Watermarks Remover — Blog

How AI watermarking works

2026-08-10T00:00:00Z

A lot of AI output now carries fingerprints you cannot see. Sometimes you can, like a C2PA badge in a photo app. Usually you cannot. This piece walks through how that marking works, in four layers, and what each layer means if you need to detect or remove a mark from content you own.

Why mark AI content at all?

Providers and regulators want provenance: proof of where a piece of content came from. Three things are pushing this:

Transparency laws. The EU AI Act (Article 50) and California's SB 942 require AI-generated content to carry machine-readable marks in many cases.
Platforms. Social networks want to label AI media at scale, which needs a signal in the file itself.
Accountability. If a model is used to spread misinformation, a watermark can help trace the output back to the generator.

Watermarking is a technical compromise. To judge it you have to see the four layers where a provider can hide a signal.

Layer 1: file metadata and C2PA

The usual approach is to attach provenance to the file container: EXIF fields, XMP packets, document properties (docProps in DOCX/ODT), or a full C2PA manifest. C2PA (Coalition for Content Provenance and Authenticity) embeds a signed, tamper-evident manifest, often as JUMBF data inside PNG or JPEG chunks, describing the generator, the toolchain, and edits.

This layer survives casual re-saving, but it is still metadata, and metadata can be stripped. Removing it is deterministic and verifiable. That is why metadata cleaning is the most reliable part of any watermark-removal pipeline.

Layer 2: invisible Unicode

Text has a hidden channel: Unicode control characters that render as nothing. Zero-width spaces (U+200B), zero-width joiners, bidi override characters, tag characters, exotic space variants, and homoglyph look-alikes (Cyrillic letters that mirror Latin ones) can all be injected into text without a reader noticing.

Edit-based marks: a provider (or a wrapper tool) sprinkles zero-width characters through the text according to a secret pattern. A detector counts them and compares them against the pattern.
Weakness: any Unicode sanitizer, including the Layer A scrub in this project, removes them losslessly. No rewording needed.
Why they still exist: they are cheap to add, invisible, and they beat naive copy-paste checks. They are not a serious defense against someone who actually tries to remove them.

Layer 3: statistical token watermarks

The strongest text watermarking does not hide anything invisible. It biases the model's token choices. The landmark scheme (Kirchenbauer et al., 2023) splits the vocabulary into a green list and a red list, seeded by the previous tokens. The model is nudged to pick green-list tokens, so the output carries a statistical signal that a detector holding the same secret seed can verify with a z-score.

Google's SynthID-Text (Dathathri et al., Nature 2024) is the deployed version of this idea, used in Gemini. The signal is spread across every sentence, which makes it hold up to light edits, translation, and summarization. The catch: the detector needs the secret key. Vendors do not publish that key, so nobody else can verify the mark.

Because the signal lives in the wording itself, you cannot delete a character and be done. You have to rewrite a large share of the text, sentence by sentence. That is why statistical-text removal is honestly described as best-effort, and why it costs quality.

Layer 4: pixel, audio, and video watermarks

For media, providers can embed tiny perturbations in the content itself. SynthID for images and video changes pixels in ways you cannot see but a model can detect. Audio marks hide signals in frequency bands. These are the strongest marks. They survive re-encoding and cropping. Removal needs the original generator (or a serious signal-processing attack), and detection needs the vendor's detector.

The robustness triangle

Academic work (notably Zhang et al., "Watermarks in the Sand," ICML 2024) shows a hard limit: for generative models, you cannot have a watermark that is robust, high quality, and undetectable by adversaries all at once. In the worst case, an attacker who knows the scheme can distort the output just enough to break the signal. In practice every watermark is a statistical bet, not a cryptographic guarantee.

