We scanned Claude output byte by byte

The scanner listed every character above ASCII and checked zero-width spaces and joiners, the word joiner, byte-order marks, soft hyphens, bidirectional controls and isolates, variation selectors, Unicode tag characters, invisible mathematical operators, line and paragraph separators, combining marks, Cyrillic and Greek lookalikes inside Latin words, and three apostrophe lookalikes found in a separate Claude Code investigation.

No zero-width character, bidirectional control, tag character or variation selector reached disk in any of the 120 files. The three apostrophe lookalikes were absent too.

The other characters have ordinary uses. Thirty-six of the 37 em dashes occur in dialogue prompts, where they mark interrupted speech. The remaining one is in an informal post. Six check marks appear inside printed test output in generated Python. Accented letters appear mainly in the 12 prompts that explicitly asked for correct diacritics, with a few elsewhere. All 12 ASCII tasks contained only printable ASCII and line breaks.

This is a count for this corpus and route. It is not a general estimate of how often a hidden mark appears in Claude output.

A clean scan means little when the collection route may have stripped the characters first. We therefore asked a model to emit known hidden characters through the same route.

Zero-width characters, bidirectional controls, variation selectors, combining marks and Cyrillic lookalikes reached disk intact. A Unicode tag payload also survived and still decoded to the text placed inside it. The scanner detected those tested classes when they were present.

The space test failed. All six requested non-ASCII spaces reached disk as ordinary spaces. That is why this article makes no claim about a watermark carried only by space variants. The filesystem was not the cause. A non-breaking space written by Python survived the filesystem, clipboard and JSON unchanged.

We ran the scanner over 3,059,329 characters from five Project Gutenberg novels, downloaded as raw files.

The two bidirectional controls in the human corpus sit around Hebrew text in the Project Gutenberg file for Moby-Dick. They are modern digital direction markers in a transcription of an 1851 book. A rule that treated these characters as proof of machine writing would flag the human file and clear all 120 collected outputs.

No character from the detectable hidden classes reached disk in this corpus: 120 files, 457,045 characters, four model assignments, one collection path and one day. A cleaner aimed at those characters would have found nothing to remove.

Every assigned model predates Anthropic's 2 August launch rule. The scan did not reach the raw API body, claude.ai, the desktop app or a Copy button. It could not observe the six space variants. It also could not verify model identity independently of the harness.

A byte scan cannot see a watermark carried by token selection. The marked passage on this site scores 2.99 against a cut-off of 1.80 and still contains ordinary ASCII. Its pattern appears only when token pairs are scored with the published seed. The scan tells us which characters are present. It cannot tell us how the words were selected.

A language model does not get a reliable view of its sampling procedure or of processing applied after generation. Asking it whether its answer contains a watermark invites a plausible account, not a measurement.

Inspect the output instead. For a Unicode check, list every code point above U+007F with its name and position. Before trusting a clean result, pass known hidden characters through the same route and confirm that they survive and are detected.

The corpus, controls, scanner, tests and SHA-256 manifest are public in san-digital/claude-watermark-audit. The repository records 177 artefacts and the exact bytes used for every count.

Read the punctuation count, or inspect the watermark method used on this site.