If a Watermark Can be Detected, It Can be Removed
Who is going to build the watermark remover, and what it means to treat provenance as a security control.
Yes, in principle. A watermark a detector can read also gives an adversary a target to attack, and published research removes marks from current image and text systems at high rates. How hard removal is depends on the attacker’s access, budget, and tolerance for quality loss. The safe engineering stance is to treat a watermark as a provenance signal, not an access control.
What “if a Watermark Can be Detected, it Can be Removed” Actually Claims
The line reads like a slogan, and like most slogans, it is right in spirit and loose in the detail. A watermark is a signal deliberately embedded in content so that a detector can later read it and confirm that the content was generated or altered by a machine. Detection and removal act on the same object. Any party that can tell whether the mark is present has, by that fact, a way to measure whether an attempt to erase it is working.
The precise version of the claim is narrower and more useful than the slogan. A watermark that some party can detect can, given enough access and effort by that party, be degraded below the detection threshold while the content remains usable. The strength of a scheme is therefore not whether removal is possible in the abstract. It is how much access, compute, and quality loss removal costs a specific attacker. That cost is the number worth arguing about, and it is the number most product claims quietly leave out.
Two words in the slogan do a lot of hidden work, and separating them keeps the rest of this article honest. “Detected” ranges from a badge anyone can see to a statistical signal only a keyholder can read. “Removed” ranges from a clean strip that leaves the content pristine to a heavy transformation that degrades it. The interesting engineering sits between those extremes, and that is where the research below lives.
How AI Watermarks Are Embedded, and What Detection Really Measures
Understanding removal starts with understanding where the mark lives, because you cannot reason about taking something out until you know how it went in. Current schemes fall into a few families, and each embeds its signal in a different layer of the content.
The main approaches in production and research look like this:
Pixel and frequency domain image marks
Classic methods hide a signal in the image using transforms such as DCT and DWT, or through learned encoders. The signal is imperceptible to a person and readable by a matching detector.
Latent and generation time image marks
Newer schemes bias the generative process itself, so the watermark is baked into how the image is produced rather than stamped on afterward. This tends to survive more handling.
Token-biasing text marks
Text watermarks nudge a model’s next-token probabilities toward a keyed subset of the vocabulary. A detector that knows the key can measure whether the keyed pattern appears more often than chance. Google’s SynthID-Text uses a variant of this idea through a mechanism it calls tournament sampling.
Signed provenance metadata
Standards such as C2PA attach a cryptographically signed record of how a file was made. This is not a watermark hidden in the content; it is a manifest bound to the file.
Detection measures presence, and only presence, against a threshold. The detector asks whether the keyed pattern or the embedded signal reads strongly enough to call the content machine-generated with acceptable confidence. That thresholding is the crack in the door. An attacker does not need to prove the mark is gone in some absolute sense. They only need to push the detector’s confidence below the line while keeping the content good enough to use.
Teams shipping generated media, or building features on top of it, inherit this whole layer as part of their attack surface, which is why it belongs in the same conversation as any other control you would put under test. For the AI and model-facing side of that surface, our AI and LLM application security work treats provenance and output-integrity signals as testable, not assumed.
Why a Detectable Watermark Hands an Attacker an Oracle?
Detection is what turns removal from guesswork into an engineering task. If an attacker can query a detector, whether through a public verification tool, an open-sourced detector, or a substitute model trained to imitate one, every query returns a usable signal: is the mark still readable? That feedback loop reduces removal to optimization. Perturb the content, check the detector, adjust, and stop when the mark falls below the threshold and the content still looks right to a human.
Two families of attack in the literature follow exactly this shape. Substitution attacks train a stand-in detector, run a gradient attack against it, and transfer the result to the real black-box detector. Regeneration attacks pass the content through a variational autoencoder or a diffusion model that reconstructs it from scratch, which drops the fragile embedded signal along the way. Neither approach needs the original watermarking key. Both exploit the fact that a detectable mark is, in the end, a measurable one.
