Claude Text Watermarking Meets an Open-Source Removal Tool: What the GitHub Project Actually Shows

Introduction

Anthropic had barely finished explaining how Claude's new text watermark works when an open-source repository focused on removing AI provenance signals started surging on GitHub.

The project, guillaumemeyer/watermarks-remover, describes itself as an agent skill plus Python service for stripping several classes of AI provenance marks from text and files that users own. At the time captured by the source article, the repository had already passed roughly 11,000 GitHub stars, turning a fairly technical provenance topic into a much broader debate about AI-generated content, user control, and the durability of watermarking systems.

The source article presents the project as proof that Claude's watermark was effectively broken overnight. That headline is more dramatic than the available evidence supports.

A more accurate conclusion is this: different provenance systems fail in different ways, and no single marking method is guaranteed to survive every transformation. Anthropic itself says watermark detection has limits, Google describes SynthID as robust rather than invulnerable, OpenAI explicitly warns that provenance signals can sometimes be stripped, and C2PA is designed as a provenance standard rather than an indestructible DRM layer.

The GitHub project is therefore interesting not because it proves all AI watermarking is useless, but because it demonstrates how quickly open-source researchers can test the assumptions behind several provenance layers.

Why the Project Went Viral

The repository appeared at exactly the right moment.

On August 14, 2026, Anthropic published a detailed explanation of the text watermark it plans to use in future Claude models. Four days later, the BAAI-syndicated article highlighted watermarks-remover as a rapidly growing counterexample from the open-source community.

The repository's own documentation says it targets several different classes of provenance signals rather than one universal "Claude watermark."

Its coverage matrix separates them into broad categories:

• Invisible or unusual Unicode and text-formatting marks
• Statistical token-sampling watermarks
• C2PA, EXIF, XMP, and document metadata
• Some image-level watermarking approaches through external research backends

That distinction matters because these mechanisms operate at completely different layers.

Removing metadata from a file is not the same problem as weakening a statistical text watermark. Likewise, changing image pixels is fundamentally different from deleting an invisible Unicode character.

The project is licensed under the MIT License, and its README explicitly frames the tool around privacy and hygiene for content the user owns.

Anthropic's Watermark Is Not a Hidden Character Trick

To understand why the repository drew so much attention, it helps to understand what Anthropic actually announced.

Claude's text watermark is not simply a hidden string, zero-width character, or secret tag pasted into the output.

Anthropic says its watermark is based on SynthID-Text, a statistical watermarking approach introduced by Google DeepMind and published in Nature in 2024.

Large Language Models Already Choose From Probabilities

A language model generates text token by token.

At each step, it assigns probabilities to possible next tokens. One token may be highly likely, several others may be plausible, and many may be unlikely.

A normal generation process then uses randomness to choose among those possibilities.

A statistical watermark modifies the source of that randomness in a controlled way. The wording remains natural to the reader, but the sequence of token choices can contain a statistical pattern that a detector with the appropriate secret key can recognize.

Google DeepMind describes SynthID-Text in similar terms: it adjusts token probability scores during generation so that a detectable signal is embedded without adding visible characters.

Anthropic's "Pi Instead of Dice" Analogy

Anthropic uses an analogy involving a board game.

Imagine that players normally roll dice to determine movement. Instead of truly random dice rolls, the game secretly uses digits from a known sequence such as pi.

To players, the movement can still look random. But someone who knows the sequence can later examine the pattern and estimate whether that source of randomness was used.

Claude's watermark follows the same general idea: it changes the statistical process behind token selection rather than inserting a visible label into the text.

What the Watermark Can and Cannot Prove

Anthropic is careful about the detector's meaning.

A watermark detector is intended to estimate the likelihood that Claude contributed to a passage. It does not prove that a human did or did not write the text, and it cannot automatically identify text produced by every other AI system.

Detection also becomes less reliable on short passages and on highly constrained factual text where the model has fewer reasonable word choices.

Proofreading is another weak case. If Claude only changes punctuation or a handful of words, there may not be enough model-selected text for a statistical watermark to be detectable.