Short version

Layer	Where it lives	Removal difficulty	Verifiable?
Metadata / C2PA", "File container (JUMBF, XMP, EXIF, docProps)", "Easy (deterministic strip)", "Yes, with c2patool
Invisible Unicode	Text characters (ZWSP, bidi, homoglyphs)	Easy (lossless scrub)	Yes, character-level counts
Statistical tokens	Token-choice bias across the whole text	Hard (heavy rewrite required)	Only with the vendor's secret key
Pixel / audio / video	Content signal itself	Very hard (needs the generator)	Only with the vendor's detector

So: metadata and Unicode marks come off with certainty. Statistical text marks come off only by rewriting, and you pay for that. Pixel-level marks are currently out of reach for third parties. The next article looks at which providers actually use which layer.

Who watermarks what

2026-08-06T00:00:00Z

Most major AI providers now do some form of content provenance. The methods are not the same. Some stack several layers. Some do almost nothing. This is a 2026 snapshot from public announcements, product behavior, and regulatory filings. The details move quickly.

Anthropic (Claude)

Anthropic has talked more than most about text watermarking. In February 2025 it published a technical report on an invisible text watermark that is meant to survive paraphrasing, and said it would test the method in a research preview. It also said it would disclose the marks, unlike some earlier proposals. As of 2026 the technique has not been broadly deployed inside Claude products.

Text: the technology exists and is tested, but it is not on by default in consumer products.
Images: Claude-generated images carry C2PA Content Credentials, so platforms and users can check AI origin.
Detector: Anthropic has published guidance on detecting Claude content, but no public API for verifying the invisible text mark.

Google (Gemini / SynthID)

Google is the only major provider with a deployed, documented watermarking stack across every modality, under the SynthID brand (DeepMind).

Text: SynthID-Text is applied to Gemini outputs. The detection method is described in a Nature paper (Dathathri et al., 2024) and research code is open-sourced. The production detection key is not public.
Images / video / audio: SynthID embeds pixel and frequency-domain marks in Imagen, Veo, and audio generation.
Detection: Vertex AI offers a SynthID detection API for enterprise customers.

OpenAI (ChatGPT / DALL·E)

OpenAI has said text watermarking is a strong idea with fragile deployment economics. It announced a text-watermarking tool in May 2025, initially disclosed, with a slow, low-key rollout that has continued through 2025 and into 2026.

Text: a statistical watermarking tool exists and is being phased in cautiously. OpenAI has stressed the risk of false positives and evasion.
Images: DALL·E and GPT-4o image outputs carry C2PA Content Credentials. A provenance classifier for images was released in 2024.
Detector: no public text-watermark detector. The image provenance classifier is available via API.

xAI, Mistral, and the rest

xAI's Grok has published little detail on provenance. Images from its image generator carry platform-level indicators on some surfaces, but there is no widely documented C2PA or invisible-mark scheme. European open-weight providers (Mistral, Aleph Alpha) generally treat watermarking as an opt-in, deployer-side concern.

The open-source ecosystem

Open-weight models ship no watermark by default, but the tooling exists. Kirchenbauer-style red/green-list watermarking has reference implementations. Google open-sourced SynthID-Text research code. Third-party frameworks can add a mark at inference time. The same limit shows up everywhere: without a public detection key, anyone can strip or ignore the mark and nobody can prove it.

What is forcing the pace: regulation

EU AI Act Article 50 requires machine-readable marking of AI-generated content, with obligations on both providers and deployers.
California SB 942 (California AI Transparency Act) requires disclosure and provenance mechanisms for generative AI services offered in California.
China's deep-synthesis rules are among the earliest mandates for labeling AI-generated content.
C2PA is the industry standard body. Steering members include Adobe, Microsoft, Intel, Google DeepMind, OpenAI, and Anthropic.

At a glance

Provider	Text	Images	Audio / video	Public detector
Anthropic (Claude)	Tested, not broadly deployed	C2PA	n/a	No (guidance only)
Google (Gemini)	SynthID-Text (deployed)	SynthID + C2PA	SynthID	Vertex AI API (enterprise)
OpenAI	Tool announced, slow rollout	C2PA	n/a	Image classifier via API
Meta	None by default	Visible + invisible labels	AudioSeal (open)	Open tools
xAI (Grok)	Little public detail	Platform indicators	n/a	No
Open-weight models	None by default; tooling exists	None by default	Tooling exists	Key-dependent

If you handle AI content, metadata marks (C2PA, XMP) are the common case and are straightforward to inspect and strip. Statistical text marks exist, but only Google's is broadly deployed. Pixel-level marks mainly matter for image and video work. Which layer you are looking at decides whether removal is easy, expensive, or not possible.

