Update — August 18, 2026: The recurring question underneath this tool's popularity — is any of this actually legal? — gets a full answer in is removing an AI watermark illegal? The actual legal answer, covering DMCA § 1202's intent requirement, the EU AI Act's provider-side marking duty, and where ToS violations and actual law diverge.
Update — August 17, 2026: watermarks-remover has crossed roughly 11.7-11.8k GitHub stars, six days after its August 11 creation — the number some aggregator headlines are now rounding to "11k stars in 5 days" while also claiming it "defeats" Anthropic's provenance system. The star count is real and checks out against the repo's own page. The "defeats" framing does not: it still describes the same unverifiable Layer B paraphrase this post covered on August 13, and even the tool's newest release doesn't change that. See the new section below for what actually shipped since.
An open-source tool called watermarks-remover added support for OpenAI and Gemini provenance marks on August 11, 2026 — two days after this blog covered Anthropic confirming Claude embeds invisible text watermarks in every model shipped since August 2. The tool, built by developer Guillaume Meyer and released under the MIT license, now claims coverage across Claude, Gemini/SynthID-Text, and OpenAI's provenance surfaces, spanning eight file formats. The announcement went semi-viral on X within hours, with one reply summing up the mood: "This guy already has a tool to remove watermarks from Claude, as well as Gemini and OpenAI."
The framing in most coverage — a tool that "erases marks" — overstates what it does. This post separates the two very different things bundled under "watermark removal" here: metadata stripping, which is real, deterministic, and always was trivial; and statistical watermark removal, which is best-effort, unverifiable, and comes with the author's own admission that it degrades the writing it's supposedly cleaning. That distinction is the whole story, and it's the same one we walked through in how AI text watermarking actually works.
TL;DR
| Question | Direct answer |
|---|---|
| What is it? | watermarks-remover — an MIT-licensed CLI on GitHub by Guillaume Meyer |
| What's new (Aug 11, 2026)? | Added OpenAI and Gemini/SynthID-Text targeting, alongside existing Claude support |
| How many formats? | 8 — PNG, JPEG, SVG, PDF, DOCX, ODT, HTML, Markdown |
| What does it remove reliably? | Invisible Unicode carriers and file metadata (C2PA hard-bound, EXIF, XMP, doc properties) |
| What does it remove unreliably? | Statistical token-sampling watermarks — via best-effort paraphrase, not deletion |
| Does it touch image pixel watermarks? | No — explicitly out of scope; SynthID image scoring is detection-only in this tool |
| Does it need a GPU? | No — core scripts are Python 3.10+ stdlib only; the optional paraphrase layer calls a model |
| Can it self-certify a bypass? | No — the author states no tool can honestly certify a pass, because vendors haven't published public detectors |
What actually shipped on August 11
The tool is a CLI and Python library, hosted on GitHub, that works in two layers:
Layer A — deterministic removal. Strips invisible Unicode artifacts (zero-width spaces, bidirectional control characters, tag characters, exotic spacing) and file-level metadata, including hard-bound C2PA manifests, EXIF, XMP, and document properties. This is scripted, exact, and needs nothing but Python's standard library. There is no ambiguity about whether it worked — the bytes are either there or they aren't.
Layer B — best-effort statistical rewrite. Targets the actual token-sampling watermark — the mechanism behind Google's SynthID-Text, Anthropic's Claude marking, and Kirchenbauer-style open-research schemes, which we broke down in detail in how AI text watermarking actually works. Because that watermark lives in which words the model chose, not in any deletable byte, the only way to disturb it is to replace enough of those word choices — via paraphrase, through another model, or a rewrite hook.
Before this update, the tool's stated scope was Claude only. The August 11 release added Gemini/SynthID-Text and OpenAI's provenance surfaces to both layers, which is what made it newsworthy days after Anthropic's own watermarking rollout put the topic in front of a much wider audience than usual.
