Remove-AI-Watermarks – CLI and library for removing AI watermarks from images

https://github.com/wiltodelta/remove-ai-watermarks

by janalsncm • 2 months ago

387 248 2 months ago

I don't know I really like the definitive indicator that something is AI so I can completely ignore anything else that comes from them.

sgarman• 2 months ago

I think the issue is it was never definitive. This is a great way to show people that.

esafak3• 2 months ago

I have not read anyone claim that SynthID had a false alarm issue, so if it returned positive I would believe it is synthetic.

recursive• 2 months ago

If someone's doing something you don't like, you can't really count on them doing it the way you prefer.

streetfighter647• 2 months ago

You can count on them doing it in a way that's economical for them. It's how email spam filters and ad blockers work. Sure somebody will always find a way to bypass it, and that's the arms race. A filter with zero false positives that removes 80% of slop is pretty darn good though.

spike021• 2 months ago

Are markers being removed here the same or similar to ones tools might add if you use an AI tool just to edit a photo? like a more complicated object removal in a photo editor?

cortesoft• 2 months ago

I feel like it is even worse if we have a marker that is ALMOST always present on AI images. It would make us more likely to be fooled by an AI image that had them removed, because we would trust the marker.

Tiberium3• 2 months ago

This is a bit misleading as for Gemini it only properly removes the visible watermark. To remove SynthID it has to regenerate the image at low noise with SDXL, which will likely destroy a lot of small details, plus won't work for higher res properly (NB2 and GPT Image 2 support up to 4K image outputs)

gpt53• 2 months ago

Nano Banana 2 only supports 1K resolution (1024x1024) natively. Anything above that is upscaling. So this matches SDXL. GPT Image 2 does support 4k natively (but experimentally).

vunderba4• 2 months ago

Where did you get that info from? According to Google's own docs as well as my own image generation tests via the API, it supports up to 4K natively for gemini-3.1-flash-image-preview (aka NB2).

It just defaults to 1K. But I didn't see anything in the docs stating that it's just a simple upscale for larger resolutions.

https://ai.google.dev/gemini-api/docs/image-generation#gener...

Tiberium3• 2 months ago

It's not upscaling for NB2, 4K outputs are very different from 1K, and output tokens count is also different.

ls6122• 2 months ago

Is SDXL still the best local image model all these years later? Damn, that’s sad…

vunderba4• 2 months ago

With the number of fine-tuned LoRAs and checkpoints - from a realism standpoint, yes SDXL is still very viable. From a prompt adherency perspective, absolutely not.

Qwen-Image-2512 / Z-Image / Flux.2 absolutely crush SDXL if you're actually generating moderately complex scenes.

Tepix• 2 months ago

It claims to remove SynthID also.

j2kun6• 2 months ago

Use cases where the threat model fits: You are preserving art or historical record against false-positive "AI-generated" labels.

Sorry, how does using AI to generate images have anything to do with this? Image generators cannot insert watermarks into things they did not generate, and it seems highly unlikely that you will get a false-positive watermark on human-generated art, especially if, as the readme says, these watermarks have high enough fidelity to trace to a specific session id. Plus the modifications to the image needed to erase watermarks would necessarily change the thing being "preserved."

[edit]: the more I read the more I'm convinced, the claimed use cases in the README are bullshit and the real reason is to provide a tool that helps people bypass "AI-generated" labels on social media for AI slop.

Tiberium3• 2 months ago

I mostly agree about the justification in the repo being wrong, but wanted to engage about this point:

Image generators cannot insert watermarks into things they did not generate

It's actually very easy to take a real image, ask Gemini/ChatGPT to modify some tiny part of it (could be something as silly as lighting/shadow/etc), and often the resulting image will be detected by their watermarking tools. This way you can easily present any real image as AI-generated.

j2kun6• 2 months ago

Ignoring that a watermark removal tool does not help with this threat model, the claim is still true: the original image can not be changed, and instead a copy is created.

rezonant• 2 months ago

So what? I can also open an image in Photoshop and make sure it saves out some Photoshop specific EXIF data and try to claim the image was doctored. What I can't do is go and put my deceptive altered file up in place of the original in all the places on the Internet it exists.

