watermarks-remover

An MIT-licensed Python project by guillaume-meyer that strips AI provenance marks — C2PA manifests, generator metadata, invisible Unicode carriers and, best-effort, statistical text watermarks — from files and text. It ships as a Claude Code plugin, an agent skill and a local HTTP service. Repository created 2026-08-11; 20,845 stars / 2,404 forks and release v0.7.0 as of 2026-09-06 (GitHub API, read the same day).

It is the counterparty to the labeling mandates this spoke tracks. china-ai-regulation records embedded provenance metadata and watermarking as a binding duty on the producer of AI content. This repository is what the other end of that duty costs — a weekend install, no licence fee, and four weeks from first commit to 20k stars.

What it actually removes

From the README's own coverage matrix:

Named target ecosystems, at class level: Claude, Gemini / SynthID-Text, OpenAI provenance surfaces, and open-weight schemes of the Kirchenbauer green-list and Aaronson keyed-Gumbel families. The token-level half of that list is already paged next door: text-watermarking is the mechanism and claude-text-watermark the vendor's own account of it. The file-level half is content-credentials-c2pa.

What the README concedes

Three statements cut against the project's own marketing, and they set the tier. The load-bearing claims here are what the artifact is and what it refuses to promise, not how well it works, which is why this page grades T1 rather than T3:

• No certification of bypass. "Until vendors ship public detectors and keys, no tool can honestly certify 'this fails the official check.'" Reports separate verifiable removals (Unicode counts, metadata actions) from best-effort ones.
• Removing a text watermark costs the text. The signal lives in token choice, so stripping it means rewriting most sentences with another model — which caps the result at the rewriting model's ceiling. The README puts the full-circle question in its own words: if you are going to rewrite with a cheaper model anyway, why pay for the premium one? It also warns that rewriting Claude text with Claude can re-stamp it.
• Stripping metadata is not stripping provenance. Hard-bound C2PA comes out; a soft binding — an in-content watermark that can re-link a remote Content Credentials manifest after the metadata is gone — survives, and the project says so.

The PDF handling makes the same move: exiftool -all= edits a PDF incrementally, so the original metadata bytes stay in the file and exiftool itself can undo the edit, while the file gets larger and every viewer shows it as clean. The project calls that a silent leak, chains qpdf --linearize behind it, and adds a Ghostscript pass because neither touches metadata inside an embedded image — on a Photoshop-exported PDF, 27 tags and a C2PA manifest survived an otherwise successful clean.

Governance-relevant facts

• Distribution is the story. The skill is markdown-only and calls a local service over HTTP, the repository doubles as a single-plugin Claude Code marketplace, and a PostToolUse hook can clean every file an agent writes. Removal is being packaged as ambient hygiene rather than as a deliberate act.
• The deterministic/best-effort line runs through the harness too. The README notes that no hook can rewrite an assistant's chat message before a human reads it — Claude Code's Stop hook gets last_assistant_message read-only — so the guarantee covers files on disk and commits, not conversation.
• Detectors are vendor-held and moving. The README lists Claude's C2PA file checker (its text detection API in private preview), OpenAI's verification page, and SynthID; the coverage matrix states Google retired its vendor detector in August 2026. Single-sourced here, and worth confirming — it points the wrong way for anyone relying on detection as the enforcement half of a labeling rule.
• Stated ethical scope: content you own or are authorized to process, "not academic fraud or false 'human-written' claims," with liability for misuse disclaimed. A norm, with nothing behind it.
• Upstream research harnesses it optionally calls (MarkLLM, CtrlRegen) carry non-commercial or all-rights-reserved licences, so they are never shipped in the Docker images.

Cross-spoke context

• ../speech-audio-wiki treats SynthID watermarking as one of the countermeasures to non-consensual voice cloning (audio-deepfake). This source is direct evidence that the countermeasure is a removable layer, not a property of the artifact — for audio it strips C2PA out of WAV, MP3 and FLAC containers, and leaves waveform-domain marks alone.
• ../agentic-tooling-wiki owns the packaging half — agent skills, plugin marketplaces, the skills-vs-hooks determinism argument the README makes at length. Routed here rather than there because the subject is the provenance regime; the packaging is how it reaches users.

Related

content-credentials-c2pa · text-watermarking · claude-text-watermark · china-ai-regulation · eu-ai-act · guillaume-meyer · ai-governance