An affordable AI text watermark remover: the research and the implementation

Imagine you wrote a text yourself, from the first word to the last, and handed it to a model (Claude/ChatGPT/Gemini) only to translate it, say, into another language. Or you took a post you had written by hand for one social network, or a transcript of a talk you gave, and asked an AI to turn it into a post for LinkedIn or Reddit. Any touch of a large language model will soon start adding invisible signals to your text that make it easy to tell the text was generated by a neural network. And that mark will not tell anyone whether you wrote the substance yourself, did the research, put your own experience into words (and assembled it into a readable text for a specific purpose), or simply typed the prompt “write an interesting LinkedIn post”: to an outside observer the mark looks the same.

Judging by the comments under my previous Reddit post, which collected 150k+ views (the post accompanied an article where I gathered everything known about text watermarks at the moment), some people think watermarks are a good thing, and some consider them a serious violation of their digital freedom and do not want any trackers or marks in their texts. I belong to the second group, so I did two things. First, I checked that removing a watermark from your own text is not forbidden by any law for an individual (Article 50 of the European AI Act requires marking synthetic text only from the AI providers themselves; the only obligation that reaches users is a separate duty to disclose AI-generated text published without editorial review on matters of public interest, and there is no ban on removing the mark from your own text). Second, I decided to work the technical side out myself.

• Is it possible today to reliably check whether a generated text carries a watermark?
• Is it possible to remove a watermark in some relatively cheap way (without relying on loud claims by people on Twitter who vibe-coded some watermark remover with no evidence that it works at all)?
• Is it possible to verify that the watermark was removed?
• How badly does the text degrade after removal, and what has to be checked in the text afterwards?
• Build a working watermark remover for myself and share it with the community (links to the open-source repository and the live demo are at the end).

1. How a watermark works, in plain words

There are no invisible characters or hidden spaces in the text. The watermark lives in the choice of words itself. When a model writes, at every step it has several suitable next words, and normally it picks between them almost at random. Take a die that has been weighted a little: it can still land on any side, but one side comes up slightly more often. A watermark does roughly that to word choice. Among equally good options the model picks a little more often the ones that sit on a secret list, and the list itself is recomputed each time from a secret key and a few previous words.

On one word the bias is invisible. On five hundred words, anyone holding the same key sees it clearly. The detector walks through the text, recomputes the list for every word from the key and the preceding words, and counts how often the choice matched it. If the matches are noticeably above half, the text is marked. The model itself does not need to run for this; all you need is the text, the key and the same way of splitting text into tokens.

This is a simplification, but it carries the essential part accurately. The DeepMind team described its SynthID Text scheme in Nature in 2024 and published the code. That is the scheme I reproduced, because today it is the only text watermark known to run in a mass product (Gemini). On 14 August 2026 Anthropic announced that future Claude models will carry a mark, that it is a version of the same SynthID Text, and that a detection API will come later; the rollout is promised over the coming months. OpenAI has not deployed a text watermark yet. I keep the current statuses in a table in the previous article.

The same mechanism leads to a conclusion I will keep repeating. The detector’s score means agreement with one specific key. It does not say “what percentage of the text was written by AI”, and it cannot tell a translation of your own text from a text the model invented from scratch.

2. How I simulated applying the watermark

At first I took the easy road and built a toy mark: a list of synonym pairs (big / large), with the key deciding which member of the pair to use. It ran on a CPU, it was transparent, and experiments on it were fast. The result was odd: translation and paraphrase removed such a mark, light synonym edits did not, and at the same time it was clear that this proved nothing about the real mark. The real mark is smeared as a weak bias over thousands of consecutive choices and depends on context every time. The toy scheme was answering the wrong question.

So I reproduced the scheme from the DeepMind paper. The transformers library contains the reference implementation of SynthID Text: it plugs into generation and at each step slightly shifts the probabilities of the next token based on the key and a few previous tokens. I set my own key, generated a corpus with that shift, and for every text produced a paired clean control from the same prompt and the same seed but without the mark. That gave me pairs of “marked text” and “the same text without the mark”, and I could honestly measure how much signal survived any processing.

