As AI-generated content becomes ubiquitous, so does the invisible metadata attached to it. Whether you are an author protecting your drafts or a developer sanitizing datasets, AI provenance marks can be a privacy and hygiene concern. Enter watermarks-remover, a new open-source agent skill and Python toolkit designed to strip these markers from text and files you own.
What Is It?
watermarks-remover is not just a script; it is a comprehensive sanitation framework. Currently at v0.3.2, it targets three distinct layers of AI marking: invisible Unicode characters (Layer A), statistical token-sampling watermarks (Layer B), and file metadata like C2PA, EXIF, and XMP. It supports major ecosystems including Claude, Gemini/SynthID, OpenAI, and various open-LLM formats across PNG, JPEG, PDF, DOCX, Markdown, and more.
How It Works
The tool operates on a deterministic, multi-layered approach:
- Layer A (Deterministic): Uses stdlib Python scripts to identify and remove edit-based carriers like exotic spaces, bidi tags, and invisible Unicode. This is verifiable and exact.
- Layer B (Statistical): Attacks sampling-based watermarks through paraphrasing. It includes a
rewrite_text.pyhook that can generate prompts for external models or integrate with local Ollama instances. Crucially, it advises using a non-origin model for rewriting to avoid re-stamping the same watermark. - File Metadata: Strips generator signatures from document properties and image headers using integrated
c2patoolandexiftoolsupport.
For advanced users, it offers optional SynthID pixel scoring via an external reverse-engineering checkout, though this is strictly for detection confidence, not removal.
Key Benefits
- Privacy & Hygiene: Ensures content you own doesn’t carry unintended third-party tracking signals.
- Zero Dependencies Core: The base cleaning scripts require only Python 3.10+ stdlib. Model calls and system tools are entirely optional.
- Honest Reporting: Unlike snake-oil removers, it distinguishes between “verifiable” removals (Unicode/metadata) and “best-effort” attacks (statistical sampling), acknowledging that no tool can certify defeat against private vendor detectors.
- Security Conscious: API keys are read exclusively from environment variables, never command arguments. Docker builds run unprivileged with read-only filesystems.
Getting Started
Installation is flexible. You can link it as a Grok agent skill (/remove-ai-marks) or use the standalone scripts directly:
# Inspect and clean a markdown file
python3 scripts/inspect_file.py draft.md
python3 scripts/clean_file.py draft.md -o draft.cleaned.md
# Clean an image's metadata
python3 scripts/clean_image.py photo.png -o photo.cleaned.png
For Layer B rewriting without cloud APIs, set WATERMARKS_REWRITE_BACKEND=ollama to use a local model. Remember, this tool is for sanitizing content you own. It explicitly excludes training backdoors and pixel-domain watermark removal (beyond SynthID scoring), keeping its scope realistic and legally sound.
In an era of automated provenance, watermarks-remover provides a necessary, transparent utility for digital autonomy. Check out the v0.3.2 release to start reclaiming your content’s cleanliness today.
License
MIT License
