substantially alter the input, and uses authorized by law to detect or investigate crimes.
The dates come from Article 50 and iubenda's summary of the AI omnibus, which moved the deadline for systems already on the market to December 2, 2026. The Commission's Code of Practice on transparency of AI-generated content, signed by about 190 organizations, sets out how signatories plan to meet the rule.
WHO CAN CHECK
Who can detect an AI watermark?
Only the company that holds the key, plus whoever it lets in. That is a deliberate design choice, and it shapes everything else.
What a real check returns
A likelihood, never a yes or no
- Length: the pattern is spread thin, so short text cannot carry enough of it.
- Edits: light changes leave most of it. Replacing every word leaves none.
- Scope: one company's key reads one company's mark.
10:10
Check this text
Private keyPasted · about 600 tokens
The storm rolled across the town on Monday, so several schools closed early while people remained indoors as crews hauled fallen trees from the local roads. By evening the county had reopened two of the three highways...
Checking word patterns
Can I check text for an AI watermark myself?
Not for Claude, ChatGPT or Gemini text. Anthropic's detection API is in private preview for eligible groups such as regulators, media, fact-checkers, researchers and educators. OpenAI limits its text detector to approved researchers. Our Claude watermark detector guide covers how to request access.
Do Turnitin, GPTZero or other AI detectors read watermarks?
No. They estimate from writing style and do not hold any vendor's key. That is a different kind of test with different error rates, covered in can Turnitin detect Claude.
Can one company's key read another company's watermark?
No. Each key rebuilds only its own pattern. Anthropic says its detector answers one question: what is the likelihood this text was partly written by Claude. Text from another model, or from a person, simply scores low.
Why not make the detector public?
A public detector lets anyone test edits until the mark is gone, and lets attackers learn the pattern. Jovanović et al. showed that for under $50 an attacker could both spoof and scrub some research watermarks with over 80% average success by querying the model. Kirchenbauer et al. also describe running detection privately, behind an API.
WHAT YOU CAN FIX
Clean the characters, then decide about the words
ClaudeClean is not a watermark detector. It handles the visible-to-a-scanner part of AI text, and offers a rewrite if you want the wording changed.
01
> source text
Paste a draft or drop a file
Any AI text works: Claude, ChatGPT, Gemini or a mix. Up to 2,000 characters without an account, or a .txt, .docx or .pdf file within your credits.
02
scan report
3 zero-width1 soft hyphencleanable signals2Scan and clean in your browser
Zero-width characters, no-break spaces, soft hyphens and lookalike letters are flagged and removed locally. The text never leaves your device for this step.
03
before → after
clearusefulanswerfocusedhelpfulresponse
Copied ✓Rewrite only if you choose
Light, Medium or Strong passes send the text to OpenAI to reword it, with a before and after diff. It changes word choice, but no detector result is promised.
PRICING
Clean the text free. Rewrite more with Pro.
The scan and hidden-character cleanup are free. Pro adds room for rewrites and files.
PRO
CLAUDECLEAN PRO
ClaudeClean Pro
$5/ month
Cancel anytime.
- 300 credits every month (≈300,000 characters of rewriting)
- 20,000 characters per request
- Clean .txt, .docx and .pdf files
- Light / medium / strong intensity
- Dashboard with history
Checking account…
Free: 10 credits a month with an account, or try 2,000 characters right here without one. Strong rewrites cost 2× credits.
THE CASE AGAINST
Limits and criticism of AI watermarking
Watermarks are the most robust provenance signal for text we have, and researchers who build them are also the loudest about the gaps.
LENGTH
Short text stays a guess
A tweet, a subject line or a two-line answer cannot carry enough green tokens to clear a strict threshold. Watermarks are a tool for essays and articles, not single sentences.
ENTROPY
Code and facts carry little signal
When there is one right next token, there is nothing to tilt. Anthropic says code gets less watermarking, and the SynthID paper reports weaker detection on low-entropy text.
TRANSLATION
Global rewrites erase it
Translating with another model and back reduced detection to random-guess level in an ACL 2024 study, without hurting the text. Anthropic does watermark translations Claude itself produces.
