External/watermarks-remover
1
0
Fork 0
mirror of https://github.com/guillaumemeyer/watermarks-remover.git synced 2026-08-22 13:11:57 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
feat/service-docker-distribution
watermarks-remover/skills/remove-ai-marks/references/removal-matrix.md
T
Guillaume Meyer (The Opinionated Man)andGitHub 61440192af feat: optional MarkDiffusion image-watermark harness and purification removal (#57) 
Add an optional harness around THU-BPM/MarkDiffusion (Apache-2.0) for
controlled image-watermark experiments and an alternative pixel-removal engine:

- markdiffusion_harness.py with watermark / detect / purify subcommands for
  nine image schemes (Tree-Ring, Ring-ID, ROBIN, WIND, SFW, Gaussian-Shading,
  GaussMarker, PRC, SEAL); same-scheme/same-model detection only
- clean_image.py --remove-pixel diffusion runs the DiffusionPurification
  regeneration attack (blind regeneration; conservative strength 0.3 default)
- setup_markdiffusion.sh bootstrap (PyPI pin 1.0.2; --checkout editable clone
  at pinned commit), requirements-markdiffusion.txt, Dockerfile.markdiffusion,
  Makefile targets, and mock-based tests (no torch in CI)
- Docs: README section, SKILL.md, removal-matrix.md, vendor-notes.md,
  references/markdiffusion.md
2026-08-14 11:22:40 -07:00

3.9 KiB
Raw Permalink Blame History

Removal matrix

Target Method Script / action Side effects Verifiable today?
Invisible Unicode / exotic spaces / bidi / tags Strip / normalize inspect_text.py, clean_text.py, clean_file.py Minimal Yes (codepoint report)
Statistical text watermark (SynthID-class / Kirchenbauer) Multi-pass paraphrase / humanize / back-translate / structural Agent Layer B + optional rewrite_text.py Meaning/style drift No without vendor key/detector; MarkLLM harness (detect_text_watermark.py) verifies a specific scheme config before/after
C2PA on PNG/JPEG/WebP Drop APP11 / PNG caBX / RIFF C2PA / exiftool clean_image.py Loses provenance metadata Yes
SVG metadata / XMP Drop <metadata>, xmpmeta clean_file.py Loses SVG metadata Yes (re-inspect)
PDF XMP / info exiftool -all= preferred clean_file.py Loses PDF metadata; degraded without exiftool Partial
DOCX props / customXml Rewrite OOXML zip clean_file.py Loses doc properties Yes
ODT meta:generator Scrub meta.xml clean_file.py Loses generator tag Yes
HTML generator / JSON-LD provenance Strip tags clean_file.py Loses meta Yes
Markdown AI frontmatter keys Drop keys clean_file.py Loses YAML keys Yes
Pixel image watermark (SynthID-media / StegaStamp / Tree-Ring / StableSignature) CtrlRegen regeneration (external backend) clean_ctrlregen.py / clean_image.py --remove-pixel ctrlregen Regenerates pixels; heavy compute; detail drift at higher strength No without official detector; reverse-SynthID score is a local surrogate; MarkDiffusion same-scheme harness (markdiffusion_harness.py detect) verifies a Tree-Ring-class scheme config before/after
Pixel image watermark (Tree-Ring-class) DiffusionPurification regeneration (external MarkDiffusion backend) clean_image.py --remove-pixel diffusion Blind regeneration; more drift than CtrlRegen; heavy compute Same-scheme only via the MarkDiffusion harness (not a vendor-detector oracle)
Audio / video watermarks (SynthID-media) — Out of scope — —
C2PA soft binding (in-content link to manifest) — Out of scope (survives our metadata strip) — Vendor detector only
Data-driven model backdoors — Out of scope — —

Default pipeline

  1. Inspect (inspect_file.py or specific inspect_*).
  2. Deterministic clean — Layer A text and/or container/image metadata; for images, optionally add pixel removal (--remove-pixel ctrlregen) after the metadata strip.
  3. Always offer Layer B rewrite for prose (paraphrase → optional strong pass: humanize / back-translate / structural).
  4. Prefer a non-origin, open-weight rewrite model when available (avoid re-stamping).
  5. Layer A again after rewrite.
  6. Report: Layer B is best-effort; residual risk remains.
  7. Optional verification: rewrite_text.py --markllm-scheme kgw|synthid runs a MarkLLM before/after detection (external detect_text_watermark.py harness) to show a specific scheme config clears. Same-config-only; not a vendor-detector oracle.

Code vs prose

  • Prose / Markdown / HTML body: full A + B.
  • Code: Layer A + formatter; statistical marks are weak; offer code rewrite (comments/docstrings/string-literal wording + local identifier renames) with user OK.

Layer B strengths

Strength When
paraphrase Default; explicit word-choice + syntax churn
humanize Zero-shot "write like a human" token reshuffle
backtranslate Stronger token reshuffle via pivot language
structural Strongest; most drift (outline → human prose)
code Comments/docstrings/string-literal wording + local identifier renames

Frontier production watermarks are currently token-by-token (streaming constraint); paragraph-level robust methods (SemStamp / PostMark) are not yet deployed, so paraphrase-class attacks remain effective today.

Reference in New Issue View Git Blame Copy Permalink