01
> source text
Paste the Claude passage
Paste text or upload a .txt, .docx or .pdf. Longer passages give a rewrite more to change, the same way they give a detector more to score.
RESEARCH ROUNDUP, OCTOBER 2026
Does paraphrasing remove Claude watermark? What the studies show
Six published experiments, three vendor statements and one clear pattern. Paraphrasing weakens a text watermark in proportion to how many of the original word choices it replaces, and the paraphraser has to be a different model.
Scan my text free Updated
claude.ai
Today
Rewrite this paragraph about remote work.
Message Claude
MacBook Pro
9:41
ClaudeCleanLocal scanPASTED FROM CLAUDE
SCANNING
…phrases to rewrite
a myriad ofstock phrase1
worth notingfiller opener1
fosteringAI favorite verb1
Light swaps keep most of the signal. Studies show heavier rewrites move it more.
9:41
ClaudeCleanLocal scanPASTED FROM CLAUDE
SCANNING
…phrases to rewrite
a myriad ofstock phrase1
worth notingfiller opener1
fosteringAI favorite verb1
Light swaps keep most of the signal. Studies show heavier rewrites move it more.
Short answer
Light paraphrasing weakens the Claude watermark but rarely erases it. Anthropic says light editing probably won't remove it completely, while a complete rewrite will. In published tests, deep paraphrasing by a different model removed most of a SynthID signal. Asking Claude to paraphrase itself produces newly watermarked text.
THE NUMBERS
How well do text watermarks survive paraphrasing?
Anthropic has published no paraphrasing numbers for Claude. These are the published measurements on related watermarks, including SynthID, the system Claude's mark is a version of.
17%
OpenAI's detection rate on its own mark after 25% of words were swapped, from about 92%
66%
Detection left after only 10% of words were swapped in the same OpenAI test
5.4%
SynthID detection after a DIPPER paraphrase, from 87.6% (5% false positive rate)
57.2%
Green-list detection on GPT2-XL text after DIPPER, from a perfect score (1% FPR)
~800
Tokens needed on average to still catch a strong human paraphrase (1e-5 FPR)
0.01
Drop in detection AUC when 10% of words were replaced by a T5 model (200 tokens)
TOOL BY TOOL
Does QuillBot, Grammarly or ChatGPT remove the Claude watermark?
No public test exists for Claude's mark, because the detector is private. What can be said follows from how each tool changes the words.
Does QuillBot remove the Claude watermark?
Only as far as it replaces Claude's words. The DAMAGE study lists QuillBot among the paraphrasers it audited and describes its output as fluent but flowery, with a high, slightly imprecise vocabulary. It ran the watermark test with DIPPER, not QuillBot, so there is no QuillBot removal number.
Does Grammarly remove it?
Grammar fixes touch a few words per paragraph, the light editing Anthropic says probably won't remove the mark. Grammarly's rewrite features change more text, and DAMAGE rated that output high quality, but the rule stays the same: what matters is the share of Claude's word choices that survive.
What if I ask Claude to paraphrase its own text?
You get fresh watermarked text. Anthropic says the watermark applies to words Claude chooses, and a Claude translation carries it too. The DIPPER authors state the paraphraser must be different from the watermarked model.
CHOOSE THE DEPTH YOURSELF
Pick how much of the wording changes.
ClaudeClean rewrites with a non-Claude model at Light, Medium or Strong depth, up to 3 passes, and shows every change in a diff so you can check the meaning. Rewriting is best effort. No detector result is promised.
- 300 rewrite credits a month
- 20,000 characters per request
- .txt, .docx and .pdf files
EDIT DEPTH VS SIGNAL
How much paraphrasing does it take to remove a watermark?
