# The science behind watermarks removal  > Watermark removal is not one technique. It is four different sciences stacked on the same file, and the research literature is unusually honest about which of them you can prove. I built [watermarks-remover](https://github.com/guillaumemeyer/watermarks-remover) around that split. Not because it made a nicer README, but because the papers already taxonomized the problem that way. Google DeepMind's Nature paper on [SynthID-Text](https://www.nature.com/articles/s41586-024-08025-4) divides text marks into edit-based, generative, and data-driven. Industry provenance guidance adds a second stack for files: signed [C2PA](https://c2pa.org/) manifests that live in metadata, plus imperceptible watermarks that live in the pixels, the waveform, or the wording itself ([Institute of AI PM guide](https://www.institutepm.com/knowledge-hub/ai-content-provenance-watermarking)). Each class has a different removal mechanism, a different side-effect, and a different honesty bar. This article is the science behind those layers. It is written for people who own the content they want to clean: drafts, research, files that got stamped without a say-so. Pro-privacy, not anti-provenance. Provenance labeling is good for the ecosystem. The interesting question is what the marks actually are, and what "removal" can honestly mean. **1. Edit-based marks: the Unicode problem is a parsing problem** The oldest class is also the most misunderstood. An edit-based watermark does not live in meaning. It lives in characters you usually cannot see: zero-width spaces (U+200B), bidi controls, Unicode tag characters (U+E0001-U+E007F), variation selectors, and space homoglyphs. The Nature taxonomy calls this _edit-based watermarking_: inject a rule into the surface form, detect it later by looking for the rule. This is why Layer A in the tool is a deterministic scrubber rather than a model. If the carrier is a codepoint, removal is a codepoint operation. You can count what's left, categorize it, and re-inspect the file. The report is an audit trail, not a confidence score. The same carriers show up in security research for a different reason. Boucher and Anderson documented how bidi overrides can hide logic from human reviewers in source code ([Trojan Source](https://arxiv.org/abs/2111.00169), CVE-2021-42574). The lesson transfers: invisible Unicode is a channel. Treating it as hygiene (strip, normalize, report) is the scientifically conservative move. Homoglyph cleanup is the one place this layer gets opinionated, which is why aggressive confusable folding is opt-in rather than default. What this layer cannot do: it cannot touch a mark that was never written as a character. **2. Generative text watermarks: the signal is the wording** The modern production mark is statistical. Kirchenbauer, Geiping, Wen, Katz, Miers, and Goldstein's ICML 2023 paper, [_A Watermark for Large Language Models_](https://proceedings.mlr.press/v202/kirchenbauer23a.html), is the reference design. Before each token is sampled, the vocabulary is randomly split into a "green" list and a "red" list, seeded from prior tokens and a secret key. The sampler then softly promotes green tokens. Detection is a hypothesis test: is the green-token rate higher than chance? You do not need the original model at detect time. You need the key, the tokenizer, and enough tokens. SynthID-Text, published in _Nature_ in 2024 by Dathathri, See, Ghaisas, Huang, and colleagues at Google DeepMind ([paper](https://www.nature.com/articles/s41586-024-08025-4)), is the production-scale version of that idea. Instead of a single green/red split, it uses _tournament sampling_: tokens compete across layers using pseudo-random g-values, and the watermark is the bias in who wins. Detection scores those g-values. The paper reports a live quality check on nearly 20 million Gemini responses, which serves as an existence proof that generative watermarking survived contact with a real product. Public research code exists. Production keys do not. That distinction matters: a tool without the vendor key cannot certify that a vendor detector will fail. Claude's public description of [how it marks AI-generated content](https://support.claude.com/en/articles/16266773-how-claude-marks-ai-generated-content) matches this class (imperceptible, survives copy-paste, statistical), not a Unicode-only scheme. Open-weight models often ship Kirchenbauer-style variants. OpenAI's public provenance consists mostly of labels and Content Credentials; unpublished text watermarks, if present, still collapse into the same statistical class. **Why paraphrase is the attack, and why it