The first corpus I made with the tiny Qwen2.5-0.5B-Instruct on an RTX 4090. That was a mistake, and it cost me the most time. A small model with free word choice could not hold a long English report together: the texts jumped into Cyrillic and Chinese characters and contained fragments of nonexistent words. When such a text is handed to a rewriter with the instruction to keep every number and claim, the rewriter has one safe move left, and that is literal copying. I got the handsome result “the mark survived 177 of 181 rewrites”, nearly published the conclusion that no remover was possible, and only then saw that all the residual signal sat in the copied chunks.

pavement, cosmic number~RúB.B5.N иметь any opportunity that departs, web browser files must synthesize within day.

The final corpus was written by Qwen2.5-14B-Instruct in float16 on a single NVIDIA A40 rented on RunPod for $0.44 per hour. Two generation runs took about half an hour and cost under 25 cents. The result was ten coherent fictional reports of 500 to 600 words: a library switching to a digital visitor log, a repair cafe tracking appliances that come back twice, and so on. Obvious internal contradictions like “55 plots available, 65 allocated” I fixed with targeted replacements: 24 edits across eight of the ten documents, in the marked texts and in their clean twins, rerunning the detector after every edit. Qwen only wrote the sources here; the key and the mark do not depend on it.

3. Which removal methods exist in the literature

Attacks on text watermarks have been studied since 2023, when the first scheme of this kind appeared (the “green list” paper by Kirchenbauer and colleagues). The strongest known move is the same across all authors: make another model rewrite the text. A dedicated model was even built for it, DIPPER, with 11 billion parameters (Krishna and colleagues, 2023), which can paraphrase with an adjustable strength of change and was built specifically to evade detectors.

The most relevant work for me came out in December 2024 from Martin Vechev’s group at ETH Zurich (Jovanović, Gloaguen, Vechev). They tested SynthID Text specifically, used that same DIPPER as the baseline rewriter, and reported that the success rate of “scrubbing” the mark exceeds 90%. They counted a case as a success when the detector missed the mark at a very strict false-alarm threshold and the automatic meaning-similarity metric P-SP rated the paraphrase as good. Remember that metric, I will come back to it.

I took four simple methods and one hard one. The simple ones: light synonym replacement, a full paraphrase, translation into German and back, translation into Chinese and back. All four were run by the same model, Qwen3.7 Plus from Alibaba, through an API at temperature zero; all forty transformations cost about 7 cents. The hard method, DIPPER, I had to deploy myself: I brought the published model up on RunPod on an NVIDIA A100 80GB at $1.39 per hour; the run over ten texts took about six minutes and cost under 14 cents. The settings came from the ETH work.

One more trap that is often forgotten. The rewriting has to be done by a model that does not apply the same kind of mark itself. Otherwise you wash one mark off and immediately get another. Qwen through the API did not add the mark I was studying in my experiment, and the safest option is open weights on your own hardware, where you control the generation procedure.

4. How watermarks are detected and how quality was checked

My detector was exactly the one described in section 1: it walks through the tokens, computes the “list” from the key and the preceding tokens, and counts the share of matches. The main question is where to put the threshold. Clean text matches about half the time, marked text noticeably more, and between them you need a boundary that clean text almost never crosses. I calibrated it on a hundred thousand random key tables for each text and got a threshold at which clean text triggers falsely in one case out of a hundred. On the ten pairs of the corpus the detector found the mark in all ten marked texts and in none of the clean ones.

Here was the second trap. My first threshold, taken from the old corpus, was one I believed to be a one-percent threshold, but in fact it gave about five percent false alarms. If you see someone’s “remover” or “detector” quote a threshold without describing the calibration, that is a reason not to trust the numbers.

Removing the mark is not enough; the text has to remain your text with the same facts. How do you check that, when an automatic similarity metric can miss a swapped date? Here is what I did. Before any transformation, for each source I fixed ten verifiable claims: names, dates, quantities, causal links, problems, outcomes, recommendations. Then four models from four different companies read every result blind. A judge received one source and one candidate, did not know how the text had been produced, and for each of the ten claims answered: preserved, changed or missing. A claim counted as preserved if at least three judges out of four said so. Separately, the judges rated readability and usability on a 0 to 100 scale in steps of 10.

Here I stepped on the third trap, and it deserves a detailed account, because it concerns anyone who checks texts with models. In the first version of the panel, three judges out of four saw all five candidates of one document in a single prompt. An independent reviewer showed that this way judges carry errors from one neighbour to another: in one document GPT-5.6 attributed to the plain paraphrase two changes (“nearly 24%” became “exactly a quarter”, “from $34 to $30” became “from $36 to $32”) that DIPPER had actually made. That was the only fact out of a hundred the paraphrase had lost. I threw that panel away entirely and re-judged all 200 pairs from scratch, one candidate per prompt.

