Claude: Remove Watermarks Based on Content Type

Claude combines two watermarking approaches: a statistical watermark embedded in the text and C2PA attestations signed within the supported image files. Their removal does not follow the same rules. Here’s what can be modified, what cannot be, and the precautions to take, without promising the impossible.

C2PA Metadata Can Be Easily Broken, But Check First

For supported images and formats, Claude does not encode a pattern in the pixels but attaches a signed C2PA attestation in the file header. Thus, the image can remain unchanged while the provenance is stored in the metadata. Anthropic indicates that operations such as format conversion, re-saving, or taking a screenshot can remove this metadata and break the link with the manifest. Before taking any action, it is recommended to check for the presence of a C2PA manifest. The official c2pa-python library allows you to read and validate these manifests via Context and Reader and can be installed with pip install c2pa-python. Anthropic specifies that provenance applies where file processing is supported, citing .svg, .png, and .jpg as examples, while reminding that some platforms or functions may not support every type of watermarking. The claim that a PDF from Claude would systematically carry a watermark is not consistent with this documentation.

Only a change in wording moves the needle.

Claude's text watermark does not rely on a hidden character that would be removed by editing the metadata. Anthropic links it to SynthID-Text, a textual variant of SynthID, and describes a process where the choice between possible words is biased to form a detectable statistical pattern over long passages. Semantically equivalent rephrasings are sufficient to carry such a pattern. Therefore, neither minor edits nor a simple copy-paste in another editor will suffice. A substantial rewrite or paraphrasing is required, possibly using other LLMs that do not utilize SynthID-Text, to reduce the presence of the watermark. However, removal cannot be taken for granted without passing through a detector that measures the percentage of watermarking. Concepts such as random watermarking functions based on LLM probabilities or iterative selection approaches are mentioned to explain this behavior.

Code Offers Fewer Opportunities for Statistical Watermarking Than Prose

Anthropic does not describe a distinct watermark for code: the generated programs fall under the text system. However, programming imposes strict syntax that reduces arbitrary choices compared to language, effectively limiting the space to embed a pattern. Modifications such as renaming variables, changing comments, or formatting preserve the program's behavior and primarily affect more flexible areas—starting with comments, which offer more linguistic leeway and thus more opportunities for statistical watermarking than executable syntax.

Transforming the Python AST to Reshape Source Code

A concrete strategy in Python involves rewriting the source via the AST. A presented script renames local identifiers, removes comments and isolated docstrings, and then reconstructs the code with ast.unparse. The transformation class, derived from ast.NodeTransformer, uses a seed of 42 and a mapping, generating new names from prefixes like tmp, value, item, obj, or data and a suffix of letters, while avoiding keywords. Visitors renaming names, arguments, and aliases apply these substitutions, while a dedicated function removes detected head docstrings as literals in the bodies. The processing chain parses, cleans, renames, corrects positions, and reissues the source, with a file-to-file variant. This is deliberately a source transformation, not a watermark decoder, and it alters the generated surface more broadly than a one-off change. The reconstruction may affect formatting or certain details: the resulting program needs to be tested.

Automatically Rewrite Text and Control Output

An example script relies on an OpenAI-compatible API to rewrite a document while preserving meaning and altering sentence structure, with a model defined by REWRITE_MODEL and a default value of gpt-5. The program reads an input file, applies detailed rewriting instructions, and writes the result to a new file. Such an approach is intended to reduce the presence of the watermark without guaranteeing its complete disappearance, unless a detector is used to measure the residual rate. Again, it is recommended to check for the presence of the relevant watermarking, then evaluate the output.