akersten2• 2 months ago

There's an underappreciated comment in the other thread about SynthID and OpenAI [0] that captures what (IMO) the hacker ethos on this should be. We care about privacy, we should not accept tools that barcode our every digital move. (note that the counter of "well, they don't do that yet" is not particularly convincing)

[0] https://news.ycombinator.com/item?id=48200060

j2kun6• 2 months ago

Building a tool that tries (and probably fails) to remove the watermark (due to the arms race that large corporate machines will win) is tacitly accepting the barcode. The hacker ethos should be, first and foremost, to run open source models locally without relying on a corporation.

akersten2• 2 months ago

[fighting against the system] is tacitly accepting the barcode.

I don't really see it. I think it's important to win on both fronts.

transcriptase2• 2 months ago

due to the arms race that large corporate machines will win

Much like how the entirety of Hollywood, book publishers, academic publishers, and game developers have won against piracy despite being some of the largest corps on earth and dedicating untold billions to the issue over the past 30 years?

photios• 2 months ago

No use messing with Google's watermark, fellas. Go do something else that's 100x harder instead.
works for Google

Gee, I wonder why...

brookst• 2 months ago

This is the “instead of using seatbelts, we should invest in trains” argument.

victorbjorklund• 2 months ago

It doesn't make any sense at all. That's like saying browsing the internet with an ad blocker and other privacy tools is a tacit acceptance of tracking and ads, and that you should only visit websites that doesn't track or have ads.

nancyminusone• 2 months ago

Or you can just take a picture of your monitor with your phone.

ryanmcbride• 2 months ago

multiple things can be in line with the hacker ethos

int0x293• 2 months ago

Accepting blindly destroying the concept of thruth should not be the hacker ethos either.

63stack• 2 months ago

Nobody said that?

bonoboTP• 2 months ago

It's already possible to lie with text. Pixels are pixels. If we can't blindly believe pixels to show the truth, we will be simply back to the pre-photography era which managed to have a concept of truth regardless.

tptacek• 2 months ago

It either works reliably or it doesn't; if it doesn't, it's better that everybody be clear about that.

151554• 2 months ago

Stalin had no issues photoshopping images almost 100 years ago.

streetfighter647• 2 months ago

The concept of truth? A bit overblown don't you think? Because some guy can make a realistic looking fake videos that destroys the "concept" of truth? How?

jameson• 2 months ago

It's best for privacy not to do this in the first place because:

- Watermarks are optional by AI provider so bad actors will circumvent by using another provider

- GH project proves watermarks can be removed

Given these, trying to ensure "truth" is a futile effort unfortunately, and watermarking only gives companies advantage to violate privacy

RobotToaster• 2 months ago

AI watermarks only give the illusion of maintaining the concept of truth. The government and corporations will still have access to un-watermarked models to destroy the truth with.

croes2• 2 months ago

Do we care about truth?

Without truth freedom and privacy are endangered too.

The other comment talks about laws that can already handle that. How if images, video and audio aren’t reliable proof anymore?

eikenberry2• 2 months ago

The watermarking should be on those things we want to verify as something that was not generated or manipulated. Something you'd add to, for instance, cameras. Putting them on the generated/manipulated is backwards as you can never get every model to watermark.

streetfighter647• 2 months ago

I think you'll have to clarify the cause and effect of that a bit.

Also note that people have been falling for obviously watermarked videos already.

And even if they weren't, wouldn't that just make them more gullible towards non-watermarked models?

mywacaday• 2 months ago

Maybe we do care about truth, freedom and privacy but the majority of rest of society will happily accept any T&Cs just to get access to whatever the next digital sliced pan is and as for truth and accountability, if they were two sides of the same coin on the ground people wouldn't bend down to pick it up as possesing it looks too much like responsibility and inconvenience.

NotMichaelBay• 2 months ago

I'm pretty sure watermarking is (or soon will be) a requirement for AI generated images in software used in the EU, as part of their regulations for AI transparency.

DonsDiscountGas• 2 months ago

It's not "every digital move" it's the photos you ask them to create. If you care about privacy use a local model

wang_li• 2 months ago

The human ethos should be to never be misleading about the origin and truth of any content you create, forward, or pass on. If we care about honesty we should jail anyone who does so.

totetsu• 2 months ago

Its what happens when people in power are paranoid dark-triad types and want to be able to catch anyone who threatens their power and stick it to them..

randycupertino• 2 months ago

It already happened with Trump claiming any unfavorable content of his administration is "AI-generated" as a defense to dismiss real, unedited media. He literally said, “If something happens that’s really bad, maybe I’ll have to just blame AI.”

ie the video of garbage being thrown out the windows that his team already confirmed was real:

https://www.kptv.com/2025/09/03/trump-says-video-showing-ite...

Also the Lincoln Project video footage him him stumbling while walking and over his words: https://www.forbes.com/sites/mattnovak/2023/12/04/donald-tru...

keybored• 2 months ago

When.

KaiserPro3• 2 months ago

"we care about privacy" Yes, yes I do.

but I also live in a society that requires trust to function. making a tool the obliterates that trust(genAI imagery pipelines) then creating a tool that makes it trivial for normal people to remove any hint of controls over said trust eroding system is, toxic.

I get the argument about not putting in fingerprints that identify users, Good I agree. But this also removes the things that identify this as an AI image.

Now, what are the legitimate uses of that?

No really, why would I _need_ to remove a watermark for _legitimate_ purposes? Assuming that watermark is generic, rather than a fingerprint of a specific person

AnthonyMouse7• 2 months ago

No really, why would I _need_ to remove a watermark for _legitimate_ purposes?

When removing the watermark is easy, a very legitimate purpose of making the code to do it publicly available is to make a public demonstration that it's easy to do.

As for content use cases, suppose someone is using AI to modify their appearance because they're being unjustly targeted by an oppressive government. That government naturally bans doing that because they want to be able to identify and arrest their critics, so now if you make videos with your real face you get arrested but if you use a generated avatar then the watermark enables automated censorship because the government orders anything with the watermark to have its reach automatically restricted.

blablabla1232• 2 months ago

The Hacker ethos is mainly about how things work: sharing, openness.

I'm not entirely sure how hiding that something is GenAI fits in here. It surely doesn't have anything to do with Privacy though.

bawolff4• 2 months ago

I disagree. Its mainly about having technical control and freedom. Reverse engineering how things work feels like peak hacker ethos. You don't have control of something if you can't remove it.

I think ethical considerations were always a bit secondary to technical power when it came to so called "hacker ethos".

After all, instructions on how to remove watermarks definitely feels like the sort of thing that would have been in phrack back in the day.

windsurfer2• 2 months ago

Even if you remove a watermark, the companies still have a record of which images they have generated and for whom. Even if you remove the obvious watermarks, all major image generators are using steganography to embed hidden information that you can't be sure were removed. This is a type of one-sided arms race where one player gets to be invisible if they want to.

swingboy• 2 months ago

Do they still work if you apply something like a filter or additional layers on top? Or add a subtle blur, etc.

grebc3• 2 months ago

What’s wrong with showing off AI bro? Why the shame?

Barbing2• 2 months ago

People don’t realize how hard it can be to throw an election or impugn an adversary with manipulated imagery

Then they ask us to do it by hand?!

streetfighter647• 2 months ago

You're assigning emotions to people based on what you'd like them to feel, not on reality. For example, most americans probably don't feel shame about being american. But it's still a good decision not to go around showing off a bunch of american flags abroad, unless you want people to look at you in a certain way.

grebc3• 2 months ago

So letting people know you’ve used AI is not a good thing? Best used in covert is what you’re saying?

pesus• 2 months ago

This is more akin to having a fake passport and pretending you're not American when asked.

tamimio• 2 months ago

Amaze amaze amaze

- Rocky

gbraad• 2 months ago

I just saw the announcement about OpenAI or so going to use SynthID and all I thought was; what can d be read(located) can be removed. Seems the tool already exists, proving my point.

janalsncm• 2 months ago

Yes, I came from that thread and figured this kind of tool was worth mentioning.

sscaryterry• 2 months ago

Yin and yang.

airstrike2• 2 months ago

Regardless of one's opinion about this particular project, it seems obvious to me that the path forward is proving authenticity of non-AI resources rather than attempting to watermark all the AI-generated ones.

xp848• 2 months ago

Pretty hard problem to tackle when you can point an "authenticated" camera at a really nice screen and snap a 'definitely real' photo of anything a screen can display :(

streetfighter647• 2 months ago

There's probably a technical solution, such as the camera manufacturer cryptographically signing a GPS location and timestamp together with the pixels. Like all DRM it will probably be broken though, and more importantly, would anyone (even e.g. a newspaper editor) care enough to verify the signature?

dabinat• 2 months ago

Isn’t the goal only to prove that a photograph was taken with a particular camera? I don’t think you could ever prove that the subject was legitimate, as there are countless ways to misrepresent things. But in a world of AI slop, knowing a photo was taken on a real camera and wasn’t synthesized artificially is still a useful data point in determining trust.

mr_toad• 2 months ago

proving authenticity of non-AI resources

You’re trying to prove a negative.

airstrike2• 2 months ago

Not really, I'm trying to prove "this is an actual photo from some specific certified hardware."

a-dub• 2 months ago

watermarking only really works when the scheme is secret.

putting cyphertext in high frequency noise is old news. in generative land would be far more interesting to use the generative flexibility to encode in macrostructure.

redox99• 2 months ago

There's quite a bit of difference in the before and after. I hope they can find a way that better preserves details.

doctorpangloss• 2 months ago

people like the idea of removing watermarks. it doesn't have to remove a watermark. do you get it? this whole product is meaningless vibes.

yalogin• 2 months ago

This is brilliant pace. What I expected to see

UrbanNorminal• 2 months ago

Can't we instead just use open source models?

b3ing• 2 months ago

Watermarking images generated from trained data on stolen copyrighted material, I get why so they can try to tell if something is real or not but something seems wrong

dostick• 2 months ago

To remove Gemini watermark, open dev tools and block http request to watermark. It is overlaying logo in client.

cush• 2 months ago

I love that this is exactly one position above OpenAI Adopts SynthID Watermarks

8cvor6j844qw_d6• 2 months ago

Are there tools to apply SynthID to existing images? e.g., make AI watermarks unreliable for those relying on it

jamwise• 2 months ago

Yeah, human minds need an security patch for firehosing

digitaltrees20• 2 months ago

Why? Don’t do this. Society is built on an implicit assumption of trust. You will erode the foundation that enables any success you might have in the short term.

vasco2• 2 months ago

How is a hidden watermark that only police and providers can read better than a hidden watermark that the people can also read if they go out of their way to setup some project like this? Also your argument makes zero sense because bad guys will do this anyway. At least there's also an open source project for normal people, and it's interesting from a stenography standpoint.

digitaltrees20• 2 months ago

Watermarks exists to create a chain of custody or attribution that can be used to establish culpability. Just like the government requires printer companies to add a dot matrix watermark to printed pages to prevent currency forgery.

Making untraceable assets means parties can’t be held liable for harms.

Just because a bad actor might poison a toddler doesn’t mean you should sell them the arsenic.

Just because the effects of arsenic on the neurons of a brain are interesting means you should feed them to a toddler and watch the effects unfold.

I support the legal freedom to pursue any idea, but we should also mentor our colleagues about the consequences of our projects and avoid unnecessary harm.

jauer• 2 months ago

Information is default low-trust unless you have reason to extend trust to the source and that's been the case for thousands of years, if not the entirety of human existence.

We now have the tools to increase trust in specific information, for example: by signing images that need high trust for things like news reporting using camera hardware root of trust with time and geo stamping. If signatures are removed, that's back to a default low-trust state.

devsda• 2 months ago

It is best not to extend blanket trust to a specific source at all.

That is how we ended up with the situation where "reputed" media organizations peddle daily lies or selective truths that are useful to their benefactors.

digitaltrees20• 2 months ago

I don’t want kidnapping scammers to have easy to fake image generators that are untraceable. I don’t want eBay scammers to have that (sometimes I will ask the seller to take a picture with specific information to confirm a listing is credible). I could site lots more examples

egeozcan• 2 months ago

IMHO you cannot base your trust on something that is so easy to work around.