Those caveats are important because the source article describes the system as nearly absolute. Anthropic's own documentation does not make that claim.

How the Open-Source Project Classifies the Problem

The repository organizes provenance-removal research into layers.

This article keeps that architecture because it is useful for understanding the technical debate, but it does not provide operational instructions for defeating provenance systems. The important part is the distinction between the mechanisms.

Layer 1: Invisible Text Hygiene

The simplest class of marks is also the easiest to understand.

Text can contain characters that are invisible or visually ambiguous, including unusual spaces, bidirectional controls, tag characters, or other Unicode formatting symbols.

The repository describes a deterministic text-hygiene layer that detects and normalizes these kinds of characters.

This is very different from Claude's new SynthID-style statistical watermark.

Anthropic specifically says its watermark does not rely on hidden characters, so cleaning Unicode alone would not be expected to defeat the statistical signal Anthropic describes.

That is one reason the repository treats Unicode cleanup and statistical watermarking as separate layers.

Layer 2: Statistical Watermarks Are a Rewriting Problem

Statistical text watermarks are harder because the signal lives in token-choice patterns rather than file metadata or hidden characters.

The repository's documentation describes large-scale rewriting or paraphrasing as the relevant attack class. The high-level principle is straightforward: if enough token choices are regenerated under a different model or sampling process, the original statistical pattern may weaken.

This is not a surprising property of statistical watermarking research. Watermark robustness is commonly evaluated against transformations such as paraphrasing, translation, editing, and regeneration.

The trade-off is equally important: stronger rewriting can also change meaning, terminology, style, factual precision, or authorship signals.

The source article briefly acknowledges this degradation risk, and it is one of the main reasons a successful detector-evasion experiment should not automatically be treated as a lossless transformation.

Why "Watermark Removed" Is Hard to Prove

Anthropic has not yet released its public Claude watermark detection API. The company says that detector access is coming later.

That means outside projects cannot currently perform an authoritative end-to-end test against Anthropic's production key and detector.

The watermarks-remover project itself uses "best effort" language in several places for statistical watermark classes. That wording is more technically responsible than claiming guaranteed removal.

Until official detectors and reproducible evaluation conditions are available, any claim that Claude's watermark has been "completely erased" should be treated cautiously.

Layer 3: C2PA and File Metadata

A separate part of the repository deals with file-level provenance data.

This includes metadata associated with formats such as images and documents, including C2PA Content Credentials, EXIF, XMP, and document properties.

C2PA is an open standard for recording the provenance and history of digital assets. It can carry signed information about where content came from, which tools handled it, and how it changed over time.

The important distinction is that C2PA metadata is not the same thing as an embedded statistical watermark.

OpenAI's current provenance documentation makes the same distinction. Supported OpenAI-generated images can carry both C2PA Content Credentials and SynthID watermarks. OpenAI says metadata can be lost or stripped through editing, conversion, sharing, or screenshots, while an embedded watermark may survive some of those transformations.

That is why modern provenance systems increasingly combine multiple signals instead of relying on metadata alone.

C2PA Is Provenance, Not DRM

The C2PA specification is designed to record verifiable provenance information.

It is not designed as an unremovable digital-rights-management system.

The C2PA explainer explicitly describes Content Credentials as working alongside standard metadata formats such as XMP and EXIF. A file can be transformed in a way that loses metadata; the ecosystem then relies on validation, durable bindings, watermarking, or other complementary signals to improve resilience.

So a tool that removes metadata demonstrates a known limitation of metadata-based provenance. It does not, by itself, invalidate the broader C2PA model.

Image-Level Watermarks Are a Different Research Area Again

The source article then moves from text and metadata to image watermarking.

That is another distinct problem.

Google's SynthID for images embeds an imperceptible signal directly into generated image content. Google says the watermark is designed to remain detectable after common changes such as cropping, filtering, frame-rate changes, and lossy compression.