Nine kinds of edit, from typo fixes to a full rewrite. The evidence column names the test behind each row; where none exists, the effect is stated qualitatively.
| Edit | What changes | Evidence | Expected effect |
|---|---|---|---|
| Typo and grammar fixes | A handful of words per paragraph | Anthropic: light editing probably won't remove it completely | Signal stays largely intact |
| Synonym swaps, about 10% | One word in ten, structure untouched | OpenAI's mark still caught in 66% of 400-token passages | Weakened, still detectable |
| Synonym swaps, about 25% | One word in four, structure untouched | OpenAI's mark caught in 17%, down from about 92% | Mostly gone for OpenAI's mark; Han et al. found SynthID more robust |
| Paraphraser tools (QuillBot style) | Words and phrases, sentences often kept | No public test on Claude's mark; DAMAGE rates QuillBot output fluent but flowery | Depends on mode; light modes keep much of the signal |
| Claude paraphrasing itself | Every word, chosen by Claude again | Anthropic: the watermark applies to words Claude chooses | New text, newly watermarked |
| Translation by Claude | Every word, in another language | Anthropic: a Claude translation carries the watermark | Watermarked in the new language |
| Back-translation by another system | Every word, twice, by a different model | Han et al.: Chinese round trip cut SynthID F1 from 1.00 to 0.711 | Strongly weakened; meaning drifts |
| Deep paraphrase by a different LLM | Most words and much of the structure | DAMAGE: SynthID detection 87.6% to 5.4% after DIPPER | Most of the signal removed |
| Full rewrite in your own wordsRemoves it | Every word, chosen by you | Anthropic: a complete rewrite where every word is replaced will remove it | Removed |
Swipe to compare →
Numbers come from different watermarks, lengths and thresholds. Read the rows as a ranking of edit depth, not as predictions for Claude's mark.
CLIMB THE NINE STEPS
Who chose the words after each kind of edit
Each step is one row of the table above. The grid shows whose word choices make up the text afterwards.
Lightest editDeepest edit
Step 1 of 9
Typo and grammar fixes
- Claude's original word
- Your word
- What changes
- A handful of words per paragraph
- Evidence
- Anthropic: light editing probably won't remove it completely
- Expected effect
- Signal stays largely intact
IN THEIR WORDS
What do the watermark makers say about paraphrasing?
The two statements that matter most, quoted verbatim from the SynthID paper and Anthropic's announcement.
In particular, generative watermarks are weakened by edits to the text, such as through LLM paraphrasing—although this usually does change the text significantly.
Light editing probably won't remove the watermark completely; a complete rewrite where every word is replaced will.
PARAPHRASE WITH A RECEIPT
See exactly how much of the wording changed
A paraphrase you cannot inspect is a guess. This flow shows the before and after side by side.
02
scan report
3 zero-width1 soft hyphencleanable signals2Clear the character layer first
The local scan removes zero-width characters, soft hyphens and look-alike letters. They are not the watermark, but they ride along in copied text.
03
before → after
clearusefulanswerfocusedhelpfulresponse
Copied ✓Rewrite at the depth you need
Light rewords about 35% of words, Medium about 60%, Strong 85% or more, using a non-Claude model. The diff shows what moved, so meaning drift is easy to catch.
PRICING
Clean the text free. Rewrite more with Pro.
The scan and hidden-character cleanup are free. Pro adds room for rewrites and files.
PRO
CLAUDECLEAN PRO
ClaudeClean Pro
$5/ month
Cancel anytime.
- 300 credits every month (≈300,000 characters of rewriting)
- 20,000 characters per request
- Clean .txt, .docx and .pdf files
- Light / medium / strong intensity
- Dashboard with history
Checking account…
Free: 10 credits a month with an account, or try 2,000 characters right here without one. Strong rewrites cost 2× credits.
UNDER THE HOOD
Why does paraphrasing weaken a text watermark?
Six mechanics explain every number on this page.
WORD BY WORD
Each word is one small vote
The detector scores every word against a key and the words before it. A replaced word loses its vote, and because scoring looks at preceding words, it can scramble the next word's score too.
