reflip

Since 2 August 2026 the text Claude produces carries a statistical watermark. It is not a character hidden between the words: at every step the sampler hashes a secret together with the four previous tokens and each candidate word into a coin flip, and leans towards the candidates whose coin came up on one side. The detector recomputes those coins and checks whether their average is higher than chance.

reflip rewrites a text with a model running on your own machine until those coins are noise again, and then measures the result. The rewriting is ordinary. The measurement is the reason the repository exists: more than forty tools appeared in August claiming to remove this watermark, and none of them publishes a detector reading before and after.

What it does not do

• It cannot check its work against Claude’s own detector, and neither can anything else. Anthropic holds the secret and the detection service is a private preview. What can be done is to run the published algorithm, which Anthropic says its watermark is a version of, with a secret of one’s own on an open model, and read that detector. Every number in the repository comes from there.
• It does not remove invisible characters and call that the job. It does remove them, and it reports that the detector did not move by so much as a second decimal when it did.
• With the default model it does not send anything anywhere. The rewriter is a two and a half gigabyte model under a local server. Any endpoint that speaks the same protocol works, and then the text goes to that endpoint; a model that watermarks its own output is refused rather than ranked.
• It does not promise that a light edit is enough. Rules alone, meaning contractions, spelling variants, dashes and stock phrases, change two words in a hundred and take a tenth off the score. The table says so.
• It has only been measured on one laptop, with one open model, against one implementation of one watermarking scheme.

What the measurement says

Twenty-four watermarked texts, the detector score before and after each transform. The score is in standard deviations above chance: unwatermarked text sits between minus two and plus two, and above four happens once in thirty thousand by accident.

transform	score before	score after	texts below the threshold	facts changed per thousand words	words changed
strip invisible characters	17.6	17.5	0 of 24	0.0	0%
word rules, no model	17.6	15.8	0 of 24	0.5	2%
replace one word in three	17.6	1.3	22 of 24	5.0	39%
rewrite every paragraph	17.6	0.5	22 of 24	24.9	67%
rewrite, coverage checked	17.6	0.5	22 of 24	25.2	68%
unwatermarked controls	0.0	-0.1	23 of 23	0.0	0%

“Facts changed” counts the numbers, names, negations and quantifiers a rewrite dropped or added. Once those words were kept out of reach, replacing one word in three changed five of them per thousand words, a fifth of what the full rewrite changes, and got as many texts below the threshold. The full rewrite reads better and stays the default; the other one is for text where the facts matter more than the prose. Keeping the facts has a price: the full rewrite now asks again for every paragraph that changed one, which nearly tripled its tokens, and the two Italian texts stay above the threshold rather than lose a fact.

The facts a rewrite can lose

A paraphrase that reads well can still say something else: a figure dropped, a name gone, a “not” lost, “most” turned into “all”. reflip diff counts those without a model, in English, Italian and Spanish, and every rewrite goes through it: the paraphrase asks again for a paragraph that changed one, and the command reports a failure if any are still changed at the end. On the October benchmark, before this check existed, the model-driven rewrites changed 20 to 34 such facts per thousand words.

The other direction: was this written by a model?

reflip detect answers with the share of measured human texts that scored at least as machine-like, and gives a verdict only where the measured error allows one. The error was measured under a protocol written before any detector ran: 3,520 human texts and 432 machine texts from three model families, in English, Italian and Spanish, at three lengths. Binoculars on a pair of small Qwen models won, with a mean AUROC of 0.965 on medium and long texts, and the strict rule lets it give a verdict in one cell of nine, long English texts. reflip’s own rewrites fall to an AUROC of 0.56 to 0.71. It cannot read Claude’s or Gemini’s watermark: only Anthropic and Google hold those secrets.

In your browser

The browser version runs the facts check, detection and rewriting on the reader’s device, with models downloaded once and checked against a fingerprint. While a text is being processed the page locks its own network access, and a test fails if any request leaves. The page counts four values from fixed lists, never the text; its privacy notice says what exactly.

Use

reflip run draft.md -o clean.md
reflip diff draft.md clean.md
reflip detect essay.md
reflip models --recommended
reflip models --measure gemma3:4b

There is a window as well, one vertical column with the model server at the top and the figures at the bottom, and a machine-readable command line so an agent can put a text through it and read what it cost. Both are in the repository.

What this does not settle

Anthropic’s secret, the length of context its hash covers, and the detector it runs are private. A tool that tells you a text is now clean of Claude’s watermark is telling you something it cannot know. reflip reports the coverage it achieved against a published algorithm, which is a different and smaller claim.

nerln.github.io/reflip

nerln/reflip on GitHubSource, the benchmark corpus, the window, and the numbers above with the text of every sample. MIT.