Watermarks Remover Tops 14,000 Stars; Claude’s Detector Isn’t Public

Guillaume Meyer’s Watermarks Remover has become a fast-growing open-source challenge to AI provenance controls. It can strip several inspectable file and text markers, while optional rewriting and image regeneration target harder-to-measure embedded signals.

The build begins

Meyer said he built the first version in roughly five hours after researching Anthropic’s marking system. The project followed Anthropic’s policy for machine-readable marking on Claude models launched in the European Union on or after August 2, 2026. The policy extends coverage worldwide across Claude, Claude Code, Claude Cowork, Claude Tag, Anthropic’s API and supported cloud platforms.

Anthropic uses different mechanisms for text and files. Its text watermark is imperceptibly embedded through model output. Supported PNG, JPEG and SVG files receive signed provenance metadata based on the C2PA standard. Meyer’s early approach sought meaning-preserving text variations that would weaken a statistical signal; the image approach similarly changes pixels.

Different kinds of removal

The project can remove invisible Unicode characters and C2PA, EXIF, XMP and document metadata across image, document, web and media formats. It can strip some hard-bound C2PA metadata, but does not address soft-bound signals that reconnect a file to remote credentials. Those file and character operations can be inspected directly.

Where the evidence differs

• Unicode and metadata removal are described in the repository as deterministic.
• Rewriting and image regeneration are optional components intended to weaken statistical text marks or pixel-level image marks.
• The repository calls statistical rewriting best-effort and says it cannot certify that a vendor detector will fail.

That last category cannot yet be independently settled against Claude. Statistical text marks reside in word choices, and Anthropic has not released the public detector or full technical guidance needed for outside testing. The tool can alter output, but cannot demonstrate whether Claude’s own detection system would still identify it.

Limits of an attribution signal

Anthropic says a detected mark means Claude may have processed content, not that it wrote the original work. Proofreading, translation, summarization and file conversion can mark work that originated elsewhere. Heavy editing, paraphrasing or translation may also make a mark undetectable, while an absent mark does not establish that AI processing never occurred.

The next iteration

Meyer is considering turning Watermarks Remover into a business, though no funding round, valuation or named investors have been disclosed. He has not settled on a product or timetable. For now, the project’s clearest capability is removing inspectable markers; its more ambitious removal methods remain a best-effort experiment.