LENGTH
Longer text keeps more evidence
Evidence adds up across words. Kirchenbauer et al. still caught strong human paraphrases once about 800 tokens were available, and Anthropic says short samples are weak.
LEFTOVERS
Surviving phrases leak the signal
Kirchenbauer et al. found paraphrases keep short runs of the original wording. Those runs still carry scored choices, which is why light rewording leaves a detectable trace.
ENTROPY
Factual text holds less signal
Where only one word fits, there is no choice to nudge. Google says SynthID is less effective on factual responses, so dates, names and code carry little signal to remove.
SAME MODEL
The paraphraser must be different
A watermarking model that rewrites its own output picks every new word with the same key. Only a different model or a person breaks that link.
QUALITY COST
Removal and quality trade off
In Kirchenbauer's tests, replacing 30% of words removed more of the mark but roughly tripled perplexity, a sign of clumsier text. Cheap paraphrasing pays in readability.
ONE SENTENCE, THREE VERSIONS
How many of Claude's word choices still vote after a paraphrase
Switch versions. Orange words are Claude choices that still count, grey words are replaced, and dotted words lost their score because the words before them changed.
paraphrase-diff
Claude original
by ClaudeThecommitteereviewedtheproposalcarefullyanddecidedtopostponethefinalvoteuntilthebudgetfiguresareconfirmednextmonth.
Every word here is a Claude choice, and each one is a small vote the detector can count.
21 of 21
Claude choices still voting
0
Words replaced
0
Scores scrambled
21 words
Longest kept run
MacBook Pro
paraphrase-diff
Claude original
by ClaudeThecommitteereviewedtheproposalcarefullyanddecidedtopostponethefinalvoteuntilthebudgetfiguresareconfirmednextmonth.
Every word here is a Claude choice, and each one is a small vote the detector can count.
21 of 21
Claude choices still voting
0
Words replaced
0
Scores scrambled
21 words
Longest kept run
- Claude choice, still votes
- Replaced, vote lost
- Score scrambled by changed neighbors
CONFLICTING RESULTS
Why do paraphrasing studies disagree on watermark removal?
OpenAI's synonym test and Han et al. point in opposite directions. Different watermarks, thresholds and lengths explain the gap.
| Study | Watermark | Attack | Setup | Result |
|---|---|---|---|---|
| OpenAI, 2026 | textGrain (OpenAI) | Synonym replacement | 400-token passages | Detection about 92% before; 66% at 10% swaps; 17% at 25% |
| Kirchenbauer et al., 2023 | Green list (KGW) | T5 span replacement | 200-token texts | 10% of words replaced cut AUC by only about 0.01; 30% worked better but text quality fell sharply |
| Krishna et al. (DIPPER), 2023 | Green list on GPT2-XL | 11B paraphrase model | 1% false positive rate | Detection fell from a perfect score to 57.2%; DetectGPT fell from 70.3% to 4.6% |
| Kirchenbauer et al., reliability, 2023 | Green list (KGW) | Human and machine paraphrase | 1e-5 false positive rate | Still detectable; strong human paraphrases needed about 800 tokens on average |
| Masrour et al. (DAMAGE), 2025 | SynthID on Gemma-2B-IT | DIPPER paraphrase | 200 tokens, ELI5 prompts | TPR 87.6% to 5.4% at 5% FPR; 66.5% to 1.5% at 1% FPR |
| Han et al., 2025 | SynthID Text and others | Synonyms, DIPPER, back-translation | Benchmark of several attacks | Synonyms at a 0.7 ratio: AUC above 0.94; Chinese back-translation: F1 1.00 to 0.711 |
Swipe to compare →
DAMAGE comes from Pangram Labs, which sells AI detection, and Han et al. is a 2025 preprint. OpenAI's numbers are from its own announcement as reported by BleepingComputer.
DIFFERENT MARKS
textGrain is not SynthID
Each scheme spreads its signal differently, so a 25% swap that breaks one mark may leave another standing.
