Every AI-generated image, document, or block of text you produce now carries a shadow. Not a visible one—something quieter. Metadata boxes with cryptographic signatures, zero-width Unicode characters wedged between letters, statistical patterns baked into token probabilities. These provenance marks are designed to follow your content wherever it goes.
The guillaumemeyer/watermarks-remover project exists to strip them out. It's a toolkit for anyone who needs to understand what's embedded in their files—and how to remove it.
This article walks through seven practical approaches, from C2PA metadata in JPEGs to statistical watermarks in AI text. Each section covers the specific techniques, the tools involved, and the tradeoffs you should know about.
Key Takeaway: AI provenance marks come in many forms—metadata, invisible characters, statistical patterns. Removing them requires format-specific approaches, not a single universal tool.
C2PA—the Coalition for Content Provenance and Authenticity—is the standards body behind the most widespread provenance system in digital media. Backed by Adobe, Microsoft, OpenAI, and the BBC, it embeds cryptographically signed metadata directly into files. As of 2024, the coalition has over 30 members.
The C2PA specification stores this data in a JUMBF (JPEG Universal Metadata Box Format) container. In JPEG files, that's an APP11 segment. In PNGs, it lives in iTXt, tEXt, and eXIf chunks. SVG files carry it in <metadata> elements.
JPEG files organize metadata into APPn segments. APP1 holds Exif data; APP11 holds JUMBF. ExifTool handles both:
exiftool -all= image.jpg
This strips every metadata segment, including C2PA provenance. For more surgical removal:
exiftool -JUMBF:all= -Exif:all= image.jpg
The image pixels remain untouched. Only the metadata container is emptied.
PNG files store metadata in named chunks. The tEXt chunk holds plain text; iTXt holds international text; eXIf holds Exif data. ExifTool can remove them all:
exiftool -all= image.png
Or selectively:
exiftool -PNG:text= -PNG:exif= image.png
Some C2PA implementations embed data in custom chunks. ExifTool's -v3 flag reveals every chunk, letting you identify non-standard carriers.
SVG is XML, which means provenance can hide in several places: <metadata> elements, <desc> and <title> tags, comments, and custom attributes. A simple approach:
xmllint --xpath '//*[local-name()="metadata"]' image.svg
To remove, use a script or an XML editor. For batch processing, Python with lxml:
from lxml import etree
tree = etree.parse('image.svg')
for elem in tree.xpath('//*[local-name()="metadata"]'):
elem.getparent().remove(elem)
tree.write('cleaned.svg')
Comments require separate handling—lxml preserves them by default.
Key Takeaway: C2PA provenance lives in format-specific containers—APP11 in JPEG, text chunks in PNG, metadata elements in SVG. ExifTool's
-all=flag removes them without touching image data.
Documents carry provenance too. PDFs embed metadata in the document information dictionary, XMP streams, and sometimes embedded files. DOCX files are ZIP archives full of XML parts, each potentially carrying properties.
The qpdf tool rebuilds PDFs from scratch, discarding metadata in the process:
qpdf --empty --pages input.pdf -- output.pdf
This creates a new PDF with only the page content. Document info, XMP metadata, embedded files—all gone. The tradeoff: annotations, form fields, and bookmarks may also be lost.
For finer control, ExifTool can target specific metadata types:
exiftool -XMP:all= -PDF:all= document.pdf
A DOCX file is a ZIP archive. Rename it to .zip, extract, and you'll find docProps/core.xml and docProps/custom.xml. These hold author names, creation dates, and custom properties.
Using python-docx:
from docx import Document
doc = Document('input.docx')
core = doc.core_properties
core.author = ''
core.last_modified_by = ''
core.created = None
core.modified = None
doc.save('output.docx')
For custom properties, you'll need to edit the XML directly:
import zipfile
with zipfile.ZipFile('input.docx', 'r') as zin:
with zipfile.ZipFile('output.docx', 'w') as zout:
for item in zin.infolist():
if 'custom.xml' not in item.filename:
zout.writestr(item, zin.read(item.filename))
This strips the custom properties file entirely. Hidden text—runs with w:vanish attribute—requires separate removal.
Key Takeaway: PDF metadata lives in multiple layers—info dictionary, XMP, embedded files. DOCX metadata is XML inside a ZIP. Both can be stripped without affecting visible content.
Text watermarks don't have to be visible. The Unicode Standard includes over 20 invisible or zero-width characters that can encode hidden data. U+200B (zero-width space), U+200C (zero-width non-joiner), U+200D (zero-width joiner), U+FEFF (byte order mark)—each can carry a bit or more.
