reflip

Since 2 August 2026 the text Claude produces carries a statistical watermark. It is not a character hidden between the words: at every step the sampler hashes a secret together with the four previous tokens and each candidate word into a coin flip, and leans towards the candidates whose coin came up on one side. The detector recomputes those coins and checks whether their average is higher than chance.

reflip rewrites a text with a model running on your own machine until those coins are noise again, and then measures the result. The rewriting is ordinary. The measurement is the reason the repository exists: more than forty tools appeared in August claiming to remove this watermark, and none of them publishes a detector reading before and after.

What it does not do

• It cannot check its work against Claude’s own detector, and neither can anything else. Anthropic holds the secret and the detection service is a private preview. What can be done is to run the published algorithm, which Anthropic says its watermark is a version of, with a secret of one’s own on an open model, and read that detector. Every number in the repository comes from there.
• It does not remove invisible characters and call that the job. It does remove them, and it reports that the detector did not move by so much as a second decimal when it did.
• It does not send anything anywhere. The rewriter is a two and a half gigabyte model under a local server. Any endpoint that speaks the same protocol works, and a model that watermarks its own output is refused rather than ranked.
• It does not promise that a light edit is enough. Rules alone, meaning contractions, spelling variants, dashes and stock phrases, change two words in a hundred and take a tenth off the score. The table says so.
• It has only been measured on one laptop, with one open model, against one implementation of one watermarking scheme.

What the measurement says

Twenty-four watermarked texts, the detector score before and after each transform. The score is in standard deviations above chance: unwatermarked text sits between minus two and plus two, and above four happens once in thirty thousand by accident.

transform	score before	score after	texts below the threshold	meaning kept	words changed
strip invisible characters	17.6	17.5	0 of 24	1.000	0%
word rules, no model	17.6	15.8	0 of 24	0.999	2%
replace one word in three	17.6	1.5	21 of 24	0.967	40%
rewrite every paragraph	17.6	0.6	23 of 24	0.956	72%
rewrite, coverage checked	17.6	0.3	24 of 24	0.955	74%
unwatermarked controls	0.0	-0.1	23 of 23	1.000	0%

The result that cost the most to accept is the fourth row against the third. Replacing one word in three was the clever idea: change a token and the coins of the four tokens after it are re-randomised too, so one edit in every five tokens should be enough, and it is. On a four billion parameter model running locally it also costs two to three times the tokens of a plain rewrite, takes twice as long, and leaves grammar a reader notices. So the plain rewrite is the default, and the clever one stayed in the box with its numbers next to it.

Use

reflip run draft.md -o clean.md
reflip models --recommended
reflip models --measure gemma3:4b

There is a window as well, one vertical column with the model server at the top and the figures at the bottom, and a machine-readable command line so an agent can put a text through it and read what it cost. Both are in the repository.

What this does not settle

Anthropic’s secret, the length of context its hash covers, and the detector it runs are private. A tool that tells you a text is now clean of Claude’s watermark is telling you something it cannot know. reflip reports the coverage it achieved against a published algorithm, which is a different and smaller claim.

nerln.github.io/reflip

nerln/reflip on GitHubSource, the benchmark corpus, the window, and the numbers above with the text of every sample. MIT.