Privacy-first provenance toolkit

Erase AI provenance marks from content you own.

AI tools leave fingerprints — hidden Unicode in text, C2PA / EXIF / XMP metadata in images and documents, statistical marks woven into the wording itself. watermark-eraser finds them and removes them. Deterministically, locally, on your machine.

Get started on GitHub See the quickstart →

16: file formats
0: dependencies — Python 3.10+ stdlib
234: tests, hermetic, two-OS CI
MIT: licensed

01 — Interactive demo

Invisible marks, made visible. Then gone.

The paragraph below carries six hidden Unicode codepoints — the kind AI tools watermark text with. Reveal them, then erase them. Everything runs in your browser.

blog-draft.md

This is a draft of Saturday's blog post—⁠the intro finally feels right. I'll tighten the middle sectiontomorrow, reread the endingwith fresh eyes, and then hitpublish before⁠lunch.

02 — How it works

Three layers of marking. Three layers of removal.

Layer A

Invisible Unicode

Zero-width characters, bidi overrides, tag characters, exotic spaces, private-use stego — detected and stripped deterministically, every removal counted. Load-bearing invisibles, like emoji glue and script joiners, are preserved.

Verifiable removal

Layer B

Statistical text marks

Token-sampling watermarks — SynthID-Text and Kirchenbauer-class — live in the wording itself. A rewrite hook attacks them: paraphrase, back-translation, structural rewrite, with your own local model. Loopback-only by default.

Best-effort, honestly

Layer C

File metadata

C2PA manifests, EXIF, XMP, document properties, customXml, generator tags — stripped from sixteen formats while pixels and prose stay untouched. Optional exiftool, c2patool and CtrlRegen backends.

Verifiable removal

03 — Workflow

One command away from clean files.

Inspect

inspect_file.py routes by format and reports every mark it finds, with confidence levels. JSON on request.

Clean

clean_file.py strips what was found: metadata chunks, invisible codepoints, AI frontmatter. Atomic writes, backup first.

Verify

The cleaner re-inspects its own output and reports residuals. Exit codes slot into scripts and CI.

04 — Quickstart

Clone and run. Nothing to install.

git clone https://github.com/tekeburak/watermark-eraser.git
cd watermark-eraser
S=skills/remove-ai-marks/scripts

# inspect anything — format is detected automatically
python3 $S/inspect_file.py draft.md

# clean it (metadata + invisible Unicode, lossless)
python3 $S/clean_file.py draft.md -o draft.cleaned.md
python3 $S/clean_file.py photo.png -o photo.cleaned.png

Also ships as an agent skill — /remove-ai-marks — that carries the whole inspect, clean, verify and rewrite workflow for you.

05 — Coverage

Sixteen formats, one router.

PNGJPEGWebPTIFFGIFSVG PDFDOCXPPTXXLSXODTODP ODSHTMLMarkdownTXT

Detection runs extension-first, then magic bytes — including OOXML and ODF archives by their zip contents.

06 — Security

Built like a security tool.

It parses untrusted files, so every surface is hardened.

Atomic, symlink-safe writes: Pre-placed symlinks cannot redirect a clean onto your files.
Binary-input guard: Text tools refuse DOCX, PDF and images instead of mangling them.
SSRF-safe networking: Loopback-only default, resolved-IP validation, connection pinning, no redirects, size-capped responses.
Resource caps: Input and stdin caps, zip budgets, rlimits on child processes — all env-tunable.
Supply chain: SHA-pinned CI actions, pip-audit, CodeQL, Dependabot.

07 — Ethics

Use it on content you own.

This project exists for privacy, hygiene and research on your own work — not for academic fraud, copyright evasion, or passing AI output off as human-written. Layer B is documented with its real quality cost, and no tool can certify that a vendor detector will fail. Read the ethics notes ↗

Your files, clean.

Star on GitHub Releases →