Claude now marks AI-generated content. But it does not mark everything the same way.<\/p>\n
Anthropic currently uses embedded watermarks<\/em> for text and signed C2PA provenance<\/em> metadata<\/em> for supported files. Code sits somewhere in between: it is still text, but its structure gives the watermark fewer places to work.<\/p>\n I went into detail about Claude\u2019s watermarks in my article how Claude\u2019s watermarking works,<\/a> and here I\u2019d answer the obvious question:<\/p>\n \n How do you remove the watermark?\n <\/p>\n<\/div>\n You\u2019ll soon find out the watermark isn\u2019t hard to remove<\/mark> at all.<\/p>\n This is the hardest case. At least on paper, because:<\/p>\n In fact, Claude does not add a hidden character that you can search for and delete.<\/p>\n Anthropic says its watermark is based on SynthID<\/strong>-Text<\/strong>. This is the text variant of the traditional SynthID<\/a> that is used by Gemini models for watermarking.<\/p>\n Furthermore, the model changes the source of randomness it uses when choosing between possible words. Across a sufficiently long passage, those choices create a statistical pattern that can be detected later.<\/p>\n For example, <\/p>\n Think about these three sentences:<\/p>\n They\u2019re essentially relaying the same information, although in a different manner (wording wise). This minor change would barely be detected by a human, but machines can hide patterns using such seemingly safe choices<\/em>. <\/p>\n In addition, a model has some freedom to choose between them. Therefore, that freedom is where a text watermark is placed. It\u2019s all in the patterns<\/em><\/strong>\u2026<\/p>\n However, there is no metadata-cleaning operation for Claude\u2019s text watermark. Since the watermark is a pattern that is distributed across text:<\/p>\n \n A substantial rewrite or paraphrase\n <\/p>\n<\/div>\n Rewriting the text is the ideal choice for countering watermarks. But if you\u2019re not interested in an overhaul, paraphrasing would suffice. Similarly, this is important because there are a lot of paraphrasing tools freely available online:<\/p>\n That gives us a simple rule:<\/p>\n Nevertheless, changing the file does not remove a text watermark. Changing the text does.<\/strong><\/p>\n Since the watermarking is in Claude\u2019s writing, redoing the text in other LLMs<\/a> (which don\u2019t have SynthID-Text) would reduce the watermarks.<\/p>\n The following code uses a generic OpenAI-compatible endpoint. Using a model other than Claude for the rewrite:<\/p>\n This would reduce the watermarks.<\/p>\n Removal isn\u2019t guaranteed unless we plug in a detector to confirm the output watermark percentage. But this should suffice as a starter code. <\/p>\n Code is more interesting.<\/em><\/strong><\/p>\n Meanwhile, Anthropic does not describe a separate \u201ccode watermark.\u201d Generated code falls under the text watermarking system. But code contains far fewer arbitrary choices than normal prose. This is because programs must follow a definite syntax<\/u>. <\/p>\n For example:<\/p>\n could legally become:<\/p>\n The program behaves the same.<\/p>\n But you cannot arbitrarily change a required Python keyword or API call without potentially breaking the program.<\/p>\n That is why watermarking is naturally weaker in code.<\/p>\n For Python code specifically, we can make substantial source-level changes while preserving the program\u2019s structure.<\/p>\n The script below:<\/p>\n This is intentionally a source transformation<\/strong>, not a watermark decoder.<\/p>\n Finally, it changes substantially more of the generated surface than simply replacing one variable name.<\/p>\n And there is an important caveat: AST reconstruction can change formatting and some source-level details. Test the resulting program before using it.<\/strong><\/p>\n The same logic applies to comments. They have much more linguistic freedom than executable syntax, so they provide more opportunities for statistical marking.<\/p>\n \n Files are theeasiest to remove watermark<\/span>from.\n <\/p>\n<\/div>\n Anthropic does not<\/strong> hide a watermark inside the pixels of supported images.<\/p>\n Instead, Claude attaches a cryptographically signed C2PA content credential<\/strong> to supported file types such as .png, .jpg, and .svg. The credential lives in the file metadata and records that Claude processed the asset.<\/p>\n This is an important distinction.<\/p>\n The image itself can remain unchanged. The provenance record sits alongside it as the metadata (header specifically) of the file. <\/p>\n That also means creating a new derivative file can break the link to the original manifest. Anthropic explicitly lists format conversion, re-saving, screenshots, and similar operations as ways metadata may be stripped.<\/em><\/p>\n The official C2PA Python library can read and validate manifests from supported media files. Install the library using:<\/p>\n Then use the following code:<\/p>\n This answers the first question:<\/p>\n Does this file <\/strong>contain<\/strong> a C2PA manifest?<\/strong><\/p>\n Do not strip metadata blindly. Check first.<\/p>\n This is where you should be careful with broad claims.<\/p>\n Anthropic says provenance metadata applies where Claude supports processing files. Its current documentation explicitly gives .svg, .png, and .jpg as examples. It also says some platforms or features may not support every marking type.<\/p>\n So don\u2019t write:<\/p>\n \u201cEvery Claude PDF has a watermark.\u201d<\/p>\n That isn\u2019t what Anthropic documents.<\/p>\nRemove Claude Watermark from Text<\/h2>\n