SPOOFING
Marks can be forged
If a pattern can be learned, it can be stamped onto human text. Watermark stealing research did this for some schemes, which is why a hit is evidence, not proof.
FAIRNESS
Who gets flagged
OpenAI said in 2024 that text watermarking could stigmatize AI as a writing aid for non-native English speakers. A watermark measures model involvement, not intent or honesty.
COVERAGE
Open models are out of reach
A watermark only covers models whose makers turn it on. Open-weight models run on your own hardware, and services that never signed up, produce unmarked text.
What a watermark can show
- A specific model was involved. With enough text, a high score is strong evidence that a vendor's model generated part of it.
- Without hidden data. No metadata or characters to strip; the evidence survives copy and paste.
- At scale. Platforms and researchers with access can check large volumes of text cheaply.
What a watermark cannot show
- That a person did not write it. OpenAI says the absence of a watermark does not prove human authorship.
- How much a person wrote. A hit says part of the text came from a model, not which part or how much.
- Anything about intent. Using AI is allowed in many settings; the mark says nothing about disclosure or permission.
If you have been accused of using AI on work you wrote, a watermark claim should come with the detector, the key holder and the score. Our guide on how to prove you didn't use AI covers drafts, version history and what to ask for.
MYTHS
Common misconceptions about AI watermarks
Most confusion comes from mixing up text watermarks with image watermarks or with hidden characters.
MYTH
"The watermark is a hidden character"
Statistical text watermarks add no characters. Hidden Unicode in AI text exists, but it is a separate artifact, and deleting it leaves the watermark untouched.
MYTH
"Any AI detector can see it"
Only the key holder can test for a watermark. Public detectors score style and guess; they cannot read the pattern.
MYTH
"A positive result proves cheating"
It shows a model was involved with some probability. Whether that use was allowed is a policy question the watermark cannot answer.
MYTH
"Changing a few words removes it"
The signal is spread over every word. Light edits leave most of it in place; OpenAI needed a quarter of words swapped before its detection rate fell to 17%.
TERMS
AI watermarking glossary
The words you will meet in papers and vendor posts, in plain language.
- Token
- The unit a model writes in: a word, part of a word or a punctuation mark. English averages a bit under one word per token.
- Green list / red list
- The keyed split of possible next tokens. Green ones get favored while the model writes; the detector counts them later.
- γ (gamma)
- The share of the vocabulary that is green at each step, such as 0.25 or 0.5.
- δ (delta)
- The bonus added to green tokens before sampling. Higher means stronger and easier to detect.
- z-score
- How many standard deviations the green count sits above what chance would give. The original paper used z > 4 as its cut-off.
- Entropy
- How many real choices the model had at a step. High-entropy prose carries a strong mark; low-entropy code or facts carry little.
- Distortion-free
- A watermark that leaves the model's output distribution unchanged on average, such as the exponential minimum sampling of Kuditipudi et al.
- Tournament sampling
- SynthID Text's method: candidate tokens compete in rounds scored by keyed functions, and the winner is emitted.
- False positive rate
- How often unmarked text gets flagged anyway. It is set by the threshold and is the number to ask about first.
- C2PA
- An open standard for signed provenance metadata on files. It covers images, video, audio and documents, not plain copied text.
WATCH
See a text watermark built from scratch
Computerphile walks through the SynthID approach and a working implementation, which pairs well with the toy demo at the top of this page.
SOURCES
Where these facts come from
Peer-reviewed papers and preprints first, then vendor announcements, then law and reporting.
arXiv / ICML 2023
A Watermark for Large Language Models
Kirchenbauer et al. The green list method, the z formula, z > 4 at a 3×10⁻⁵ false positive chance, 16 and 25 token results.
View sourcearXiv
On the Reliability of Watermarks for Large Language Models
Kirchenbauer et al. Detection after strong human paraphrasing at about 800 tokens on average.
View sourcearXiv / TMLR
Robust Distortion-free Watermarks for Language Models
Kuditipudi et al. Detection from about 35 tokens after 40 to 50% random edits.
View sourceNature
Scalable watermarking for identifying large language model outputs
Dathathri et al., Oct 2024. SynthID Text tournament sampling, about 20 million Gemini responses, 0.57% latency.
