Watermarks Remover strips AI provenance marks from text and files you own. It ships as an agent skill plus a Python service with no third-party dependencies: the skill is a thin client that calls the service over HTTP, so the agent host needs no Python of its own. A second, self-contained text-only skill (clean-user-facing-text) runs its own Unicode scripts for manuscripts, documentation, and web copy without the service.
Marks are handled in three layers. Layer A removes edit-based carriers deterministically: invisible Unicode, exotic spaces, bidi controls, and tag characters. Layer B attacks statistical token-sampling watermarks through a heavy rewrite, either by the agent itself or by a rewrite hook that calls a local Ollama model or an OpenAI-compatible endpoint, and is described as best-effort because the signal is spread across word choices and rewording changes the copy. The file layer strips C2PA, EXIF, XMP, and document properties from images, documents, web formats, and audio and video containers. Covered vendors are Claude, Gemini and SynthID-Text, OpenAI provenance surfaces, and open-LLM green-list and keyed-Gumbel marks.
The service exposes inspect, detect, clean, and watermark endpoints with batch variants, routes files by extension then magic bytes, binds to loopback by default, and publishes an OpenAPI 3.0.3 spec. Detection is separate from cleaning and fail-soft: a text file goes through same-config MarkLLM and keyed-Gumbel detectors and stylometry, an image through an optional SynthID pixel score, and an unconfigured detector reports itself unavailable rather than blocking a clean. Text cleaning requires a configured Layer B strategy, an ordered list of tactic and intensity steps such as paraphrase and masked-language-model substitution.
The skill installs into Claude Code (also as a plugin and single-plugin marketplace with a PostToolUse hook that checks or cleans every file the agent writes), Codex, Cursor, Grok Build, and Cowork. Optional external backends, cloned at pinned commits into their own virtual environments, add SynthID pixel scoring, CtrlRegen and DiffusionPurification pixel-watermark removal, MarkLLM text-watermark verification, and a MarkDiffusion image harness, plus a benchmark that measures how well a rewrite clears SynthID-text marks and at what cost.
| Channel | Claude | Gemini/SynthID | OpenAI | Open-LLM |
|---|---|---|---|---|
| Unicode / edit-based text | Layer A | Layer A | Layer A | Layer A |
| Statistical sampling text | Layer B best-effort | Layer B best-effort, plus MarkLLM same-config harness | Layer B if present | Layer B best-effort, plus optional MarkLLM harness |
| C2PA / file metadata | Yes (listed formats) | Yes when present | Yes when present | Yes when present |
| Pixel image marks | Out of scope | Optional SynthID score, CtrlRegen or MarkDiffusion removal (external) | Out of scope | Optional CtrlRegen / MarkDiffusion removal (external) |
| Training backdoors | Out of scope | Out of scope | Out of scope | Out of scope |
Features
- Layer A Unicode scrub: deterministic removal of invisible characters, exotic spaces, bidi controls, and tag characters, with an option to keep typographic non-breaking spaces
- Layer B rewrite: attacks token-sampling watermarks by rewriting text, through the agent or a hook that calls Ollama or an OpenAI-compatible model, with an ordered tactic-and-intensity strategy
- File metadata cleaners: strips C2PA, EXIF, XMP, and document properties from PNG, JPEG, WebP, AVIF, HEIC, BMP, GIF, TIFF, SVG, PDF, DOCX, XLSX, PPTX, EPUB, ODT, HTML, Markdown, MP4/MOV, WAV, MP3, and FLAC
- HTTP service: inspect, detect, clean, and watermark endpoints with batch variants, an OpenAPI spec, optional bearer-token auth, and loopback-only binding by default
- Fail-soft detection: same-config MarkLLM and keyed-Gumbel text detectors, stylometry, and an optional SynthID pixel score, each reporting unavailable rather than blocking a clean
- Before-and-after scoring: clean requests can score the input and the output to measure what a clean changed
- Claude Code hook: a PostToolUse hook checks or cleans every file the agent writes, with check-by-default and an opt-in clean mode
- Multi-host skill: installs into Claude Code (plugin marketplace included), Codex, Cursor, Grok Build, and Cowork, validated against Agent Skills packaging rules
- Text-only skill: clean-user-facing-text runs vendored Unicode scripts without the service, image tooling, or external models
- Optional pixel backends: SynthID scoring, CtrlRegen regeneration, and MarkDiffusion DiffusionPurification for image watermarks, loaded from pinned external checkouts
- Verification harnesses: MarkLLM and MarkDiffusion watermark test content and re-detect it after a rewrite under the same scheme config, never as a vendor oracle
- Binary-input refusal: text tools refuse ZIP-container documents and route them to the format-aware cleaners, and unrecognized formats are never auto-cleaned