Before the rerun, every judge went through a canary of three prompts: a byte-for-byte identical text, a text with five deliberately corrupted facts, and an empty text. Claude Haiku 4.5 gave the empty text 10 out of 10 and 100% usability and found only 2 of the 5 corruptions; Grok 4.20 also credited the empty text with all ten claims. I replaced both: the final panel is GPT-5.6 Luna, Claude Sonnet 5, Gemma 4 31B and Grok 4.6, and all four passed the canary completely. The rerun of the panel cost 92 cents.

The final score of each text equals the worst of four required scores: signal removed, facts preserved, readability, usability. If the mark is removed but facts are lost, that result is useless, and the other way round.

5. What the results were

Method	Mark removed	Facts	Usability	Total
Light synonym edits	20%	100%	98%	49.6%
Full paraphrase	100%	100%	98%	93.6%
Round trip via German	0%	98%	97%	63.2%
Round trip via Chinese	0%	87%	83%	61.6%
DIPPER from the paper	100%	77%	73%	71.0%

This is a test of the published SynthID Text algorithm with a reference key, not of Gemini's private production detector or a future Claude detector. The corpus is ten fictional reports in one length range, so 10 out of 10 describes only this sample. The share of signal removed is not the share of text written by a human or by a model.

Verified 2026-08-22. Judges: OpenAI, Anthropic, Google, xAI.

The full paraphrase removed the mark in all ten texts, took away on average 94.5% of the original signal, and kept all 100 of the pre-registered claims. DIPPER also removed the mark in all ten and took away 94.7% of the signal, but lost 23 claims out of a hundred, nearly one in four, and the judges rated the usability of its texts at 73%. Neither round-trip translation removed the mark in a single text: the German route took away 63% of the signal, the Chinese route 62%, and that was not enough. Light synonyms removed the mark in two texts out of ten.

Translation surprised me the most, and the explanation is visible in the data. Back-translation restores the same familiar English phrasing that was in the source: after the German route 45% of five-token sequences match the original, after the Chinese route 36%. Together with the phrasing, the other die’s rolls come back. Paraphrase leaves only 9% of such sequences.

Now about P-SP, the metric used at ETH. For DIPPER it is 91%, meaning that by that metric its texts are close to the source. By facts, 77% was preserved. A shared topic and similar vocabulary do not guarantee that a number, a date or a cause stayed the same. The ETH result “DIPPER removes SynthID in more than 90% of cases” held up for me, 10 out of 10. Where we part is the word “success”: I need a text that can be handed to a person without checking it against the source.

The optimal method in this sample turned out to be the most ordinary full paraphrase by a model that does not add a mark. It was the only one that both removed the mark in every text and kept every verifiable claim; its final score is 93.6% against 71% for DIPPER and 62 to 63% for the translations. “100 out of 100” here means one hundred pre-selected composite claims as decided by a majority of judges, not a full inventory of every fact in the text; all 34 non-unanimous votes were later checked against the texts (more on that in section 6), and for the paraphrase not one of them was confirmed as an error.

About the limits. This is a test of the published scheme with my own key on ten fictional reports of one length. Google’s key is private and there is no public text detector for Gemini, so nobody can verify the removal of the actual production mark. Short texts behave differently: the fewer the words, the weaker the accumulated signal and the noisier any conclusion. The whole paid budget of the final table, including the re-judged panel, stayed under $1.13; the code, corpus, prompts, model outputs and judge decisions are in the repository.

6. How to review the result without collecting errors

For every “changed” status the judges wrote down what exactly changed, and those notes show what breaks most often. All the examples below are real, from my ten texts and the final panel. Here is what I now check in a rewritten text, and in what order.

Numbers and dates. This is the first thing to drift. DIPPER turned the tablet cost “about $7,500” into “$7,000”, the satisfaction rise “from 78% to 83%” into “from 76% to 83%”, “nearly 85%” into a precise “84.9%”, and split the total “nearly $3,500” into “$3,000 plus $500 for training”, although no such breakdown exists in the source. Every number and every date from the source must be found in the result with the same value, with no added precision and no added hedges.

