🙏 Thank you to the researchers behind this project

Every feature on this site stands on the shoulders of researchers, engineers, and open-source maintainers who published their watermarking work — or deliberately published how to detect and remove it. This article is our way of saying thank you. Each name below links to the original paper or repository, so you can read the primary source yourself.

The foundations: provenance metadata

The most reliable marks we strip are file-level provenance: C2PA manifests, EXIF fields, XMP packets, and document properties. That layer exists because of open standards and the tools built around them. The C2PA (Coalition for Content Provenance and Authenticity) specification, and the c2patool command-line tool from its reference implementation, gave us a way to inspect signed manifests. ExifTool and qpdf are the workhorses that make structural metadata stripping — especially for PDF — actually verifiable. Thank you to the maintainers of all of these.

Text watermarking research

Statistical text watermarking — the idea that a mark can live in the token choices themselves — began with Kirchenbauer et al., "A Watermark for Large Language Models", the red/green-list scheme that most open-source text watermarking traces back to. Google took that line of work into production with Dathathri et al., "Scalable watermarking for identifying large language model outputs" (SynthID-Text, Nature 2024), and released the synthid-text research code alongside the SynthID safeguards documentation. Anthropic's documentation on how Claude marks AI-generated content likewise shapes what we look for on Claude surfaces.

Two papers set honest expectations for the whole field. Zhang et al., "Watermarks in the Sand: Impossibility of Strong Watermarking for Generative Models" (ICML 2024) proves the fundamental limits — you cannot have robustness, quality, and stealth all at once. And Goonatilake & Ateniese, "Removing the Watermark Is Not Enough" reminds us that removal can still leave forensic traces, which is exactly why we keep strength settings conservative. Thank you to those authors for publishing the limits as clearly as the methods.

The toolkits we build on

For controlled verification we rely on two open-source harnesses from THU-BPM. MarkLLM unifies the evaluation of LLM watermarking algorithms, letting us prove in a controlled experiment that a mark clears under a rewrite. Pan et al., "MarkDiffusion: An Open-Source Toolkit for Generative Watermarking of Latent Diffusion Models" (JMLR) does the same for images, with code and docs. These projects turn a tangle of papers into reproducible experiments, and we are grateful for it.

Pixel-domain marks: scoring and removal

Image watermark removal is the hardest layer, and it only works because of dedicated research and maintained reimplementations. Liu et al., "Image Watermarks are Removable Using Controllable Regeneration from Clean Noise" (CtrlRegen, ICLR 2025) showed that controllable regeneration can erase pixel-domain marks; its reference code and the maintained noai-watermark implementation made it usable here. Kassis & Hengartner, "UnMarker: A Universal Attack on Defensive Image Watermarking" (IEEE S&P 2025) gives us a different attack to compare against. And reverse-SynthID gives us a local, approximate scorer for SynthID-class images, alongside DeSynth for SynthID removal on OpenAI and Google images.

Industry context

The two-layer model — hard-bound C2PA plus an imperceptible watermark — is explained clearly in the Institute of AI PM's guide to AI content provenance and watermarking, which situates all of this within SB 942 and the EU AI Act. Google's SynthID page and the Content Credentials Verify service are where you can check residual signals yourself.

A closing note

Watermarking is a hard problem, and the honest thing about removal is that most of it is best-effort. That honesty comes directly from the researchers above, who published both their methods and their limits. If you work in this space — thank you. Your papers and repositories make tools like this possible, and we hope we are giving back by documenting what actually works.