Hidden Watermarks in AI Text: What's Real, What's Myth

Some AI text does carry a watermark in 2026, but it isn't made of hidden characters. Google, Anthropic and, for text generated in the EU, OpenAI watermark text by nudging which words the model picks. You can't see it, you can't delete it with find-and-replace, and only a statistical test can find it, usually only on longer text.

Invisible characters are a different thing. They turn up in AI output, in copy-pasted text and from ordinary keyboards. They aren't a watermark and they don't prove anything about who wrote a post, but they do change how your post is counted and can break it in small ways.

Here's how each kind of "invisible sign" works, which ones are real, and how to check your own posts.

Three things people mean by "invisible signs"

1. Statistical watermarks, hidden in the pattern of word choices
2. Metadata and provenance, such as C2PA Content Credentials attached to a file
3. Invisible Unicode characters, like zero-width spaces, sitting inside the text

Only the first is used to watermark AI text at scale today.

Statistical watermarks: real, and weaker than you'd think

A language model writes one token (roughly a word or part of one) at a time, choosing from many likely options. A watermark tilts those choices in a pattern only the provider knows. The 2023 paper that popularised the idea, by Kirchenbauer and colleagues at the University of Maryland, describes splitting the vocabulary into a random "green" list before each word and softly favouring green words. Over enough words, a detector that knows the key can see far more green words than chance would give.

Google DeepMind published its version, SynthID-Text, in Nature in October 2024, after testing it on nearly 20 million Gemini responses, and released it as open source the same day.

Who watermarks text, as of October 2026:

All three describe the same limits:

• Short text is hard to detect. The signal builds up over many words. The EU's code of practice doesn't even require watermarking text under 200 tokens, which covers most single social posts.
• Editing weakens it. The SynthID paper says watermarks are "weakened by edits to the text, such as through LLM paraphrasing". Hugging Face's write-up adds translation and thorough rewriting.
• Factual answers carry less of it. When there's only one right way to say something, the model has fewer choices to tilt.
• Detectors are mostly private. The EU code lets providers limit text-watermark detectors to vetted experts such as regulators, researchers and fact-checkers.

OpenAI held its own text watermark back in 2024 for exactly these reasons. It said rewording with another model or translation could get around it, and that it could stigmatise AI as a writing tool for non-native English speakers. In October 2026, with the EU AI Act now requiring providers to mark AI text, it announced a watermark for text generated in the EU. We cover what that law means for people who post in do you need to label AI-written posts under the EU AI Act?

Metadata and C2PA: built for files, not posts

C2PA is the standard behind Content Credentials: a signed record, attached to a file, of how it was made and edited. It's what lets LinkedIn show a "CR" icon on some AI images, and what Meta reads to add "AI info" labels to images.

It doesn't help much with text, for two reasons:

• Plain text has nowhere to put it. The EU code of practice says free-form text "cannot transport metadata". C2PA's latest specification does define a way to embed a manifest in plain text, but it does it with invisible Unicode variation selectors, calls it a method for when nothing else is possible, and marks it as still under review.
• It gets stripped. NIST notes that metadata is often removed when files are shared through social platforms. Meta has said the same about invisible markers in general.

So for a social post, C2PA is about the images you attach, not the words.

Invisible characters: not a watermark, still worth finding

The idea that AI text is marked with hidden characters spread in April 2025, when an education startup noticed narrow no-break spaces (U+202F) in answers from two new ChatGPT models. OpenAI said it wasn't a watermark but "a quirk of large-scale reinforcement learning", and within days the characters stopped appearing. Anthropic's 2026 announcement says plainly that its watermark adds "no hidden characters". OpenAI describes its own as working through word choices.

Invisible characters also come from ordinary places: French typing puts narrow no-break spaces before some punctuation, word processors add non-breaking spaces, and copying from web pages and PDFs brings all sorts along. Seeing one in a post tells you nothing about whether AI wrote it.

Some are also essential. Emoji use them: 👩‍💻 is two emoji joined by a zero-width joiner, ❤️ ends with a variation selector, and some flags are built from tag characters. Stripping "every invisible character" can break emoji and some writing systems, so a good cleanup is selective.

