Can invisible characters be used to detect AI-generated text?

Not reliably. Invisible characters in a document usually indicate a rich-text pipeline — a word processor, a CMS, a chat interface — rather than a particular author. No major model vendor inserts them as a marker.

Does removing invisible characters help my text pass an AI detector?

Generally no. AI-detection services classify linguistic patterns such as sentence structure and word predictability. They do not examine invisible characters, so removing them does not change their verdict.

How can I tell whether text carries a SynthID watermark?

Only with the detector and the key. The signal is statistical and cannot be seen by inspecting the characters. Google and Anthropic both operate detection on their own side rather than publishing a key that anyone can check with.

Do AI watermarks use invisible characters? No — and here is the evidence

August 31, 2026 · 9 min read

No major language model vendor watermarks text with invisible Unicode characters. Google's SynthID-Text and Anthropic's watermark for Claude both bias token sampling during generation, so the signal lives in which words were chosen. Deleting every invisible character in a document leaves those watermarks completely intact. Tools sold as "AI watermark removers" that strip characters cannot work, and the vendors' own documentation says so.

How statistical watermarking actually works

When a language model generates text it repeatedly picks the next token from a probability distribution. A statistical watermark changes the source of randomness used for that pick. A secret key, combined with the preceding few tokens, determines which of several near-equivalent continuations wins.

Google's SynthID-Text implements this as tournament sampling: candidate tokens compete in bracket rounds, and the winner of each round is the one whose pseudorandom "g-value" — derived from the key and an n-gram of recent context — is higher. Over hundreds of tokens this produces a measurable statistical bias that a detector holding the key can find, while any individual word choice looks entirely ordinary.

Anthropic's watermark for Claude uses the same approach. Their documentation describes it as changing the dice, not the game: the words Claude picks are still random, but one can check whether the sequence is consistent with the choices Claude would make.

Why character cleaning cannot touch it

The watermark is not stored anywhere in the text. There is no payload, no marker, no appended data. The evidence is the statistical distribution of the word choices themselves.

Anthropic states the position without ambiguity: nothing is added to the text and there are no hidden characters. Deleting invisible characters from watermarked output changes nothing about which words are present, so the detector's evidence survives untouched.

The ChatGPT watermark that never existed

In 2025 a claim circulated widely that ChatGPT marks its output with U+202F, the narrow no-break space. It does not. OpenAI built a text watermarking system and chose not to deploy it.

U+202F appearing in some model output is a tokenization and post-processing artifact. It carries no key, encodes nothing, and appears inconsistently. Removing it changes nothing about detectability, because it was never a detection mechanism.

What does degrade a statistical watermark

Meaning-preserving rewriting. Paraphrasing, back-translation and heavy editing all measurably reduce detection confidence, because they replace the very word choices the signal is made of. Published research on attacks against SynthID-Text confirms this and proposes defenses against it.

Two properties follow. Short passages carry a weak signal because the statistics have not accumulated. Factual and technical writing carries a weaker signal than discursive prose, because there are fewer genuinely equivalent ways to say the same thing — which is also why code is largely unaffected.

Anthropic makes the honest point about the endpoint of that process: text where every word has been replaced no longer really is the model's output.

What a character-cleaning tool can honestly claim

It removes invisible and zero-width characters, and reports every one.
It decodes hidden-text payloads, including the prompt-injection channel in the Unicode Tags block.
It identifies steganographic encodings and shows the recovered message.
It normalizes typography — smart quotes, dashes, ellipses — to plain ASCII on request.
It does not remove SynthID, the Claude watermark, or any statistical watermark.
It cannot make text pass an AI-detection classifier, which analyses writing style, not characters.

Frequently asked

Can invisible characters be used to detect AI-generated text?: Not reliably. Invisible characters in a document usually indicate a rich-text pipeline — a word processor, a CMS, a chat interface — rather than a particular author. No major model vendor inserts them as a marker.
Does removing invisible characters help my text pass an AI detector?: Generally no. AI-detection services classify linguistic patterns such as sentence structure and word predictability. They do not examine invisible characters, so removing them does not change their verdict.
How can I tell whether text carries a SynthID watermark?: Only with the detector and the key. The signal is statistical and cannot be seen by inspecting the characters. Google and Anthropic both operate detection on their own side rather than publishing a key that anyone can check with.

Keep reading

Invisible Unicode characters: a complete reference
Every category of invisible, zero-width and blank-rendering Unicode character, what each one is legitimately for, and when its presence is a signal that something is hidden in your text.
Invisible prompt injection with Unicode Tags
How the U+E0000 block hides instructions that people cannot see but language models read, why it works, and how to strip it before untrusted text reaches a model.
Zero-width steganography: how text hides inside text
StegCloak, base-N zero-width encodings and variation-selector channels — the practical schemes for hiding data in a string, their fingerprints, and how detection works.