The oracle is not always freely available, and that distinction matters for real threat models. Some detectors are gated behind secret cryptographic keys, so a member of the public cannot run detection at will. That raises an attacker’s cost and is a genuine design advantage. The theoretical work known as “Watermarks in the Sand” argues that this raises cost rather than closing the door: for a broad class of schemes, an adversary with access to quality and perturbation oracles can drive the mark below detection while preserving content quality. Gating the detector buys robustness. It does not buy a guarantee.
Where the Watermark Removal Claim Holds, and Where it Breaks Down
Removability is a spectrum, and the honest version of this article lives on that spectrum rather than in the slogan. Whether a given watermark comes off, and at what cost, tracks a small set of variables that a defender can actually reason about.
Removal difficulty rises and falls with the following factors:
Attacker access to a detector or a good substitute
A freely queryable detector makes removal an optimization problem. A key-gated detector forces the attacker to approximate the detector or to fall back on generic regeneration.
The perturbation budget the scheme uses
Low-budget, imperceptible marks are easier to wash out with diffusion purification. High-budget marks that visibly change the content resist purification but tend to yield to substitute-model attacks.
The transformation the attacker will tolerate
Paraphrase, regeneration, translation, compression, and re-encoding each remove different marks, and each trades some content quality for a lower detection score.
The modality
Text watermarks weaken under paraphrase and translation. Image watermarks weaken under regeneration. Audio and video inherit the weaknesses of both, spread across time.
So “detectable implies removable” is directionally true and, in image and text settings, repeatedly demonstrated. The cost ranges from trivial to substantial. A visible badge in the corner of an image comes off in seconds with a crop or an inpainting brush. An invisible statistical mark spread across every region of the content is significantly harder, and the current best schemes genuinely improve performance. Published attacks still clear that bar in many reported settings, which is the point a security reader should carry into any decision that relies on a mark.
What Watermark Removal Research Has Already Reproduced
The claim would be weak if it rested on argument alone. It does not. The evidence map below summarizes what peer-reviewed and preprint work reports, so the strength of the claim is legible rather than asserted. Each row represents a distinct attack family targeting a distinct target.
| Attack approach | What it targets | What the research reports |
| Regeneration with a VAE or diffusion model | Invisible image watermarks | Over 99 percent removal on several schemes, including DwtDctSvd, RivaGAN, and SSL; StegaStamp held out more strongly |
| Diffusion purification | Low perturbation-budget image watermarks | Removes marks with minimal visible change, exposing a fundamental evasion versus spoofing tradeoff |
| Substitute model with a gradient attack | Black-box, high-budget image watermarks | A stand-in detector is trained, then used to strip the mark from the real detector’s view |
| Visual paraphrase | Six recent state-of-the-art image schemes | Encoding and decoding the image produces a dewatermarked output across all six |
| Paraphrase, translation, and heavy editing | Text watermarks, including token-biasing schemes and SynthID-Text | Detection confidence falls sharply under thorough rewriting or translation |
| Theoretical bound (“Watermarks in the Sand”) | A broad class of schemes | Strong robustness does not preclude removal for an adversary with quality and perturbation oracles |
The pattern across this table consistently proves that marks that survive ordinary handling, cropping, mild filtering, and light edits tend to fall to a deliberate adversary who is willing to regenerate the content or paraphrase it and accept a small quality cost. Robustness against accident is not the same as robustness against intent, and the two are often conflated.
How AI Watermarking Works in Production Today: SynthID, C2PA, and the Visible Badge
None of this makes watermarking pointless, and the largest deployments deserve to be understood on their own terms rather than through the slogan. The production picture has moved quickly, so a short timeline helps orient the rest.
The recent sequence looks like this:
- 2023: Google DeepMind launches SynthID for images generated by its Imagen models.
- 2024: SynthID expands to text in the Gemini app and to video in Veo, and the text scheme is deployed at production scale across Gemini responses.
- May 2026: Google reports that more than 10 billion pieces of content have been marked with SynthID across images, audio, video, and text. OpenAI adopts SynthID watermarking for images from ChatGPT and its API and joins the C2PA steering committee.
- 14 August 2026: Google lets Gemini users switch off the visible watermark badge on generated images, video, and songs. The invisible SynthID mark and the C2PA metadata remain on by default.