Names, titles and roles. After the Chinese round trip “Florence Heights Middle School” became “High School”, and “president Johnathon Adams” turned into “chair John Adams”. After the German route “head librarian” became “library director”, and “math day” turned into “Pi Day”. DIPPER renamed the company “GreenCycle Delivery Services” to “GreenCycle Bicycle Courier Services”. Check names, job titles and proper nouns letter by letter.

Subject and cause. DIPPER attributed the 40% savings to renting radio equipment, while the source was about maintaining physical audio guides, and replaced “auto-fill for common items” with “automatic reminders”. After the German route the damaged “gear system” became a “transmission system”. For an automatic similarity metric such sentences barely differ; for the reader it is a different fact.

Strength of wording. The recommendation “to consider setting up a science club” became, after paraphrase, “we strongly recommend establishing a permanent club”. Check whether “perhaps” and “consider” turned into “must”.

Losses and inventions. In one text DIPPER kept the old waiting time “more than ten minutes” and lost the new one, “under two minutes”; in another it lost the very fact that a second bus was added; the Chinese route once returned an empty result, and in another text glued a sentence together so that the figure 85% was left hanging without a subject. Remove everything that was not in the source; look for everything that was.

Verbatim chunks. If large fragments of the source were carried over unchanged, the mark’s signal stayed in them, however new the rest of the text looks. In my data the paraphrase kept under 10% of verbatim five-token sequences, the translations 36 to 45%, and that was enough for the mark to stay.

The fastest way is to put the source and the result side by side and go through exactly this list instead of reading the result “for general impression”. You can use a second model as a judge, I did, but judges make mistakes even without neighbours. In the final panel 34 of 500 votes were not unanimous; Claude Code (Fable 5) checked each of them against the full texts, and the two overturned decisions I verified by hand: “head librarian → library director” is a real change of role that three judges forgave, while “Environmental Studies → the Environment” in DIPPER’s output does not change the fact. So in my setup the majority decided, a second model re-read the disputed places, and the final word on them belonged to a human, and for your own texts I recommend the same order: the judge marks, you decide.

7. What demo I decided to build

A simple page. You paste your text and press one button; the tool paraphrases it with a model that carries no mark, audits the result against your source, repairs the factual slips it finds, and shows the rewrite with every changed word in bold, the places the final review still doubts in orange, and the share of 5-word sequences that were replaced. You check the orange places, copy the text and take it wherever you need.

The whole experiment, including the rewriter and judge prompts, is open in the repository on GitHub. Ten fictional reports show the mechanism, they do not prove “it works on everything”, so check the highlighted places in your own texts. The demo is free and you can try it now at painintheagent.com/tools/ai-text-watermark-remover.

For those who want to check the numbers

What was measured	Result
Mean signal, marked texts	57.03%
Mean signal, clean texts	49.98%
Threshold at a 1% false-alarm target	50.95%
Marked texts detected	100%
Clean texts falsely detected	0%

Method	Signal removed	Exact 5-grams	P-SP	Readability	Pipeline
Light synonym edits	50.5%	54.6%	98.4%	98%	100%
Full paraphrase	94.5%	9.4%	94.8%	98%	100%
Round trip via German	63.2%	45.0%	98.5%	99%	100%
Round trip via Chinese	61.6%	36.0%	88.3%	86%	90%
DIPPER from the paper	94.7%	9.4%	91.3%	86%	100%

Judges saw one candidate per prompt; the first version of the panel showed three judges five candidates at once and carried errors between them, so it was replaced entirely. Non-unanimous votes: 34; after a manual check against the texts 2 were overturned (claims after adjudication: Light synonym edits 100%, Full paraphrase 100%, Round trip via German 97%, Round trip via Chinese 87%, DIPPER from the paper 78%). Sources of the new corpus: Qwen/Qwen2.5-14B-Instruct. Rewriter for synonyms, paraphrase and translations: qwen/qwen3.7-plus (Alibaba), temperature 0. DIPPER: kalpeshk2011/dipper-paraphraser-xxl, revision c1fbf7a958a2, NVIDIA A100 80GB PCIe. Judges: openai/gpt-5.6-luna, anthropic/claude-sonnet-5, google/gemma-4-31b-it, x-ai/grok-4.6. The old threshold 50.67% gave 5.1% false alarms on the exact null distribution instead of the claimed 1%. Correlation between literal copying and detector score in the old corpus: 0.988. The whole paid budget of the retest stayed under $1.12.