![\"How](\"https:\/\/cdn.analyticsvidhya.com\/wp-content\/uploads\/2026\/08\/image-1-1e1bxu.webp\")
<\/figure>\n<\/div>\n Click here to view the functionality of SynthID-Text<\/summary>\n
![\"LLM](\"https:\/\/cdn.analyticsvidhya.com\/wp-content\/uploads\/2026\/08\/image-2-1e1bxu.webp\")
![\"Tournament](\"https:\/\/cdn.analyticsvidhya.com\/wp-content\/uploads\/2026\/08\/image-3-1e1bxu.webp\")
\n
Rewrite, don\u2019t \u201cstrip\u201d<\/h3>\n
\n
What does work then?<\/h4>\n
Python approach<\/h3>\n
import os\nfrom openai import OpenAI\n\n\ndef rewrite_text(text: str) -> str:\n client = OpenAI(api_key=os.environ[\"OPENAI_API_KEY\"])\n\n prompt = f\"\"\"\nRewrite the following text completely in new wording.\n\nRules:\n- Preserve the facts and meaning.\n- Preserve technical accuracy.\n- Change sentence structure throughout.\n- Do not merely replace a few words with synonyms.\n- Rebuild paragraphs where useful.\n- Return only the rewritten text.\n\nTEXT:\n{text}\n\"\"\"\n\n response = client.responses.create(\n model=os.getenv(\"REWRITE_MODEL\", \"gpt-5\"),\n input=prompt,\n )\n\n return response.output_text\n\n\nif __name__ == \"__main__\":\n original = open(\"input.txt\", \"r\", encoding=\"utf-8\").read()\n rewritten = rewrite_text(original)\n\n with open(\"output.txt\", \"w\", encoding=\"utf-8\") as f:\n f.write(rewritten)<\/code><\/pre>\nRemove Claude Watermark from Code<\/h2>\n
for i in range(len(users)):\n process(users[i])<\/code><\/pre>\nfor index in range(len(users)):\n process(users[index])<\/code><\/pre>\n\n
A Python AST rewrite<\/h3>\n
\n
import ast\nimport keyword\nimport random\nimport string\nfrom pathlib import Path\n\n\nclass IdentifierRenamer(ast.NodeTransformer):\n def __init__(self, seed: int = 42):\n self.rng = random.Random(seed)\n self.mapping = {}\n\n def _new_name(self, old_name: str) -> str:\n if old_name in self.mapping:\n return self.mapping[old_name]\n\n prefix = random.choice([\"tmp\", \"value\", \"item\", \"obj\", \"data\"])\n suffix = \"\".join(\n self.rng.choice(string.ascii_lowercase)\n for _ in range(5)\n )\n\n candidate = f\"{prefix}_{suffix}\"\n\n while keyword.iskeyword(candidate):\n suffix = \"\".join(\n self.rng.choice(string.ascii_lowercase)\n for _ in range(6)\n )\n candidate = f\"{prefix}_{suffix}\"\n\n self.mapping[old_name] = candidate\n return candidate\n\n def visit_Name(self, node):\n node.id = self._new_name(node.id)\n return self.generic_visit(node)\n\n def visit_arg(self, node):\n node.arg = self._new_name(node.arg)\n return self.generic_visit(node)\n\n def visit_alias(self, node):\n if node.asname:\n node.asname = self._new_name(node.asname)\n return self.generic_visit(node)\n\n\ndef remove_docstrings(tree: ast.AST) -> None:\n for node in ast.walk(tree):\n if not isinstance(node, (ast.Module, ast.FunctionDef,\n ast.AsyncFunctionDef, ast.ClassDef)):\n continue\n\n if not node.body:\n continue\n\n first = node.body[0]\n\n if (\n isinstance(first, ast.Expr)\n and isinstance(first.value, ast.Constant)\n and isinstance(first.value.value, str)\n ):\n node.body.pop(0)\n\n\ndef rewrite_python(source: str) -> str:\n tree = ast.parse(source)\n\n remove_docstrings(tree)\n\n transformer = IdentifierRenamer()\n tree = transformer.visit(tree)\n\n ast.fix_missing_locations(tree)\n\n return ast.unparse(tree)\n\n\ndef rewrite_file(input_path: str, output_path: str) -> None:\n source = Path(input_path).read_text(encoding=\"utf-8\")\n rewritten = rewrite_python(source)\n\n Path(output_path).write_text(\n rewritten,\n encoding=\"utf-8\",\n )\n\n\nif __name__ == \"__main__\":\n rewrite_file(\n \"input.py\",\n \"rewritten.py\",\n )<\/code><\/pre>\nRemove Claude Watermarks from Files<\/h2>\n
Use Python to inspect the file<\/h3>\n
pip install c2pa-python<\/code><\/pre>\nimport json\nfrom c2pa import Context, Reader\n\n\ndef inspect_c2pa(path: str) -> dict | None:\n try:\n with Context() as context:\n with Reader(path, context=context) as reader:\n data = reader.json()\n\n return json.loads(data)\n\n except Exception as exc:\n print(f\"No readable C2PA manifest: {exc}\")\n return None\n\n\nif __name__ == \"__main__\":\n manifest = inspect_c2pa(\"image.png\")\n\n if manifest:\n print(json.dumps(manifest, indent=2))<\/code><\/pre>\nWhat About PDFs and Other Files?<\/h2>\n
![\"Using](\"https:\/\/cdn.analyticsvidhya.com\/wp-content\/uploads\/2026\/08\/image-4-1e1bxu.webp\")
<\/figure>\n<\/div>\n