Three Ways AI Marks Its Output (And Which Ones You Can Actually Remove)

TL;DR

AI/LLMs are increasingly marking generated output in three different ways, not all equally removable. Provenance metadata like C2PA is embedded in a file and can be stripped, which is what MetaStrip does. Statistical watermarks, on the other hand, are woven into the content itself, so they can’t be stripped, though they degrade when heavily rewritten. Stylistic tells are simply how the writing reads, which no tool removes. Anyone selling a single “AI watermark remover” is combining three very different things into one product.

The three tiers

We pulled the first two apart in more technical detail in content credentials vs watermarking vs metadata tags.

1. Provenance metadata

This is a signed record attached to a file that says what produced it and whether it has been modified since. The industry standard is C2PA, marketed by Adobe as Content Credentials. It travels with the file, not inside the pixels. If you want to see one for yourself, here’s how to check whether an image has a content credential.

Because it’s metadata, it behaves like metadata. Converting the file, re-saving in a different application, screenshotting it, or running it through a metadata remover like MetaStrip and boom, the manifest is gone. AI companies acknowledge this openly, and Anthropic’s own documentation lists metadata stripping through format conversion or re-saving as one reason a file may no longer carry any detectable marks.

This tier is where MetaStrip operates. When we say we remove Content Credentials, this is precisely what we’re talking about and it’s worth being precise, because the next tier is where the confusion comes in hot.

2. Statistical watermarks

This is a whole other animal. Instead of attaching data to the file, the system biases the content as it’s generated so that it contains a detectable statistical signature.

When discussing images, Google’s SynthID imperceptibly adjusts pixels across the entire image. Because the signal is spread across millions of pixels, it’s incredibly durable: it persists through cropping, screenshots, filters and file recompression. There is no embedded data chunk to be deleted because the watermark is within the visual image itself.

The same idea applies to text, by nudging the model’s word choice as it writes. Google released this as SynthID-Text and Anthropic’s new text marking is described in the same way: woven into the text, invisible to the reader, travelling with the text when copied and pasted.

There isn’t a metadata remover that touches this tier, MetaStrip included. There’s just nothing to strip.

3. Stylistic tells

Most people are actually detecting the third tier, where there’s no watermark at all. AI detectors, such as GPTZero and Originality.AI, measure perplexity, a measure of how predictable a word is, and “burstiness”, the variation in sentence length. Human writing is more lumpy. They also capture characteristic phrasing and the well-documented fondness for em dashes or heading eyebrows on vibe-coded websites.

This tier is worth separating out as it is the tier that AI detectors actually measure. They’re not scanning for watermarks. Which gives rise to the most enduring myth in this area.

The invisible-character myth

One of the biggest myths online is that AI tools secretly hide zero-width spaces inside text as a watermark. They don’t.

There’s a whole category of tools promising to remove “hidden AI watermarks” by stripping invisible Unicode characters: zero-width spaces, narrow no-break spaces, or byte-order marks.

These are all real characters that do actually show up in AI outputs, but they’re not a watermark. They’re artefacts of tokenisation and training data, since the web is chock full of them from CMSes and various layout frameworks. There isn’t a provider that’s got a documented tracking scheme for them. Crucially, AI detectors don’t even look for them so removing them doesn’t even change your detection results. Originality.AI, who build detectors, say this plainly.

However, stripping invisible characters is definitely still worth doing, just not for the advertised selling points. Zero-width characters do actually break things: string comparisons fail, CSV parsing goes wrong, code throws an error on a URL with an invisible character at the front. They have also been used to hide instructions inside text that a human reader can’t see but an LLM will happily read, which is a real prompt-injection technique. It’s more text hygiene than detection evasion.

What about paraphrasing?

Paraphrasing tools sit awkwardly across tiers two and three, and they help with one and hurt with the other.

Against statistical text watermarks, paraphrasing is the weak point that’s well documented. The signal lives specifically in the sequence of words chosen. Changing enough of the words degrades it, but doesn’t remove it completely. This is a structural asymmetry between text and image watermarking: an image offers millions and millions of pixels to hide a signal, while a thousand words of text is only around 1,300 tokens, which is far less room to work with, and far less redundancy when the content is easily edited. Longer passages do carry enough signal to survive some light changes/editing but the short ones do not.

What a detected mark actually proves

Actually less than people assume, in both directions, and the AI companies are (refreshingly) candid about it.

A mark means the content was processed by that particular system, not authored by it. A lot of people use AI tools to proofread, translate, summarise or convert files, so marked output can carry someone else’s ideas entirely. Content can be edited, excerpted or mixed with other material after the fact.

Absence of a mark proves even less. Content may come from a model released before marking existed, or a platform where marking isn’t even supported. The passage may be too short to carry any reliable signals, or the file’s metadata might have been stripped in the process of ordinary editing.

Treat a mark as a signal, not a verdict. That’s how the standards themselves describe it.

Where MetaStrip sits in this

MetaStrip removes tier one. We detect C2PA manifests, EXIF, XMP and the rest of the metadata attached and strip it entirely within the browser, with no upload.

We don’t claim to remove tier two, because we don’t. A statistical watermark is part of the content, not dangling fruit for us to snag out with a script. We’d rather just tell you that, honestly, than tell you something that quietly doesn’t work.

If your concern is that your files contain hidden information about you, your device, your location and your editing history, that’s what we handle. If your concern is defeating AI detection, then there’s no metadata removal tool that’s right, MetaStrip included.

FAQ

Can you remove an AI watermark from an image? It depends which kind. C2PA Content Credentials are metadata attached to the file, and those can be removed. Pixel-level statistical watermarks like SynthID are part of the image itself and cannot be stripped by any metadata tool.

Does Claude watermark its text? Yes. Anthropic began marking output from models launched on or after 2 August 2026, using a watermark embedded in the generated text, plus C2PA provenance metadata on generated image files. Detection tooling has been announced but is not publicly available yet.

Do invisible Unicode characters mean text is AI-generated? No. Zero-width spaces and similar characters are artefacts of tokenisation and training data, not a deliberate watermark, and they also come from ordinary sources like CMSes and copy-pasting between apps. AI detectors do not scan for them, so removing them will not change a detection result.

Does paraphrasing remove an AI text watermark? Heavy rewriting degrades statistical text watermarks, because the signal lives in specific word choices. Light editing usually does not, and short passages behave differently from long ones. It is also not the same thing as beating a detector, which measures writing style rather than watermarks.

How do I check whether a file carries Content Credentials? Open it in a C2PA verification tool, or run it through MetaStrip, which will show you what provenance metadata is attached before you decide to remove it.

If a file has no AI mark, was it made by a human? Not necessarily. A mark can be absent because the model predates marking, the file type is unsupported, the passage is too short, or the metadata was stripped during ordinary editing or format conversion. Absence of a mark is weak evidence either way.

A footnote: I ran this post through three AI detectors

Something funny about this post: I drafted it with AI help, then rewrote the whole thing in my own words as an experiment. I ran the result through three popular “AI detectors” and got three very different answers: 3%, 100%, and 0% AI. The most confident one was confidently wrong, rating the text 100% machine-written despite the typos and grammatical errors I had introduced myself (fed back in to the model to catch and fix). None of these tools were testing for a watermark; they were scoring writing style. There is no public detector for Anthropic’s text watermark, and Google’s SynthID detector is model-specific: it identifies watermarks only from models configured with SynthID, and cannot universally detect text from any arbitrary AI platform. So this little experiment says something quite real about detectors and nothing at all about tier two.