Does Editing or Paraphrasing Remove an AI Watermark?

The question people actually want answered is a number: how much of the text has to change before the mark stops registering? No such number has been published, and the reason is worth understanding before anyone quotes one at you.

Anthropic's two endpoints

Verbatim, from August 14, 2026:

"Light editing probably won't remove the watermark completely."

"A complete rewrite where every word is replaced will."

Everything between those two statements was left out deliberately. Anthropic did not publish a percentage, a word count, or a threshold, and there is no independent way to derive one while the detection API stays closed.

What the two endpoints imply

Typo fixes, cutting a sentence, reordering a paragraph: not enough. Most of the original word choices are still in place, and those choices are the signal.

A full rewrite through a different model, or a full human rewrite: the mark goes with the words that carried it.

Anything in between depends on how many of the original low-stakes word choices you replaced, and on how long the passage is. More replacement means less signal. A long passage tolerates more editing before the remaining signal drops below what a detector can score, because it started with more signal to spend.

Translation

Anthropic addressed translation directly. Translation by Claude carries the mark forward, because every word in the translated text is still chosen by Claude. Translation by a different model, or by a human, replaces every word choice in a new language, and the signal goes with them.

Round-tripping through two non-Claude translators is the pattern researchers describe as the translation defeat. It works for the same reason a rewrite works: the output shares meaning with the input and shares almost none of its word choices.

What independent researchers have added

Scott Aaronson, whose 2022 proposal is the root of this family of schemes, listed the practical defeats on August 22, 2026: removal via translation, emoji interleaving, or open-model paraphrase. Emoji interleaving is a curiosity rather than advice, and the underlying point is general. Anything that disrupts the token stream degrades the signal, and most things that disrupt the token stream also ruin the text.

Sebastian Raschka, writing the same week, expects local-model rewriting to be the durable defeat, because it can be run at scale without leaving a cloud rewriter's own fingerprints on the output.

A test of five popular removers published in August reached a blunter conclusion: no clean getaway. Every tool examined either left a Claude-shaped signal or could not demonstrate that it had not.

The shape of the curve

There is a curve, and it runs in the obvious direction. Replace a few word choices and the signal barely moves. Replace most of them and it collapses. Replace all of them, and by Anthropic's own statement it is gone.

What nobody outside Anthropic can currently supply is the position of the detection threshold on that curve. That is why this article gives no percentages, and why any tool that reports a "watermark strength" figure for text today invented it. There is no public detector to measure strength against.

What the defeats cost

A full rewrite through another model risks tone drift and factual drift, since a paraphraser can quietly change what a sentence claims. It is also a question for the terms of service of whichever provider you route through.

A human rewrite costs the labour that generating the text was meant to save.

Translation defeat costs two rounds of translation quality.

Emoji interleaving and similar token-stream tricks produce text that reads as obviously tampered with, which defeats the point of wanting clean output in the first place.

What this tool does, and does not do

The text tool here checks hidden characters, clipboard HTML fragments and lookalike letters, shows a diff, and reports Clean, Found, Unknown or Unsupported per check. No percentages. The same engine is behind the Claude watermark remover and the SynthID remover, and both pages state plainly which part of the mark they leave alone.

It does not offer a paraphrase step. Rewriting is the operation that changes what a statistical detector would see, and that decision belongs to the writer rather than to a checkbox on a cleanup tool. Shipping a one-click rewriter would mean shipping a claim about an outcome nothing here can verify.

When Anthropic's API opens, the real detector gets wired in: the API's verdict, dated, with a length caveat shown before submit.

Other providers, same shape

Google's SynthID Text is the same family of technique, so the editing answer is the same: it survives light edits, and is defeated by a full rewrite or a translation through a non-Google route. Google's public detector portal is waitlist-only, so there is no consumer verdict there either.

OpenAI has not deployed a text watermark, so for ChatGPT text the editing question does not yet apply. The same is true for Copilot, Grok, Meta AI, Perplexity, Mistral and DeepSeek, none of which have announced a text watermark as of August 30, 2026.