An 8.3K-Star GitHub Tool Is Taking Aim at AI Provenance Marks
An open-source project called Watermarks Remover has rapidly attracted attention by targeting several different ways AI-generated content can carry provenance signals. The MIT-licensed repository combines deterministic text cleaning, best-effort rewriting against statistical language-model watermarks and metadata removal for common document and image formats. Its popularity is notable, but so are its limits: the developer explicitly says the tool cannot guarantee that content will defeat proprietary vendor detection systems.Watermarks Remover has passed 8,000 GitHub stars
The Watermarks Remover repository currently shows about 8.3K stars and more than 800 forks, making it one of the more visible recent open-source projects focused specifically on AI provenance removal. The project is distributed under the MIT license and is currently presented as both a Python-based service and an agent skill that can be integrated into AI workflows.The project describes its purpose more narrowly than the phrase "AI detector bypass" suggests. Its stated focus is removing multi-vendor provenance marks from content a user owns, while separating signals that can be removed deterministically from those that can only be attacked on a best-effort basis.
That distinction is central to the project: there is no single universal "AI watermark." Different systems place signals in different parts of text, token selection, file metadata or media content itself.
The first layer targets invisible Unicode markers
The simplest category is hidden text formatting. Watermarks Remover scans for invisible Unicode characters including zero-width characters, bidirectional control marks, tag characters and unusual space variants that can be embedded in otherwise normal-looking prose.This layer is deterministic because the characters physically exist in the text. The software can identify and remove them without having to infer how an AI model generated the surrounding words. It is closer to text sanitation than statistical watermark breaking.
This matters because invisible characters are easy to confuse with more sophisticated language-model watermarking. Removing a zero-width character says nothing about whether the wording itself still contains a statistical signal.
Statistical text watermarks require rewriting the prose itself
The second layer addresses a much harder class of watermark. Research systems such as Kirchenbauer-style schemes and Google's SynthID-Text can encode a statistical signal through token selection rather than through visible or hidden characters. In those cases, the watermark is distributed across the wording itself.Watermarks Remover therefore treats statistical removal as a rewrite problem rather than a simple cleaning operation. The repository describes this layer as best-effort and warns that meaningful removal can require substantial rewording, which may reduce style, precision and writing quality.
That warning is consistent with how modern text watermarking works. Google describes SynthID as technology for embedding imperceptible signals into AI-generated content, while academic watermark designs similarly rely on patterns that are intended to remain invisible to readers.
Files expose a completely different provenance layer
The third component operates on files rather than prose. The project supports formats including PNG, JPEG, WebP, SVG, PDF, DOCX, ODT, HTML and Markdown, looking for provenance information such as C2PA manifests, EXIF and XMP metadata, document properties and AI-related metadata fields.C2PA is fundamentally different from a statistical text watermark. The C2PA technical specification defines digitally signed provenance manifests intended to document where digital content came from and how it was modified. Removing embedded metadata can therefore remove provenance information even when the visible content itself remains unchanged.
That makes the project relevant beyond AI text. The same general problem applies to generated images, documents and other files where the origin signal is stored in the container rather than embedded into the wording.
Claude, Gemini and OpenAI support needs careful wording
The repository lists Claude, Gemini and SynthID-Text, OpenAI provenance surfaces and Kirchenbauer-style open-model watermarks as vendor or ecosystem classes. That does not mean one universal detector has been reverse-engineered for every proprietary model.Instead, the project maps known classes of signals to different cleaning approaches. Unicode carriers can be removed directly. Metadata can be stripped from supported containers. Statistical language-model marks are approached through rewriting. Proprietary detectors remain a separate problem because their keys, thresholds and full detection logic may not be publicly available.
This is why claims that the tool can simply make any Claude, Gemini or OpenAI output "undetectable" would go beyond what the repository itself promises.
The current version goes further on image watermarks than early descriptions
The latest repository has expanded beyond its original scope. Earlier documentation treated pixel-domain watermarks primarily as out of scope, but the current v0.5.0 project can optionally connect to external research backends for pixel-watermark experiments and scoring.Those components are not equivalent to a guaranteed SynthID eraser. The project explicitly labels them as external, optional and best-effort. It also states that C2PA soft bindings and residual media watermarks can survive even after ordinary metadata has been removed.
The distinction is important because deleting EXIF or a hard-bound C2PA manifest is much easier to verify than proving that an imperceptible watermark embedded in image pixels has disappeared.
The developer explicitly rejects guaranteed detector bypass claims
Perhaps the most important part of the project is its disclaimer. Watermarks Remover states that until vendors publish the relevant detectors and keys, no independent tool can honestly certify that a cleaned file or rewritten text will fail an official detection check.The repository therefore separates verifiable operations from probabilistic ones. Unicode characters can be counted before and after removal. Metadata can be inspected. Statistical rewriting can reduce a known test watermark in controlled conditions, but passing the same test does not prove that a private vendor detector will reach the same conclusion.
This turns the project into an interesting demonstration of the current provenance arms race: watermarking technology is becoming more sophisticated, but so are open-source tools designed to remove, weaken or audit those signals.
AI provenance is becoming a durability problem
The broader issue is that provenance systems now operate across multiple layers at once. C2PA can provide cryptographically verifiable metadata, statistical text watermarks can survive without visible markers, and imperceptible media watermarks can remain inside pixels or audio even after ordinary metadata disappears.Tools such as Watermarks Remover demonstrate why no single provenance layer should be treated as permanent on its own. Metadata can be removed, text can be rewritten and media can be transformed. Strong provenance systems increasingly need multiple independent signals if they are expected to survive normal editing as well as deliberate removal attempts.
At 8.3K GitHub stars, the project has already become more than a niche experiment. Its popularity is evidence that AI provenance is no longer only a problem for model vendors. It is becoming an open technical contest between systems that attach origin signals and tools that test how durable those signals really are.
Editorial Team - CoinBotLab
