In today’s column, I examine the flurry of lies and scams underlying those watermark removal apps that are supposed to be able to remove digital watermarks found in the outputs of generative AI and large language models (LLMs). Though such lies and scams have been around for quite a while, they have taken on a new and egregious life after Anthropic announced that it is watermarking the AI-generated output from Claude.
Why would Anthropic’s announcement ratchet things up? Because having a major LLM now adopt automatic watermarking of all its AI outputs has caused masses of people to rush to find a means to defeat the watermarking. Those people do not like the fact that their AI output could be detected as having come from AI. In a desperate attempt to avoid getting their fingers caught in the cookie jar, there is a pell-mell sprint toward finding a watermark removal app that can yank out the digital watermarks. The problem is that promoters of watermark removal apps realize that a marketplace frenzy is underway, and some are unscrupulously capitalizing on this sudden heightened demand. Mistruths, false claims, scams, and other deceptive efforts are tricking people into thinking that a watermark removal app will do wonders, whereas the reality is that the results are at best half-mixed or aimed to cause damage.
Let’s talk about it. This analysis of AI breakthroughs is part of my ongoing Forbes column coverage of the latest in AI, including identifying and explaining key AI complexities (see the link here).
AI Output Watermarking By Anthropic
The place to start is by discussing Anthropic’s recent announcement about watermarking. It has been like the blast of a starting gun for a slew of unintended adverse consequences, as you’ll see in a moment.
In a posting on the Anthropic Claude support page on August 11, 2026, the popular AI maker announced that they are starting to watermark their AI outputs. For my in-depth analysis of this matter, see the link here. The upshot is that when you use Claude to answer questions or provide responses to your prompts, the plain text that is generated will henceforth contain a secret watermark. The text will look perfectly normal. Nothing obvious to the naked eye can discern that the text has been watermarked. There aren’t catchy emojis or oddball characters being implanted.
How can they possibly hide a watermark in ordinary text and yet you cannot see it? Aha, this is cleverness in mathematics and computational orchestration to select words that ultimately have a subtle but detectable statistical pattern. When the AI is composing a response, it is carefully selecting words that not only answer your question or query but also reflect patterned choices of which words to use, acting as a non-obvious signal of sorts.
Think of it this way. Suppose that any given sentence can be composed of words that have multiple choices of which word to use in the sentence. For example, a sentence might say that a cat sat on the floor. Another way to say that same sentence is to indicate that a feline resided on the ground. Assume that those words, such as feline for cat, reside for the word sat, and the ground for the floor, are all second choices, yet are still fully reasonable choices. The algorithm inside the AI is choosing the words that embody a pattern, such as always picking the second choices of word selections, that can later be detected.
Watermarking Can Be Extremely Complex
I think you can see that this statistical uplift is going to be quite hard to detect. Humans are unlikely to see the watermark by looking for any patterns in the wording. All the sentences are still going to make sense and abide by whatever the topic at hand is. The subtlety of picking the second statistically viable word on numerous occasions is a nearly hidden way of producing the watermark.
How does an authorized detection tool figure out if the watermark is present?
Aha, that’s by knowing what approach was used at the get-go while the text was being watermarked. The chances of any usual detection method ferreting out the watermark are low. A tool that is built knowing the specific method can examine the sentences and compare the word choices to the pattern of word choices that the AI would normally make. If the second word choice is consistently being encountered in the examined text, this is a strong indicator that the AI indeed generated that content.
We can make this method much more robust. Maybe instead of always choosing the second choice, the watermark process does something else. Suppose that 50% of the time the second choice is made, 30% of the time the third choice is made, and 20% of the time the fourth choice is made. This makes things even harder for anyone else to crack and find the watermark. An even stronger method includes having a secret cryptographic key that guides the watermarking process toward the preferred token patterns.
Other Avenues Of Watermarking
I’ve so far been explaining how text-oriented watermarking takes place. The statistical uplift scheme is one of many mathematical and computational methods that can be utilized. Much simpler approaches can be used, but those are typically readily defeated without much effort involved. If the text contains emojis or special characters as watermarks, you will undoubtedly remove those visible disturbances without hesitation. There might be so-called invisible characters too, such as using a white font on a white background. Again, that is trivial to find and expunge.