The 8 formats, and what each one loses
| Format | What gets stripped |
|---|---|
| PNG, JPEG | C2PA hard-bound manifests, EXIF, XMP metadata |
| SVG | Embedded metadata and provenance tags in the XML |
| Document properties, embedded C2PA/XMP data | |
| DOCX, ODT | Document properties, embedded provenance metadata |
| HTML, Markdown | Invisible Unicode carriers in the text body |
Notice what's missing from that table: image pixels. The tool's own scope notes explicitly place pixel-domain watermarks like SynthID's image variant out of scope — it can score for their presence, not remove them. That's a meaningfully different and harder engineering problem, the kind tackled by dedicated visible-stamp removers using inpainting rather than metadata edits — for example BGRemover.video's ChatGPT, Claude, and Gemini watermark removers (see our visible vs. invisible guide for when each applies). Confusing the two — as some of the viral coverage did — makes this sound like a bigger bypass than it is.
Why this only half-defeats what Anthropic just shipped
Our post on detecting a Claude watermark laid out the two provenance layers Anthropic ships today: C2PA file metadata (verifiable now, with free tools) and an invisible text watermark (no public detector yet). watermarks-remover maps almost exactly onto that split — and the split explains why "removal" means two different things depending on which layer you're talking about.
Against C2PA metadata, this is a clean, complete removal. That was always true of C2PA generally — as we noted when covering Claude's invisible watermarks, metadata doesn't survive a re-save even without a dedicated tool. A script that strips it systematically across eight formats is a convenience, not a breakthrough.
Against the statistical text watermark, this is not removal at all — it's degradation. The tool doesn't locate and delete a signal, because there's nothing byte-level to delete; the mark is baked into word choice across the whole passage, the mechanism we detailed in how AI text watermarking actually works. Paraphrasing through a second model can dilute that signal, at the cost of the original wording, tone, and precision. The tool's own documentation is candid about the tradeoff: pushing a passage through a cheaper rewriting model to "clean" it raises the honest question of whether you should have just generated it with that cheaper model to begin with.
Why "degradation" and "deletion" look different — try it
The demo below has an "Editing" tab that shows exactly this: the mark lives in short, untouched runs of wording, and it fades in proportion to how much of the original phrasing survives — a light edit dilutes it, a full rewrite erases it. It's the same reason a byte-level tool can cleanly strip C2PA metadata but can't cleanly "delete" a statistical text watermark.
A model doesn't know "the next word" — it has a shortlist with preferences. Roll the dice and watch it land somewhere on the shortlist, matching the odds.
The results of the study were quite …
A teaching model with illustrative parameters — not any provider's actual watermarking scheme.
The line the author draws himself
The most useful part of this release isn't the feature list — it's the disclaimer. watermarks-remover's documentation states plainly: "Until vendors ship public detectors and keys, no tool can honestly certify 'this fails the official check.'"
That's the same structural gap we flagged in are AI watermarks monetisable? — Anthropic has said a detection API is coming but hasn't shipped one, Google keeps SynthID's keys private, and OpenAI hasn't confirmed a production text watermark at all. Without a public detector to test against, a removal tool is optimizing against a target it can't see. It can measure that it changed a lot of tokens. It cannot measure that a vendor's detector will return a negative result, because it doesn't have the vendor's key any more than you do.
The tool's stated intended use backs this up: it's pitched for privacy and research on content you generated, not for defeating detection to pass off AI writing as human-authored. Framing this as a definitive "AI marks: erased" undersells both how narrow the guaranteed part is and how murky the rest genuinely remains.
The star count is real. The "defeat" claim still isn't.
By August 17, watermarks-remover had passed roughly 11.7-11.8k GitHub stars — up from the low thousands this post originally described on August 13. That growth is easy to verify directly on the repo, and it's a genuinely fast trajectory for a six-day-old project. Some of the coverage repeating the "11k stars in 5 days" figure is close enough to be fair.