View sourceAnthropic
Claude text watermark explainer
Aug 14, 2026. Worldwide rollout, a version of SynthID Text, no hidden characters, private detection API, limits.
View sourceBleepingComputer
OpenAI is adding invisible watermarks to ChatGPT and Codex text in the EU
Oct 5, 2026. textGrain rollout and OpenAI's detection numbers at 1% false positive rate.
View sourceGoogle DeepMind
SynthID
SynthID covers text from the Gemini app and web experience. Open-source code on GitHub.
View sourcearXiv / ACL 2024
Can Watermarks Survive Translation?
He et al. The CWRA translation attack cuts detection AUC to random-guess level.
View sourcearXiv
Watermark Stealing in Large Language Models
Jovanović, Staab, Vechev. Spoofing and scrubbing for under $50 with over 80% average success.
View sourcearXiv
Paraphrasing evades detectors of AI-generated text
Krishna et al. DIPPER drops DetectGPT from 70.3% to 4.6% accuracy at 1% FPR and also evades watermarking.
View sourceEU AI Act
Article 50: Transparency obligations
Machine-readable marking of synthetic audio, image, video and text, with exemptions. Applies from Aug 2, 2026.
View sourceLoeb & Loeb / Morgan Lewis
China's labeling Measures and California's disclosure rules
China from Sep 1, 2025, text included. California from Aug 2, 2026, text excluded.
View sourceAlso used: Morgan Lewis on California, iubenda on the AI omnibus, Claude help center, TechCrunch, Engadget on OpenAI's 2024 statement, Google's SynthID Text docs, SynthID Text on GitHub and C2PA.
FAQ
AI watermarking FAQ.
AI watermarking is a way for an AI company to mark what its model generates so the company can later recognize it. For text, the mark is a statistical pattern in which words the model picks, set by a secret key. Nothing visible or invisible is added to the text, and only someone holding the key can test for it.
While the model writes, a keyed function nudges each word choice toward a hidden subset of options. Kirchenbauer et al. call that subset the green list; Google's SynthID Text runs a tournament between candidate words instead. A detector with the same key counts how often the text lands on the favored options and turns that into a score. Unmarked text lands there about as often as chance, marked text far more often.
No. As of October 2026, Anthropic watermarks text from its newer Claude models worldwide, OpenAI watermarks eligible ChatGPT and Codex text for EU users, and Google marks Gemini app and web text with SynthID. Other models, older outputs and open-weight models you run yourself may carry no watermark at all. Very short replies and code carry little or none of the pattern.
Usually not. Each company keeps its detection key private. Anthropic's detection API is in private preview for eligible organizations such as researchers, media and educators, and OpenAI's text detector is limited to approved researchers. Public AI detectors guess from writing style; they do not read these watermarks.
It weakens it, in proportion to how much changes. OpenAI reported that swapping 25% of words for synonyms dropped its detection rate from about 92% to about 17% on 400-token passages. Anthropic says light editing probably won't remove its watermark, while a complete rewrite where every word is replaced will. Translation with another model weakened research watermarks to near chance in one ACL 2024 study.
Statistical text watermarks do not. Anthropic says nothing is added to the text and there are no hidden characters. Zero-width spaces or no-break spaces you find in AI text are a separate issue from copy paths, editors and model quirks, and a character cleaner removes them without touching the watermark.
In the EU, yes. Article 50(2) of the AI Act, which applies from August 2, 2026, requires providers of generative AI to mark synthetic audio, image, video and text in a machine-readable, detectable way. Systems already on the market before then have until December 2, 2026 under the AI omnibus. China requires labels on AI content since September 1, 2025. California's disclosure law excludes text.
More than a sentence. In the original green list paper, a watermark could show up in as few as 25 tokens of unedited text. After strong human paraphrasing, the same authors needed about 800 tokens on average. Anthropic says detection doesn't work well on small samples, and OpenAI's own numbers were measured on 200 to 400 token passages.
ClaudeClean is not a watermark detector. It finds and removes hidden Unicode characters in your browser, and its optional rewrite sends text to OpenAI to reword it. Rewording changes word choice, which is what a statistical watermark depends on, but no detector result is promised.