Watermarking for AI-generated digital photographs and graphical images is done at an under-the-hood bit level. People cannot readily see that. All sorts of implanted ones and zeros won’t impact the picture but can be detected by inspecting the binary representation involved. It is possible to use sophisticated mathematical algorithms to populate the bits in a manner that almost no one other than someone armed with the algorithm can later detect as being part of a special pattern.
Trying to watermark ordinary text is a beast of a different kind. Anything that is done to the text will potentially alter the words we see and impact the meaning of the text. If you had an algorithm that simply said to replace the word “of” with the word “and”, the resulting text, which is now presumably discernible as AI-written, is going to be nonsensical for human use.
The statistical uplift watermarking method has been gaining popularity among AI makers since it instills a kind of patterning or veritable watermark during the generation of the words that are going to be output. This aims to ensure that the response is still readable and sensible for the prompt that was entered. And, of course, embodies the “hidden” or secret word selection pattern that can later be detected by those in the know.
Watermarks Can Get Broken
Anthropic said that their watermark will persist when the text is copied and placed somewhere else and can tolerate some semblance of editing. Let’s think about that. First, the text, if kept entirely intact, is going to carry the watermark since it has that secret pattern of word choices. The puzzling question is how much editing can be done before the watermark breaks down and is no longer significant.
Imagine that I take the sentence that says feline and I change the word to cat. I have now marred the watermark. I didn’t do this with the intention of undermining the watermark; indeed, I had no idea where the watermark is. I was merely making some desired edits. Will a watermark detection still say the text is watermarked? Suppose that I change the word “ground” to the word “floor” and do likewise by changing the word “reside” to the word “sat”. I have nearly obliterated the watermark. The watermark is almost entirely marred or demolished.
The statistical signal of the watermark must remain at a high enough threshold that the watermark is reasonably still intact. The more that I make edits to the text, the less of the watermark that will likely remain. If the watermarks remain at, say, only 10% of the text after my edits, now things are getting dicey. The detection tool is going to be on thin ice to conclude that the watermark is truly there.
More Problems About The Watermark
Other problems arise. Consider this. Assume that I don’t edit the AI-generated response. I haven’t changed one iota of it. But I opt to paste the text into a much larger body of text. The one sentence isn’t going to be enough of a preponderance of the text to serve as a viable signal of a watermark. It gets lost in a sea of text. The statistical signal is getting diluted by the unwatermarked content.
The statistical uplifting watermarking method, akin to nearly all watermarking methods for text, must be rated with a grain of salt. If a user collects AI-generated watermarked text and plunges it inside a large body of unwatermarked text, the watermark becomes less viable.
There are many more escape routes. If a user goes to one AI to generate text, then hands the text to another AI to do a rewrite, the odds are that the resulting text is going to end up no longer having a viable concentration of the watermark. The other AI is going to be making its choices of which words to select, no longer bound by the second-choice preference.
Removing Watermarks
Now that we’ve got the fundamentals on the table, let’s consider the topic of apps that allegedly perform watermark removal from AI-generated outputs.
First, we need to consider what type of AI-generated content has a watermark that we want to remove. If it is a digital photograph or image, the app would need to presumably find and “remove” the bits that are part of the watermark. This might involve switching the various ones to zeros and zeros to ones. I put the word “remove” in quotes because you could quibble over whether changing the bits so that they no longer reflect the watermark is the same as a “removal” per se. You could insist that the watermark was marred or demolished, instead of saying that it was removed.
If the content is text, the first level of “removal” would be to scan the text for any of the more obvious forms of watermarking. Any hidden characters would usually be readily detected and could indeed be removed from the body of text. The same goes for oddball characters and emojis. Those can be removed.
The tougher nut to crack is the statistical uplift watermarks. There is almost a zero chance of discerning what watermarking approach was used, unless the builder of the app knows what algorithm was employed. Even if they know the algorithm, this still depends on knowing what the word choices were. All told, it is a slim chance other than for the AI maker themselves to have all that available.
Challenges Galore
One notable aspect about the Anthropic announcement is that we aren’t told what specific method is being used to perform the watermarking. On the one hand, you could emphasize that they should keep their method a secret. If they divulge how it works, people will undoubtedly find ways to defeat it. Ergo, it makes sense to remain mum about their secret method.
