Scrubbing AI Fingerprints: Inside a 16k-Star Provenance Hygiene Tool

The Hype Moment: From Claude Marks to Multi-Vendor Scrubbing

The repository now known as watermarks-remover began life as remove-claude-marks, a narrow utility with a single target. Its popularity spiked shortly after Anthropic publicly disclosed the technical mechanisms Claude uses to mark AI-generated text. Within a short window, the project accumulated roughly 16,000 stars on GitHub and broadened its scope to become a multi-vendor hygiene platform. The rename signals a larger ambition: stripping provenance surfaces not only from Claude outputs but from Gemini and SynthID-Text-class marks, OpenAI metadata, and open-LLM sampling schemes such as Kirchenbauer-style green-list and keyed-Gumbel watermarks.

That growth reflects a tension in the current AI landscape. As vendors embed C2PA manifests, invisible Unicode carriers, and statistical token biases into generated content, a parallel demand has emerged for tools that sanitize that content before it enters private archives, client deliverables, or mixed human-AI workflows. The project positions itself as a privacy and hygiene utility for content you own, not as a bypass for disclosure obligations. A Facebook group post discussing the tool noted the same distinction: removability does not erase the duty to disclose AI involvement where required.

Architecture: A Skill With No Code

The project’s architecture is deliberately split into a code-free agent skill and a stdlib-only Python HTTP service. The skill itself is a thin markdown client; it drives the machinery over HTTP, meaning the host running the agent needs no Python runtime, no dependency tree, and no Docker daemon. The core service runs on Python 3.10 or newer using only the standard library, exposing inspect, detect, and clean endpoints that accept base64-encoded files and route them by magic number and extension.

This lightweight core is surrounded by a halo of optional, heavy backends that are never bundled. CtrlRegen pixel removal pulls from an external checkout of noai-watermark, which ships no LICENSE file and is treated as all-rights-reserved. The reverse-SynthID image scorer loads from a separate research checkout governed by a non-commercial Research License. MarkLLM and MarkDiffusion harnesses for verification are likewise external Apache-2.0 checkouts, installed on demand into isolated virtual environments. The product characteristic is clear: the engine starts instantly anywhere, but the expensive, licensable, or legally ambiguous machinery is strictly opt-in.

Layer A and Layer B: Two Different Surgeries

The technical heart of the project is its two-layer model for text. Layer A performs deterministic byte surgery on invisible Unicode carriers: zero-width spaces, bidirectional override characters, exotic space homoglyphs, and tag characters. This is lossless, testable, and fast. Layer B, however, attacks statistical sampling watermarks—the kind embedded in which tokens a model chooses. Here the watermark is not a foreign object injected into the text; it is the wording itself.

Because the signal is woven through sentence-level token choice, Layer B cannot remove it without rewording the text. The project is unusually candid about the consequences. Its documentation states plainly that stripping a statistical mark requires rewriting a substantial fraction of the prose, sentence by sentence, and that this process flattens tone, voice, and precision. It even poses the uncomfortable question: if the plan is to rewrite premium-model output through a cheaper model anyway, why pay for the premium model in the first place? That honesty is the project’s most distinctive feature. Layer B is explicitly labeled best-effort, not a magic eraser.

Recent releases have hardened this best-effort path into an iterative, detection-guided loop. The rewrite engine now generates candidate variants, evaluates them against an optional MarkLLM harness (same-config only), and stops early if an attempt passes detection. If no detector is configured, it falls back to lexical divergence scoring. The loop is capped by default, and the reporting includes per-attempt pass/fail records. This turns the tool from a simple cleaner into a verification harness for watermark resilience.

The File Format Long Tail

Beyond text, the project maintains an extensive matrix of file-format cleaners. It strips C2PA chunks, EXIF, XMP, and generator metadata from PNG, JPEG, WebP, AVIF, HEIC, BMP, GIF, TIFF, and SVG. It scrubs document properties from PDF, DOCX, XLSX, PPTX, EPUB, ODT, HTML, and Markdown. It even handles media containers—MP4, MOV, M4A, M4V, WAV, and MP3—by dropping ISOBMFF boxes and RIFF chunks that carry generator tags.

The documentation reveals the unglamorous complexity of this work. PDF cleaning, for instance, cannot rely solely on ExifTool because ExifTool writes incrementally: it appends an update block that frees the old Info object but leaves the original metadata bytes verbatim inside the file. The tool flags this silently recoverable state and prefers a structural rebuild via qpdf when available. Similarly, BMP cleaning truncates trailing non-image bytes, while GIF preservation carefully drops comment and XMP extensions but retains the NETSCAPE2.0 looping extension so cleaned images do not break. This is forensic housekeeping at scale, and the README catalogs the residual risks honestly: soft-bound C2PA links and pixel-domain audio/video watermarks remain out of scope.

What It Cannot Do (And Says So)

Perhaps the most striking characteristic of the repository is its repeated insistence on what it cannot promise. It states directly that no tool can honestly certify that a vendor detector will fail on a cleaned file. The MarkLLM harness is only valid against the same scheme configuration and keys used to generate the original watermark; it is a research verification tool, not an oracle. The reverse-SynthID scorer offers a confidence score, not a removal guarantee. Pixel-domain removal via CtrlRegen defaults to a conservative strength of 0.25 because higher values regenerate more of the image and may still leave forensic traces, a limitation supported by citations to recent academic work on stealth in generative-AI watermark removal.

This intellectual honesty sets the project apart from the broader consumer ecosystem. Services such as WatermarkRemover.io, PhotoTune.ai, Unwatermark.ai, and EzRemove use inpainting and GANs to erase visible stock-photo logos and timestamps, often advertising instant, blur-free results. Those tools address a different problem: visual copyright marks on raster images. The GitHub project, by contrast, targets invisible provenance metadata and statistical text marks. It is infrastructure for hygiene and privacy, not a photo editor.

Outlook: The Verification Arms Race

With the v0.5.0 release, the project has shifted from a static cleaner toward an evaluation platform. It now offers batch auditing of directory trees and websites, SARIF export for CI gating, and pre-commit hooks that can block commits containing detected marks. The HTTP service exposes OpenAPI specifications dynamically, and the Docker compose stack separates core, harness, and heavy profiles so that optional pixel and verification backends run only where needed.

The unresolved tension is built into the design. Every improvement in Layer B rewriting is a reaction to detector evolution; every detector update will prompt new rewrite strategies. The README already advises using a non-origin model for rewriting to avoid re-stamping, acknowledging that the most reliable way to avoid one vendor’s watermark is to avoid that vendor’s token distribution entirely. In that sense, the repository is less a product than a snapshot of an arms race—a meticulously documented, stdlib-only snapshot, but an arms race nonetheless.