Two days ago I wrote about Claude's impending watermarking mechanism — the statistical token-level signal Anthropic is baking into generated text. Today, the countermeasure shipped.
watermarks-remover is a new open-source tool (915 ★, hit #2 on GitHub trending today) that strips multi-vendor AI provenance marks from text and files. It's structured as an agent skill + Python backend service, and it targets everything at once:
- Layer A — Invisible Unicode: Zero-width spaces, exotic whitespace, bidi overrides, tag characters. Deterministic, trivially removed.
- Layer B — Statistical text watermarks: Token-sampling signals (Kirchenbauer-style, SynthID-Text, Claude's variant). Handled via agent-guided rewriting with an optional
rewrite_text.pyhook. - Layer C — File metadata/C2PA: Strips EXIF, XMP, C2PA manifests from PNG, JPEG, WebP, AVIF, HEIC, SVG, PDF, DOCX, XLSX, PPTX, EPUB, ODT, HTML, Markdown, MP4, WAV, MP3.
The vendor list is comprehensive: Claude, Gemini/SynthID-Text, OpenAI provenance surfaces, and open-LLM Kirchenbauer-style marks. One tool, all the major detection frameworks.
The architecture is interesting — the skill ships no code. It's a markdown manifest that calls the service over HTTP (default localhost:8765). The agent host needs no Python; the service handles the heavy lifting. This means any MCP-compatible agent (Claude Code, OpenAI Codex, Cursor, Grok) can invoke it with a slash command like /remove-ai-marks.
Why this matters
Provenance as a concept assumes you can enforce it. This tool proves you can't — at least not with current approaches. Statistical watermarks are probabilistic; Unicode tricks are deterministic; C2PA metadata is advisory. None of them survive a determined pass through a tool that knows what to look for.
The irony: every major AI lab is racing to build detection mechanisms, but the same open-source ecosystem that democratizes model access also democratizes countermeasures. The gap between a provenance signal hitting the market and a removal tool appearing is now measured in days, not months.
This doesn't mean watermarking is futile — but it means the game has shifted from prevention to raising the cost of removal. And that's a fundamentally harder problem.