The other side of that coin is that the public currently have no ready means to figure out whether the watermark exists in a piece of content or not. If we don’t know the method, how are we to discern whether the watermark is there? The answer in the Anthropic posting is that Anthropic indicates they are working on that aspect (“We’re also working to enable users and other third parties to detect Claude’s embedded watermarks and provenance metadata”).
Presumably, you will ultimately be able to take a piece of content and run it through a detection tool that will be provided by Anthropic or an authorized third party. They will be keeping the method close to their chest. I’m sure hackers will try mightily to reverse engineer the detectors and otherwise work steadily to crack the code of how the watermarking is being undertaken. That is one of those few surefire bets in life.
Watermark Removal Apps
The Anthropic announcement has spurred people to hurriedly search for a watermark removal app that will remove the watermark of AI-generated output from Claude. They probably don’t realize that the removal might be more of a marring or demolishing of the watermark versus actually removing the watermark per se. That being said, most people probably don’t care what you call it, as long as the watermark is no longer detectable.
In their haste, some people are grasping at straws. They find a removal app that says it does wonders, and they immediately download and use the app. Would they even know if the removal worked? Nope, not at this time. Since there isn’t an official way to test for the watermark, you have no viable means of verifying that the removal app did its wondrous act. Maybe it tells you that it did, which is possibly blarney.
Evildoers are setting up fake or fraudulent removal apps that are aimed at infecting your computer with a virus or doing other evil acts. Those conniving rats are bound to boldly say that their watermark removal app is especially updated to handle the Anthropic watermarks. They are pulling a scam.
Another variation is that a removal app might be made for certain types of watermarks, such as handling only watermarks in digital photos and images, but a person excitedly downloading the app doesn’t read the fine print. They think it also encompasses text-based watermarks. They are probably not going to realize that the text isn’t going to be impacted by the app. Or maybe the removal deals with the more obvious text-based watermarks, such as hidden characters, and has no capability for the statistical uplift watermarks.
The Mess Is Going To Get Messier
There is gold in them thar hills when it comes to providing a watermark removal app. And, just like the famous Gold Rush of a bygone era, there are going to be a lot of people who seek out those apps without nary an ounce of understanding whether they work. You might be aware that gold diggers used to buy gold-divining sticks that were purported to indicate where gold was buried. It was a scam. The same is happening with some removal apps.
A legitimate removal app should clearly indicate what it can and cannot do. This must be bold and front-and-center. No beating around the bush. No tiny print. If the claims by the removal app are beyond belief, it most likely is beyond belief. If the claims are couched in technical verbiage, this is another way of trying to confuse people into thinking it must be rock solid. Also, the claims are only useful if they are verified by an unbiased, independent, recognizable, real-world third party; otherwise, it is highly suspect and ought to be viewed as unreliable and unsubstantiated contentions.
Unfortunately, we’ve got quite a conundrum on our hands. There will be people who aren’t versed in removal aspects who will blindly fall for any removal app that they come upon. There are legitimate removal apps that will get tarnished by all the fake and evil ones. Evildoers relish these types of circumstances. They can get away with wild lies and scams amidst the confusion. Plus, business is booming.
Watch Your Back
This problem is going to get abundantly worse. How so? Each of the major AI makers is inevitably going to watermark their AI-generated outputs. This will push many more people toward frantically relying on a watermark removal app. There are approximately 1.5 billion people using popular LLMs and generative AI every week. Of those billion or so, what percentage do you think will be eager to find and use a watermark removal app? A lot. Millions or perhaps multitudes of millions.
It’s a huge problem that is currently under the radar, and few realize the ugly and bumpy road that awaits society.
A final thought for now. The ancient Greek playwright Sophocles made this pointed remark: “Watch out for danger.” I mention this because some might believe that if they pick a removal app that doesn’t achieve removal, they haven’t particularly been harmed (though they might be caught unawares when a watermark detector catches them red-handed). The added danger is that the app might have other devious or mischievous intentions in mind. Be wary, be skeptical, be cautious, and keep your eyes open for danger afoot.