A watermarking system might insert U+200B for binary 0 and U+200C for binary 1, encoding a message across thousands of characters. To a reader, the text looks normal. To a detector, it's a signal.
The simplest approach—strip known zero-width characters:
import re
text = "Hello\u200bWorld\u200c!"
cleaned = re.sub(r'[\u200b\u200c\u200d\u2060\ufeff]', '', text)
print(cleaned) # "HelloWorld!"
This handles the most common carriers. For broader coverage:
import unicodedata
cleaned = ''.join(c for c in text if unicodedata.category(c) != 'Cf')
The Cf category covers format characters—a superset of invisible watermarks.
Unicode normalization converts text to a canonical form. NFC (Canonical Composition) and NFD (Canonical Decomposition) both alter the byte sequence without changing visible appearance:
import unicodedata
normalized = unicodedata.normalize('NFC', text)
This disrupts steganographic schemes that rely on specific character sequences. It won't remove all watermarks—some use characters that survive normalization—but it raises the bar.
Key Takeaway: Invisible Unicode characters—U+200B, U+200C, U+200D, U+FEFF—can encode hidden watermarks. Regex filtering and Unicode normalization remove or disrupt them.
Statistical watermarking is different. There's no metadata to strip, no invisible characters to remove. The watermark is in the token probabilities themselves.
The Kirchenbauer et al. (2023) approach modifies the language model's sampling process. Before generating each token, it computes a hash of the previous token and uses it to partition the vocabulary into "green" and "red" lists. Green tokens are boosted; red tokens are suppressed. The result is text that reads normally but has a statistically detectable bias toward green tokens.
You can't remove a statistical watermark by deleting a few words. The bias is distributed across every token. A detector with access to the hash function can analyze the full text and measure the green-token ratio. If it's significantly above chance, the text is flagged.
Light editing—synonym swaps, punctuation changes—preserves most of the original token sequence. The watermark survives.
The Kirchenbauer paper found that paraphrasing with a different language model removes the watermark with about 90% success. The paraphrased text has a new token sequence, one that wasn't generated under the watermarking constraints.
This works because the watermark is tied to the specific model and hash function. A different model, generating text independently, produces unbiased tokens.
The tradeoffs:
The watermarks-remover project includes hooks for automated rewriting. These call out to a language model, pass the text through a paraphrase prompt, and return the result. The goal is consistent, high-quality rewriting that removes statistical signals without damaging readability.
Key Takeaway: Statistical watermarks live in token probabilities, not metadata. Simple editing won't remove them. Paraphrasing with a different model achieves ~90% removal but risks quality degradation.
HTML and Markdown are text formats, which means they're vulnerable to the same invisible Unicode tricks as plain text. But they have additional carriers: HTML comments, CSS, and front matter.
HTML comments (<!-- -->) can hold arbitrary data. A watermarking system might embed a signature in a comment near the top of the file. Stripping them is straightforward:
from bs4 import BeautifulSoup, Comment
soup = BeautifulSoup(html, 'html.parser')
for comment in soup.find_all(string=lambda text: isinstance(text, Comment)):
comment.extract()
CSS can also carry watermarks—unusual property values, custom properties, or even whitespace patterns. Minifying the CSS disrupts many schemes.
For invisible Unicode, the same regex approach applies:
import re
cleaned = re.sub(r'[\u200b-\u200f\u2060\ufeff]', '', html)
Markdown files often start with YAML front matter:
---
title: My Document
author: AI Assistant
watermark: abc123
---
That watermark field is a giveaway. Remove or sanitize front matter before publishing.
Hidden Unicode characters can appear anywhere in Markdown—between words, inside code blocks, even in link URLs. A cleaning script:
def clean_markdown(text):
text = re.sub(r'[\u200b-\u200f\u2060\ufeff]', '', text)
text = re.sub(r'<!--.*?-->', '', text, flags=re.DOTALL)
return text
For batch processing, combine with file iteration and write cleaned versions to a new directory.
Key Takeaway: HTML and Markdown carry watermarks in comments, CSS, front matter, and invisible Unicode. Cleaning requires both format-aware parsing and character-level filtering.
Removing provenance marks isn't always legal. It's not always ethical. The tools exist; whether you should use them depends on context.
OpenAI, Adobe, and Microsoft all include clauses in their terms of service about AI-generated content. Some prohibit removing watermarks or provenance metadata. Violating these terms can result in account suspension or legal action.
Adobe's Firefly terms, for example, require that C2PA credentials remain intact when you distribute generated images. Stripping them may breach the agreement.
