AI companies are increasingly looking for ways to mark content generated by their models. From invisible Unicode characters to statistical patterns in word selection, these provenance signals are designed to help platforms identify machine-generated material. Now, a developer has built an open-source tool that aims to remove some of those marks.
The GitHub project watermarks-remover is designed to strip different types of AI provenance signals from text and files. According to its documentation, it can work with invisible Unicode characters, statistical text watermarks, and metadata embedded in formats including PNG, JPEG, SVG, PDF, DOCX, ODT, HTML, and Markdown. The latest version, 0.3.1, adds aggressive text rewriting to disrupt statistical watermarking, and the developer has stated that it now supports outputs from OpenAI and Gemini alongside Claude.
Key Facts
- Project name: watermarks-remover
- Latest version: 0.3.1
- Supported AI generators: OpenAI, Gemini, Claude
- Target formats: PNG, JPEG, SVG, PDF, DOCX, ODT, HTML, Markdown
- Techniques: Unicode character removal, statistical watermark disruption, metadata cleanup
- Developer: Guillaume Meyer
- Claimed limitation: rewriting can affect tone, voice, and precision
Understanding AI watermarking in layers
The project separates its approach into different layers. One targets edit-based signals such as unusual Unicode characters. These characters are often invisible to the human eye but can be detected by software as a marker of AI involvement. Another layer focuses on statistical patterns in generated text. Because AI models select words based on probability distributions, their choices can create patterns that are detectable across a long enough sample. A separate cleanup layer deals with file provenance information such as C2PA, EXIF, XMP, and document properties.
The presence of metadata is relatively straightforward to understand. When a file is created or edited, certain fields may be automatically populated with details about the software used, the device, or the original author. C2PA, an initiative involving companies like Adobe, Microsoft, and Intel, has developed a standard for cryptographically signing content provenance. EXIF and XMP metadata are commonly found in image and video files, while document properties can include author names, creation dates, and revision histories.
Removing metadata can be done cleanly, much like deleting the properties from a file in any image or document editor. If a watermark is only stored in this metadata, stripping it may be as simple as running a cleanup script. But statistical watermarking is different.
Statistical watermarks are embedded into the way an AI model chooses words. There is no single marker that can be cut out; instead, the watermark is a subtle bias that runs through the entire generated text. It may be invisible to the naked eye, but it is visible to a detector that has been trained to recognize the model's particular probability patterns. To remove this kind of watermark, the text itself must be changed. That means rewording sentences, altering word choices, changing transitions, and possibly restructuring whole sections.
The latest version of the tool makes the text rewriting side more aggressive instead of simply swapping a few words. The updated version changes sentence structure, word choices, transitions, and other patterns in an attempt to disrupt statistical watermarking. It also includes options intended to make rewritten text sound more natural, which is important because grammar and style can be further signals of machine involvement.
However, there is an obvious catch. Rewriting text to remove a statistical watermark can also change the text itself. The project's documentation admits that this process can affect tone, voice, and precision, particularly when a large portion of the original wording needs to be changed. This is not the digital equivalent of hitting remove watermark in an image editor. In fact, the developer's README goes further, saying that a rewrite changes the words used by a premium model to those used by a cheaper model. The project asks why someone would pay more for a premium model and then use a worse model to process its output.
The limitations are also clear about detection evasion. The project describes the rewriting process as best effort and says it cannot guarantee that a particular vendor's detection system will fail. Some signals can remain after the cleanup process. There is no universal AI watermark hiding inside every piece of generated content. Different companies and systems use different approaches, and the project divides those signals into several categories. The repository also states that its purpose is privacy and research, rather than helping people falsely claim that AI-generated work was written entirely by a human.
The bigger picture: AI provenance and the arms race
The emergence of a tool like watermarks-remover highlights how quickly the AI watermarking landscape is evolving. Governments and industry groups are increasingly pushing for transparency about AI-generated content. The European Union's AI Act, for example, includes provisions about disclosing synthetic content. Social media platforms have started adding labels to AI-generated videos and images. Content standards like C2PA are gaining traction across industries that need to verify the origin of digital files.
At the same time, researchers and developers are working on ways to defeat those protections. Some have demonstrated that image watermarks can be bypassed by adding noise or resizing. Others have shown that text can be paraphrased to remove statistical markers. The watermarks-remover project is part of this larger trend. It is not the first tool to attempt watermark removal, and it likely will not be the last.