is not magic** If the watermark is a bias in token choice, then the removal operation is rewording. Not moving paragraphs. Not changing headings. Sentence-by-sentence substitution of the biased tokens. That is exactly what the attack papers measure. Krishna, Song, Karpinska, Wieting, and Iyyer's NeurIPS 2023 paper, [_Paraphrasing evades detectors of AI-generated text, but retrieval is an effective defense_](https://arxiv.org/abs/2303.13408), introduced DIPPER, an 11B paraphraser with knobs for lexical diversity and content reordering. Paraphrasing watermarked text caused several detectors to collapse, including watermark checks, GPTZero, DetectGPT, and OpenAI's (since-withdrawn) classifier. DetectGPT's accuracy at a 1% false-positive rate fell from 70.3% to 4.6% in their setting. Their proposed defense was not a stronger watermark. It was retrieval: keep a database of prior generations and match on meaning. Sadasivan, Kumar, Balasubramanian, Wang, and Feizi pushed the same idea into a loop ([_Can AI-Generated Text be Reliably Detected?_](https://arxiv.org/abs/2303.11156)). Recursive paraphrasing (paraphrase the paraphrase) dropped watermark true-positive rate at 1% FPR from 99.8% to 9.7% on ~300-token passages after five rounds. They also give a theoretical bound: as the AI-text distribution approaches the human-text distribution, even the best detector's AUROC is limited by total variation distance. Watermarks try to escape that bound by _deliberately changing_ the AI distribution. Paraphrase tries to change it back. Kirchenbauer's own follow-up at ICLR 2024, [_On the Reliability of Watermarks for Large Language Models_](https://arxiv.org/abs/2306.04634), is the paper people skip when they want a simple story. After human and machine paraphrasing, the signal is diluted rather than erased. Fragments leak. At a 1e-5 false-positive rate, strong human paraphrasing still left the watermark detectable after observing about 800 tokens on average. Reliability, in their framing, is a function of length. Short cleaned snippets can look clean. Long documents accumulate residual n-grams. That is why Layer B in the tool is labeled best-effort, and why the strengths escalate: paraphrase, then humanize, then backtranslate, then structural (outline, then regenerate). Each step increases token churn at the cost of greater style drift. The README's uncomfortable question is the scientific one: if you are going to rewrite the text with a weaker model anyway, why generate with a premium model in the first place? Layer B is for cases where you want the original model's thinking and then accept a hygiene pass. It is not a free eraser. Two more design constraints come straight from the papers: - Rewrite with a _different_ model family than the suspected origin. Sampling watermarks are applied at decode time. Rewriting Claude text with Claude can re-stamp it. - Current production marks are token-by-token because they have to stream. Sentence-level and paragraph-level schemes designed to survive paraphrase, notably Hou et al.'s [SemStamp](https://aclanthology.org/2024.naacl-long.226/) (NAACL 2024; locality-sensitive hashing over sentence embeddings) and Chang et al.'s [PostMark](https://aclanthology.org/2024.emnlp-main.506/) (EMNLP 2024; post-hoc insertion of semantically chosen watermark words), are not what frontier vendors deploy today. If they ship, paraphrase-class removal gets harder. The cat-and-mouse is not theoretical. It is the next paper. Data-driven marks (trigger phrases, backdoored fine-tunes) also sit within the Nature taxonomy. They live in model weights. They are out of scope for a file cleaner, on purpose. **3. C2PA and container metadata: cryptography you can drop, binding you cannot** Files are a different science. [C2PA Content Credentials](https://c2pa.org/) are signed manifests bound to a container: JUMBF / APP11 in JPEG, PNG chunks, XMP packets, OOXML document properties, PDF Info/XMP. The cryptographic object is the manifest. The removal operation is "delete the bytes that hold it." That is why clean_file.py / clean_image.py can be verified: re-inspect the container and confirm the chunk is gone. The industry two-layer model exists because everyone already knows this. Hard-bound C2PA is easy to strip. Soft binding is an imperceptible watermark _in the content_ that can later resolve to a remote manifest. Strip the metadata, keep the pixels, and a vendor verifier can still re-attach the credential. This project's file cleaners implement the hard-bound side. Soft binding is called out as residual risk because it is. A successful C2PA strip does not mean "no AI provenance left." It means the