Remove-AI-Watermarks: Strip Visible and Invisible AI Watermarks in One Command
Remove-AI-Watermarks: Strip Visible and Invisible AI Watermarks in One Command
Generative AI images come with more baggage than meets the eye. That image you just generated in Gemini, ChatGPT, or Midjourney carries three hidden layers: visible logos (like the Gemini sparkle), invisible SynthID watermarks (imperceptible but machine-detectable), and C2PA/EXIF metadata (how social platforms detect and tag "Made with AI" content).
Until recently, cleaning all three required separate tools: Photoshop for the logo, a diffusion model for SynthID, and exiftool for metadata. But in May 2026, developer Victor K. released an open-source CLI tool called Remove-AI-Watermarks that combines all three into a single command.
What It Does
Remove-AI-Watermarks isn't a drag-and-drop web tool — it's a Python CLI and library that handles three distinct watermark removal tasks:
Visible watermark removal:
- Gemini / Nano Banana sparkle logo
- Doubao "豆包AI生成" text strip (ByteDance)
- Jimeng "★ 即梦AI" wordmark (ByteDance)
- Samsung Galaxy AI bottom-left strip
These aren't removed by AI guesswork. The tool ships with a registry of known watermarks — exact positions, sizes, and visual features — detected via normalized cross-correlation (NCC) and filled using inpainting algorithms.
Invisible watermark removal:
- Google SynthID v1+v2 (the most widely deployed AI watermark)
- OpenAI gpt-image-2 pixel-level watermark
- Stable Diffusion / SDXL DWT-DCT watermarks
- TreeRing, StableSignature, and other research schemes
This step requires a GPU. The approach is diffusion-based regeneration: a ControlNet + SDXL pipeline lightly "redraws" the image with enough perturbation to defeat the watermark decoder while preserving visual content.
Metadata stripping:
- C2PA Content Credentials (used by Adobe, Microsoft, and major AI platforms)
- EXIF/XMP "Made with AI" labels (Instagram, Facebook detection)
- IPTC metadata, PNG text chunks, TC260 Chinese AI labels
- Video/audio metadata via ffmpeg (MP4, MOV, WebM, MP3)
Metadata removal is the simplest — it operates at the file level, modifying header bytes without touching pixel data.
Installation
Four installation methods, with pipx or uv recommended:
# pipx (recommended)
pipx install remove-ai-watermarks
# uv
uv tool install remove-ai-watermarks
# Homebrew (macOS/Linux)
brew install wiltodelta/tap/remove-ai-watermarks
# From source
git clone https://github.com/wiltodelta/remove-ai-watermarks
cd remove-ai-watermarks
pip install -e .
For GPU-accelerated invisible watermark removal:
pip install "remove-ai-watermarks[gpu]"
Usage
The all command runs the full pipeline:
# Single file
remove-ai-watermarks all --input watermarked.png --output clean.png
# Batch process a directory
remove-ai-watermarks all --input ./images/ --output ./clean/
Individual subcommands for granular control:
| Command | Purpose | GPU Required |
|---|---|---|
identify | Detect watermarks and metadata in image | No |
visible | Remove only visible watermarks (fast, CPU) | No |
invisible | Remove invisible watermarks (SynthID, etc.) | Yes |
metadata | Strip metadata only | No |
erase | Erase arbitrary region by coordinates | No |
all | Full pipeline (visible + invisible + metadata) | Yes |
Start by inspecting what's hidden in an image:
remove-ai-watermarks identify --input gemini-image.png --json
The output reveals the source AI platform, visible watermark type, invisible watermark scheme, and C2PA issuer information.
How SynthID Works
Google's SynthID (v1 and v2) is the most widely deployed AI image watermark. Unlike traditional DWT-DCT watermarks that embed a fixed bit pattern into frequency coefficients (and get destroyed by JPEG compression at quality 90), SynthID uses jointly-trained deep learning models: an encoder f adds a watermark signal to already-generated images, and a decoder g detects its presence.
