Zero-width spaces, Unicode controls, and what ‘AI watermarks’ really means

Start with three different kinds of signal

The phrase ‘AI watermark’ is used for several unrelated mechanisms. Mixing them together produces confident-looking tools that explain very little.

A trustworthy taxonomy separates what is found directly in text from what a classifier infers and what a specific provenance system can verify. The current AIssistify inspector implements a deliberately smaller subset: named invisible characters, bidirectional controls, and English editorial heuristics.

• Found in the current text inspector: named zero-width characters, unusual spaces, bidirectional controls, and selected mixed-script lookalikes, with exact positions.
• The current inspector also flags a deliberately narrow set of common Cyrillic and Greek lookalikes when they appear inside otherwise Latin tokens. It never auto-replaces them, does not claim exhaustive UTS #39 coverage, and does not inspect signed file metadata.
• Inferred: language patterns such as repeated framing, unusually uniform rhythm, or similarity to a model-trained classifier.
• Verified: a signature or model-specific statistical signal checked by a detector that has the required key and method.

Invisible Unicode is real—and not automatically malicious

A zero-width space, byte-order mark, non-breaking space, soft hyphen, or direction-control character can make copied text behave differently from what a reader sees. Those characters may come from a rich-text editor, a website, a PDF, a writing system, or deliberate manipulation.

Joiners are necessary in some scripts and emoji sequences. Bidirectional controls also have legitimate uses, although they deserve careful review because they can create security-sensitive display differences. A safe cleaner identifies the exact code point and context before offering removal.

• Normalize ordinary interchange text conservatively; NFC is generally safer than compatibility normalization.
• Do not bulk-delete joiners from multilingual content or emoji.
• Treat mixed-script and confusable warnings as review prompts, not automatic proof of deception.

Statistical watermarks are not hidden characters

Generation-time systems such as SynthID Text alter token-selection probabilities. The resulting signal lives in the distribution of token choices, not as a zero-width glyph that a regular expression can highlight.

Verification depends on the watermark design, enough text, and often detector access unavailable to a generic cleaner. Rewriting, translation, cropping, or mixing text can weaken statistical signals, which is one reason provenance claims need careful wording.

A trustworthy cleanup workflow

Reveal exact artifacts first. Offer a conservative normalization with context and undo, not a universal safety claim. Put language and rhythm suggestions in a separate layer, show the contributing passage, and keep the original draft available.

Never ‘humanize’ text by adding homoglyphs, hidden characters, or deliberate typos. Those tricks make downstream search, accessibility, security, and editing worse.