Inspect the marks. Clean what you own. Keep agency over what travels with your work.

---

What this is

Watermarks Remover is Harshith Vaddiparthy's local-first toolkit for inspecting and cleaning AI-era provenance signals from content you own.

A machine mark may show that a model processed an artifact. It cannot decide who originated the idea, who performed the meaningful work, or who owns the result. This project keeps those claims separate and reports exactly what it can verify.

Browse the complete open-source directory, see the Contributions page, or read I am an Open Node.

Coverage

Surface	Inspects	Cleans	Confidence
Text	Invisible Unicode, bidi controls, tag characters, unusual spaces	Deterministic character removal and normalization	Verifiable
Statistical text marks	Token-level watermark classes	Substantial rewrite with a chosen model	Best-effort
PNG / JPEG	C2PA, EXIF, XMP, APP metadata	Container metadata removal	Verifiable with limits
Documents	SVG, PDF, DOCX, ODT, HTML, Markdown metadata	Format-aware metadata cleaning	Format-dependent

Out of scope: pixel-domain image marks, audio/video watermarks, C2PA soft binding, undisclosed vendor detectors, and training backdoors.

Install

git clone https://github.com/harshith-vaddiparthy/watermarks-remover.git
cd watermarks-remover
python3 watermarks_remover.py --help

The normal runtime uses Python 3.10+ and the standard library. Optional system tools add deeper container inspection:

• c2patool for signed C2PA manifests;
• exiftool for residual metadata, especially PDFs.

Install as a Codex skill

make install-codex

Restart the agent session, then invoke /remove-ai-marks or ask it to inspect a file.

Use one command

# Inspect first
python3 watermarks_remover.py inspect draft.md

# Clean into a separate output
python3 watermarks_remover.py clean draft.md -o draft.cleaned.md

# Inspect Unicode carriers
python3 watermarks_remover.py inspect-text draft.txt

# Remove Unicode carriers and report exact counts
python3 watermarks_remover.py clean-text draft.txt \
  -o draft.cleaned.txt \
  --stats

# Produce a statistical-watermark rewrite prompt.
# This makes no network request by default.
python3 watermarks_remover.py rewrite draft.md \
  --backend print-prompt

Command	Job
inspect	Inspect any supported file
clean	Clean any supported file
inspect-text	Report suspicious Unicode carriers
clean-text	Remove or normalize text carriers
inspect-image	Inspect PNG or JPEG metadata
clean-image	Remove PNG or JPEG metadata
rewrite	Print or run a best-effort rewrite

Every cleaner prefers a new *.cleaned.* artifact. In-place mode creates a backup.

Trust model

Watermarks Remover never collapses different outcomes into a fake “undetectable” score.

Removed and verified

The tool can count removed Unicode characters, enumerate metadata actions, and re-inspect supported containers after cleaning.

Attempted, not certified

Statistical text watermarks live in wording choices. Reducing them requires substantial rewriting, which may flatten voice or reduce precision. Without a vendor detector and its keys, no tool can honestly certify removal.

Outside the boundary

Pixel, audio, video, soft-bound, and undisclosed signals may remain even after container metadata is removed.

Test

python3 -m venv .venv
.venv/bin/pip install pytest
.venv/bin/python -m pytest -q
make smoke

The suite covers Unicode cleaning, images, containers, rewrite behavior, C2PA report parsing, and the unified CLI.

Contribute

Issues and pull requests are welcome—especially reproducible format fixtures, clearer failure reporting, new container support, and research grounded in public evidence.

Start with CONTRIBUTING.md. Keep four rules in view:

1. inspect before cleaning;
2. test every behavior change;
3. separate verified, best-effort, and out-of-scope claims;
4. never commit private user content or credentials.

Responsible use

Use Watermarks Remover only on content you own or are authorized to process. Do not use it for academic fraud, impersonation, contractual evasion, copyright abuse, or false authorship claims.

The same operation can protect privacy in one context and enable deception in another. The project documents that boundary instead of pretending dual use does not exist.

License

Released under the MIT License.

_{H® · Built and maintained by Harshith Vaddiparthy · Part of Open Source by Harshith.}