Remove–AI–Watermarks – CLI and library for removing AI watermarks from images (github.com)

151 points by janalsncm 5 hours ago

akersten 5 hours ago

There's an underappreciated comment in the other thread about SynthID and OpenAI [0] that captures what (IMO) the hacker ethos on this should be. We care about privacy, we should not accept tools that barcode our every digital move. (note that the counter of "well, they don't do that yet" is not particularly convincing)

[0]: https://news.ycombinator.com/item?id=48200060

totetsu 4 minutes ago

Its what happens when people in power are paranoid dark-triad types and want to be able to catch anyone who threatens their power and stick it to them..

j2kun 5 hours ago

Building a tool that tries (and probably fails) to remove the watermark (due to the arms race that large corporate machines will win) is tacitly accepting the barcode. The hacker ethos should be, first and foremost, to run open source models locally without relying on a corporation.

transcriptase 2 hours ago

>due to the arms race that large corporate machines will win

Much like how the entirety of Hollywood, book publishers, academic publishers, and game developers have won against piracy despite being some of the largest corps on earth and dedicating untold billions to the issue over the past 30 years?

blanched an hour ago

PostOnce an hour ago

UqWBcuFx6NV4r an hour ago

SecretDreams an hour ago

akersten 5 hours ago

> [fighting against the system] is tacitly accepting the barcode.

I don't really see it. I think it's important to win on both fronts.

j2kun 10 minutes ago

gpt5 3 hours ago

int0x29 5 hours ago

Accepting blindly destroying the concept of thruth should not be the hacker ethos either.

bonoboTP 4 hours ago

It's already possible to lie with text. Pixels are pixels. If we can't blindly believe pixels to show the truth, we will be simply back to the pre-photography era which managed to have a concept of truth regardless.

BoredPositron 2 hours ago

tptacek 4 hours ago

It either works reliably or it doesn't; if it doesn't, it's better that everybody be clear about that.

xp84 4 hours ago

ninjalanternshk 3 hours ago

jameson 4 hours ago

It's best for privacy not to do this in the first place because:

- Watermarks are optional by AI provider so bad actors will circumvent by using another provider

- GH project proves watermarks can be removed

Given these, trying to ensure "truth" is a futile effort unfortunately, and watermarking only gives companies advantage to violate privacy

63stack 4 hours ago

Nobody said that?

int0x29 4 hours ago

streetfighter64 4 hours ago

The concept of truth? A bit overblown don't you think? Because some guy can make a realistic looking fake videos that destroys the "concept" of truth? How?

15155 4 hours ago

Stalin had no issues photoshopping images almost 100 years ago.

int0x29 4 hours ago

tredre3 4 hours ago

croes 4 hours ago

NotMichaelBay 4 hours ago

I'm pretty sure watermarking is (or soon will be) a requirement for AI generated images in software used in the EU, as part of their regulations for AI transparency.

transcriptase 2 hours ago

Of course. Regulations are the EUs primary output these days! Anywhere else they’re just sparkling suggestions.

UqWBcuFx6NV4r an hour ago

DonsDiscountGas 2 hours ago

It's not "every digital move" it's the photos you ask them to create. If you care about privacy use a local model

croes 4 hours ago

Do we care about truth?

Without truth freedom and privacy are endangered too.

The other comment talks about laws that can already handle that. How if images, video and audio aren’t reliable proof anymore?

mywacaday 4 hours ago

Maybe we do care about truth, freedom and privacy but the majority of rest of society will happily accept any T&Cs just to get access to whatever the next digital sliced pan is and as for truth and accountability, if they were two sides of the same coin on the ground people wouldn't bend down to pick it up as possesing it looks too much like responsibility and inconvenience.

eikenberry 4 hours ago

The watermarking should be on those things we want to verify as something that was not generated or manipulated. Something you'd add to, for instance, cameras. Putting them on the generated/manipulated is backwards as you can never get every model to watermark.

amarant 4 hours ago

streetfighter64 4 hours ago

I think you'll have to clarify the cause and effect of that a bit.

Also note that people have been falling for obviously watermarked videos already.

And even if they weren't, wouldn't that just make them more gullible towards non-watermarked models?

wang_li 2 hours ago

The human ethos should be to never be misleading about the origin and truth of any content you create, forward, or pass on. If we care about honesty we should jail anyone who does so.

site-packages1 5 hours ago

I don't know I really like the definitive indicator that something is AI so I can completely ignore anything else that comes from them.

spike021 an hour ago

Are markers being removed here the same or similar to ones tools might add if you use an AI tool just to edit a photo? like a more complicated object removal in a photo editor?

sgarman 5 hours ago

I think the issue is it was never definitive. This is a great way to show people that.

esafak 5 hours ago

I have not read anyone claim that SynthID had a false alarm issue, so if it returned positive I would believe it is synthetic.

Retr0id 2 hours ago

Wacari 4 hours ago

recursive 5 hours ago

If someone's doing something you don't like, you can't really count on them doing it the way you prefer.

streetfighter64 4 hours ago

You can count on them doing it in a way that's economical for them. It's how email spam filters and ad blockers work. Sure somebody will always find a way to bypass it, and that's the arms race. A filter with zero false positives that removes 80% of slop is pretty darn good though.