Removing AI watermarks: what actually works

2026-08-01T00:00:00Z

Search for "remove AI watermark" and you will find two kinds of tools: ones that strip metadata, and ones that promise to erase statistical text watermarks. The first kind works. The second kind sells a half-truth. This guide is about what removal can actually do, and what it costs, based on how the marks work.

The short answer

Mark type	Removable?	How	Cost
C2PA / EXIF / XMP / doc props	Yes, reliably	Metadata strip	None
Invisible Unicode (ZWSP, bidi, homoglyphs)	Yes, losslessly	Unicode scrub	None
Statistical token watermarks	Best-effort only	Sentence-level rewrite	Quality of the prose
Pixel / audio / video marks	No (third parties)	Needs the generator	n/a

What strips cleanly: metadata and Unicode

C2PA manifests, EXIF fields, XMP packets, and document properties sit on the container, not in the content. Stripping them is deterministic. The cleaned file is byte-verifiable as mark-free at the metadata layer, and tools like c2patool or Content Credentials Verify will confirm it. Invisible Unicode characters are characters like any other. A sanitizer removes them and the visible text is untouched.

💡 One caveat: metadata-only cleaning does not clear "soft-bound" marks, content watermarks designed to re-link a remote Content Credentials manifest even after the local metadata is gone. If the mark is soft-bound, a verify tool can still surface the origin. That channel is out of scope for metadata cleaning.

What "best-effort" means for text

Statistical watermarks live in the wording. The signal is spread across token choices. Nearly every sentence carries a little of it, so removal is rewriting, not erasing. Practical consequences:

Shuffling paragraphs, changing headings, or light touch-ups barely move the signal. Stripping a statistical mark means rewriting a large share of the text, sentence by sentence.
Rewriting degrades the copy. The rewrite model's word choices replace the original's, flattening tone, voice, and precision. On production copy (SEO, marketing, client work) the drop is real, and the people who care most about the writing usually notice.
Use a non-origin model for the rewrite. Rewriting Claude text with Claude, or Gemini text with Gemini, risks stamping the output with the same provider's marks again.

If you were going to rewrite the text with a cheaper model anyway, why pay for a premium model first? Generating directly with the cheaper model is simpler, cheaper, and produces the same result, or a better one.

Layer B (rewrite-based removal) makes sense when you want a premium model's drafting and you accept a rewrite pass for hygiene or privacy. It is not a cheap route to mark-free text.

What is not removable

Pixel-level marks (SynthID images and video, invisible perturbations). Removing them needs the original generator or a heavy signal-processing attack. No third-party tool does this honestly today.
Training backdoors: content a model was fine-tuned to recognize. That is not a watermark, and cleaning will not remove it.
Certified failure of a vendor detector. No tool can honestly promise "this fails the official check," because vendors do not publish detection keys. Reports should separate verifiable removals from best-effort work.

A sane workflow

Inspect first. Run an inspection pass to see which layers are actually present (Unicode counts, metadata actions, container format).
Clean the deterministic layers. Unicode scrub plus metadata strip. Lossless, verifiable, no downside.
Decide on Layer B on purpose. If hygiene matters more than quality, rewrite with a non-origin model and accept the stylistic cost. If quality matters more, skip it.
Verify residual risk. Use c2patool or Content Credentials Verify for metadata. Statistical marks can only be estimated, not certified.