Trust should be between people, not a person and some data.

So showing how easy to generate "false" data, this makes it more obvious for people focus on other people. Trusting people makes life much easier in my experience, while focusing on data, again in my experience, is a game of cat and mouse.

goatlover4• 2 months ago

The Kentucky primary had $1.7 million spent on deepfake political ads which were seen 49 million times. Don't know how much it effected the result, but it's not a good sign of where things are headed.

InsideOutSanta• 2 months ago

Trusting people makes life much easier in my experience

Sure, but how do you apply that to a society at large where powerful people are interested in making everybody distrust all reliable sources of information?

AI watermarks are no panacea, but at least they are a clear signal of what not to trust.

digitaltrees20• 2 months ago

Except how do you have trust between people when deep fakes and voice clones are trivial to spin up? Are we going to have to go back to doing business physically in person?

If I got a picture of my mom being held hostage it sure would be nice to have a watermark confirming in was an AI generated image. So again, why make this broadly an easily removable?

basch• 2 months ago

The distortion is shockingly visible in images. Especially with any amount of generational iteration https://streamable.com/9x3s4r

That said, this tool is incredibly lossy, garbling text, completely changing shapes. It also fails to remove the new gemini spark / placement that moved since yesterday.

antiloper• 2 months ago

You will erode the foundation that enables any success you might have in the short term.

It's too late already. We live in a post-trust society now.

digitaltrees20• 2 months ago

But why make it worse and easier to avoid detection?

bsza2• 2 months ago

Would you prefer if someone did the same thing and kept it to themselves (or sold it to the highest bidder)? I think knowing it exists is better than not knowing it exists.

digitaltrees20• 2 months ago

No. I would prefer we, as a community, don’t build this. I am under no illusion that I will persuade all people but I feel clarity that it is morally and practically unwise to build a tool like this at all and especially unwise to publish it as a freely available open source project

probably_wrong• 2 months ago

I'd like to frame this differently: watermarking is a (weaker) form of DRM, and DRM has never worked in favor of the users.

I know of at least one music GenAI service whose ToS forbid me from using their productions in ways that are incompatible with my local rights. If Google decides, as they did with YouTube, that they'll enforce this company's watermark even though I have a right to use their results then I've passively accepted that a (foreign) company decides which of my legal rights I can exercise.

For a more pessimistic outlook: for the GenAI companies that work for the military, are those pictures also watermarked? Because if watermarks only apply to one group then the "implicit trust" argument doesn't work.

I'm in favor of watermarking the same way I am in favor of paying artists for their work. But just as with youtube-dl and DVD decryption libraries, tools like these are necessary to level the playing field.

digitaltrees20• 2 months ago

I don’t think the military should be allowed to generate fake images. I do think there should be international standards on AI because the social harm is universal and dangerous. Just like we don’t allow chemical weapons etc.

hathym• 2 months ago

lol

digitaltrees20• 2 months ago

The electricity used to send the http request, run the lisp code on the server, save it to whatever database Paul Graham used to build HN and render it on my display could have been put to better use that your comment. Or mine. :)

b65e8bee43c2ed06• 2 months ago

Why? Don’t do this. Society is built on an implicit assumption of trust. You will erode the foundation that enables any success you might have in the short term.

would you say the same thing about a ROT13 breaker, or would you recognize how laughably naive that sounds?

digitaltrees20• 2 months ago

I have no idea what a Rot13 breaker is and dont care that you think advocating for an ethical posture in what the tech industry builds is naive. Its naive to think bullies wont be in a kids playground. Its also naive to think we just need to accept that rather than creating norms around the type of play that is acceptable so that the playground functions.

AI generated images have never existed before, they will break our ability to use the digital tools we have built society on if we let them. Ensuring they can be identified and have attribution tracing data embedded is a reasonable step to prevent abuse.

__MatrixMan__2• 2 months ago

Society was build on that assumption, it didn't last. Now we have to build a new one where we put in the work of explicitly trusting each other.