signed sidecar is gone. The same pattern repeats across formats: SVG <metadata>, PDF XMP (exiftool is the serious tool; stdlib strip is degraded), DOCX docProps / customXml, ODT meta:generator, HTML generator / JSON-LD, Markdown AI frontmatter keys. Different containers, same science: structured metadata is removable and auditable; in-content binding is not. **4. Pixel watermarks: regeneration, not inpainting** Invisible image watermarks are a third literature. Three methods show up in almost every robustness benchmark: - [StegaStamp](https://openaccess.thecvf.com/content_CVPR_2020/html/Tancik_StegaStamp_Invisible_Hyperlinks_in_Physical_Photographs_CVPR_2020_paper.html) (Tancik, Mildenhall, Ng; CVPR 2020): a learned encoder/decoder trained against print-and-photograph distortions. Post-process, model-agnostic, historically the most robust of the three against naive attacks. - [Tree-Ring](https://arxiv.org/abs/2305.20030) (Wen, Kirchenbauer, Geiping, Goldstein; NeurIPS 2023): the watermark is a pattern in the diffusion model's initial noise that is recovered in Fourier space. In-process, not a post-hoc stamp. - [Stable Signature](https://openaccess.thecvf.com/content/ICCV2023/html/Fernandez_The_Stable_Signature_Rooting_Watermarks_in_Latent_Diffusion_Models_ICCV_2023_paper.html) (Fernandez, Couairon, Jégou, Douze, Furon; ICCV 2023): fine-tune the latent decoder so every image carries a model-specific signature an extractor can test for. WAVES ([An, Ding, Rabbani, et al., 2024](https://arxiv.org/abs/2401.08573)) is the benchmark that made comparisons less apples-to-oranges. The consistent finding across that line of work: classical distortions (JPEG, crop, blur) are the wrong attack model. Generative _regeneration_ is the right one. Zhao, Zhang, Su, and colleagues proved the core claim at NeurIPS 2024: [_Invisible Image Watermarks Are Provably Removable Using Generative AI_](https://arxiv.org/abs/2306.01953). Add noise until the watermark is destroyed, then reconstruct the image with a denoiser or a diffusion model. Pixel-level invisible marks do not survive a round trip through a generative prior that was never trained to keep them. Semantic-preserving watermarks (marks on meaning, not pixels) are the suggested defense, which is the image-domain echo of SemStamp. CtrlRegen (Liu, Song, Ci, Zhang, Wang, Shou, Bu; ICLR 2025, [_Image watermarks are removable using controllable regeneration from clean noise_](https://arxiv.org/abs/2410.05470)) is the method the optional pixel backend in this project wraps. The insight is control. Unconditional regeneration destroys the watermark _and_ the picture. CtrlRegen starts from clean Gaussian noise (or a tunable number of noise steps) and steers denoising with a semantic adapter plus a spatial ControlNet, so the cleaned image stays close to the original. In their numbers, StegaStamp true-positive rate at 1% FPR falls from 1.00 to 0.01; Tree-Ring from 0.99 to 0.12. CtrlRegen+ trades more noise steps for more removal and less pixel fidelity. That trade-off is why the tool's default CtrlRegen strength is conservative (0.25, not the upstream 0.5). Higher strength removes more mark and regenerates more of the image. There is no local oracle for StegaStamp, Tree-Ring, or Stable Signature. The optional reverse-SynthID score is a surrogate, not Google's detector. Audio and video SynthID remain out of scope. **What "removed" is allowed to mean** Put the four literatures next to each other, and the honesty rules write themselves: 1. **Verifiable.** Unicode counts. Missing C2PA chunks. Re-inspectable containers. These are facts about bytes. 2. **Best-effort.** Statistical text rewrite. Pixel regeneration. These are facts about a procedure, not about a vendor detector. Kirchenbauer 2024 says residual signal can survive paraphrasing at sufficiently long length. Zhao 2024 and Liu 2025 say pixel marks yield to regeneration, with quality cost. Neither paper hands you a certificate against a private production key. 3. **Out of scope.