The open-source repository points to external research systems that study regeneration-based attacks and evaluation of latent or pixel-level watermarks.

The project also references MarkDiffusion, an open-source toolkit for generative watermarking research in latent diffusion models.

MarkDiffusion is not itself simply a "watermark remover." Its stated purpose is broader: implementing, visualizing, and evaluating generative watermarking algorithms, including their detectability, robustness, and output quality.

This is a useful reminder that watermarking research has always included both sides of the problem:

Embed a provenance signal
↓
Apply edits or transformations
↓
Test whether the signal survives
↓
Measure quality and detectability
↓
Improve the watermark

A robust watermark is meaningful only if it is tested against realistic transformations.

MarkLLM Provides a Research Harness for Text Watermarks

The repository also references MarkLLM, an open-source toolkit developed by researchers at Tsinghua University and collaborators for implementing and evaluating LLM watermarking methods.

MarkLLM supports multiple families of text-watermarking algorithms, including KGW, SynthID-Text, Unigram, SWEET, SIR, and others.

Its role is important because it gives researchers a common environment for asking questions such as:

• How detectable is a watermark?
• How much does it affect text quality?
• How does it behave after editing or paraphrasing?
• How robust is it across languages?
• How do different watermark algorithms compare?

That research context is more useful than the simplistic framing of "watermark versus watermark remover."

The real technical problem is a continuous trade-off among detectability, robustness, quality, privacy, interoperability, and false-positive risk.

The Project's Coverage Is Broad, but Not Universal

The GitHub coverage matrix is ambitious, but it also includes explicit limits.

Some mechanisms are listed as best-effort. Some image methods rely on external backends. Some classes of marks are out of scope. And different vendors expose different provenance systems across different products and modalities.

This is especially important for claims about OpenAI.

The repository lists OpenAI-related provenance surfaces in its vendor coverage, but that should not be read as proof that OpenAI currently uses one universal invisible statistical watermark in all generated text.

OpenAI's official 2026 documentation says supported images use C2PA metadata plus SynthID, while supported audio uses SynthID. OpenAI has also said it is expanding provenance work across modalities, including text, but coverage varies by product, model, export path, file type, and date.

So "removes OpenAI's hidden mark" is too broad without specifying the content type and provenance mechanism.

Why Claude May Refuse to Help Remove Provenance Signals

The source article includes screenshots from users who reportedly tried to get Claude to operate the removal tool and were refused.

That behavior is consistent with a safety policy distinction many AI providers make between analyzing provenance systems and directly helping users defeat them.

A user can have legitimate reasons to inspect metadata or privacy-sensitive fields in files they own. At the same time, provenance signals can be important for authenticity, fraud prevention, platform transparency, and compliance.

For that reason, the safest use of projects like this is research, interoperability testing, privacy review, or controlled evaluation on content you own—not disguising synthetic content as independently human-created or bypassing disclosure requirements.

The source goes further and claims other models installed the project without objection. Those anecdotes are user-reported behavior, not a reliable cross-model policy benchmark, so they should not be generalized into a claim that one country's models "allow" watermark removal while another company's models do not.

Why Anthropic Is Adding the Watermark Globally

The policy context is the EU AI Act.

Article 50 requires providers of systems that generate synthetic audio, image, video, or text to make those outputs machine-readable and detectable as artificially generated or manipulated, subject to the law's detailed scope and exceptions.

The Article 50 transparency obligations became applicable on August 2, 2026.

The European Commission also published a voluntary Code of Practice on transparency of AI-generated content to help providers and deployers demonstrate compliance.

Anthropic says it signed the Code and is implementing text watermarking as part of that compliance work.

Why Users Outside Europe Are Seeing the Same System

This part of the source article is substantially correct, although its wording is confrontational.

Anthropic's own August 14 post says it is applying watermarking globally at launch because it does not yet have a durable way to scope the system by region.

Anthropic also says it will continue evaluating other approaches.

So the global rollout is not an inference from user behavior; it is something Anthropic has stated directly.

