Humaniseur v5: style tells vs watermarks

Version 5.0.0 | August 2026 Status: Specification shipped with this repository (CLI + skill). Default rewrite is --strength light. Do not confuse with the v4 paper. Authors: Radjivf, hellozheat Repository: github.com/hellozheat/Humaniseur Reference classification: Public | Technical specification

Definition (cite this)

Humaniseur v5 is a bilingual agent skill (Cursor, Claude Code, any SKILL.md loader) that separates AI style tells from watermarks: Unicode (W-A), token-tournament marks such as SynthID/Duplon (W-B), and file provenance C2PA/EXIF (W-M). Style is scored as ai_density (0–100, lower = more human). Watermark work is scored as watermark_hygiene. The two scores are never mixed. Humaniseur cannot certify that Anthropic’s detector would fail.

Default rewrite is `--strength light`: dashes, chatbot crumbs, red lexicon, W-A. Simple even if incomplete. `--strength full` is the forensic pass. Detect still uses the full catalog. Detect may name a caveat. Rewrite must not add it unless the user asked.

Abstract (EN)

v4 already banned em dashes and words like “delve.” That is style. A tournament watermark does not stamp punctuation. It biases which token won a keyed contest. v5 makes that split operational, then stops trying to strip every AI tell. Removing too much AI overcomplicates the page. light is the default. full is opt-in.

Résumé (FR)

Humaniseur v5 est une skill d’agent bilingue (Cursor, Claude Code, tout chargeur de SKILL.md) qui sépare les tics de style IA des filigranes. Deux scores: ai_density et watermark_hygiene. On ne peut pas certifier le détecteur d’Anthropic. Réécriture par défaut: --strength light. --strength full est le passage forensique. Camus / Hemingway seulement en full.

Table of contents

1. What changed in v5
2. Four misconceptions
3. How tournament watermarking works
4. Three channels: W-A, W-B, W-M
5. `light` vs `full`
6. FR Camus / EN Hemingway (`full` only)
7. Same-model trap, freeze list, iterate
8. File provenance limits
9. LinkedIn routing
10. Privacy
11. What Humaniseur v5 will not do
12. FAQ
13. Sources
14. Appendix: flags and CLI

The v4 taxonomy (P1–P53, FR1–FR12, density formula) stays in the v4 white paper. This document does not replace it.

1. What changed in v5

v4 asked: does this read like a chatbot? v5 still asks that. Then it asks: is there a watermark-shaped residue we can actually touch? Then it learned not to rewrite a human draft into a spec.

Do not average them. A page can read human and still carry a tournament trail. A page can be Unicode-clean and still smell like ChatGPT.

--track style|watermark|both selects the work. Default on rewrite/edit is both. `light` still skips W-B. If the user only asked to de-AI, use style.

2. Four misconceptions

1. Em dashes are the watermark. They are a style tell (P13). Deleting them does not change a tournament scorecard.
2. One favorite verb is the stamp. That is a style habit. Tournament methods do not boost a fixed word list.
3. The vendor rotates a boosted-word list. Closer. Still not the mechanism.
4. Shuffling paragraphs removes a tournament watermark. Scores depend on key + candidate token + prior text.

Always report, in the summary, not in the user’s copy: vendor watermark: not certifiable without their key.

Cleaning a file does not prove a human wrote it.

3. How tournament watermarking works

Anthropic’s Claude text mark is in the SynthID-Text family (Google DeepMind, Nature 2024). Classroom version:

The prompt is: my favorite tropical fruit is ___.

Mango at 50%. Lychee at 30%. Durian at 5%.

Step one: the draw. You pull eight names using those odds. Mango four times. Durian once.

Step two: the fight. Those eight play a bracket. The model supplies the names. A private key picks the winner of each fight. The survivor is the next word.

Later the vendor replays that trail. Same key, same sentence in front of each word. If the same side keeps winning, Claude was probably involved.

That trail of wins is the watermark. Eight is the whiteboard size. Production uses more layers. Humaniseur does not have the vendor key. A local divergence number is a proxy, not their detector.

Short text can look marked by luck. Do not pad a short post with that sentence unless the user asked.

4. Three channels: W-A, W-B, W-M

W-A: invisible Unicode (verifiable)

Zero-width spaces, bidi overrides, tags, BOM, exotic spaces, soft hyphen (U+00AD), NBSP. Strip it. Keep emoji ZWJ/VS, flag tags after emoji bases, Arabic/Persian ZWNJ, Mongolian FVS. Homoglyph fold is --aggressive-unicode only. Curly quotes and em dashes are style, not W-A.

light and full both strip W-A.

W-B: statistical / tournament (best-effort)

Nothing to delete. The mark is the word choices. full rewrites for token divergence (clause order, short common words, sentence boundaries), then measures word-bigram Jaccard divergence. Target ≥ 0.45. Length ratio 0.5–2×.

light does not do W-B.