DIFFERENT BARS
1% vs 5% false positives
A stricter false positive limit lowers the catch rate. DAMAGE reports both: 5.4% at a 5% limit, 1.5% at 1%.
DIFFERENT TOOLS
Synonyms are not paraphrases
Dictionary swaps keep sentence structure. Model paraphrasers rebuild sentences, which changes far more scored words.
BEFORE AND AFTER, SIDE BY SIDE
Where each study started and where detection ended up
Black dots are detection before the edit, colored dots after. Pick an explanation to see which results it accounts for.
Every published before and after on this page, on one 0 to 100% detection scale.
textGrain, 10% synonym swaps
OpenAI, 2026 · Synonym swaps
about 92%66%OpenAI, 2026, textGrain, 10% synonym swaps: from about 92% to 66%textGrain, 25% synonym swaps
OpenAI, 2026 · Synonym swaps
about 92%17%OpenAI, 2026, textGrain, 25% synonym swaps: from about 92% to 17%Green list, DIPPER, 1% FPR
Krishna et al., 2023 · Model paraphrase
perfect57.2%Krishna et al., 2023, Green list, DIPPER, 1% FPR: from perfect to 57.2%SynthID, DIPPER, 5% FPR
DAMAGE, 2025 · Model paraphrase
87.6%5.4%DAMAGE, 2025, SynthID, DIPPER, 5% FPR: from 87.6% to 5.4%SynthID, DIPPER, 1% FPR
DAMAGE, 2025 · Model paraphrase
66.5%1.5%DAMAGE, 2025, SynthID, DIPPER, 1% FPR: from 66.5% to 1.5%DetectGPT, not a watermark
Krishna et al., 2023 · Style detector
70.3%4.6%Krishna et al., 2023, DetectGPT, not a watermark: from 70.3% to 4.6%
Scores on a 0 to 1 scale (F1 and AUC)
1.00 to 0.711
SynthID F1 after back-translation through Chinese
Han et al., 2025
above 0.94
SynthID AUC after synonym substitution at a 0.7 ratio
Han et al., 2025
about 0.01
Drop in green-list AUC after 10% of words replaced by T5
Kirchenbauer et al., 2023
TERMS DECODED
What do green lists, z-scores and tournament sampling mean?
The vocabulary in the papers above, in plain language.
- Green list
- In the Kirchenbauer scheme, a key splits the vocabulary into green and red words at each step, and the model is nudged toward green ones. Watermarked text ends up with more green words than chance.
- Z-score
- How far the green-word count sits above what chance predicts. Kirchenbauer used a threshold of 4, which keeps false positives near 3 in 100,000.
- Tournament sampling
- SynthID's method, described in Nature: draw several candidate words, then run knockout rounds scored by keyed functions. The winner is a normal sounding word with a hidden statistical lean.
- Entropy
- How many words could reasonably come next. High entropy leaves room for a watermark; the Nature paper says tournament sampling works less well when entropy is low.
- False positive rate (FPR)
- How often human text is wrongly flagged. Studies fix it at 1% or 5%, then report how much watermarked text is still caught.
- True positive rate and AUC
- TPR is the share of watermarked text caught at the chosen FPR. AUC sums up detection across all thresholds, where 1.0 is perfect and 0.5 is a coin flip.
WHAT DECIDES IT
When does a watermark survive a paraphrase?
The same paraphrase can leave a strong signal in one document and almost none in another.
Signal weakens when
- A different model or a person does the rewording. New words come without Claude's key behind them.
- Sentences are rebuilt, not just re-worded. Structure changes replace far more scored choices than synonyms.
- The passage is short. Fewer words leave a detector less evidence to add up.
- The text is mixed with other writing. Claude's help center lists mixing among the cases where detection can fail.
Signal survives when
- Claude does the paraphrasing or translating. Every new word is a Claude choice again.
- Only a few words are swapped. OpenAI's own mark survived a 10% swap two times in three.
- The passage is long. Thousands of words give a detector enough scored choices even after edits.
