Developer guide

The Windows AI text watermark: what it is and how to strip it

Starting in October 2026, text from Microsoft’s on-device Windows AI text APIs (Phi Silica) can contain an invisible watermark: the four code points U+200B U+034F U+2060 U+200B. It doesn’t show on screen, but it can break JSON parsing, Markdown and code output. Here is how the Windows AI text watermark works, which APIs add it, and how to find or remove it.

Facts checked against the sources below on November 2, 2026.

How it works

Unlike statistical watermarks such as SynthID, textGrain or Claude’s watermark, the Windows AI text watermark is made of characters. The APIs insert a fixed four-code-point sequence into the output string. Heuristics decide whether and where to place it, so a response can contain zero, one or several copies, and the positions change from one response to the next.

Microsoft says the heuristics avoid spots where the sequence would affect word breaking, and that they will change over time — so don’t rely on a fixed position, or assume every response is marked. Because the mark is ordinary Unicode, anyone can detect it with a character scan, and deleting the characters removes it completely — no rewrite needed.

The sequence

Position	Code point	Unicode name
0	`U+200B`	ZERO WIDTH SPACE
1	`U+034F`	COMBINING GRAPHEME JOINER
2	`U+2060`	WORD JOINER
3	`U+200B`	ZERO WIDTH SPACE

Which APIs add the watermark

Microsoft lists seven methods in the Microsoft.Windows.AI.Text namespace that insert it automatically:

LanguageModel.GenerateResponseAsync
LanguageModel.GenerateResponseFromEmbeddingsAsync
TextRewriter.RewriteAsync
TextRewriter.RewriteCustomAsync
TextSummarizer.SummarizeAsync
TextSummarizer.SummarizeConversationAsync
TextSummarizer.SummarizeParagraphAsync

What it breaks

Selection and cursor movement. Most renderers don’t display the characters, but Microsoft notes they can still affect text selection and cursor movement.
Structured output. Microsoft calls out Markdown, generated code or markup such as HTML and CSS, and JSON that you then parse — a copy between two JSON tokens makes the parse fail.
Encoding. Most non-Unicode code pages can’t represent the sequence, so converting a response can throw, or leave fallback characters such as ? in the text.
Exact string comparisons. Two responses that look identical won’t compare equal if only one carries the sequence, and string lengths are off by four per copy.

Find or remove it in code

Match the whole four-character sequence rather than every zero-width character, so you don’t touch any that belong in the text (zero-width joiners inside emoji, for example).

const string WindowsAiWatermark = "\u200B\u034F\u2060\u200B";

// Compare ordinally: culture-aware IndexOf skips zero-width characters.
bool marked = text.Contains(WindowsAiWatermark, StringComparison.Ordinal);
string clean = text.Replace(WindowsAiWatermark, "", StringComparison.Ordinal);

JavaScript / TypeScript

const WINDOWS_AI_WATERMARK = "\u200B\u034F\u2060\u200B";

const copies = text.split(WINDOWS_AI_WATERMARK).length - 1;
const clean = text.replaceAll(WINDOWS_AI_WATERMARK, "");
const data = JSON.parse(clean); // strip before parsing generated JSON

Python

WINDOWS_AI_WATERMARK = "\u200b\u034f\u2060\u200b"

copies = text.count(WINDOWS_AI_WATERMARK)
clean = text.replace(WINDOWS_AI_WATERMARK, "")

Before you remove it

Microsoft’s documentation carries a warning: you are responsible for making sure your app meets the requirements for marking AI-generated content that apply to it, and should consider them before removing the watermark. In the EU, Article 50 of the AI Act is the rule to look at (see the tracker for dates). A common approach is to strip the sequence for parsing and display, and disclose AI generation another way — a visible label or metadata.

Not a developer?

Paste the text into the AI watermark checker: it names the Microsoft sequence and counts every copy, entirely in your browser. To remove it, use the Unmark homepage scanner’s “Strip hidden chars only” — no rewrite needed, because this watermark is made of characters, not word choice.

Check text for the Windows AI watermark

Free, runs in your browser.

Open the homepage scanner

FAQ

What is the Windows AI text watermark?+

Since October 2026, Microsoft’s on-device Windows AI text APIs (Phi Silica) can insert the four invisible Unicode characters U+200B U+034F U+2060 U+200B into their output. It is a character sequence, not a statistical watermark.

How does the Windows AI text watermark work?+

The APIs use heuristics to insert zero, one or several copies of the four-character sequence into a response. Positions change between responses. Nothing shows on screen, but the characters are still in the string — so string length, JSON parsing and exact comparisons can break.

Is the Windows AI watermark a statistical watermark like SynthID?+

No. It is four ordinary Unicode characters inserted into the text. That makes it the opposite of SynthID, textGrain or Claude’s watermark: anyone can detect it with a character scan, and deleting the characters removes it completely.

Does Microsoft Copilot add this watermark?+

Microsoft documents it only for the seven Microsoft.Windows.AI.Text APIs (Phi Silica). Apps built on those APIs pass it through unless they remove it. Microsoft 365 Copilot’s documented watermarks cover images, audio and video, not text.

Will trim(), \s or Unicode normalisation remove it?+

No. None of the four characters counts as whitespace in JavaScript, C# or Python regular expressions, and NFC or NFKC normalisation leaves them in place. Match the exact sequence, or strip the individual characters.

Why does my generated JSON fail to parse?+

JSON only allows spaces, tabs and line breaks between tokens. If a copy of the watermark lands between two tokens, JSON.parse and most JSON libraries throw. Remove the sequence before you parse, as in the code above.

Am I allowed to remove it?+

Microsoft leaves that to you, with a warning: you are responsible for meeting whatever rules for marking AI-generated content apply to your app. Stripping it for parsing and then labelling the content another way is a common pattern. This is not legal advice.