Remove-AI-Watermarks: A CLI and Library for Stripping Provenance from AI-Generated Images

A new open-source tool, remove-ai-watermarks, targets the growing ecosystem of AI watermarks—both visible and invisible—embedded in images from models like Google Gemini, DALL-E, Stable Diffusion, Adobe Firefly, and Midjourney. It strips SynthID, C2PA Content Credentials, EXIF/XMP metadata, and even the Gemini sparkle logo, all in one command.

How It Works

The tool employs three distinct techniques:

  1. Visible Watermark Removal (Gemini/Nano Banana sparkle): Google Gemini applies a sparkle logo via alpha blending: watermarked = α × logo + (1 − α) × original. The tool reverses this using a known alpha map extracted from Gemini output on a black background: original = (watermarked − α × logo) / (1 − α). A three-stage Normalized Cross-Correlation (NCC) detector locates the watermark position and scale, even if the image was resized or cropped. Residual artifacts are cleaned via gradient-masked inpainting. Speed: ~0.05s per image on CPU.

  2. Invisible Watermark Removal (SynthID, StableSignature, TreeRing): These imperceptible frequency-domain patterns survive cropping, resizing, and JPEG compression. The removal pipeline (default SDXL, May 2026) resizes to ~1024px, encodes to latent space via VAE, adds controlled noise (forward diffusion), denoises (~50 steps at strength 0.05), decodes back to pixels, and upscales. The SDXL profile was chosen because SD-1.5 at 768px failed against SynthID v2 on Gemini 3 Pro outputs. GPU recommended (CUDA/MPS); CPU works but is slow.

  3. Metadata Stripping (C2PA, EXIF, XMP, PNG chunks): The tool parses each metadata layer, removes AI-related fields (e.g., trainedAlgorithmicMedia in XMP, C2PA manifests, EXIF tags with prompt/seed/model hash), and preserves standard fields like Author and Copyright. PNG/JPEG are fully covered; AVIF/HEIF/JPEG-XL have limited support for EXIF/XMP inside containers.

Installation and Usage

Install via pipx or uv as an isolated CLI tool:

pipx install git+https://github.com/wiltodelta/remove-ai-watermarks.git

For invisible watermark removal, install GPU dependencies:

pip install -e ".[gpu]"

Basic usage:

# Remove all watermarks from a single image
remove-ai-watermarks all image.png -o clean.png

# Process an entire directory
remove-ai-watermarks batch ./images/ --mode all

# Visible only (fast, offline)
remove-ai-watermarks visible image.png -o clean.png

# Invisible only (requires GPU)
remove-ai-watermarks invisible image.png -o clean.png --humanize 4.0

Check or strip metadata

remove-ai-watermarks metadata image.png --check remove-ai-watermarks metadata image.png --remove


Python API example:
```python
from remove_ai_watermarks.gemini_engine import GeminiEngine
import cv2

engine = GeminiEngine()
image = cv2.imread("watermarked.png")
result = engine.detect_watermark(image)
print(f"Detected: {result.detected} (confidence: {result.confidence:.1%})")
clean = engine.remove_watermark(image)
cv2.imwrite("clean.png", clean)

Supported Models and Watermarks

The tool explicitly supports:

AI ModelVisible WatermarkInvisible WatermarkMetadata
Google Gemini / Nano Banana / Gemini 3 Pro✅ Sparkle logo✅ SynthID v1+v2 (SDXL native)✅ C2PA + EXIF
OpenAI DALL-E 3 / ChatGPT——✅ C2PA manifest
OpenAI ChatGPT Images 2.0 (gpt-image-2)—⚠️ imperceptible pixel watermark (no public detector)✅ C2PA manifest
Stable Diffusion (AUTOMATIC1111, ComfyUI)—✅ DWT / steganographic✅ PNG text chunks
Adobe Firefly——✅ Content Credentials (C2PA)
Midjourney——✅ EXIF + XMP (prompt, model, seed)
StableSignature (Meta)—✅ In-model watermark—
TreeRing—✅ Latent space watermark—

Legal and Ethical Considerations

The README includes a legal disclaimer noting that watermark removal is regulated in several jurisdictions. The EU AI Act Article 50(2) marking obligations are postponed to December 2, 2026. The US COPIED Act (enacted 2025) criminalizes removal of provenance information with intent to deceive. The tool itself is lawful, but usage may not be. The developers explicitly state they will not implement removal of defensive perturbations like Nightshade or Glaze, as those protect artists' work from being scraped into AI training sets.

Threat Model

The tool defends already-distributed AI imagery against automatic detection systems (social platform labels, classifiers). It does not retroactively anonymize generation: SynthID-Image v2 embeds a 136-bit payload (arxiv 2510.09263) believed to encode a user/session identifier. If the original file ever passed through a Google-controlled system, Google retains server-side records. The tool strips the watermark from a copy you possess but cannot erase Google's logs.

Why It Matters

As AI-generated images proliferate, platforms increasingly label them with "Made with AI" tags or invisible fingerprints. This tool gives developers a way to strip those markers—useful for legitimate use cases like publishing your own generated work, running security evaluations, or preserving art against false-positive AI detection. However, it also raises ethical and legal red flags: using it to deceive about content origin may violate laws like the COPIED Act.

Next Steps

If you're evaluating AI watermark robustness, try the tool on your own generated images. For production use, review the legal landscape in your jurisdiction. The project is actively maintained—watch for video pipeline support and improved AVIF/HEIF metadata handling.