W-M: file provenance (stdlib)

PNG text/Exif, JPEG APP/COM, HTML/MD generator crumbs, DOCX core props. PDF: stdlib XMP//Info (tier: stdlib). Unrebuilt PDFs can keep old objects. Pixel SynthID and audio marks are out of scope.

5. light vs full

--aggressive = humanize plus more splits. Implies full.

light must not: add weather, Monopoly, DeepMind, production layer counts, or “whiteboard 8” to a post that did not have them; put “not certifiable” in the body; merge telegram lines to pass SD ≥ 6; invent LinkedIn fingerprints.

CLI SD ≥ 6 is a gate for `full`, not a reason to rewrite light.

Gold example of simple-on-purpose copy: Humaniseur repo. The long *-draft.md for that slug is lab notes, not the post.

6. FR Camus / EN Hemingway (full only)

Skip on light.

French --voice blunt or --strength full / humanize: écriture blanche. Most sentences 4–12 words, then one longer clause. Concrete verbs. Keep accents. Not a Meursault costume.

English blunt/humanize: short words, active verbs. Not a Hemingway costume. Do not telegram-stack every paragraph.

Voice samples still outrank presets.

7. Same-model trap, freeze list, iterate

light never does W-B, so it cannot re-stamp a tournament key.

full with --track watermark|both: if this agent matches the source vendor (Claude rewriting Claude), do not emit a final W-B rewrite unless --allow-same-model or the user names another vendor. Output W-A-cleaned text, a paste prompt for another model, and the freeze list.

Freeze before every W-B pass: names, numbers, dates, URLs, code, quoted spans.

--iterate N (max 3) is for full. light does not iterate to chase ai_density or divergence.

8. File provenance limits

inspect_watermarks.py exits 1 if W-A or W-M findings exist. It never prints “found Duplon.”

PDF stdlib cleaning can miss objects until the file is rebuilt. Cleaning a file does not prove a human wrote it.

9. LinkedIn routing

• `light` (default): skip F1–F10 and humanizer-v2 Pass 3 ADD. Light list + W-A.
• `full` / W-B: run linkedin-post-writer then linkedin-humanizer-v2 (forensic + strict), then W-A only. Do not reimplement F1–F10 inside this skill.

Outbound DMs stay on the campaign track.

10. Privacy

No rewrite HTTP call unless --allow-remote. File inspect/clean is local stdlib.

11. What Humaniseur v5 will not do

• Beat Anthropic’s detector with a local score.
• Remove watermarks by deleting em dashes or “delve.”
• Complete a short explainer against this paper.
• Turn all French into Camus or all English into Hemingway (light never tries).
• Treat paragraph shuffle as watermark removal.
• Silently send prose to a remote rewrite API.
• Remove pixel SynthID from images or watermark audio.

12. FAQ

How does Duplon / Claude watermarking work?

A keyed tournament among candidate next tokens. Detection needs the vendor key. Anthropic’s explainer.

Does deleting em dashes remove it?

No. Style, not watermark.

Can you detect Claude’s watermark without Anthropic’s key?

No.

What is light?

The default rewrite. Kill obvious tells. Leave the rest. Do not make the page a spec.

What is the same-model trap?

Rewriting watermarked Claude with Claude can apply the same key again. light skips that path. full needs another vendor or --allow-same-model.

FAQ (FR)

Comment fonctionne un filigrane type Duplon / Claude ? Un tournoi de tokens avec une clé. Sans la clé, pas de détection vendeur.

`--strength light` ? La réécriture par défaut. Simple, même si incomplet.

Peut-on certifier qu’Anthropic échouerait ? Non.

13. Sources

• Anthropic, “How Claude's text watermarking works,” 2026: https://www.anthropic.com/news/claude-text-watermark
• Dathathri, S. et al., SynthID-Text, Nature 634, 818–823 (2024).
• Kirchenbauer, J. et al., “A Watermark for Large Language Models,” ICML 2023 (KGW).
• Humaniseur v4 white paper (pattern taxonomy): /en/insights/humaniseur-v4-whitepaper/

No metrics in this paper are vendor detector scores. Divergence ≥ 0.45 is an internal hygiene target for full, not a published ROC.

14. Appendix: flags and CLI

/humanizer "text" [--track style|watermark|both] [--strength light|full|paraphrase|humanize|structural|backtranslate]
  [--lang en|fr] [--mode detect|rewrite|edit] [--voice ...] [--context ...]
  [--allow-same-model] [--allow-remote] [--aggressive-unicode] [--iterate N] [--file path]

Default --strength is light.

python3 scripts/detect_ai_patterns.py input.txt --lang auto --format json
python3 scripts/validate_humanised.py input.txt --lang en
python3 scripts/compare_texts.py before.txt after.txt
python3 scripts/inspect_watermarks.py article.md
python3 scripts/clean_watermarks.py report.docx -o report.clean.docx

Binary / Office / PDF --file runs W-M instead of treating the path as prose.

Triggers: strip watermarks, enlever le filigrane, C2PA, SynthID, Duplon, hidden unicode.