24 Hours After Anthropic Announces Watermarks, Open Source Ships a Remover
The speed of open-source never fails to impress.
On August 2, 2026, Anthropic quietly rolled out invisible watermarks for Claude. Models released on or after that date now embed an imperceptible, machine-readable signal directly into generated text. Images get C2PA provenance metadata. The watermark travels with the content when you copy-paste, survives light editing, and works across the chatbot, API, and Claude Code.
Ten days later, watermarks-remover hit v0.3.0 with support for Claude, Gemini, OpenAI, and open-LLM watermarks.
The open-source arms race moves fast.
What Anthropic Actually Shipped
The watermarking serves two purposes:
-
EU AI Act compliance: The Act’s transparency rules kicked in August 2, requiring generative AI providers to make synthetic output machine-detectable. Anthropic chose to apply the marking globally rather than geo-fence it.
-
Fighting AI slop: There’s growing pressure from publishers and platforms to distinguish AI-generated content from human work. YouTube is cracking down on AI slop monetization. Substack launched reader-triggered AI scanners. Anthropic’s watermark is part of this broader push.
The signal sits at the model level, so it follows Claude’s output everywhere. Even asking Claude to proofread or translate a paragraph can leave a trace. Heavy rewrites or translations may knock it out, but casual editing won’t.
For images, Anthropic adds C2PA metadata showing Claude processed the file and flags if someone has tampered with it since.
What watermarks-remover Does
Guillaume Meyer’s tool attacks AI watermarks on three layers:
Layer A: Unicode Hygiene (Deterministic)
The easy stuff. Many watermarking schemes inject invisible Unicode characters — zero-width spaces, bidirectional control characters, tag characters, exotic space variants. Layer A strips these deterministically:
python3 scripts/clean_text.py draft.md -o draft.cleaned.md --statsThis is lossless. Your text stays intact, just without the hidden characters.
Layer B: Statistical Watermark Attack (Best-Effort)
Here’s where it gets interesting. Modern LLM watermarks don’t just hide in invisible characters — they live in which tokens the model chooses. The signal is spread across word choices, so nearly every sentence carries part of it.
Removing this requires rewriting the text. The tool offers hooks to paraphrase via local models (Ollama) or API-compatible services:
WATERMARKS_REWRITE_BACKEND=ollama WATERMARKS_REWRITE_MODEL=llama3.2 \
python3 scripts/rewrite_text.py draft.md -o draft.rewritten.mdThe catch: rewriting degrades quality. You’re taking Claude’s carefully chosen words and running them through a different model. The documentation is refreshingly honest about this:
If the plan is to rewrite the text with a cheaper model anyway, why pay for a premium model in the first place?
It also warns against rewriting Claude text with Claude — that may just re-stamp the watermark.
File Metadata Stripping
For images and documents, the tool strips C2PA manifests, EXIF, XMP, and document properties:
| Format | What Gets Stripped |
|---|---|
| PNG/JPEG | C2PA chunks, APP11 segments, AI XMP hints |
| SVG | <metadata>, XMP blocks |
| Byte-level metadata + XMP (exiftool preferred) | |
| DOCX | docProps, customXml |
| HTML | meta tags, JSON-LD, data-ai* attributes |
| Markdown | AI keys in YAML frontmatter |
Optional: SynthID Pixel Scoring
For Gemini/Google’s SynthID pixel watermarks in images, the tool can detect (not remove) them using an external scorer from aloshdenny/reverse-SynthID. Pixel-domain removal is explicitly out of scope.
The Honest Limitations
What I appreciate about this project is its transparency about what it can’t do:
Until vendors ship public detectors and keys, no tool can honestly certify “this fails the official check.”
The coverage matrix is clear:
| Channel | Claude | Gemini/SynthID | OpenAI |
|---|---|---|---|
| Unicode/edit-based text | ✅ Layer A | ✅ Layer A | ✅ Layer A |
| Statistical sampling text | ⚠️ Best-effort | ⚠️ Best-effort | ⚠️ If present |
| C2PA/file metadata | ✅ Yes | ✅ When present | ✅ When present |
| Pixel image marks | ❌ Out of scope | ⚠️ Score only | ❌ Out of scope |
Soft-bound C2PA — where an in-content watermark can re-link to a remote manifest even after metadata stripping — remains unaddressed. So do pixel/audio/video watermarks.
The Cat-and-Mouse Reality
This isn’t surprising. Every content protection system eventually faces circumvention tools:
- DRM → rippers
- Paywalls → bypass scripts
- AI detection → paraphrasing tools
- Watermarks → strippers
The question isn’t whether removal tools will exist — it’s whether watermarks provide enough friction to be useful. If a determined bad actor can strip them, but casual users leave them intact, that’s still valuable signal.
Anthropic’s watermark probably won’t stop someone generating thousands of fake news articles. But it might help identify when a blog post or essay was Claude-assisted, which is what the EU regulations care about.
The Ethics Angle
The tool’s documentation includes an ethics section emphasizing legitimate use cases:
- Privacy on content you own
- Research into watermarking robustness
- Cleaning personal documents before sharing
It explicitly discourages academic fraud or false “human-written” claims.
But tools don’t have ethics — users do. The same script that helps a privacy-conscious user clean their personal notes also helps a content farm strip provenance before publishing AI slop.
This is the fundamental tension. Watermarks are a social solution to a technical problem. They work when people play along. Open-source removal tools shift the equilibrium.
The Bigger Picture
We’re watching the provenance infrastructure for AI content get built and stress-tested in real-time:
The compliance layer (C2PA, watermarks): Technical mechanisms that mark AI-generated content as machine-detectable. Required by regulations like the EU AI Act.
The detection layer (AI content scanners, watermark detectors): Tools that check for the marks. Increasingly embedded in platforms.
The circumvention layer (watermarks-remover, paraphrasers): Open-source tools that strip or degrade the marks.
The policy layer (platform rules, academic integrity policies): Human systems that decide what to do when content is flagged — or when marks are suspiciously absent.
No single layer solves the problem alone. Watermarks raise the bar for casual misuse. Detection tools help platforms make decisions. Circumvention tools keep the marking schemes honest by exposing weaknesses. Policy creates consequences.
The fact that watermarks-remover exists within days of Anthropic’s announcement isn’t a failure — it’s the system working as designed. Now we get to see how robust the marking actually is.
Try It Yourself
git clone https://github.com/guillaumemeyer/watermarks-remover.git
cd watermarks-remover
# Inspect a file
python3 skills/remove-ai-marks/scripts/inspect_file.py document.md
# Clean Unicode markers (Layer A)
python3 skills/remove-ai-marks/scripts/clean_text.py document.md -o cleaned.md --stats
# Clean image metadata
python3 skills/remove-ai-marks/scripts/clean_image.py photo.png -o photo.cleaned.pngFor Layer B rewrites, you’ll need a model backend (Ollama, OpenAI-compatible API) and should read the documentation on quality tradeoffs.
Links: