On August 17, Anthropic's moat was trampled. Early that morning, a watermark-removal code repository exploded on GitHub, garnering 11,000 stars! It uses the MIT open-source license, can erase not only Claude's watermarks but also Google's SynthID-Text and OpenAI's invisible marks. More aggressively, it also cleans C2PA authentication data and EXIF metadata from images and PDF files. Only a week earlier, Anthropic had been showing off, publishing a lengthy official blog post detailing its proud "text watermark tracking technology." But a few days later, the boomerang came back. Developers cheered for this project. The watermarks defense of large models was thus crushed.
1.Anthropic's "Absolute Defense": The Invisible Magic of Probability Substitution
To understand the power of this open-source tool, we first need to see how Anthropic praised its own watermark technology in its official blog. According to Anthropic engineers, Claude's text watermark is "AI's most counterintuitive secret." In the past, adding watermarks to digital content meant either placing a semi-transparent logo on images or inserting invisible zero-width characters in text that are readable by machines but invisible to humans. These primitive methods could be easily deleted by anyone who knows some regex in seconds. But this time, Anthropic adopted Google's SynthID-Text scheme, a "statistical text watermark." The essence of LLM text generation is "word chaining." Each token output is a probabilistic choice. Anthropic's black technology: secretly swap the "dice." They replace the true random number with a hash value based on an official key and previous content. In their blog, they analogize: imagine playing Monopoly, where steps are normally determined by rolling dice. Now, the house secretly replaces the dice with a book of Pi. Each move follows digits of Pi. For players, each number is still "random," and text quality is unaffected. But the house can later check the step trajectory with the Pi book (the key) and instantly catch: "Hey, this text was generated by Claude!" Anthropic confidently claims: no extra token consumption, no hidden characters. Even if you don't rewrite word-for-word, with slight modifications, this statistical "Pi trajectory" remains, and the watermark can never be washed away. The open-source community's response: since you force us to rewrite, we'll use magic against magic!
2.The Higher the Devil, the Taller the Saint: The GitHub Tool's "Three-Layer Stripping"
Facing Anthropic's "absolute defense," the watermarks-remover project demonstrates impressive engineering elegance. It is not just a simple script, but a composite of "Agent Skill + standard Python service." It drives the underlying cleaning engine via HTTP, avoiding tedious local environment setup. To thoroughly erase the marks of the giants, the developer directly employs a "three-layer stripping" plus "image deep purification."
Layer A: Physically Stripping Invisible Magic. Although Anthropic claims not to use hidden characters, there are still many physical-layer marks in the wild. watermarks-remover's Layer A performs extremely deep text sanitation. It not only cleans regular invisible Unicode characters but also special whitespace, bidirectional text control characters, and any hidden characters that may carry payloads. Moreover, this operation is completely lossless.
Layer B: The Ultimate Killer against SynthID - Proxy Rewriting (Paraphrasing). Anthropic and Google's SynthID-Text hide watermarks in the statistical patterns of vocabulary distribution; how to break it? The author hits the nail on the head: "Removing statistical watermarks requires rewriting a large portion of the text — sentence by sentence, not paragraph by paragraph." Since manual rewriting is too laborious, let an Agent do it! The core logic of Layer B is to introduce a non-source model as the cleaning engine. For example, to remove Claude watermarks, the system calls local Ollama to run Llama 3 or calls other APIs. It uses specific prompts to paraphrase and back-translate the text extensively while preserving original meaning and terminology as much as possible. Since Claude uses Pi to move, Layer B directly overturns the board and lets Llama 3's probability distribution re-determine the moves. This thoroughly destroys the original text's statistical characteristics, blinding Anthropic's key. Of course, the author admits this causes some degradation in text quality.
Layer C: Metadata Purge. Additionally, Anthropic adds C2PA authentication data to generated images (PNG/JPEG/SVG) and files (PDF/DOCX/HTML). Layer C shows strong "bomb disposal" capabilities. It supports almost all mainstream formats, precisely locates C2PA, EXIF, XMP, and document properties in DOCX/PDF, and strips them directly. Notably, its defensive design: older versions would corrupt files if images were mistakenly processed as text. In the current update, the system automatically detects file type via extension and Magic Bytes; text tools will reject binary input, making it very elegant.
3.Even More Hardcore: Image Pixel-Level Washing and MarkLLM Verification Mechanism
If you think this project only cleans text and file attributes, you underestimate its 11,000-star value. It also achieves extreme sophistication in pixel-level image dehydration and scientific validation. First, it violently reconstructs pixel-level image watermarks. Watermarks like Google's SynthID-media, StegaStamp, and Tree-Ring embed signals directly into the pixel frequency domain; cleaning EXIF is useless. Therefore, the project integrates an extremely hardcore external backend: CtrlRegen engine, which uses the latest ICLR 2025 technology, combining ControlNet and DINOv2 IP-Adapter. In short, it does not paint over the original image but "controlledly regenerates" a highly similar image. For images larger than 512x512, it automatically performs overlapping tiling, processing, and smooth stitching. This is equivalent to demolishing the watermarked building and rebuilding it on the same blueprint, making the watermark vanish. MarkDiffusion verification and purification: it embeds a blind regeneration attack against diffusion models to clean pixel watermarks. Moreover, the process doesn't rely on guessing; it uses MarkLLM for "scientific targeted validation." The most admirable point: it doesn't just say "I deleted it" based on feeling; it introduces the open-source framework MarkLLM and MarkDiffusion led by Tsinghua University as a validation harness. This is extremely geeky. It performs a "left-hand-right-hand combat" locally: first, watermark a text using the KGW mechanism, then clean it with Layer B, and finally use MarkLLM to attempt detection. Only when the detector reports "watermark not found" is the cleaning loop closed!
4.Claude Refuses to Delete, But Chinese Large Models Do It Instantly
Interestingly, practice produced a funny incident. Some netizens tried to have Claude itself run the project's plugin to remove their marks, but Claude outright refused. No matter how much they pleaded, "This is my own content, I own the copyright, I just don't want these watermarks," Claude remained cold and unyielding. Anthropic clearly wrote restrictions into the underlying protocol, prohibiting its own AI from helping users remove these "regulatory marks." As a result, irritated users turned around and installed the plugin on other Chinese large models. It installed instantly and thoroughly removed the watermarks.
5.Why Do We Resent "Cyber Branding" So Much?
Why has this project become so popular? Because it hits a global pain point: forced "cyber branding." Behind these 11,000+ stars lies a collective backlash from developers worldwide against the arrogance of big corporations. The trigger: Anthropic's attempt to appease the EU and comply with the strict EU AI Act. The EU mandates that if you provide AI services in the EU, you must make it possible to detect whether content is AI-generated. Originally, this was just EU regulation. But Anthropic handled it crudely: since it cannot precisely distinguish who is in Europe, it slaps watermarks on all global users! Even paying users have no option to turn this off. Netizens erupted: "Why should billions of people worldwide pay for the EU's regulatory anxiety?" Using a tool does not make the tool the creator of the work. Looking back at history, human thought has always needed a "second pair of hands" to put ideas on paper. Einstein had assistants, Darwin had recorders, but these typists and scribes never left watermarks. Today, AI is just a super typewriter that has mastered vast language resources. Many people spend dozens of hours reading and conceiving, and only ask Claude to polish it at the end. Yet Anthropic claims that if AI participates even a little, the "purity" of the work is contaminated. The process of humans using tools has been completely inverted to: humans must prove to the tool that "I am the real author." Currently, this cat-and-mouse game is far from over. The author of watermarks-remover also admits that until manufacturers release official detectors and keys, all removal methods can only be best-effort. But that's the charm of open-source community — not blindly following giants, but defending control with code.
