remove-ai-watermarks

SynthID-Image is a post-hoc, model-independent watermarking system. Unlike in-generation watermarks that inject signals into a model's latent noise, SynthID-Image is applied to the raw pixel output after the generative model (e.g., Imagen or Gemini) has finished its work.

Key architectural characteristics:

• Pixel-space embedding: The watermark is stamped onto pixels using a separate neural network encoder f, not within the model's latent activations.
• Model independence: The generative model does not need to be modified to support watermarking, and replacing the model does not remove the watermarking capability.
• Deep learning based: It uses jointly-trained deep learning models (encoder and decoder) rather than classical frequency-domain methods like DWT-DCT. This allows the signal to be optimized for imperceptibility and robustness against specific perturbations.

C2PA 2.4 introduces 'soft bindings' (invisible watermarks or content fingerprints) that link an asset to a server-side manifest repository.

Implication for developers: While remove_ai_metadata successfully deletes the embedded manifest from the file, the asset may still be re-linked to its provenance via these soft bindings in a remote repository. Stripping the file is a necessary but potentially insufficient step for complete provenance removal against C2.4 standards.

The package provides four primary processing paths for handling input files:

1. Identify provenance: Generates a ProvenanceReport by identifying metadata and watermarks.
2. Visible mark removal: Produces a localized and filled image by removing visible watermarks.
3. Invisible regeneration: Uses diffusion to regenerate the image and remove invisible watermarks.
4. Metadata stripping: Removes AI-related metadata from the container.

The all command executes these in order: visible removal, optional invisible regeneration, and metadata stripping.

The photomaker extra (implemented in photomaker_restore.py) and other face-restoration features are NON-COMMERCIAL.

While the adapter weights may be Apache-2.0, the PhotoMaker-V2 pipeline uses a dual ID encoder that requires InsightFace (antelopev2/buffalo_l model packs) to generate ArcFace embeddings. These model packs are released under a non-commercial/research-only license.

To ensure a monetized deployment remains legal, do NOT install or use the photomaker extra.

Empirical testing shows that the required img2img strength to remove SynthID watermarks varies significantly by vendor. When testing removal, use the following benchmarks as a guide:

Key Findings:

• Vendor Dominance: Google's SynthID is roughly 3x more robust than OpenAI's.
• Resolution Independence: For OpenAI, removal strength is consistent across resolutions (e.g., 1024x1536 to 1600x1600 all clear at 0.05).
• Google Resolution Note: For Google, testing was performed on capped resolutions (--max-resolution 1536). Native large Gemini images (e.g., 2816x1536) may require higher strength (>= 0.30) or discrete GPU resources.

When building a pipeline that requires identity preservation without re-introducing SynthID watermarks, you must use semantic embeddings (conditioning a fresh generation) rather than pixel-based restoration (like GFPGAN or CodeFormer), as pixel-based methods can transport the watermark.

Commercial-Safe Path

• PhotoMaker-V1: Uses OpenCLIP-ViT-H/14 (MIT license) for identity encoding. It does not use the InsightFace/ArcFace branch, making it end-to-end commercial-safe (Apache-2.0 adapter + MIT encoder).

Non-Commercial Paths (Avoid for paid services)

Any stack requiring insightface.app.FaceAnalysis to compute ArcFace embeddings is blocked for commercial use due to the InsightFace model-pack license. This includes:

• PhotoMaker-V2
• IP-Adapter FaceID
• InstantID
• PuLID
• Arc2Face

When building a pipeline to restore text after a global scrub, two primary research-grade approaches are recommended:

• TextSR: Uses a detector, multilingual OCR, and character-shape diffusion priors. This is the closest approach to existing detector-driven pipelines.
• EasyText: Uses FLUX-DiT glyph re-rendering. It supports multilingual text (including CJK) and utilizes the 16-channel VAE.

Implementation Requirements:

• Requires a new OCR-recognition step (the current system only detects text; it does not recognize the content needed for re-rendering).
• Requires heavy FLUX/DiT-class models, typically necessitating serverless GPU infrastructure.
• Verification: Because restoration is diffusion-based, you must empirically verify that the restored output contains no watermarks by running the SynthID oracle on the final output.

Diffusion-based invisible watermark removal requires the gpu extra. The code supports CUDA, XPU, MPS, and CPU devices, though a GPU is recommended for performance.

To install with GPU support using uv:

uv tool install --force "remove-ai-watermarks[gpu]"

For the CUDA-only Qwen Image plus Z-Image profile (which includes standard gpu dependencies):

uv tool install --force "remove-ai-watermarks[qwen-zimage]"

Images generated via the Gemini API, AI Studio, or Nano Banana do not contain C2PA or IPTC metadata. They only contain the SynthID pixel watermark and a visible sparkle.

To successfully identify these images using the identify method, you must enable visible sparkle detection by setting check_visible=True. Otherwise, the tool will return Unknown because the metadata is missing.