A Watermark Removal Tool Just Added OpenAI and Gemini Support

An open-source tool called watermarks-remover added support for OpenAI and Gemini provenance marks on August 11, 2026 — two days after this blog covered Anthropic confirming Claude embeds invisible text watermarks in every model shipped since August 2. The tool, built by developer Guillaume Meyer and released under the MIT license, now claims coverage across Claude, Gemini/SynthID-Text, and OpenAI's provenance surfaces, spanning eight file formats. The announcement went semi-viral on X within hours, with one reply summing up the mood: "This guy already has a tool to remove watermarks from Claude, as well as Gemini and OpenAI."

The framing in most coverage — a tool that "erases marks" — overstates what it does. This post separates the two very different things bundled under "watermark removal" here: metadata stripping, which is real, deterministic, and always was trivial; and statistical watermark removal, which is best-effort, unverifiable, and comes with the author's own admission that it degrades the writing it's supposedly cleaning. That distinction is the whole story, and it's the same one we walked through in how AI text watermarking actually works.

TL;DR

What actually shipped on August 11

The tool is a CLI and Python library, hosted on GitHub, that works in two layers:

Layer A — deterministic removal. Strips invisible Unicode artifacts (zero-width spaces, bidirectional control characters, tag characters, exotic spacing) and file-level metadata, including hard-bound C2PA manifests, EXIF, XMP, and document properties. This is scripted, exact, and needs nothing but Python's standard library. There is no ambiguity about whether it worked — the bytes are either there or they aren't.

Layer B — best-effort statistical rewrite. Targets the actual token-sampling watermark — the mechanism behind Google's SynthID-Text, Anthropic's Claude marking, and Kirchenbauer-style open-research schemes, which we broke down in detail in how AI text watermarking actually works. Because that watermark lives in which words the model chose, not in any deletable byte, the only way to disturb it is to replace enough of those word choices — via paraphrase, through another model, or a rewrite hook.

Before this update, the tool's stated scope was Claude only. The August 11 release added Gemini/SynthID-Text and OpenAI's provenance surfaces to both layers, which is what made it newsworthy days after Anthropic's own watermarking rollout put the topic in front of a much wider audience than usual.

The 8 formats, and what each one loses

Notice what's missing from that table: image pixels. The tool's own scope notes explicitly place pixel-domain watermarks like SynthID's image variant out of scope — it can score for their presence, not remove them. That's a meaningfully different and harder engineering problem, the kind tackled by dedicated image-watermark tools using diffusion regeneration rather than metadata edits. Confusing the two — as some of the viral coverage did — makes this sound like a bigger bypass than it is.

Why this only half-defeats what Anthropic just shipped

Our post on detecting a Claude watermark laid out the two provenance layers Anthropic ships today: C2PA file metadata (verifiable now, with free tools) and an invisible text watermark (no public detector yet). watermarks-remover maps almost exactly onto that split — and the split explains why "removal" means two different things depending on which layer you're talking about.

Against C2PA metadata, this is a clean, complete removal. That was always true of C2PA generally — as we noted when covering Claude's invisible watermarks, metadata doesn't survive a re-save even without a dedicated tool. A script that strips it systematically across eight formats is a convenience, not a breakthrough.

Against the statistical text watermark, this is not removal at all — it's degradation. The tool doesn't locate and delete a signal, because there's nothing byte-level to delete; the mark is baked into word choice across the whole passage, the mechanism we detailed in how AI text watermarking actually works. Paraphrasing through a second model can dilute that signal, at the cost of the original wording, tone, and precision. The tool's own documentation is candid about the tradeoff: pushing a passage through a cheaper rewriting model to "clean" it raises the honest question of whether you should have just generated it with that cheaper model to begin with.

The line the author draws himself

The most useful part of this release isn't the feature list — it's the disclaimer. watermarks-remover's documentation states plainly: "Until vendors ship public detectors and keys, no tool can honestly certify 'this fails the official check.'"

That's the same structural gap we flagged in are AI watermarks monetisable? — Anthropic has said a detection API is coming but hasn't shipped one, Google keeps SynthID's keys private, and OpenAI hasn't confirmed a production text watermark at all. Without a public detector to test against, a removal tool is optimizing against a target it can't see. It can measure that it changed a lot of tokens. It cannot measure that a vendor's detector will return a negative result, because it doesn't have the vendor's key any more than you do.

The tool's stated intended use backs this up: it's pitched for privacy and research on content you generated, not for defeating detection to pass off AI writing as human-authored. Framing this as a definitive "AI marks: erased" undersells both how narrow the guaranteed part is and how murky the rest genuinely remains.

What this means for the watermarking story

Three things follow directly from this release, and none of them are "watermarking is dead":

• The metadata layer was never the hard part. C2PA stripping tools have existed for as long as C2PA has. Adding OpenAI and Gemini targeting to an existing tool is a scope expansion, not a new capability class.
• The statistical layer is still standing, structurally. No public detector exists to prove a bypass either way, for any vendor. That's the same uncertainty will every AI model watermark its output? flagged about the whole ecosystem — labs are converging on watermarking faster than they're publishing verification tooling.
• Open weights remain the actual structural exemption. As that same post argued, a watermark applied by the sampler only exists if you don't control the sampler. Paraphrase-to-evade is a workaround with quality costs; running an open-weight model with your own sampling pipeline never generates a mark to begin with.

The practical takeaway for developers: don't treat "a removal tool exists" as proof that provenance signals are worthless, and don't treat "vendors are watermarking" as proof that output is now traceable. Both claims currently outrun the evidence. What's verifiable is narrower and more boring than either extreme — C2PA metadata checks work today via free tools, and the token-level signal remains an open question on both the marking and the unmarking side until someone publishes a detector.

Related on explainx.ai

• Anthropic is watermarking Claude text — the rollout this tool responded to within days
• How to detect a Claude watermark — the same two-layer split (metadata vs. statistical), from the detection side
• How AI text watermarking actually works — why the statistical layer can't be "deleted," only diluted
• Will every AI model watermark its output? — the open-weight exemption this tool's paraphrase route imitates at a cost
• Are AI watermarks monetisable? — why no public detector exists yet, and what that gap is worth commercially
• The case FOR AI watermarks — the provenance argument this tool directly complicates
• LinkedIn's C2PA Content Credentials for AI images — a platform betting on the metadata layer this tool strips
• EU AI Act and US policy: complete regulation guide — the transparency obligations behind why labs are watermarking at all

Primary sources: watermarks-remover on GitHub (Guillaume Meyer, MIT license) · Guillaume Meyer on X, August 11, 2026, announcing OpenAI and Gemini support · Anthropic Help Center, "How Claude marks AI-generated content"

Accurate as of August 13, 2026. This post describes publicly documented tool capabilities and does not provide step-by-step instructions for evading detection or misrepresenting AI-generated content as human-authored. Format support, vendor targeting, and removal guarantees are as stated in the tool's own documentation at time of writing and may change with future releases. Follow @explainx_ai for updates.