Preserving the illusion that that assumption is still useful only helps the people who are exploiting it.

northernsausage• 2 months ago

As a photographer I say "down with this sort of thing"

subscribed2• 2 months ago

Good. Better than only known bad actors doing this with the public wrongly believing watermarks are reliable.

steve19772• 2 months ago

I think AI watermarks are kind of a lost cause anyway.

I'd be more interested in some kind of trusted Non-AI watermark.

This is something that could get integrated into cameras for example. However, considering how much AI-processing we already have in "normal" photos, it will be difficult to decide where to draw the line.

frotaur• 2 months ago

That would be great, but I always wonder: how do you prevent people from photographing an AI generating image through the 'legitimizing' camera?

steve19772• 2 months ago

Maybe LIDAR or IR focus could help with that.

But then again, the photo itself would be authentic in this case strictly speaking.

It's not an easy problem. If I had a good solution, I would have tried to monetize it already ;)

febed• 2 months ago

Since it seems like you would know, could it also work with Non AI static watermarks like repeating oblique lines?

Tacite• 2 months ago

Didn't work at all for me. Hive Moderation still shows "gemini3: 99.9%". Tried their online version and it went from gemini3: 99.9% to midjourney: 64.7% + stablediffusionxl: 16.1%.

Planktonne5• 2 months ago

I find the casual malevolence of this kind of thing breathtaking. Every time someone raises potential issues with AI misuse, they're dismissed as fear-mongering while a host of people immediately rush to demonstrate that not only is the fear justified, it's gleefully anticipated under the vaguest colour of lofty ideals.

People want to dismiss the potential harms of deepfakes while also excitedly releasing the deepfake-hider-3000 and saying they just really, really care about privacy (for people who make deepfakes).

b65e8bee43c2ed06• 2 months ago

the genie is out of the bottle. the sooner you let go of the notion that it can be kvetched out of existence the less frustrated you'll feel.

for example, 35 years ago PGP was a "casually malevolent" thing, enabling terrorists and pedophiles to email each other with impunity. the effort to make math illegal had (very predictably) failed and now we have encryption everywhere. did the world end? how do you feel about Chat Control and numerous other initiatives to roll it all back?

Planktonne5• 2 months ago

That argument is a lot less convincing (and sincere) when we're talking about a specific tool with a very specific purpose, rather than maths itself. In much the same way, you can make pro-gun arguments based on sport shooting, but not when you're holding a landmine.

This is a very specific tool with the purpose of making it easier to lie, in an area where the kinds of lies people tell are directly injurious to society. "It's just math" doesn't fly here, and all the primary uses for such a tool are malevolent.

jappgar• 2 months ago

doing the devil's work here.

__MatrixMan__2• 2 months ago

Trusting your adversary to reliably identify themselves is folly.

We need to get to a place where we're checking digital signatures to see which humans were involved in the creation of something, and ignoring everything else.

ShreyashM172• 2 months ago

Isn't this wrong? like removing AI watermarks, people like make morphed images using AI, and then use something like this, and claim it to be real

eleventen• 2 months ago

How you use the tool matters, yes. But the freedom to demonstrate and understand this weakness with watermarks is much more important to exercise than saying "shhhhh don't tell people about this".

The takeaway should be that watermarks aren't very reliable and you should keep your guard up anyway.

ShreyashM172• 2 months ago

I think we can find out a way where these watermark, becomes too difficult to remove

deadbabe• 2 months ago

What happens to watermarks when you turn images to videos on other platforms? Does every frame carry the original mark?

madrox• 2 months ago

For better or worse, I think the future has to be showing warnings on images with no C2PA-like watermarking like we do for insecure web sites. Media can be signed by authors. If the Associated Press sign an image, I can feel more confidence in its authenticity than the next decade's InfoWars. Power users can still choose to ignore it, but standardizing UX around trust sources like we do TLS will save the less savvy among us.

I don't think we've even seen the full brutal force of disinformation that we are capable of yet.

Remove-AI-Watermarks – CLI and library for removing AI watermarks from images

Related Stories