Watermarks-remover: Strip multi-vendor AI provenance marks Watermarks-remover v0.3.2, an open-source agent skill and Python script suite by Guillaume Meyer, strips multi-vendor AI provenance marks from text and files, including Claude, Gemini/SynthID-Text, OpenAI, and open-LLM Kirchenbauer-style marks, targeting invisible Unicode, statistical watermarks, and C2PA/EXIF/XMP metadata. The tool, requiring Python 3.10+ and optional external tools like c2patool and exiftool, offers deterministic scripts for Layer A text cleaning, an optional Layer B rewrite hook, and image cleaning with optional pixel-domain SynthID scoring via an external reverse-SynthID checkout. | | | | | | | | / |\/| | | | / | / | / | |\/| | | | | | | / | | | | | | | | \ | | | | | \ | \ | \ | | | | | \/ | | \ Agent skill + stdlib Python scripts to strip multi-vendor AI provenance marks from text and files — for privacy and hygiene on content you own . | Layer | Target | How | |---|---|---| A | Invisible Unicode, exotic spaces, bidi, tag chars | Deterministic Python scripts | B | Statistical token-sampling text watermarks | Agent rewrite + optional rewrite text.py hook | Files | C2PA / EXIF / XMP / doc props | PNG, JPEG, SVG, PDF, DOCX, ODT, HTML, Markdown | Vendors / ecosystems class-level : Claude , Gemini / SynthID-Text , OpenAI provenance surfaces, open-LLM Kirchenbauer-style marks. Latest release: v0.3.2 https://github.com/guillaumemeyer/watermarks-remover/releases/tag/v0.3.2 Skill path: skills/remove-ai-marks/ migration: formerly remove-claude-marks ; slash alias /remove-claude-marks still documented Grok Build / project-local mkdir -p .grok/skills ln -sfn "$ pwd /skills/remove-ai-marks" .grok/skills/remove-ai-marks User-global Grok mkdir -p ~/.grok/skills ln -sfn "$ pwd /skills/remove-ai-marks" ~/.grok/skills/remove-ai-marks Invoke with /remove-ai-marks or ask to “strip AI watermarks / C2PA / Claude marks / SynthID-class text.” Optional system tools auto-used when present : | Tool | Role | |---|---| c2patool | exiftool Core scripts need Python 3.10+ stdlib only. Layer B model calls are optional. SCRIPTS=skills/remove-ai-marks/scripts Unified inspect / clean python3 "$SCRIPTS/inspect file.py" draft.md python3 "$SCRIPTS/clean file.py" draft.md -o draft.cleaned.md python3 "$SCRIPTS/clean file.py" photo.png -o photo.cleaned.png python3 "$SCRIPTS/clean file.py" notes.docx -o notes.cleaned.docx Text Layer A python3 "$SCRIPTS/inspect text.py" draft.md python3 "$SCRIPTS/clean text.py" draft.md -o draft.cleaned.md --stats Layer B rewrite hook default: print prompt only — no model required python3 "$SCRIPTS/rewrite text.py" draft.md --backend print-prompt --strength paraphrase Optional local Ollama loopback only by default — remote endpoints require WATERMARKS REWRITE ALLOW REMOTE=1 or --allow-remote : WATERMARKS REWRITE BACKEND=ollama WATERMARKS REWRITE MODEL=llama3.2 \ python3 "$SCRIPTS/rewrite text.py" draft.md -o draft.rewritten.md API keys are read from WATERMARKS REWRITE API KEY only never argv . Images python3 "$SCRIPTS/inspect image.py" shot.png python3 "$SCRIPTS/clean image.py" shot.png -o shot.cleaned.png inspect image.py and clean image.py can report a pixel-domain SynthID confidence score when an external checkout of aloshdenny/reverse-SynthID https://github.com/aloshdenny/reverse-SynthID is available. The scorer is not bundled : it is loaded at runtime from your checkout, and its code remains under the upstream project's non-commercial Research License. SCRIPTS=skills/remove-ai-marks/scripts Clones upstream, creates a venv, and installs scorer-only dependencies. "$SCRIPTS/setup synthid.sh" Score an image default checkout: ~/reverse-SynthID . REVERSE SYNTHID DIR=~/reverse-SynthID \ ~/reverse-SynthID/.venv/bin/python "$SCRIPTS/score synthid.py" shot.png Or surface the score from inspect / clean same venv Python . REVERSE SYNTHID DIR=~/reverse-SynthID \ ~/reverse-SynthID/.venv/bin/python "$SCRIPTS/inspect image.py" shot.png setup synthid.sh accepts --dir PATH , --ref REF , and --full install the full upstream requirements.txt , which adds torch / diffusers for the upstream