The ones you'll run into:

What invisible characters do to a post

They change your count on X. X counts most characters as 1 and some as 2, using the ranges in its open-source counting library. Many invisible characters fall outside the 1-weight ranges: U+202F, U+FEFF, the word joiner, direction controls, tag characters and variation selectors count as 2 each. Zero-width and no-break spaces count as 1, but they still count. A post that looks like 278 characters can be over the limit.

They can break hashtags, mentions and links. A zero-width space inside #BuildInPublic or a URL changes the text the network sees, so the tag may not link, the mention may not notify, or the URL may not resolve. It depends on how each network parses text, so the safe habit is to keep them out of tags, handles and links.

They can hide instructions. Tag characters mirror normal letters but don't display. Security researcher Johann Rehberger showed in 2024 that text hidden this way can carry instructions to AI assistants that the person pasting it never sees. If you paste text from the web into an AI tool, or AI output into a post, it's worth knowing they exist.

They can make text look different from what it is. Direction controls can reorder how text displays, which the 2021 "Trojan Source" research showed could hide what code really does. In a post, the same trick can make a link or a name read differently from what it contains.

AI detectors don't work on posts

If you can't see a watermark and invisible characters prove nothing, what about AI detectors? For social posts, they're not reliable:

• OpenAI's own classifier caught only 26% of AI-written text in its tests and wrongly flagged 9% of human text. OpenAI withdrew it in July 2023 for "its low rate of accuracy".
• A 2023 Stanford study found detectors "consistently misclassify non-native English writing samples as AI-generated".
• Turnitin, one of the most used commercial detectors, requires at least 300 words of long-form prose and says it doesn't reliably handle short or unconventional writing. A post is usually a fraction of that.

The EU's code of practice says the same about detection without a watermark: not mature enough to rely on. Never call someone out for using AI because a detector said so.

What's real and what's myth

How to check a post for invisible characters

• In our invisible character remover. Paste the post into the free invisible character remover. It lists every invisible or format character with its name, code point and position, marks each one in place, and shows what it adds to your count on X. That includes the zero-width and no-break spaces X counts as 1. The cleaned copy keeps the joiners and selectors that hold your emoji and flags together.
• In a code editor. VS Code highlights invisible and look-alike Unicode characters by default. Paste the post into a new file and look for highlighted gaps.
• Retype the risky parts. If a hashtag, handle or link was pasted from somewhere else, typing it fresh is the quickest fix.

Where Shaflex fits

The Shaflex Composer counts each network the way that network does, including X's weights, so an invisible character that costs you on X shows up in the count before you schedule. For a quick check without signing up, the invisible character remover and the X character counter are free and run in your browser.

Sources

Checked on October 20, 2026.

• Kirchenbauer et al. (2023): A Watermark for Large Language Models
• Dathathri et al. (2024): Scalable watermarking for identifying large language model outputs, Nature 634
• Hugging Face: Introducing SynthID Text
• Google DeepMind: SynthID
• Anthropic: Watermarking Claude's text and how Claude marks AI-generated content
• OpenAI: Our approach to EU text provenance rules, October 2026
• Engadget: OpenAI confirms it's looking into text watermarking, August 2024
• European Commission: Code of practice on transparency of AI-generated content
• C2PA: Specification 2.4, Appendix A.8
• NIST: AI 100-4, Reducing Risks Posed by Synthetic Content
• Meta: Labeling AI-generated images on Facebook, Instagram and Threads
• LinkedIn Help: Content Credentials
• Rumi: New ChatGPT models seem to leave watermarks on text, April 2025
• Unicode: Language tagging FAQ
• Johann Rehberger: Hiding and finding text with Unicode tags, January 2024
• Boucher and Anderson: Trojan Source, 2021
• X: twitter-text counting configuration and counting characters
• OpenAI classifier retirement, as reported by MediaPost, July 2023
• Liang et al. (2023): GPT detectors are biased against non-native English writers, Patterns
• Turnitin: Understanding false positives and AI writing report file requirements