The EU Rule Is Broader Than "Put a Watermark on Everything"

The source simplifies the AI Act into a one-line requirement.

The actual legal framework is more nuanced.

Article 50 establishes transparency obligations for providers and deployers of certain AI systems. The European Commission's 2026 guidance explains that providers must add machine-readable marks that enable detection of AI-generated or manipulated content, while deployers have separate labeling obligations for cases such as deepfakes and certain AI-generated publications.

The Code of Practice is voluntary. The underlying Article 50 obligations are not.

This distinction matters when discussing why companies such as Anthropic, Google, and OpenAI are investing in provenance systems.

The Debate Is Really About Authorship, Provenance, and User Control

The final section of the source article argues that users dislike what it calls a "cyber brand" attached to their work.

There is a real tension here, but it is more complicated than either side's strongest rhetoric.

A person may spend hours researching, outlining, and writing a document, then use an AI model only for editing. Anthropic itself acknowledges this case and says light proofreading may leave too little model-generated text for its watermark to register strongly.

That nuance matters.

Using AI does not automatically settle questions of authorship, ownership, or creative contribution. Provenance signals answer a narrower question: was a particular tool likely involved in generating or modifying this content?

They do not determine whether the work is accurate, original, legal, ethical, human-led, or professionally valuable.

OpenAI makes the same point in its verification documentation: detecting a provenance signal can indicate that a supported OpenAI tool produced or exported a file, but it does not establish truthfulness, ownership, or context.

Watermarking and Removal Will Remain a Cat-and-Mouse Problem

The source ends with a point that is more defensible than its headline: this is not a finished contest.

Anthropic has not yet released its public text-watermark detector. The GitHub project therefore cannot conclusively demonstrate removal against Anthropic's production detector and secret key.

Likewise, watermarking systems will continue to change as researchers learn which transformations weaken them.

The likely future is not one perfect watermark.

It is a layered provenance stack:

A mature system will probably combine several of these rather than trust any one technique.

What Is Confirmed and What Is Still a Claim

Confirmed by Anthropic

• Future Claude models will use a text watermark based on SynthID-Text.
• The watermark changes the statistical source of randomness used during token generation rather than inserting hidden characters.
• Detection is less reliable on short samples and lightly edited or factual passages.
• Anthropic plans to provide a watermark detection API.
• Anthropic is applying the system globally at launch because it cannot yet reliably scope it by region.
• The rollout is connected to compliance with the EU AI Act and the transparency Code of Practice.

Confirmed by the GitHub Repository

• watermarks-remover is MIT-licensed.
• The repository targets several classes of AI provenance signals rather than one single watermark.
• Its documentation separates Unicode cleanup, statistical watermark transformations, file metadata, and image-level research backends.
• Statistical-watermark handling is described in several places as best effort rather than guaranteed.
• The project's stated use case is privacy and hygiene on content the user owns.

Confirmed by Google DeepMind

• SynthID can watermark AI-generated text, images, audio, and video.
• SynthID-Text changes token probability scores during generation.
• Image and media watermarks are designed to survive a range of common transformations, but Google does not claim absolute indestructibility.

Confirmed by OpenAI

• Supported OpenAI-generated images can include both C2PA Content Credentials and SynthID watermarks.
• Supported OpenAI-generated audio can include SynthID.
• OpenAI explicitly notes that metadata can be stripped and that no single provenance technique is foolproof.

Claims That Need Caution

• That Claude's watermark has been "completely broken" before Anthropic's production detector is publicly testable.
• That the project guarantees removal of every SynthID or statistical watermark.
• That OpenAI uses one universal invisible text watermark across all products.
• That every model provider has the same policy on provenance removal.
• That an undetected watermark proves a piece of content was human-written.

常见问题

What is Claude's new text watermark?

Claude's text watermark is a statistical watermark based on Google DeepMind's SynthID-Text approach. It changes token-selection probabilities during generation so a detector with the relevant key can estimate whether Claude likely contributed to a passage.

Does Claude's watermark use invisible Unicode characters?