Key design choice: SynthID is post-hoc and model-independent — applied after the VAE decoder outputs pixels, not baked into the diffusion model's weights. This means Google can update the encoder/decoder independently of the image generation model.
At 512×512 resolution, SynthID-O encodes 136 bits of information. It achieves 99.9%+ TPR across 30 image transformations (color, noise, JPEG compression, cropping, rotation), far outpacing WAM (~90%) and StegaStamp (~70%).
Empirical findings from the tool's testing:
- OpenAI's SynthID (gpt-image-2): removable at img2img strength 0.05
- Google's SynthID (Gemini): removable at img2img strength 0.15
- Google's watermark is approximately 3× more robust than OpenAI's
Visible Watermark Detection
The visible watermark removal system works from a registry of known marks. For each entry, it stores the watermark's visual template, typical location, and alpha blending pattern. At runtime it uses NCC for template matching, then inpaints the detected region.
Currently supported visible marks:
- Gemini sparkle: bottom-right corner animated star
- Doubao "豆包AI生成": ByteDance's Chinese text banner
- Jimeng "★ 即梦AI": ByteDance's trademark watermark
- Samsung Galaxy AI strip: locale-specific bottom-left label
The erase command extends this to arbitrary objects — specify a bounding box and the tool will remove anything in that region.
Detection vs. Anti-Detection
A 2026 paper (Goonatilake & Ateniese, arXiv:2605.09203) evaluated 6 watermark removal attacks against a ResNet-50 forensic detector. The key finding: all attacks defeated the watermark verifier, but all were caught by the forensic classifier with AUROC > 0.998.
| Attack | Type | AUROC | TPR @ 0.1% FPR |
|---|---|---|---|
| CtrlRegen+ | Regeneration | 0.9999 | 99.64% |
| WatermarkAttacker | Regeneration | 0.9997 | 99.38% |
| UnMarker | Distortion | 0.9994 | 98.28% |
| NFPA | Inversion | 0.9984 | 62.10% |
| WiTS | Erosion | 0.9999 | 99.55% |
The takeaway: removing a watermark and evading forensic detection are two different problems. The tool removes watermark signals but processed images can still be identified as "tampered with" by forensic classifiers.
Face Protection
The tool ships with YOLO-based face detection enabled by default. When processing images containing faces, it preserves facial regions from inpainting artifacts. This can be disabled with --no-face-protection if needed.
Best Use Cases
- Content creators: Legitimately using AI-generated assets while removing platform watermarks for multi-channel distribution
- Developers: Automating watermark and metadata removal in batch processing pipelines
- Researchers: Studying AI watermark robustness and security properties
Legal note: The tool is Apache 2.0 licensed, but the authors explicitly state: "Intended for lawful use only — not for deception, fraud, or any unlawful activity." Some jurisdictions have specific restrictions on removing AI provenance labels.
Quick Start
# 1. Install
pipx install remove-ai-watermarks
# 2. Analyze a Gemini-generated image
remove-ai-watermarks identify --input photo.png
# 3. Remove all watermarks and metadata
remove-ai-watermarks all --input photo.png --output clean.png
# 4. Batch process with GPU
remove-ai-watermarks all --input ./ai_images/ --output ./clean/ --gpu
Summary
Remove-AI-Watermarks is a practical open-source tool that consolidates AI watermark removal into a single CLI command. It covers all three watermark layers — visible, invisible, and metadata — supporting images from Gemini, DALL-E, Stable Diffusion, Midjourney, Adobe Firefly, and most other major AI platforms.
The main limitation is the GPU requirement for invisible watermark removal (or using a third-party cloud service like raiw.cc). And of course, removing watermarks doesn't mean escaping forensic detection — the processed images still carry traces of manipulation. It's a powerful tool, but one that demands an understanding of its capabilities and limits.