Meta · model family
Remove Watermarks From Llama Output
Llama is a family of open weights rather than a finished product, so nobody meets Llama directly: you meet it through a hosted provider, a local runtime such as Ollama, llama.cpp or LM Studio, a local web UI, or an IDE extension. Each of those is a different extraction path with different things it can introduce, and the weights are the part that stays constant. This page is therefore organised by runtime, because that is the variable that actually decides what ends up in your file.
Scan your Llama code now
Free, and it reports every removal by codepoint and line.
What we measured
68
code-generation calls
17
provider and model targets
59,486
characters generated
0
contained a hidden character
On 2026-08-12 we sent identical code-writing prompts to every model our own gateway can reach and scanned each raw API response. Not one of them contained a zero-width character, a bidirectional control, or a tag character.
3 of the 68 answers contained typographic punctuation, and only in the prose-heavy prompts rather than in the plain code one. The most common was the non-breaking hyphen, which is visible but still breaks a copied command. 2 left trailing whitespace.
The useful conclusion is the boring one: raw model output is essentially clean, so when you do find hidden characters in your file, they almost certainly came from the path the text travelled rather than from the model. That is what the section below is about.
Scope: this measured API output from models we can reach directly. It did not measure the Llama web app, which is the point being made, since the browser is where the characters get added.
How code gets out of Llama, and what each path adds
The model streams into a terminal that is wrapping lines to your window width, and selecting that output with the mouse can copy the visual wrap as real newlines, splitting long code lines at the column where they happened to reach the edge. Terminals also preserve trailing spaces on every line and, with bracketed paste, can wrap what you paste onward in escape sequences.
These are browser pages, so the text reaches the clipboard through rendered HTML in exactly the way a hosted chat product does. That round trip is where no-break spaces, typographic quotes and dashes, and soft hyphens can enter, regardless of the fact that the model is running on your own machine.
Reading the same weights from a hosted endpoint returns a raw string with no rendering step, so the only additions are whatever your own script contributes, such as a byte order mark from the file encoding you write with. The provider in front of the weights does not change this, only your client does.
An extension that inserts completions directly into the editor skips the clipboard and the HTML entirely, so it is the cleanest of the Llama paths. Its chat side panel is a different matter, because that panel is a rendered view and copying from it is a browser copy.
Because the weights are open, the thing you are running is often not stock Llama: it is a community fine-tune, a quantised GGUF, or a merge, packaged by someone who also chose the chat template. A wrong or mismatched template is the classic local-Llama failure, and it shows up as special tokens such as begin-of-text or end-of-turn markers leaking into the text as literal readable strings. Those are visible characters and this tool will not touch them, which is worth knowing so you do not mistake a template problem for a hidden-character problem. What the tool does cover is everything your runtime and your copy path can add on top, and running the same prompt through a local API call instead of the chat pane is the quickest way to tell the two apart.
What this does not do
It does not remove statistical watermarking. Schemes of the SynthID family add no characters at all: they bias which token the model samples, so the signal lives in word choice across the whole output and nothing you can delete carries it. Attacking that means rewriting the text, which for source code risks changing what it does.
This is a hygiene and security tool, not an attribution bypass. Formatters already normalise surface signals, and what identifies generated code is structure and style rather than hidden bytes. Disclose AI assistance wherever you are asked to.
Llama questions
Does Llama itself put watermarks in its output? +
A model emits tokens, and any codepoint in its vocabulary can in principle appear in text, including zero-width joiners that are ordinary parts of emoji and some scripts. But most of what people find in a file arrived after generation, from the terminal, the browser or the editor in between. Running the same prompt through a raw API call and comparing the two strings settles it in about a minute.
I use Ollama from the command line. What should I actually watch for? +
Wrapped long lines becoming real line breaks when you select output with the mouse, trailing whitespace at the end of every code line, and pasting into an editor that reflows or auto-formats what it receives. Piping to a file instead of copying from the screen avoids all three, and this tool then reports anything that survived, with the line numbers.
Does quantisation or a community fine-tune change any of this? +
It changes what the model tends to write, since a fine-tune has its own habits about quote style and formatting, but it does not change the mechanics of the path. A GGUF run locally and the same family served from a hosted API are still raw strings; the browser or terminal between the model and your file is what adds characters.
Can this remove a watermark from Llama output? +
No, and it is worth being precise about why. Statistical watermarking works by biasing which token gets sampled, so it adds no characters at all and no character edit can affect it. This tool only removes codepoints that are present in your file and invisible when rendered. It is not a way to disguise the origin of text.