No. Anthropic says the new watermark does not depend on hidden characters. Invisible Unicode cleanup is a separate category of text hygiene and does not, by itself, address a SynthID-style statistical signal.

Has the open-source project definitely broken Claude's watermark?

Not conclusively. Anthropic has not yet released its public detection API, so independent projects cannot fully validate their results against the production detector and secret key. The repository itself uses best-effort language for statistical watermark classes.

What is the difference between SynthID and C2PA?

SynthID embeds a watermark signal into generated content, while C2PA Content Credentials attach signed provenance information and editing history to digital assets. They are complementary: metadata can carry richer context, while embedded watermarks may survive transformations that remove metadata.

Can C2PA metadata be removed from a file?

Metadata can be lost through editing, conversion, exporting, sharing platforms, or deliberate stripping. That is a known limitation, which is why provenance systems increasingly combine Content Credentials with embedded watermarks and verification services.

Why is Anthropic applying Claude watermarking outside the EU?

Anthropic says it is rolling the watermark out globally because it does not yet have a durable way to limit the system by region. The company says it will continue evaluating other approaches.

Does the EU AI Act require AI-generated content to be detectable?

Article 50 requires providers of certain generative AI systems to ensure relevant synthetic outputs are marked in a machine-readable form and detectable as artificially generated or manipulated. The transparency obligations became applicable on August 2, 2026, with detailed guidance and a voluntary Code of Practice supporting compliance.

Does a missing watermark prove that content is human-written?

No. Anthropic, Google, and OpenAI all describe provenance detection as probabilistic or signal-based rather than proof of human authorship. A signal can be absent because of unsupported formats, short samples, transformations, or other limitations.

相关工具

• Anthropic Claude Text Watermark: Anthropic's official explanation of its SynthID-Text-based watermark, limitations, and global rollout.
• Google DeepMind SynthID: Google's official overview of watermarking and detection for AI-generated text, image, audio, and video.
• C2PA: The official standards organization for Content Credentials and interoperable media provenance.
• MarkLLM: An open-source research toolkit for implementing and evaluating LLM watermarking algorithms.
• MarkDiffusion: An open-source research toolkit for generative watermarking in latent diffusion models.
• watermarks-remover: The MIT-licensed repository discussed in the source article; its own documentation frames usage around content the user owns.

Related Links

• Anthropic: How Claude's Text Watermark Works: Primary source for Claude's watermark design, detection limitations, EU compliance rationale, and global rollout.
• Google DeepMind: SynthID: Primary source describing how SynthID marks text and other media.
• EU Code of Practice on Transparency of AI-Generated Content: European Commission guidance supporting compliance with Article 50 transparency obligations.
• EU AI Act, Regulation (EU) 2024/1689: Official legal text containing Article 50 requirements for machine-readable marking and detection of synthetic content.
• OpenAI: Advancing Content Provenance: OpenAI's explanation of C2PA, SynthID, verification, and the limits of any single provenance signal.
• C2PA Technical Specifications: Official specifications and implementation guidance for Content Credentials.
• MarkLLM GitHub Repository: Research framework covering numerous LLM watermarking and robustness methods.

Summary

An open-source repository focused on AI provenance removal surged on GitHub just days after Anthropic published the technical rationale behind Claude's upcoming SynthID-based text watermark. The timing makes for a dramatic story, but the evidence does not support declaring Claude's watermark universally defeated.

The more useful lesson is that provenance is layered. Invisible Unicode, statistical text watermarks, C2PA metadata, and embedded media watermarks are different mechanisms with different strengths and failure modes. A technique that removes one signal may leave another intact, and heavy transformations that weaken a watermark can also degrade the content itself.

Anthropic, Google, OpenAI, C2PA, MarkLLM, and MarkDiffusion all point toward the same broader conclusion: provenance works best as a combination of signals and verification tools rather than a single permanent mark.

AI watermarking is not an absolute lock, and watermark removal is not an absolute eraser—the real problem is building provenance that remains useful under realistic transformation.