VAE bypass this project does not use . make docker-synthid-build Run unprivileged and with a read-only rootfs; the scorer only needs to read /data and write to stdout/tmp. docker run --rm \ --user "$ id -u :$ id -g " \ --read-only --tmpfs /tmp \ -v "$ pwd :/data" \ watermarks-remover-synthid-scorer /data/shot.png The image is built locally from the upstream source at build time. It is not published, so it does not redistribute the upstream code. V4 scoring uses artifacts/spectral codebook v4.npz from the upstream checkout ~220 MB . This is detection/scoring only — it does not remove pixel watermarks. | Channel | Claude | Gemini/SynthID | OpenAI | Open-LLM | |---|---|---|---|---| | Unicode / edit-based text | Layer A | Layer A | Layer A | Layer A | | Statistical sampling text | Layer B best-effort | Layer B best-effort | Layer B if present | Layer B best-effort | | C2PA / file metadata | Yes listed formats | Yes when present | Yes when present | Yes when present | | Pixel image marks | Out of scope | Optional SynthID score external ; removal out of scope | Out of scope | Out of scope | | Training backdoors | Out of scope | Out of scope | Out of scope | Out of scope | Details: skills/remove-ai-marks/references/vendor-notes.md /guillaumemeyer/watermarks-remover/blob/main/skills/remove-ai-marks/references/vendor-notes.md , . /guillaumemeyer/watermarks-remover/blob/main/skills/remove-ai-marks/references/mark-classes.md mark-classes.md Modern LLM watermarks often hide a signal in which tokens are chosen generative / sampling bias , not only in invisible characters. Edit-based schemes inject Unicode or synonym rules. File schemes attach C2PA or generator metadata. Layer A removes edit-based Unicode carriers testable . Layer B attacks sampling watermarks via heavy rewrite best-effort; literature-standard attacks such as paraphrase / back-translation . File cleaners strip C2PA/XMP/props from supported containers. Until vendors ship public detectors and keys, no tool can honestly certify “this fails the official check.” Reports must separate verifiable vs best-effort work. Prefer a non-origin model for Layer B do not rewrite Claude text with Claude if you are trying to avoid re-stamping . Text watermarks live in the wording itself : the signal is spread across token choices, so nearly every sentence carries a little of it. Two consequences follow, and they are why Layer B is honestly described as best-effort rather than a magic eraser. - Removal means rewording, not restructuring. Shuffling paragraphs, changing headings, or light touch-ups barely move the signal. Stripping a statistical mark requires rewriting a substantial fraction of the text — sentence by sentence, not section by section. - Rewording degrades the copy. Any rewrite replaces the original word choices with the rewriting model's, which flattens tone, voice, and precision. On production copy SEO, marketing, client work that degradation is real and often visible to the people who care most about the writing. It is like taking text from a top-tier model and asking a less capable model to rewrite it from scratch: the result cannot exceed the rewrite model's ceiling. Which leads to the honest full-circle question: If the plan is to rewrite the text with a cheaper model anyway, why pay for a premium model in the first place? Generating directly with the cheaper model is simpler, cheaper, and produces the same — or better — end result. Layer B makes sense when you specifically want the premium model's thinking and drafting and accept a rewrite pass to satisfy a hygiene or privacy requirement — not as a cheap route to mark-free text. When to skip Layer B: Quality matters more than hygiene: use the lossless path — Layer A Unicode scrub plus the file metadata cleaners — and keep the original prose. Rewriting anyway: use a non-origin model rewriting with the origin model can re-stamp the text , and remember residual risk remains — no tool can certify a vendor detector will fail. | Format | Inspect | Clean | |---|---|---| | PNG / JPEG | C2PA chunks / APP11, AI XMP hints | Drop metadata segments | | SVG |