** Soft-bound C2PA, audio/video watermarks, training backdoors, secret-key detectors. No paper in this list claims a universal undetectability result, and the ones that look close (Sadasivan's impossibility bound) apply to _distributional_ detectors, not to keyed watermarks with unbounded document length. The scientifically honest product position is therefore the one in the [ethics file](https://github.com/guillaumemeyer/watermarks-remover/blob/main/skills/remove-ai-marks/references/ethics.md): a removed mark does not mean the content was never AI-assisted. Do not market a clean report as "proves human-written." **Why publish the removal side** Watermarking research has always published the attack. DIPPER, recursive paraphrase, regeneration, CtrlRegen: these are conference papers, not underground tricks. Robustness is not a slogan. It is a measured failure mode. Building an open, auditable cleaner for content you own is how those measurements become engineering: Layer A, where the science is deterministic; Layer B, where the science is statistical and costly; file strip, where the science is a container spec; optional CtrlRegen, where the science is generative reconstruction. The EU AI Act's [Article 50](https://artificialintelligenceact.eu/article/50/) labeling obligations made this stack mainstream. Provenance is a feature. Features have owners. The science of removal is the science of what ownership still means after the stamp. If you want the implementation that follows this literature, it is here: [watermarks-remover](https://github.com/guillaumemeyer/watermarks-remover). MIT, stdlib-first, and limits in the README. Star it, fork it, or send the paper I missed. **References** 1. Kirchenbauer, J., Geiping, J., Wen, Y., Katz, J., Miers, I., & Goldstein, T. (2023). [A Watermark for Large Language Models](https://proceedings.mlr.press/v202/kirchenbauer23a.html). _ICML 2023_. Also [arXiv:2301.10226](https://arxiv.org/abs/2301.10226). 2. Dathathri, S., See, A., Ghaisas, S., Huang, P.-S., McAdam, R., Welbl, J., ... Kohli, P. (2024). [Scalable watermarking for identifying large language model outputs](https://www.nature.com/articles/s41586-024-08025-4) (SynthID-Text). _Nature, 634_, 818-823. 3. Kirchenbauer, J., Geiping, J., Wen, Y., Shu, M., Saifullah, K., Kong, K., ... Goldstein, T. (2024). [On the Reliability of Watermarks for Large Language Models](https://arxiv.org/abs/2306.04634). _ICLR 2024_. 4. Krishna, K., Song, Y., Karpinska, M., Wieting, J., & Iyyer, M. (2023). [Paraphrasing evades detectors of AI-generated text, but retrieval is an effective defense](https://arxiv.org/abs/2303.13408) (DIPPER). _NeurIPS 2023_. 5. Sadasivan, V. S., Kumar, A., Balasubramanian, S., Wang, W., & Feizi, S. (2023). [Can AI-Generated Text be Reliably Detected?](https://arxiv.org/abs/2303.11156) 6. Hou, A. B., Zhang, J., He, T., Wang, Y., Chuang, Y.-S., Wang, H., ... Tsvetkov, Y. (2024). [SemStamp: A Semantic Watermark with Paraphrastic Robustness for Text Generation](https://aclanthology.org/2024.naacl-long.226/). _NAACL 2024_. Also [arXiv:2310.03991](https://arxiv.org/abs/2310.03991). 7. Chang, Y., Krishna, K., Houmansadr, A., Wieting, J. F., & Iyyer, M. (2024). [PostMark: A Robust Blackbox Watermark for Large Language Models](https://aclanthology.org/2024.emnlp-main.506/). _EMNLP 2024_. Also [arXiv:2406.14517](https://arxiv.org/abs/2406.14517). 8. Boucher, N., & Anderson, R. (2023). [Trojan Source: Invisible Vulnerabilities](https://arxiv.org/abs/2111.00169). _IEEE Symposium on Security and Privacy_; CVE-2021-42574. 9. Coalition for Content Provenance and Authenticity. [C2PA specifications](https://c2pa.org/specifications/). 10. Tancik, M., Mildenhall, B., & Ng, R. (2020). [StegaStamp: Invisible Hyperlinks in Physical Photographs](https://openaccess.thecvf.com/content_CVPR_2020/html/Tancik_StegaStamp_Invisible_Hyperlinks_in_Physical_Photographs_CVPR_2020_paper.html). _CVPR 2020_. 11. Wen, Y., Kirchenbauer, J., Geiping, J., & Goldstein, T. (2023). [Tree-Ring Watermarks: Fingerprints for Diffusion Images that are Invisible and Robust](https://arxiv.org/abs/2305.20030). _NeurIPS 2023_. 12. Fernandez, P., Couairon, G., Jégou, H., Douze, M., & Furon, T. (2023). [The Stable Signature: Rooting Watermarks in Latent Diffusion Models](https://openaccess.thecvf.com/content/ICCV2023/html/Fernandez_The_Stable_Signature_Rooting_Watermarks_in_Latent_Diffusion_Models_ICCV_2023_paper.html). _ICCV 2023_. 13. An, B., Ding, M., Rabbani, T., Agrawal, A., Xu, Y., Deng, C., ... Huang, F. (2024). [WAVES: Benchmarking the Robustness of Image Watermarks](https://arxiv.org/abs/2401.08573). 14. Zhao, X., Zhang, K., Su, Z., Vasan, S., Grishchenko, I., Kruegel, C., Vigna, G., Wang, Y.-X., & Li, L. (2024). [Invisible Image Watermarks Are Provably Removable Using Generative AI](https://arxiv.org/abs/2306.01953). _NeurIPS 2024_. 15. Liu, Y., Song, Y., Ci, H., Zhang, Y., Wang, H., Shou, M. Z., & Bu, Y. (2025). [Image watermarks are removable using controllable regeneration from clean noise](https://arxiv.org/abs/2410.05470) (CtrlRegen). _ICLR 2025_. 16. Regulation (EU) 2024/1689 (AI Act), [Article 50](https://artificialintelligenceact.eu/article/50/) (transparency obligations for AI-generated content). Official text: [EUR-Lex](https://eur-lex.europa.eu/eli/reg/2024/1689/oj).