
I figured out a loophole to remove Claude watermark WITHOUT rephrasing
I've been curious whether you can kill an Claude's text watermark just by editing (not "rewriting/rephrasing") what it wrote. And so I built a Claude/OpenAI/Gemini text-watermark generator plus a detector and threw a bunch of attacks at gpt-oss-20b and Qwen outputs to find out. The technique relies on the famous Tournament Sampling built upon standard Gumbel-max sampling.
It turns out almost everything people assume works, doesn't. Swapping em-dashes for hyphens, stripping markdown, converting AmE to BrE spellings... none of it moved the needle. Across nearly 300 test runs only one attack crossed the detection threshold, and that was deleting 40% of every word, which just wrecks the text.
After rigorous benchmarking, the only method that consistently beat 10/10 times was inserting invisible Unicode variation selectors (the same characters used for emoji and CJK rendering) throughout the text. Performed that to about 30% of characters and the watermark score dropped from 45 down to under 1. And unlike every other invisible character trick I tried, this one survives normalization, because these are real meaningful codepoints that a normalizer can't safely strip.
Interesting finding: Code is barely watermarked to begin with. Watermark strength tracks how uncertain the model is about the next token, and code is low entropy, so some code samples come out basically unwatermarked with zero attack at all.
Not the first repo doing this kind of attack, I know, but I wanted to actually spend the weekend testing it properly across a few different open models instead of rushing something half-baked out.
Repo with all the code and results: https://github.com/aloshdenny/claude-awm
Interactive demo where you can try the attack yourself: https://aloshdenny.com/claude-awm/
Check it out and let me know what you think!