What's not fair is the second half of those same headlines: that the tool now "defeats Anthropic's Claude provenance." Nothing about the star count changes the split this post laid out on day one. The project's own changelog shows it reached v0.5.0 in the interim, and the meaningful change is a new optional integration with MarkLLM, an open-source research toolkit that can score text against published academic watermarking schemes — including KGW (Kirchenbauer et al.) and SynthID-style detectors. That's a real, useful addition: it lets the tool self-test its Layer B rewrites against detectors that actually exist and are publicly documented.
It does not touch the underlying problem. Anthropic has still not published Claude's own detector or the key behind it — the same gap are AI watermarks monetisable? flagged when discussing Anthropic's promised-but-unshipped detection API. Passing MarkLLM's open KGW/SynthID checks demonstrates the rewrite disrupted those detectors' statistics. It says nothing about whether the same rewrite would pass Anthropic's specific, undisclosed one, because nobody outside Anthropic can run that test. A viral star count is a measure of developer interest, not a measure of cryptographic defeat — and headlines conflating the two are repeating the same error this post flagged in its first version.
What this means for the watermarking story
Three things follow directly from this release, and none of them are "watermarking is dead":
- The metadata layer was never the hard part. C2PA stripping tools have existed for as long as C2PA has. Adding OpenAI and Gemini targeting to an existing tool is a scope expansion, not a new capability class.
- The statistical layer is still standing, structurally. No public detector exists to prove a bypass either way, for any vendor. That's the same uncertainty will every AI model watermark its output? flagged about the whole ecosystem — labs are converging on watermarking faster than they're publishing verification tooling.
- Open weights remain the actual structural exemption. As that same post argued, a watermark applied by the sampler only exists if you don't control the sampler. Paraphrase-to-evade is a workaround with quality costs; running an open-weight model with your own sampling pipeline never generates a mark to begin with.
The practical takeaway for developers: don't treat "a removal tool exists" as proof that provenance signals are worthless, and don't treat "vendors are watermarking" as proof that output is now traceable. Both claims currently outrun the evidence. What's verifiable is narrower and more boring than either extreme — C2PA metadata checks work today via free tools, and the token-level signal remains an open question on both the marking and the unmarking side until someone publishes a detector.
Related on explainx.ai
- Is removing an AI watermark illegal? The actual legal answer — the legal companion to this post: DMCA § 1202, the EU AI Act, and where ToS violations and real law diverge
- AI watermark removal: right vs. wrong (2026 guide) — visible Sora/Veo stamp removal vs. invisible provenance stripping, with BGBlur for video and BGRemover.video for ChatGPT/Claude/Gemini image stamps
- Smart glasses misuse, venue bans, and how to protest — ambient POV capture and blurring bystanders before publish
- Anthropic is watermarking Claude text — the rollout this tool responded to within days
- How to detect a Claude watermark — the same two-layer split (metadata vs. statistical), from the detection side
- How AI text watermarking actually works — why the statistical layer can't be "deleted," only diluted
- Will every AI model watermark its output? — the open-weight exemption this tool's paraphrase route imitates at a cost
- Are AI watermarks monetisable? — why no public detector exists yet, and what that gap is worth commercially
- The case FOR AI watermarks — the provenance argument this tool directly complicates
- LinkedIn's C2PA Content Credentials for AI images — a platform betting on the metadata layer this tool strips
- EU AI Act and US policy: complete regulation guide — the transparency obligations behind why labs are watermarking at all
Primary sources: watermarks-remover on GitHub (Guillaume Meyer, MIT license) · Guillaume Meyer on X, August 11, 2026, announcing OpenAI and Gemini support · Anthropic Help Center, "How Claude marks AI-generated content"
Accurate as of August 17, 2026, updated from the original August 13, 2026 version to reflect the tool's star-count growth and v0.5.0 release. This post describes publicly documented tool capabilities and does not provide step-by-step instructions for evading detection or misrepresenting AI-generated content as human-authored. Format support, vendor targeting, and removal guarantees are as stated in the tool's own documentation at time of writing and may change with future releases. Follow @explainx_ai for updates.