/remove-ai-marks

Vendor notes (public / class-level)

This skill targets mark classes, not reverse-engineered private detectors. Details below are from public docs and the research literature. Algorithms may change.

Industry two-layer model (context)

Product and regulatory guidance often frames AI disclosure as:

1. C2PA Content Credentials — signed, hard-bound metadata (easy to strip; what this skill removes).
2. Imperceptible watermark (SynthID-class) — survives strip/re-upload; includes soft binding that can re-attach a remote C2PA manifest.

See: Institute of AI PM — C2PA and SynthID guide (SB 942 / EU AI Act Art. 50 framing). This project only implements the hard-bound / Unicode / rewrite side of that stack.

Anthropic / Claude

• Embedded text watermarks at model level (imperceptible; survive copy-paste). Public description matches statistical token-sampling class, not only Unicode.
• C2PA Content Credentials on supported files (e.g. PNG, JPEG, SVG).
• Models launched on/after 2026-08-02: marking at launch; older models in transition; worldwide.
• Detection APIs for third parties: described as forthcoming.
• Caveats: mark ⇒ may have been processed by Claude; no mark ≠ human-only; proofreading can stamp human text.

Skill mapping: Layer A (Unicode hygiene) + Layer B (rewrite) + container/image C2PA strip.

Source: How Claude marks AI-generated content.

Google Gemini / SynthID-Text

• Nature 2024 paper: Scalable watermarking for identifying large language model outputs (SynthID-Text).
• Generative watermarking: modifies next-token sampling (Tournament sampling); detection uses a scoring function + key; no need for the LLM at detect time.
• Paper also taxonomizes:
  • Edit-based (Unicode / synonym rules) → our Layer A (+ Layer B for synonyms)
  • Data-driven / backdoor (trigger phrases) → out of scope
  • Generative (sampling) → Layer B best-effort
• Productionized in Gemini-scale systems; open research code exists, but production keys are not public — this skill does not ship a SynthID detector.
• Retired from the API (Aug 2026): Google confirmed the Generative Language API no longer watermarks text output and DETECT_TEXT_WATERMARK is rejected on current (3.x) models; "native text watermarking is not planned at the moment" (Google AI forum). The gemini-synthid-text detector was removed for this reason; a vendor detector can be re-added (e.g. via Vertex AI) if Google exposes detection again.
• Optional external verification harness: THU-BPM/MarkLLM (Apache-2.0) reimplements SynthID-Text among other schemes with configurable keys; wired as detect_text_watermark.py / rewrite_text.py --markllm-scheme. Same-config-only — it verifies a mark you generated under a known config, not Google's production keying.
• Current frontier production watermarks are token-by-token (streaming constraint); paragraph-level robust methods (SemStamp / PostMark) are not deployed yet, which keeps paraphrase-class attacks effective today.
• Optional external reference: aloshdenny/reverse-SynthID provides a reverse-engineered pixel-domain scorer. It is not bundled here, is best-effort, and is under a non-commercial Research License; it is not the official Google detector.
• Optional pixel-domain removal: mertizci/noai-watermark's CtrlRegen profile is wired through clean_image.py --remove-pixel ctrlregen / clean_ctrlregen.py. It is not bundled (no LICENSE file → all-rights-reserved), and no local detector certifies the result; the official Google check is the final authority. For Tree-Ring-class marks, the optional MarkDiffusion harness (markdiffusion_harness.py, Apache-2.0) adds a same-scheme detector and a blind-regeneration removal engine (--remove-pixel diffusion) — see references/markdiffusion.md.

Skill mapping: same Layer B rewrite attacks (paraphrase / back-translate / structural) used in the literature against sampling watermarks.

OpenAI / ChatGPT

• Public provenance often surfaces as labels, C2PA / Content Credentials on some media exports, and product UI disclosure — not a fully public text-sampling watermark spec comparable to SynthID-Text.
• Treat file metadata / C2PA as in-scope when present; treat any unpublished text watermark as the same statistical class → Layer B only, best-effort.
• Do not invent algorithm claims.

Skill mapping: container/image metadata strip + Layer A/B on text.

Open-weight / open-LLM (Kirchenbauer-style)

• Classic green-list / red-list sampling bias (Kirchenbauer et al.) and variants.
• Detectable with the key and tokenizer; removal still relies on heavy paraphrase or regeneration.
• Optional external harness: MarkLLM (detect_text_watermark.py --scheme kgw) reproduces KGW detection under a config you control, for controlled before/after experiments.

Skill mapping: Layer B multi-pass; prefer rewrite with a different model family when possible.

Cross-vendor hygiene rule

Prefer local open-weight backends and avoid any known-watermarked vendor, not just the suspected origin. Then re-run Layer A on the rewritten text.