The EU AI Act, passed in 2024, includes transparency requirements for AI-generated content. In some jurisdictions, failing to disclose that content is AI-generated is now illegal. Removing provenance marks could be construed as circumventing these requirements.
Similar laws are under consideration in the US and other countries. The regulatory landscape is shifting.
The Digital Millennium Copyright Act prohibits removing "copyright management information" (CMI) under certain conditions. C2PA credentials might qualify as CMI. If they do, stripping them could expose you to DMCA liability.
This is unsettled law. No major cases have tested whether C2PA metadata constitutes CMI. But the risk exists.
There are cases where removal is defensible:
The watermarks-remover project includes documentation on ethical use. The tools are neutral; the intent matters.
Key Takeaway: Removing provenance marks may violate terms of service, disclosure laws, and DMCA provisions. Legitimate uses exist—privacy, creative control, research—but require careful consideration.
The watermarks-remover project bundles several tools and techniques into a unified interface. Here's what's available and how to use it.
ExifTool handles metadata for images, PDFs, and many other formats. Key commands:
# Remove all metadata
exiftool -all= file.jpg
# Remove specific metadata types
exiftool -XMP:all= -IPTC:all= file.jpg
# View all metadata
exiftool -a -G1 file.jpg
The -a flag shows duplicate tags; -G1 groups by metadata category.
qpdf rebuilds PDFs, stripping metadata in the process:
qpdf --empty --pages input.pdf -- output.pdf
For metadata-only removal without rebuilding:
qpdf --linearize --object-streams=disable input.pdf output.pdf
The GitHub repository provides a command-line interface and Python API. It wraps ExifTool, qpdf, and custom scripts into a single tool:
watermarks-remover --input file.jpg --output cleaned.jpg --strip-all
The project is under active development. Check the repository for current capabilities and installation instructions.
Key Takeaway: ExifTool, qpdf, and Python libraries cover most removal needs. The watermarks-remover project unifies them. Always back up, verify, and test.
C2PA adoption is growing. More companies are joining the coalition. More AI tools are embedding provenance by default. The infrastructure for tracking AI-generated content is becoming ubiquitous.
At the same time, removal tools are improving. The arms race between watermarking and removal is ongoing. Each new watermarking technique prompts new removal methods, and vice versa.
What does this mean for you?
If you're creating AI-generated content, understand what's embedded. Know your rights and your obligations. If you're removing provenance marks, do so responsibly—respect terms of service, follow disclosure laws, consider the ethical implications.
The watermarks-remover project is a tool, not a mandate. Use it to understand your files, to protect your privacy, to maintain creative control. Don't use it to deceive.
Key Takeaway: Provenance infrastructure is expanding; removal tools are keeping pace. The technology is neutral. The responsibility is yours.
What is the purpose of the watermarks-remover project?
The project provides tools to strip multi-vendor AI provenance marks from various file formats—images, documents, and text. It's designed for privacy, creative control, and security research.
Is it legal to remove watermarks from AI-generated content?
It depends on jurisdiction and context. Some terms of service prohibit it. Some laws require AI disclosure. DMCA provisions may apply. Consult legal counsel for specific situations.
How does C2PA watermarking work?
C2PA embeds cryptographically signed provenance data in a JUMBF container within files. The data includes information about the content's origin, editing history, and signing entity.
Can statistical watermarks in text be removed by simple editing?
No. Statistical watermarks are distributed across token probabilities. Simple editing preserves most of the signal. Paraphrasing with a different language model achieves ~90% removal.
What are invisible Unicode characters and how are they used as watermarks?
Characters like U+200B, U+200C, and U+200D have no visible width. They can encode binary data by their presence or absence, creating hidden messages in plain text.
Does removing metadata affect the quality of images or documents?
Removing metadata does not affect image pixels or document content. However, rebuilding PDFs with qpdf may lose annotations or form fields. Always verify output quality.
What tools can be used to remove watermarks?
ExifTool for images and PDFs, qpdf for PDFs, python-docx for DOCX, BeautifulSoup for HTML, and custom scripts for Unicode cleaning. The watermarks-remover project unifies these.
Are there ethical concerns with removing AI provenance marks?
Yes. Removal can facilitate misinformation or evade disclosure requirements. Legitimate uses exist—privacy, creative control, research—but require responsible application.
Ready to take control of your AI-generated content? Explore the watermarks-remover project on GitHub to learn how to strip provenance marks responsibly. Always respect terms of service and local laws—use these techniques ethically.