Show HN: Watermarks Remover: Clean LLM watermarks from text and files Show HN：水印移除器：清除文本和文件中的LLM水印

TL;DR

• A Python-based open-source tool that removes multi-vendor AI provenance watermarks from text and various file formats (images, documents, audio, video)
• Supports detection and removal of watermarks from Claude, Gemini/SynthID-Text, OpenAI, and open-LLM systems using Kirchenbauer-style and keyed-Gumbel/Aaronson methods
• Ships as an agent skill with a thin HTTP client architecture, integrating as a PostToolUse hook in Claude Code and Cursor to auto-detect and strip watermarks from files the agent writes
• Provides two operational modes: "check" (reports marks without modifying files) and "clean" (strips marks in-place with atomic file swaps to preserve mtimes)
• Version 0.6.0, requires Python 3.10+ stdlib with zero external dependencies, and includes pre-commit hooks, CI SARIF export, and support for 15+ file formats

Why It Matters

This tool addresses a growing tension between AI provenance tracking and user privacy/ownership rights, offering practitioners a way to reclaim full control over AI-assisted content before publication or distribution. As major AI vendors increasingly embed invisible watermarks into generated outputs, tools like this become relevant for researchers, developers, and organizations concerned about content hygiene, metadata privacy, and the ability to publish AI-assisted work without embedded tracking signals.

Technical Details

• Three-layer watermark removal architecture: Layer A handles invisible Unicode, exotic spaces, bidi overrides, and tag characters via deterministic Python scripts; Layer B addresses statistical token-sampling text watermarks through agent rewrite plus an optional rewrite_text.py hook; Layer C targets metadata watermarks in C2PA, EXIF, XMP, and document properties across PNG, JPEG, WebP, AVIF, HEIC, BMP, GIF, TIFF, SVG, PDF, DOCX, XLSX, PPTX, EPUB, ODT, HTML, Markdown, MP4/MOV/M4A/M4V, WAV, MP3, and FLAC
• Agent skill integration: The skill acts as a thin HTTP client calling a local Python service, with a PostToolUse hook registered on Write|Edit|MultiEdit|NotebookEdit events that runs hook_written_file.py against newly written files, using audit_lib's scan_file/is_actionable for consistent detection across hooks, pre-commit gates, and CI SARIF exports
• Atomic cleaning strategy: In "clean" mode, the tool writes to a sibling temp file and swaps only when content actually changes, preserving file mtimes and avoiding unnecessary file watcher triggers
• Installation and packaging: Supports Claude Code (personal and project-scoped), Cursor, Cowork, claude.ai, and cloud sessions via a unified install_skill.py script that validates against Agent Skills packaging rules (spec-only frontmatter, naming constraints, 1024-char description limit, 30 MB upload cap for Cowork bundles)
• Configuration via environment and settings: Hook mode is controlled by WATERMARKS_HOOK_MODE=clean or the CLAUDE_PLUGIN_OPTION_HOOK_MODE variable, deliberately avoiding ${user_config.hook_mode} interpolation to prevent silent hook failures on fresh installs

Industry Insight

• The emergence of dedicated watermark-removal tooling signals an escalating cat-and-mouse dynamic between AI providers embedding provenance marks and users seeking to strip them, likely prompting vendors to adopt more robust or server-verified watermarking schemes in the near term
• The hook-based integration pattern (detect-on-write with check-by-default) offers a reusable blueprint for other content-integrity tooling, such as license compliance scanning, PII detection, or style-guide enforcement in AI-assisted development workflows
• Professionals should evaluate whether their organization's AI content policies require keeping or removing these marks, as the tool's existence makes watermark removal trivially accessible and may affect downstream content authenticity claims or platform compliance requirements

TL;DR

• 开源工具watermarks-remover可移除多供应商AI溯源水印，支持Claude、Gemini/SynthID-Text、OpenAI及开源LLM的水印技术
• 覆盖三层水印类型：不可见Unicode字符/特殊空格/双向文本、统计token采样水印、文件元数据（C2PA/EXIF/XMP等）
• 支持多种文件格式处理，包括图片（PNG/JPEG/WebP/HEIC等）、文档（PDF/DOCX/XLSX/PPTX/EPUB等）、视频音频（MP4/WAV/MP3等）
• 提供Agent skill集成方案，兼容Claude Code、Cursor等AI编程工具，通过HTTP服务驱动
• 支持check（检测报告）和clean（自动清除）两种工作模式，通过PostToolUse钩子实现自动化

为什么值得看

该工具为AI内容创作者和隐私保护者提供了实用的水印清除方案，帮助用户维护对自己内容的控制权。对于关注AI内容溯源、版权保护和隐私合规的从业者具有重要的参考价值。

技术解析

工具采用分层架构设计，Layer A处理不可见Unicode字符、特殊空格、双向文本和标签字符，使用确定性Python脚本；Layer B处理统计token采样水印，通过Agent重写和可选的rewrite_text.py钩子实现；Layer C处理文件元数据，支持C2PA/EXIF/XMP等标准。

服务与skill分离架构：skill作为轻量级客户端通过HTTP调用服务，agent宿主无需安装Python。安装脚本支持Claude Code（个人/项目级）、Cursor、Cowork等多种宿主环境，并提供--link模式实现实时更新。

PostToolUse钩子机制：在Write/Edit/MultiEdit/NotebookEdit操作后自动运行，check模式报告水印并返回exit code 2供模型决策，clean模式直接清除并通知模型文件已变更。检测逻辑复用audit_lib库确保一致性。

行业启示

AI水印技术正在成为内容溯源的行业标准，但同时也引发了用户隐私和内容自主权的争议。该工具的出现反映了市场对"内容所有权"的强烈需求，提示AI厂商需要在溯源能力和用户权利之间寻求平衡。

对于AI内容创作者和企业用户，建议建立内容水印管理策略：在需要保留溯源信息时选择check模式，在追求内容纯净度时使用clean模式。同时关注C2PA等开放标准的发展，确保内容合规性。