One reason the cat-and-mouse dynamic is so active is that watermarking and detection are open problems. A good watermark should be robust enough to survive normal editing, but invisible enough not to harm the quality of the content. It should be easy for a computer to verify but hard for a person to notice. Those goals are in conflict. A watermark that relies on invisibility is vulnerable to deliberate distortion. A watermark that is too visible harms the user experience. As a result, AI companies must constantly balance robustness against usability.
For text, the challenge is even more difficult. Images can be embedded with signals across thousands of pixels. Audio can hide watermarks in frequencies that human ears cannot hear. But text is composed of discrete characters and words. There is far less redundancy to hide a signal in. Unicode characters offer one possible hiding place, but they can be stripped easily with sanitization tools. Statistical watermarks embedded in word choice are harder to remove, but they require large enough samples and can be diluted by paraphrasing.
These trade-offs are visible in the watermarks-remover project. The tool can eliminate metadata cleanly, but it must rewrite and potentially degrade the text to disrupt statistical watermarks. No method is perfect. The developer's own documentation warns that rewriting is best effort, and that detection systems might still succeed. This honesty is important because it reflects the current state of the field. AI watermarking is still young, and so is watermark removal.
Why this matters for creators and companies
For creators, AI watermarks raise questions about ownership and attribution. Some artists and writers want to prove that they used AI tools, while others want to keep their creative process private. A tool that strips watermarking can help with privacy, but it can also be misused to pass off AI work as human-made. The project's stated purpose is privacy and research, and its README explicitly says it is not intended to help people falsely claim that AI-generated work was written entirely by a human. But any tool can be used in ways its creator did not intend.
For companies, the existence of such tools complicates content moderation and provenance efforts. If a platform labels AI-generated images, it needs a reliable way to detect those images. If the watermark can be stripped easily, the label may be meaningless. This is why companies are exploring more robust watermarking techniques. OpenAI, Google, and Anthropic have all shown interest in developing better provenance methods. At the same time, they must be careful not to degrade the quality of their models' outputs.
Another issue is economic. The watermarks-remover README argues that rewriting premium model output with a weaker model defeats the purpose of paying for a premium model. This points to a deeper tension in the AI industry. Model makers are competing on quality and price. If watermark removal becomes common, it could change the economics of AI-generated content. A user who wants the quality of a premium model but does not want the watermark might simply use the premium model to generate text and then run it through a cheaper, less sophisticated rewriting pass. That could undercut the value of the premium model.
There is also the question of what counts as AI-generated content. Many writers and editors use AI tools to help with brainstorming, outlining, drafts, and grammar checks. Human involvement ranges from minimal to extensive. A binary watermark that labels a piece of text as AI-generated may fail to capture the nuance. If the text is rewritten substantially, is it still AI-generated? The watermarks-remover project highlights these questions without answering them.
The future of watermark removal
It is still early in the AI watermarking arms race. Tech companies are likely to keep improving their watermarking methods, making them more robust and harder to remove. Developers will likely keep building tools to counter them. This is a familiar pattern. It happened with DRM for digital media, with CAPTCHA systems, and with content fingerprinting. Each advance in protection is followed by an attempt to bypass it.
There are also legal and ethical implications. In some jurisdictions, removing a digital watermark may violate copyright law or terms of service. The Digital Millennium Copyright Act in the United States includes provisions against circumventing technological measures that protect copyright. If a file contains C2PA metadata that identifies an author, stripping that metadata could expose the user to legal risk. The watermarks-remover README advises against unlawful use, but the legal landscape is still uncertain.
AI watermarking is also a moving target. OpenAI, Google, and Anthropic are continually updating their models. A watermark that works for one version of a model may behave differently in the next. Detection tools must be updated regularly, and so must removal tools. The project's support for OpenAI and Gemini alongside Claude suggests that the developer is keeping pace with the major players.
For now, watermarks-remover is best understood as a sign of where the AI industry is heading. Companies are looking for ways to establish provenance and identify AI-generated material, while developers are already exploring how to remove or disrupt those signals. The interesting part is not whether this particular GitHub project can beat every AI detector. It probably cannot. The interesting part is that AI watermarking is already becoming a cat-and-mouse game, and we are still very early in it.
Source: Digital Trends News