An open-source tool for removing AI watermarks and provenance metadata has passed 4,908 stars on GitHub and shipped version 0.27.0 on August 18. Its maintainer describes it plainly in the repository's own summary line: "Remove visible and invisible AI watermarks and provenance metadata from images and video. Python library and CLI for SynthID, C2PA, EXIF, IPTC, XMP, and common generative-AI marks." Provenance, the policy world's preferred answer to synthetic media, now has a maintained adversary with a release cadence.
Key facts
- The remove-ai-watermarks project stands at 4,908 GitHub stars, with its most recent push on August 18, 2026.
- Version 0.27.0 shipped the same day, adding C2PA credential validation before reporting attribution.
- It names SynthID, C2PA, EXIF, IPTC and XMP as targets, and added detection for QuickTime TC260 placements, Luma AI tags and MiniMax video provenance.
- Primary source: the project's own GitHub repository and release notes.
Governments and standards bodies have converged on a single answer to the question of whether a machine made a given image: attach a signed record saying so. The C2PA specification defines that record, Google's SynthID hides a statistical signal in the pixels, and the EU has set dates. We have covered Claude watermarking plain text with an EU deadline attached and how lightly that watermark touches the code Claude writes.
This repository is what that policy looks like from the other side, and its most interesting property is that it is honest about its own limits.
The tool is not one button. For images, a metadata mode removes AI metadata only; an invisible mode regenerates the image to disrupt pixel and frequency watermarks; and an all mode combines visible, invisible and metadata removal. For video, the default all path removes visible marks and verified AI metadata, but invisible-video removal is explicitly opt-in behind a separate flag. When no local invisible signal is detected, the tool reports "Skipped (no invisible AI watermark detected; pixels left intact)" rather than claiming the file is clean. The documentation states that proprietary pixel watermarks may remain after metadata has been stripped, and that the diffusion-based invisible path cannot guarantee a proprietary verifier will reject its output.
That distinction is the whole story, and it is worth stating in plain terms. Metadata provenance is like a shipping label on a parcel: informative, cryptographically signed, and removable by anyone with a pair of scissors. An invisible watermark is more like a dye woven through the fabric inside: harder to see, much harder to remove, and impossible to remove without damaging the fabric. This tool cuts labels reliably and bleaches fabric unreliably.
The August 18 release makes the asymmetry sharper rather than softer. Version 0.27.0 added "verified text restoration that reconstructs detected watermark text before removal" and "validated C2PA credentials before reporting attribution, rejecting invalid or untrusted manifests." It also vectorized the decode path for a 15x speedup on the decoder, halved decoder memory, and documented that the invisible video path leaves audio untouched. The release notes even disclose a known dependency vulnerability in an optional extra, noting that the default installation does not include it and that the vulnerable code path is unreachable through the package. This is the changelog of a maintained security tool, not a script kiddie's dump.
Why it matters: any policy that assumes a C2PA manifest survives an ordinary trip through the internet is assuming something this repository disproves in one command. The durable question is whether the invisible layer holds, and there the answer is genuinely uncertain rather than settled. C2PA's own specification allows a durable content credential to be discovered through soft bindings such as a fingerprint or invisible watermark, precisely so provenance can live in the content rather than beside it. Whether that survives a determined diffusion pass is an empirical question nobody has fully answered.
The honest caveat comes from the project's own issue tracker. Issue #84, opened on August 18, reports that forcing the full pipeline of visible repair, invisible diffusion and metadata cleanup distorts text, tables and user-interface screenshots. Stripping provenance costs you fidelity. For an image meant to deceive, that cost may be acceptable; for the screenshot of a document, it is not. There is a real, if small, defensive implication in that: heavily laundered images may carry their own detectable damage.
Our lesson on content provenance and watermarking covers the underlying tradeoff, and jailbreaking and red teaming covers the broader pattern of published attack tooling forcing defenders to state what their systems actually guarantee.
Originally published on Ground Truth, where every claim is checked against the primary source.