That last change is the one to sit with, because it cleanly separates two things that often get blurred in the same sentence. A visible badge is a design element. Anyone can crop it or paint it out in seconds, so it never functioned as a control. The invisible SynthID mark is a statistical property woven across the whole file, which is harder to remove and is now the layer doing the real provenance work.
C2PA content credentials add a third layer: cryptographically signed metadata that states how a file was made. That signature is strong where it sits, and it is also strippable, because a screenshot or a re-encode discards the metadata while keeping the pixels.
Production provenance is therefore a stack rather than a single guarantee. A visible label that is weak by design, an invisible watermark that is moderate and degradable, and signed metadata that is strong in place but fragile in transit. Layered together they raise an attacker’s cost. Taken one at a time, each has a documented way off. Reading a mark and validating that it holds under pressure are different activities, which is the same distinction that separates a scan from a pentest.
Where the EU AI Act Leans on Watermarks, and Bans the Remover
The reason this stopped being an academic argument is regulation. Article 50 of the EU AI Act requires providers of generative systems to mark synthetic outputs in a machine-readable format, and to keep those solutions effective, interoperable, robust, and reliable as far as is technically feasible. The obligation became enforceable on 2 August 2026, with a grace period to 2 December 2026 for systems already on the market before that date. Non-compliance can carry fines of up to €15 million or 3 percent of global annual turnover, whichever is higher. Recital 133 lists acceptable techniques, including watermarks, metadata, cryptographic provenance methods, and fingerprints, and the Act points in practice toward C2PA and emerging ISO and NIST standards.
The Code of Practice on Transparency of AI-Generated Content, published on 10 June 2026, fills in the operational detail. Two provisions are worth a security reader’s attention. Very short text, under 200 tokens, is exempt from marking, which concedes that the signal needs room to survive. And compliant providers may not offer tools designed to remove AI markings from content. That second rule is a sensible policy lever, and it also quietly confirms the technical point in this article. If removal were genuinely infeasible, there would be nothing to forbid. Some governance scholars have gone further and argued that, at the current state of the art, the detection the Article assumes is not yet fully realizable.
The tension is worth naming plainly, and without treating anyone as careless. The law asks for marking that is robust as far as technically feasible, while the research record shows that feasibility has real limits. The Code closes one door by forbidding removal tools as products. That keeps the easy button off the compliant market, and it cannot retract the published attacks or the open-source code that already demonstrate removal. For teams that fall under this regime, the practical work is documenting that your marking meets the state of the art and recording its known limits, which sits alongside the rest of your compliance readiness evidence rather than apart from it.
Who is Going to Build the Watermark Remover
The honest answer is that the research community already built it, in the open, and regulators are now working to keep it from becoming a shrink-wrapped product. Removal exists today as papers, benchmarks, and reference implementations. Whether a polished, one-click remover reaches the mainstream is now partly a policy question, since the Code of Practice discourages compliant providers from shipping one. Nothing in that constraint binds a non-compliant actor, and nothing stops a researcher from reproducing the result in the open.
For a security team, the identity of whoever ships the remover is the less interesting half of the question. The half that changes decisions is what you are trusting the watermark to do. A control that assumes a watermark cannot be removed has assumed a property the literature has broken more than once. The question is not academic for anyone building on top of generated media, because the assumption tends to hide inside a product decision rather than sitting in a threat model where someone would challenge it.
What This Means for Teams That Treat Provenance as a Control
The through-line from watermarking back to ordinary application security is a single habit: a boundary is only as good as what someone reproduces under test. Detection tells you a mark reads today. It does not tell you the mark survives an adversary who wants it gone, any more than a passing scan tells you an authorization check holds against a request crafted to slip past it.
That failure mode is common and undramatic. Earlier this year, our founder, Shashank reported CVE-2026-10753 in Google’s Site Kit plugin, which runs on millions of WordPress sites. A REST API write endpoint that should have been restricted to administrators could be reached by a lower-privileged editor who had been granted dashboard-sharing access, letting them change a site-wide setting. The boundary read as admin-only. Under test, it was not. A watermark presented as un-removable and an endpoint presented as admin-only fail in the same shape: the label described the intent, and only reproduction described the reality.
