AI Watermark Lab · Study 01

Invisible-character census in Claude output

We generated 128 answers from four Claude models, wrote each one straight to disk, and counted every code point. Zero zero-width or bidirectional-format characters appeared in any of them. The most repeated explanation of Claude's watermark (that it hides invisible characters in your text) finds no support in the bytes.

Version 1.1.0 adds the model that matters most for the question. Anthropic marks models launched on or after 2 August 2026, and until 1 September no shipped model qualified. Fable 5.1 does, and Anthropic names it as supported. So this is the first measurement anyone outside Anthropic has published on a Claude model the company confirms carries the watermark, and it still contains no hidden characters. That independently matches Anthropic's own statement that "nothing is added to the text."

Every output here was captured on 12 August 2026 or 3 September 2026. Anthropic's help page, re-read on 25 September 2026, lists Claude Opus 5 as marked, and a 25 September 2026 email to Claude Platform customers dates that from 14 September 2026 (a 4 September 2026 notice to administrators had said 9 September). The same email schedules Claude Sonnet 5 from 30 September 2026. Two of the four models in this corpus are therefore marked, or scheduled to be, after their sampled output was captured, so a rerun against Opus 5 and Sonnet 5 output generated after those dates is the obvious next version.

Every character class we counted

Twenty classes of invisible or non-obvious character, chosen because they are the ones every "AI watermark remover" on the web actually operates on. Nineteen returned zero across all four models.

The single non-zero row is the interesting one, and it is not a watermark. All 48 ideographic spaces occur inside the Japanese-language outputs, where U+3000 is ordinary typography, the character a Japanese writer uses to indent a line. A naive scanner that flagged "invisible characters found" on that basis would be reporting correct Japanese as evidence of a hidden mark.

The result per model, including the marked one

Splitting the corpus by model is the whole point of version 1.1.0. Three of these four predate Anthropic's 2 August 2026 marking threshold. One does not. The column below reports what was true when each output was captured, not what is true today: Anthropic dates Opus 5 from 14 September 2026 and Sonnet 5 from 30 September 2026, both after every capture date here.

The marked model behaves exactly like the unmarked ones at the byte level. That is the expected result if Anthropic's description is accurate, and it is worth stating as a positive finding rather than a null one: a keyed statistical watermark should be invisible to a code-point census, and it is.

It also closes off the last honest defence of the hidden-character theory. Until 1 September a reader could argue that this census only ever measured models Anthropic had not yet marked. It now includes one Anthropic says it has.

One cell needs its date read carefully. Opus 5 launched on 24 July 2026, nine days before the threshold, so it was unmarked when these 32 outputs were captured, and the zero in its row is a measurement of unmarked output. Anthropic's 4 September 2026 notice to Claude for Work administrators then scheduled Opus 5 output from 9 September 2026; Anthropic's 25 September 2026 email gives 14 September 2026 instead, and its help page now lists Opus 5 as marked. None of the counts above change: they describe the corpus as captured.

One number we are withholding, and why

The scan also counts em dashes, and the Fable 5.1 run returned zero of them across 6,729 words against a rate of 2 to 5 per thousand words in the other three models. We are not publishing that as a finding, because it is measuring our own tooling.

The original corpus was written on 12 August 2026 at 23:32. A standing instruction in this project's own tooling telling the assistant never to use em dashes was added 19 minutes later, at 23:51. Every Fable 5.1 generation therefore ran with that instruction in context and every earlier generation ran without it. A difference that large, with a confound that exact, is not a model property.

No output was dropped from the corpus. The exclusion applies to one derived statistic for one model, it is recorded in the manifest, and the character-class counts are unaffected, because nothing in that instruction mentions zero-width or format characters and the positive control confirms the capture path preserves them. A clean em dash comparison would need generation through a path carrying no project instructions at all.

How it ran

Three model identifiers, claude-opus-5, claude-sonnet-5, and claude-haiku-4-5-20251001 each answered the same eight prompts, four independent times, for 32 outputs per model. The prompts span a short factual answer, long prose, source code, a list, Spanish, Japanese, a markdown table, and dialogue, because a marker might plausibly attach to some output shapes and not others.

Fable 5.1 was added on 3 September 2026 the same way: four generators, claude-fable-5-1, the same eight prompts, one output per prompt each, for a further 32 outputs. Its positive control reproduced the original result exactly, emitting U+200B, U+200C and U+00AD to disk while substituting an ordinary space for U+00A0 on two independent attempts.

The capture path is the part that matters. Each answer was written straight to a file by the generating process, with no clipboard, no terminal rendering, and no editor in between, since every one of those can quietly strip or add characters. Sampling settings are not controllable through this harness and are not published by the provider, so defaults were used; that is a limitation rather than a control.

Where this study stops

1. One provider, four model identifiers, one harness, two dates 22 days apart. Nothing here is longitudinal in any useful sense, and a provider can change behaviour between releases.
2. The two runs are not a controlled comparison of each other. They share prompts, generator count and capture path, but 22 days of tooling drift sit between them, and the withheld em dash figure is proof that such drift can reach the numbers.
3. 128 outputs rules out a per-output or per-paragraph marker. It does not rule out a rare probabilistic marker appearing in well under 1% of outputs. Ruling that out would need a corpus one to two orders of magnitude larger.
4. Generation ran through a command-line agent harness. If a marker were applied as a presentation-layer step in a different product surface, this capture path would not see it. A sampling-layer mark would be unaffected by the harness.
5. The corpus was generated for this study, so the prompt distribution is ours rather than the world's.
6. None of this measures the statistical watermark Anthropic has confirmed. That remains unmeasurable outside Anthropic.

Run it on your own text

The same character classes, scanned in your browser. Paste Claude output, or anything else, and you get a per-character count rather than a verdict. Nothing is uploaded.

If it comes back clean, that matches our corpus. If it does not, the interesting question is where the text has been since it was generated: editors, CMSs, and web pages all leave these characters behind routinely.

Data, code, and how to check us

The scanner is a dependency-free Node script. Point it at your own corpus: outputs from any model, saved as plain text. The numbers are directly comparable to ours.

The current dataset is v1.1.0, generated 3 September 2026, covering 128 outputs from four models. The original three-model dataset stays published and unedited as v1.0.0, so a citation to it keeps resolving to exactly the numbers it cited. Reruns add a version here; they never overwrite one.

• aggregate.json (totals overall and per model, per character class).
• per-file.csv (one row per output, 96 rows, every class counted).
• manifest.json lists the models, prompts, design, control result, and the stated limitations.
• scan.mjs is the analysis script. node scan.mjs [corpusDir] [outDir]

Reuse is welcome with attribution and a link back. If a re-run disagrees with ours, that is a correction and it gets published. See the corrections policy.

What follows from this