Ethics and legality

Removing provenance marks is legitimate on content you own, for privacy, hygiene, or workflow reasons. It is not legitimate for academic fraud, impersonation, or faking human authorship. Transparency rules (EU AI Act Article 50, California SB 942) still apply to what you publish. If you publish AI-generated content after cleaning its marks, you may still have to disclose the AI origin. Clean for privacy; disclose for compliance.

💡 This site runs the open-source watermarks-remover engine: Layer A Unicode scrub, metadata/container strip for PNG, JPEG, SVG, PDF, DOCX, ODT, HTML and Markdown, and an optional Layer B rewrite hook. Try it on the homepage with your own content.

Thank you to the researchers behind this project

2026-08-14T00:00:00Z

Every feature on this site stands on the shoulders of researchers, engineers, and open-source maintainers who published their watermarking work — or deliberately published how to detect and remove it. This article is our way of saying thank you. Each name below links to the original paper or repository, so you can read the primary source yourself.

The foundations: provenance metadata

The most reliable marks we strip are file-level provenance: C2PA manifests, EXIF fields, XMP packets, and document properties. That layer exists because of open standards and the tools built around them. The C2PA (Coalition for Content Provenance and Authenticity) specification, and the c2patool command-line tool from its reference implementation, gave us a way to inspect signed manifests. ExifTool and qpdf are the workhorses that make structural metadata stripping — especially for PDF — actually verifiable. Thank you to the maintainers of all of these.

Text watermarking research

Statistical text watermarking — the idea that a mark can live in the token choices themselves — began with Kirchenbauer et al., "A Watermark for Large Language Models", the red/green-list scheme that most open-source text watermarking traces back to. Google took that line of work into production with Dathathri et al., "Scalable watermarking for identifying large language model outputs" (SynthID-Text, Nature 2024), and released the synthid-text research code alongside the SynthID safeguards documentation. Anthropic's documentation on how Claude marks AI-generated content likewise shapes what we look for on Claude surfaces.

Two papers set honest expectations for the whole field. Zhang et al., "Watermarks in the Sand: Impossibility of Strong Watermarking for Generative Models" (ICML 2024) proves the fundamental limits — you cannot have robustness, quality, and stealth all at once. And Goonatilake & Ateniese, "Removing the Watermark Is Not Enough" reminds us that removal can still leave forensic traces, which is exactly why we keep strength settings conservative. Thank you to those authors for publishing the limits as clearly as the methods.

The toolkits we build on

For controlled verification we rely on two open-source harnesses from THU-BPM. MarkLLM unifies the evaluation of LLM watermarking algorithms, letting us prove in a controlled experiment that a mark clears under a rewrite. Pan et al., "MarkDiffusion: An Open-Source Toolkit for Generative Watermarking of Latent Diffusion Models" (JMLR) does the same for images, with code and docs. These projects turn a tangle of papers into reproducible experiments, and we are grateful for it.

Pixel-domain marks: scoring and removal

Image watermark removal is the hardest layer, and it only works because of dedicated research and maintained reimplementations. Liu et al., "Image Watermarks are Removable Using Controllable Regeneration from Clean Noise" (CtrlRegen, ICLR 2025) showed that controllable regeneration can erase pixel-domain marks; its reference code and the maintained noai-watermark implementation made it usable here. Kassis & Hengartner, "UnMarker: A Universal Attack on Defensive Image Watermarking" (IEEE S&P 2025) gives us a different attack to compare against. And reverse-SynthID gives us a local, approximate scorer for SynthID-class images, alongside DeSynth for SynthID removal on OpenAI and Google images.

Industry context

The two-layer model — hard-bound C2PA plus an imperceptible watermark — is explained clearly in the Institute of AI PM's guide to AI content provenance and watermarking, which situates all of this within SB 942 and the EU AI Act. Google's SynthID page and the Content Credentials Verify service are where you can check residual signals yourself.

A closing note

Watermarking is a hard problem, and the honest thing about removal is that most of it is best-effort. That honesty comes directly from the researchers above, who published both their methods and their limits. If you work in this space — thank you. Your papers and repositories make tools like this possible, and we hope we are giving back by documenting what actually works.