- Whole phrases are kept. Surviving runs of original wording still carry the lean.
THREE QUESTIONS
Will the watermark survive your paraphrase?
Answer in order. The flow follows the two lists above to a qualitative outcome, not a score.
Outcome
Answer the questions to reach an outcome.
CHECKING YOUR RESULT
Can you test whether paraphrasing removed the watermark?
Not with any public tool, and a public AI score is a different measurement altogether.
An AI detector score is not a watermark reading
Turnitin, GPTZero and similar tools run their own classifiers. In the DIPPER study, paraphrasing cut DetectGPT from 70.3% to 4.6% while the watermark held at 57.2%, so a low style score says little about the mark.
WHO CAN READ IT
Anthropic's key only
The detection API is in private preview for eligible organizations, per Claude's help center. It indicates likely Claude involvement, not authorship.
THREE ANSWERS
Yes, no and uncertain
SynthID's detector returns watermarked, not watermarked or uncertain. A paraphrase often lands in uncertain rather than a clean no.
WHAT YOU CAN CHECK
Meaning and characters
You can verify the facts survived and that no hidden characters remain. Those two checks are fully in your hands.
WATCH
Green lists to SynthID, explained on video
READ THE ORIGINALS
Sources on paraphrasing and AI watermarks
Primary papers and vendor statements, each linked to the original.
ANTHROPIC
Claude's text watermark
Light edits probably won't remove it; a full rewrite will; Claude translations keep it.
View sourceNATURE
Scalable watermarking for LLM outputs
SynthID Text, tournament sampling, and the paraphrasing caveat.
View sourceBLEEPINGCOMPUTER
OpenAI's EU watermark and synonym test
10% swaps left 66% detection, 25% swaps left 17%.
View sourceARXIV, KRISHNA ET AL.
Paraphrasing evades detectors of AI text
DIPPER, and why the paraphraser must be a different model.
View sourceARXIV, PANGRAM LABS
DAMAGE: humanizers and paraphrasers
SynthID detection 87.6% to 5.4% after DIPPER; QuillBot and Grammarly audited.
View sourceARXIV, KIRCHENBAUER ET AL.
On the reliability of watermarks
Watermarks survive paraphrasing given enough text, about 800 tokens.
View sourceOPENAI
Approach to EU text provenance
textGrain on eligible EU ChatGPT and Codex text; edits make it less reliable.
View sourceGOOGLE AI FOR DEVELOPERS
SynthID text documentation
Survives mild paraphrasing; thorough rewrites and translation cut confidence.
View sourceARXIV, HAN ET AL.
Benchmarking watermark robustness
SynthID held up to synonym swaps; back-translation hurt it most.
View sourceFAQ
Paraphrasing and the Claude watermark: FAQ
Partly. Light paraphrasing leaves much of the signal, and Anthropic says light editing probably won't remove it completely. Deep paraphrasing by a different model removed most of a SynthID signal in published tests, and a full rewrite removes it.
Nobody can show that publicly, because Claude's detector is private. QuillBot swaps words and phrases, so it weakens the signal in proportion to how much it changes. Light modes leave much of Claude's wording, and with it much of the signal.
More than most people expect. OpenAI's test on its own watermark still caught 66% of passages with 10% of words swapped, and 17% with 25% swapped. Anthropic's bar for full removal is a rewrite where every word is replaced.
Grammar and spelling fixes change too few words to matter, which is the light editing Anthropic says won't remove it. Grammarly's paraphrasing features change more, but the same rule holds: the signal fades only as Claude's word choices disappear.
It weakens it, since ChatGPT's words are not Claude's choices. Since October 5, 2026, eligible ChatGPT text in the EU can carry OpenAI's own watermark, so heavy reuse of ChatGPT output can add a different mark.
Not yourself. Only Anthropic's private detector can read the mark, and access is limited to eligible organizations. Public AI detectors score writing style, not the watermark. No detector result is promised.