Table of Contents
One Tool to Undo What the AI Industry Built
AI watermark removal has moved beyond the familiar trick of painting over a logo in the corner of an image. A GitHub project called remove-ai-watermarks, which has surfaced on Hacker News, presents itself as a full CLI tool and Python library for stripping visible marks, invisible watermarks, and provenance metadata from AI-generated images. It targets material generated by Google Gemini, OpenAI’s DALL-E, Stable Diffusion, Adobe Firefly, and Midjourney, while describing coverage across six major AI image platforms.
That breadth matters more than the project’s individual techniques. The AI industry has spent the past several years building an overlapping set of signals intended to answer a basic question: where did this image come from? Some are visible to anyone looking at the picture. Some are embedded in the file’s metadata. Others are designed to remain detectable after ordinary edits such as cropping or JPEG compression. remove-ai-watermarks goes after all three categories.
The project targets six watermarking and provenance systems in one pipeline: Google’s SynthID, StableSignature, TreeRing invisible watermarks, C2PA Content Credentials, EXIF and XMP metadata fields, and the visible sparkle logo that Gemini overlays on generated images. It also handles the metadata layers that trigger “Made with AI” labels on Instagram, Facebook, and X.
This is not merely a dispute over whether an image carries an unattractive badge. Watermarks and provenance records are often presented as a practical middle ground in the fight over synthetic media: not a perfect guarantee of truth, but at least a clue that platforms, publishers, and viewers can inspect. A tool built to remove those clues exposes the limit of that approach. If the signal travels with an ordinary image file and can be altered by a person who possesses that file, it should be understood as useful provenance information rather than an unbreakable chain of custody.
How AI Watermark Removal Actually Works Here
The project splits the job into two tracks, because visible and invisible marks create very different technical problems. The visible approach is closer to image compositing. The invisible approach concerns signals designed to live inside image data rather than on top of it. Metadata removal is different again: it does not restore pixels or alter an embedded pattern, but removes descriptive information attached to the image.
For visible watermarks, currently only used by Google Gemini, which the project notes is internally codenamed “Nano Banana,” the tool uses reverse alpha blending. Gemini composites its sparkle logo onto generated images using a standard alpha channel formula: watermarked = α × logo + (1 − α) × original.
In plain terms, alpha blending combines the logo with the underlying image at a defined transparency. If the logo and its alpha map can be known, the compositing operation can be worked backwards. The project says the alpha map is deterministic and extractable by running Gemini on a pure-black background. Its reverse formula is: original = (watermarked − α × logo) / (1 − α).
That is a more consequential claim than “the tool can erase a logo.” Blurring or inpainting a visible mark typically leaves some trade-off behind: softened detail, altered texture, or a patch that can look suspicious under close inspection. Reverse compositing aims at recovering the underlying pixel values rather than covering the watermark with new pixels. The project uses a three-stage Normalized Cross-Correlation detector to locate the watermark position and scale dynamically, allowing it to work even if an image has been resized or cropped.
The stated performance is roughly 0.05 seconds per image. It requires no GPU and runs entirely offline. Those details change the practical stakes. A slow, cloud-dependent process is an inconvenience used by a small number of technically determined people. A fast local process can become a routine step in an image workflow, especially when the result is intended for reposting or redistribution.
Invisible marks face a different kind of pressure
Invisible watermarks are a harder problem. Systems like SynthID, StableSignature, and TreeRing are intended to survive the kinds of transformations that commonly happen after an image leaves a generator: a crop, a resize, a re-encoded JPEG, or a trip through a social platform. That persistence is their reason for existing. A visible logo can be cut away. Metadata can be discarded when a file is exported. An invisible pattern is supposed to remain available for later detection even when the image looks unchanged to a human viewer.
The project’s stated scope is notable because it treats such watermarking systems as part of the same removal pipeline as obvious overlays and ordinary metadata. That does not mean every provenance system has identical goals or identical technical assumptions. It does mean that, from the perspective of someone trying to erase the origin signal, the distinction may not matter much. The task is to identify every place an image says it was generated by AI, then remove or weaken those signals before the file is shared.
C2PA Content Credentials deserve particular attention in that picture. They are not the same thing as an invisible watermark: they are a provenance framework associated with the file and its history rather than a hidden visual pattern. EXIF and XMP fields serve a related purpose at a more familiar level, carrying information that software and platforms can read. The project’s ability to strip C2PA manifests, EXIF, and XMP metadata goes directly to the labels seen on Instagram, Facebook, and X. When those labels depend on information still attached to a file, they are only as durable as that information.
Why the “Made with AI” label is not enough
Platforms have good reasons to label AI-made material. A label can provide context without banning an image, and it gives viewers a chance to evaluate a post with more care. But provenance labels are not the same as content verification. Their absence does not establish that an image is authentic, human-made, or untouched. It may simply mean the relevant metadata was never there, was lost during normal editing, or was removed deliberately.
That distinction has always been central to the content-authenticity debate, and tools such as remove-ai-watermarks make it harder to ignore. The danger is not that every unlabeled image will be deceptive. The danger is that a label system can be mistaken for a reliable dividing line between trustworthy and untrustworthy material. Once removal becomes accessible, the signal is most useful for identifying cooperative sources and much less useful for catching actors who want to obscure an image’s origins.
The project also includes an optional Analog Humanizer, which injects film grain and chromatic aberration to fool AI image classifiers entirely. That feature points to a second, separate problem. Watermarks and metadata are intentional disclosures. AI classifiers attempt to infer an image’s origin from its visual characteristics. If a workflow can remove the intentional signals and then modify the image to evade inference, platforms lose two distinct ways of identifying synthetic content.
None of this makes provenance work pointless. It does make the marketing around it sound thinner. Watermarks, Content Credentials, metadata, and platform labels can still help preserve information when creators and tools choose to retain it. They can still support disclosure and establish a record in cooperative publishing environments. What they cannot reliably do is compel disclosure from somebody who has both the file and an incentive to hide its source.
That is the uncomfortable lesson in this project’s design. The current AI content-authentication ecosystem has built several layers because no single layer was expected to solve the problem alone. A single pipeline aimed at visible sparkle overlays, invisible frequency-domain patterns that survive cropping and JPEG compression, and metadata-based labels shows why those layers need to be judged together. If they can be stripped together, authenticity will depend less on a mark embedded in a file and more on the institutions, platforms, and publication practices surrounding it.
