Six word changes against our published watermark

Each replacement below comes from the same authored candidate slot as the word it replaces. We selected changes with access to the detector, then reviewed the result as an ordinary piece of technical writing. The table reports scalar offsets in the original passage, before any replacement changes later positions.

Watch the repeated words. There is a second "value" at original offset 327 and a second "passes" at 1030, and neither gets touched. Offsets drift too. The first five changes add three characters between them, so by the time the last replacement is applied it begins at offset 997. That is why the table records original offsets: every target stays unambiguous.

After five changes the score stands at 1.7698, under the 1.80 cut-off but only by 0.0302. That margin is less than one scoring step, because with 358 effective pairs a single green-pair change moves the z score by about 0.1221 here. The sixth change takes the score to 1.5257, which leaves 0.2743 below the cut-off.

Every scored pair is built from the previous token and the current one. So a single replaced word can shift two pairs at once, the pair ending at that word and the pair starting from it. One visible word changes. The green count drops by two. That is exactly what each selected change above does.

Recomputing the entire passage is not optional for a guided editor. A replacement can change the contexts either side of it, and a repeated pair only counts at its first occurrence, so nothing local can be trusted on its own. Treat a highlight as a place to investigate. It is no promise that the score will fall by any fixed amount.

In the cleaner, the replacement comes from the user. The tool previews the new whole-passage score and applies nothing until the user confirms it. It generates no synonyms and rewrites no text silently. And once an edit lands, the context table gets rebuilt, since the previous ranking cannot be assumed to still hold.

Reproduced observation. Six human-reviewed, detector-aware substitutions move this fixed passage from 2.9904 to 1.5257, with the effective pair count holding at 358 throughout. The registered candidate slots constrain what wording is available. Take the published profile and the reference implementation and you can reproduce the exact result yourself.

The experiment does not establish that meaning is mathematically unchanged. Semantic review is a human judgement recorded for this fixture. Nor does the experiment show that six edits will clear another passage, another seed, another detector or Claude's mark. A different word can increase the score, change the effective pair count or damage the writing.

Crossing the cut-off does not make the result "human". In the frozen evaluation, 2 of 96 passages by named public-domain authors crossed this site's threshold. The score answers one narrow question about one published pattern. It does not answer who wrote a passage or how they worked.

Inference, not evidence. A public post on 17 August, still carrying no measurements or replies when its API record was checked on 8 September, suggested that asking a model to answer in base64 and decoding the result afterwards would shake off a distribution-based watermark. Generation carried out in the encoded form is something a fixed-template watermark like this one cannot be made to do, so Declawd cannot set that case up and neither confirms nor refutes it. What it can do is measure the transform against its own published method.

Reproduced observation. Base64 used as transport changes nothing. Encode the marked passage and decode it again and the bytes come back identical, scoring 2.9904. Score the base64 text itself, without decoding, and it reads as 260 tokens with 255 distinct pairs, 53 of them green, for a score of -1.5547, below the 1.80 cut-off. Re-encoding rewrites the words the scorer reads, so it counts different pairs, not the same pairs made to disappear. The bundle behind these numbers, carrying the scorer, the profile and the marked passage, is published to rerun: the reproduction script, the marked input, the hash manifest and the dated report.

In the controlled fixture every choice is inspectable. Reproducibility comes from what was pinned down in advance: the registered passage and its existing candidate slots, plus a fixed expected result.

The guided mode lets a person explore their own text, provided it is long enough, and it comes with fewer guarantees. Below 200 distinct pairs the public site shows no score, verdict or attack table. At or above that presentation floor the editor can show contributing contexts and preview a replacement the user has written. What it cannot do is promise that an acceptable alternative exists, or decide on the user's behalf that a semantic change is harmless.

Publishing a detector makes detector-aware research possible. An automatic rewriting service would be a different product with a much broader claim.

Try the controlled experiment and guided editor, or read what current cleaners can and cannot change.