mirror of
https://github.com/guillaumemeyer/watermarks-remover.git
synced 2026-08-22 13:11:57 +02:00
Guillaume Meyer (The Opinionated Man)andGitHub
61440192af
Add an optional harness around THU-BPM/MarkDiffusion (Apache-2.0) for controlled image-watermark experiments and an alternative pixel-removal engine: - markdiffusion_harness.py with watermark / detect / purify subcommands for nine image schemes (Tree-Ring, Ring-ID, ROBIN, WIND, SFW, Gaussian-Shading, GaussMarker, PRC, SEAL); same-scheme/same-model detection only - clean_image.py --remove-pixel diffusion runs the DiffusionPurification regeneration attack (blind regeneration; conservative strength 0.3 default) - setup_markdiffusion.sh bootstrap (PyPI pin 1.0.2; --checkout editable clone at pinned commit), requirements-markdiffusion.txt, Dockerfile.markdiffusion, Makefile targets, and mock-based tests (no torch in CI) - Docs: README section, SKILL.md, removal-matrix.md, vendor-notes.md, references/markdiffusion.md
3.9 KiB
3.9 KiB
Removal matrix
| Target | Method | Script / action | Side effects | Verifiable today? |
|---|---|---|---|---|
| Invisible Unicode / exotic spaces / bidi / tags | Strip / normalize | inspect_text.py, clean_text.py, clean_file.py |
Minimal | Yes (codepoint report) |
| Statistical text watermark (SynthID-class / Kirchenbauer) | Multi-pass paraphrase / humanize / back-translate / structural | Agent Layer B + optional rewrite_text.py |
Meaning/style drift | No without vendor key/detector; MarkLLM harness (detect_text_watermark.py) verifies a specific scheme config before/after |
| C2PA on PNG/JPEG/WebP | Drop APP11 / PNG caBX / RIFF C2PA / exiftool |
clean_image.py |
Loses provenance metadata | Yes |
| SVG metadata / XMP | Drop <metadata>, xmpmeta |
clean_file.py |
Loses SVG metadata | Yes (re-inspect) |
| PDF XMP / info | exiftool -all= preferred |
clean_file.py |
Loses PDF metadata; degraded without exiftool | Partial |
| DOCX props / customXml | Rewrite OOXML zip | clean_file.py |
Loses doc properties | Yes |
| ODT meta:generator | Scrub meta.xml |
clean_file.py |
Loses generator tag | Yes |
| HTML generator / JSON-LD provenance | Strip tags | clean_file.py |
Loses meta | Yes |
| Markdown AI frontmatter keys | Drop keys | clean_file.py |
Loses YAML keys | Yes |
| Pixel image watermark (SynthID-media / StegaStamp / Tree-Ring / StableSignature) | CtrlRegen regeneration (external backend) | clean_ctrlregen.py / clean_image.py --remove-pixel ctrlregen |
Regenerates pixels; heavy compute; detail drift at higher strength | No without official detector; reverse-SynthID score is a local surrogate; MarkDiffusion same-scheme harness (markdiffusion_harness.py detect) verifies a Tree-Ring-class scheme config before/after |
| Pixel image watermark (Tree-Ring-class) | DiffusionPurification regeneration (external MarkDiffusion backend) | clean_image.py --remove-pixel diffusion |
Blind regeneration; more drift than CtrlRegen; heavy compute | Same-scheme only via the MarkDiffusion harness (not a vendor-detector oracle) |
| Audio / video watermarks (SynthID-media) | — | Out of scope | — | — |
| C2PA soft binding (in-content link to manifest) | — | Out of scope (survives our metadata strip) | — | Vendor detector only |
| Data-driven model backdoors | — | Out of scope | — | — |
Default pipeline
- Inspect (
inspect_file.pyor specific inspect_*). - Deterministic clean — Layer A text and/or container/image metadata; for images, optionally add pixel removal (
--remove-pixel ctrlregen) after the metadata strip. - Always offer Layer B rewrite for prose (paraphrase → optional strong pass:
humanize/ back-translate / structural). - Prefer a non-origin, open-weight rewrite model when available (avoid re-stamping).
- Layer A again after rewrite.
- Report: Layer B is best-effort; residual risk remains.
- Optional verification:
rewrite_text.py --markllm-scheme kgw|synthidruns a MarkLLM before/after detection (externaldetect_text_watermark.pyharness) to show a specific scheme config clears. Same-config-only; not a vendor-detector oracle.
Code vs prose
- Prose / Markdown / HTML body: full A + B.
- Code: Layer A + formatter; statistical marks are weak; offer
coderewrite (comments/docstrings/string-literal wording + local identifier renames) with user OK.
Layer B strengths
| Strength | When |
|---|---|
paraphrase |
Default; explicit word-choice + syntax churn |
humanize |
Zero-shot "write like a human" token reshuffle |
backtranslate |
Stronger token reshuffle via pivot language |
structural |
Strongest; most drift (outline → human prose) |
code |
Comments/docstrings/string-literal wording + local identifier renames |
Frontier production watermarks are currently token-by-token (streaming constraint); paragraph-level robust methods (SemStamp / PostMark) are not yet deployed, so paraphrase-class attacks remain effective today.