Tiberium 5 hours ago

This is a bit misleading as for Gemini it only properly removes the visible watermark. To remove SynthID it has to regenerate the image at low noise with SDXL, which will likely destroy a lot of small details, plus won't work for higher res properly (NB2 and GPT Image 2 support up to 4K image outputs)

gpt5 5 hours ago

Nano Banana 2 only supports 1K resolution (1024x1024) natively. Anything above that is upscaling. So this matches SDXL. GPT Image 2 does support 4k natively (but experimentally).

vunderba 5 hours ago

Where did you get that info from? According to Google's own docs as well as my own image generation tests via the API, it supports up to 4K natively for gemini-3.1-flash-image-preview (aka NB2).

It just defaults to 1K. But I didn't see anything in the docs stating that it's just a simple upscale for larger resolutions.

https://ai.google.dev/gemini-api/docs/image-generation#gener...

gpt5 3 hours ago

Tiberium 2 hours ago

It's not upscaling for NB2, 4K outputs are very different from 1K, and output tokens count is also different.

ls612 4 hours ago

Is SDXL still the best local image model all these years later? Damn, that’s sad…

vunderba 4 hours ago

With the number of fine-tuned LoRAs and checkpoints - from a realism standpoint, yes SDXL is still very viable. From a prompt adherency perspective, absolutely not.

Qwen-Image-2512 / Z-Image / Flux.2 absolutely crush SDXL if you're actually generating moderately complex scenes.

ls612 4 hours ago

b3ing an hour ago

Watermarking images generated from trained data on stolen copyrighted material, I get why so they can try to tell if something is real or not but something seems wrong

j2kun 5 hours ago

> Use cases where the threat model fits: You are preserving art or historical record against false-positive "AI-generated" labels.

Sorry, how does using AI to generate images have anything to do with this? Image generators cannot insert watermarks into things they did not generate, and it seems highly unlikely that you will get a false-positive watermark on human-generated art, especially if, as the readme says, these watermarks have high enough fidelity to trace to a specific session id. Plus the modifications to the image needed to erase watermarks would necessarily change the thing being "preserved."

[edit]: the more I read the more I'm convinced, the claimed use cases in the README are bullshit and the real reason is to provide a tool that helps people bypass "AI-generated" labels on social media for AI slop.

Tiberium 5 hours ago

I mostly agree about the justification in the repo being wrong, but wanted to engage about this point:

> Image generators cannot insert watermarks into things they did not generate

It's actually very easy to take a real image, ask Gemini/ChatGPT to modify some tiny part of it (could be something as silly as lighting/shadow/etc), and often the resulting image will be detected by their watermarking tools. This way you can easily present any real image as AI-generated.

j2kun 5 hours ago

Ignoring that a watermark removal tool does not help with this threat model, the claim is still true: the original image can not be changed, and instead a copy is created.

rezonant 5 hours ago

So what? I can also open an image in Photoshop and make sure it saves out some Photoshop specific EXIF data and try to claim the image was doctored. What I can't do is go and put my deceptive altered file up in place of the original in all the places on the Internet it exists.

Barbing 4 hours ago

airstrike 4 hours ago

Regardless of one's opinion about this particular project, it seems obvious to me that the path forward is proving authenticity of non-AI resources rather than attempting to watermark all the AI-generated ones.

xp84 4 hours ago

Pretty hard problem to tackle when you can point an "authenticated" camera at a really nice screen and snap a 'definitely real' photo of anything a screen can display :(

streetfighter64 4 hours ago

There's probably a technical solution, such as the camera manufacturer cryptographically signing a GPS location and timestamp together with the pixels. Like all DRM it will probably be broken though, and more importantly, would anyone (even e.g. a newspaper editor) care enough to verify the signature?

baby_souffle an hour ago

UrbanNorminal an hour ago

Can't we instead just use open source models?

a-dub 4 hours ago

watermarking only really works when the scheme is secret.

putting cyphertext in high frequency noise is old news. in generative land would be far more interesting to use the generative flexibility to encode in macrostructure.

redox99 4 hours ago

There's quite a bit of difference in the before and after. I hope they can find a way that better preserves details.

yalogin 3 hours ago

This is brilliant pace. What I expected to see

sscaryterry 4 hours ago

Yin and yang.

gbraad 4 hours ago

I just saw the announcement about OpenAI or so going to use SynthID and all I thought was; what can d be read(located) can be removed. Seems the tool already exists, proving my point.

janalsncm 4 hours ago

Yes, I came from that thread and figured this kind of tool was worth mentioning.

tamimio 4 hours ago

Amaze amaze amaze

- Rocky

grebc 4 hours ago

What’s wrong with showing off AI bro? Why the shame?

Barbing 4 hours ago

People don’t realize how hard it can be to throw an election or impugn an adversary with manipulated imagery

Then they ask us to do it by hand?!

streetfighter64 4 hours ago

You're assigning emotions to people based on what you'd like them to feel, not on reality. For example, most americans probably don't feel shame about being american. But it's still a good decision not to go around showing off a bunch of american flags abroad, unless you want people to look at you in a certain way.

pesus 2 hours ago

This is more akin to having a fake passport and pretending you're not American when asked.

grebc 4 hours ago

So letting people know you’ve used AI is not a good thing? Best used in covert is what you’re saying?

userbinator 2 hours ago