Closing that gap uses the same discipline whether the control is a provenance mark or an access check. You do not assume robustness. You reproduce the attack under realistic conditions, record what held and what failed, and put a named reviewer’s accountability behind the finding rather than a green checkmark. That is the difference between detection and validation, and it is the reason a control that has never been attacked should not be counted as one. For provenance specifically, that means running the removal playbook the research community has published, then reading the detector afterward, on a cadence that keeps pace with model and pipeline changes through continuous testing rather than a once-a-year snapshot.
Robustness checklist
A checklist for testing whether a watermark holds
Run this against any system that leans on watermarking today. Work through it before you treat a mark as a dependable signal.
You have run the full list. You now know whether your mark is a dependable signal or a disclosure layer that needs backup. The step that proves it is running the removal playbook against your own pipeline.
This tells you whether your mark is a dependable signal or a disclosure layer that needs support. If you want the removal playbook run against your own pipeline by people who do adversarial testing for a living, a human-led engagement can pressure-test the mark and the provenance layers behind it.
Pressure-test your watermarkingThe takeaway is practical, and it fits on a short checklist you can run against any system that leans on watermarking today. Work through it before you treat a mark as a dependable signal.
Classify what the watermark is for:
Provenance and disclosure, not access control and not rights enforcement. Marks are weak as a hard guarantee and useful as a disclosure layer, and naming the job prevents overreliance.
Write down the threat model:
A casual reposter, a motivated individual, and a resourced adversary call for different schemes, and a mark that stops the first may do nothing against the third.
Separate the visible label from the invisible mark:
Treat the badge as user-facing design, treat the statistical mark as the actual signal, and remember that a screenshot strips signed metadata while leaving the pixels.
Run the removal playbook, then read the detector:
Regeneration, paraphrase, translation, compression, and re-encoding are the documented attacks. Apply them, then measure whether detection still holds rather than trusting the vendor’s default claim.
Layer provenance signals:
Pair watermarking with signed C2PA metadata and server-side logging so that no single strippable layer carries the whole claim.
For EU exposure, document feasibility:
Record that your marking meets the state of the art and note its known limits, since Article 50 is judged against what is technically feasible at the time.
Re-test after any model or pipeline change:
A new image model, a new sampler, or an added editing step can silently drop or alter the mark you were relying on.
Frequently Asked Questions About Watermark Detection and Removal
Q1. Does “detectable implies removable” mean watermarks are useless?
No. Watermarks raise an attacker’s cost and serve disclosure and provenance, which is often the actual goal. They are weak when treated as a hard, unremovable guarantee and useful when treated as one signal among several in a layered design.
Q2. Can SynthID be removed?
In part, depending on effort and modality. Research shows image watermarks, including strong schemes, degrade under regeneration, and SynthID-Text confidence drops under paraphrase and translation. Google reports robustness to common edits such as cropping and mild filtering, which is a different and lower bar than a determined adversary who is willing to regenerate or rewrite the content.
Q3. Is building a watermark remover legal in the EU?
The Code of Practice bars compliant providers from offering tools designed to remove AI markings, which is a provider obligation and a signal of regulatory intent. General legality varies by jurisdiction and by use, and this is not legal advice.
Q4. Is C2PA the same thing as a watermark?
No. C2PA is signed provenance metadata attached to a file. It is cryptographically strong where it sits, and it can be stripped by a screenshot or a re-encode, which is why it is usually paired with a watermark rather than relied on alone.
Q5. What is the difference between the visible badge and the invisible watermark?
The visible badge is a label that can be cropped or painted out. The invisible watermark is a statistical property spread across the content and is meaningfully harder to remove, though not immune to regeneration or paraphrase.
Q6. How do we actually test whether our provenance layer holds?
Treat it as an exploitable control and attack it. Apply the published removal methods for your modality, read the detector afterward, and record the results the way you would any pentest finding, with a named reviewer and a reproducible method rather than a single confidence score.