A Free Tool to Strip AI Watermarks Just Went Viral. Its Own Docs Argue Against Using It.

Days after Anthropic said Claude would start watermarking everything it writes, a countermeasure showed up on GitHub. watermarks-remover strips AI provenance marks from text and files, and it's spreading fast as the answer to Anthropic, Google, and everyone else shipping mandatory watermarks under the EU AI Act.

The tool works in two layers. Layer A is boring and legitimate: it scrubs invisible Unicode characters, zero-width spaces, and bidi markers that AI tools sometimes leave behind. That part is real hygiene, not evasion. Layer B is the interesting one. Modern text watermarks like Google's SynthID-Text and Claude's new mark don't hide in characters or metadata. They hide in which words the model picked, a statistical pattern spread across long stretches of text that a detector can catch even after light edits. Layer A does nothing to that. So Layer B hands your text to a second AI model and has it reword sentence by sentence, swapping synonyms that read naturally, hoping to scramble the pattern enough to stop it registering.

The tool's own documentation makes a case against using it.

The README is more candid than most vendor marketing. It says plainly that no tool can honestly certify text will pass an official detector check, that rewriting flattens tone and precision because "the result cannot exceed the rewrite model's ceiling," and then asks the question that undercuts its own pitch: if you're going to reword a premium model's output with a cheaper one anyway, why pay for the premium model at all? Generating with the cheaper model directly gets the same or better result for less money and no laundering step.

Three things worth taking from this, ranked by what changes your workflow most.

1. If getting caught using AI would be bad, stripping the watermark doesn't fix the problem. Scrambling a statistical pattern doesn't turn AI-assisted work into work you did yourself. It adds one more step between you and whoever finds out anyway, nothing more.
2. The clean way to avoid vendor watermarks is to not route sensitive output through a watermarked vendor at all. Watermarking happens at the inference layer, where the vendor controls token sampling. Self-hosted open-weight models like Qwen or DeepSeek don't carry that requirement, because you're the one running inference and nobody is biasing your token choices for you. Both ship under permissive licenses (Apache 2.0 and MIT) built for exactly this kind of self-hosting, and both hold up well against proprietary models on coding and reasoning benchmarks.
3. A watermark only ever proved one thing, and stripping it doesn't change what you actually need to prove. As covered here in a previous blog post, the mark shows Claude touched your text. It never showed the output matched an approved spec or a real process. Removing the mark doesn't give you that record either. If provenance is the actual concern, a spec-driven paper trail solves it. A rewrite pass just hides the one weak signal that existed.

None of this makes the disclosure requirement disappear. It moves the risk from getting caught to never having a record in the first place, and that's a worse position to be in the day someone asks.