Rewrites watermarked text until the detector reads it as ordinary writing.

01 / the problem

Every site calling itself a watermark remover leaves the score exactly where it found it: 17.6 before, 17.5 after.

Since 2 August 2026 Claude's text has carried a statistical watermark: a bias in which words the model chose, not a hidden character in the text. The detector recomputes a coin flip for each word from a secret that only Anthropic holds, then checks whether too many of those coins came up heads.

Deleting a zero-width space or straightening a curly quote changes none of those coins, because the coins were never encoded in the characters. That is what most sites calling themselves watermark removers do, and the number above is what it buys: the same score to the second decimal.

02 / why one edit is enough

Change one token, and five coins are thrown again.

Each coin the detector recomputes depends on its token and the four tokens before it. Edit one token, and the coins for that token and the four that follow it become fresh, unbiased flips, because their hash context is no longer the one the original sampler saw.

Cover every window of five consecutive tokens with at least one edit and every coin is re-randomised, whatever the strength of the watermark. That is one edit in five tokens, about one word in three or four. A toy generator with no language model at all shows the same shape: replacing every fifth token brings its score from above 10 down below 4, and replacing every tenth token only halves it.

03 / the numbers

24 watermarked texts, one detector, run before and after nine kinds of edit.

z counts standard deviations above chance: unwatermarked text lands between -2 and +2, and a z above 4 would happen about once in thirty thousand times by accident.

04 / the window

One column, top to bottom.

The window runs down in a single column: the model server and a button to start it, a place to paste text, a button that rewrites it, and the result.

The numbers along the bottom of the picture are a real run of the paragraph above them, generated by the application itself rather than staged by hand.

05 / for agents

One command, and a result meant to be read by a program.

reflip rewrite draft.md --json --progress

The result is a single JSON object carrying the transform and model used, the rewritten text, the share of words changed, the coverage of five-token windows, and what the call spent in tokens and seconds; with --progress, JSON Lines arrive on standard error while the work runs, so a caller can show progress without pulling the result out from between them.

Exit code 0 means done, 1 an expected refusal carrying a reason meant to be shown as written, 2 a usage mistake, and 130 an interrupt.

06 / choosing a model

A catalogue that says what it does not know, and a way to check it yourself.

reflip models --recommended
reflip models --search "gemma 3"
reflip models --measure gemma3:4b  

--recommended lists what is worth trying and what each entry is bad at. --search reaches Hugging Face for anything published as a GGUF file. --measure settles an argument instead of stating an opinion: it rewrites watermarked texts from the benchmark corpus with the named model and reports the detector before and after, the coverage, the words changed, the seconds and the tokens.

A model that watermarks its own output is refused rather than ranked. That covers Claude models launched since August 2026 and the Gemini service, while open weights run under a local server, such as Gemma's, carry no watermark to begin with.