noai-watermark 0.1.2

AI Metadata Toolkit for cloning, checking, cleaning, and watermark removal

              ███╗   ██╗ ██████╗  █████╗ ██╗
              ████╗  ██║██╔═══██╗██╔══██╗██║
              ██╔██╗ ██║██║   ██║███████║██║
              ██║╚██╗██║██║   ██║██╔══██║██║
              ██║ ╚████║╚██████╔╝██║  ██║██║
              ╚═╝  ╚═══╝ ╚═════╝ ╚═╝  ╚═╝╚═╝
                 ─── noai-watermark ───

noai-watermark

Remove invisible watermarks and manage AI image metadata.

AI image generators (Google Gemini, DALL-E, Midjourney, Stable Diffusion, etc.) embed invisible markers into every image they produce. These markers come in two forms:

• Invisible watermarks — signals hidden directly in the pixel data (e.g. SynthID, StableSignature, TreeRing). They survive file format conversions, screenshots, and basic editing. Standard image editors cannot see or remove them.
• AI metadata — text fields stored alongside the image (EXIF tags, PNG text chunks, C2PA provenance manifests). They record the model, prompt, seed, and generation parameters.

noai-watermark removes both. It uses diffusion-based image regeneration — encoding the image into latent space, injecting noise to break watermark patterns, and reconstructing via reverse diffusion — so the output is visually faithful but no longer carries the hidden signal. All AI metadata is automatically stripped from the output as well.

The controllable regeneration approach is based on Liu et al. (arXiv:2410.05470) and the CtrlRegen repository.

---

Table of Contents

1. Example
2. Ethics and Responsible Use
3. Quick Start
4. Installation
5. Pipeline Profiles
6. CLI Reference
7. Python API
8. Watermark Removal Guide
9. Verification
10. AI Metadata Types
11. Troubleshooting
12. Project Structure
13. Testing
14. Acknowledgements

---

Example

Default settings (--strength 0.15 --steps 50) — watermark removed, image visually unchanged:

Source (SynthID watermarked)	Cleaned (watermark removed)

SynthID verification result on cleaned image:

"Based on a SynthID analysis, this image was not made with Google AI. However, it is not possible to determine if it was generated or edited using other AI tools."

noai-watermark source.png --remove-watermark --strength 0.15 --steps 50 -o cleaned.png

---

Ethics and Responsible Use

Why this tool exists

Invisible watermarks like SynthID, StableSignature, and TreeRing are being positioned as the backbone of AI content detection. Companies and platforms present them as robust, reliable proof of AI origin. But how robust are they really?

A single img2img pass at low strength is enough to fool SynthID in most cases. If these systems are supposed to underpin trust and content authenticity on the internet, the public needs to know how fragile they actually are — not just researchers behind closed doors.

This project exists to make that fragility visible. If watermark-based detection can be defeated by a few lines of open-source code, it shouldn't be sold as bulletproof. Public scrutiny is how we get to better, more honest solutions.

Intended use

• Security research — stress-testing watermark robustness, measuring false positive/negative rates
• Defensive analysis — validating whether your provenance pipeline actually holds up
• Interoperability testing — evaluating how watermarks behave across formats, edits, and re-encoding

What not to do

Don't use this to strip attribution from content that isn't yours. Don't use it to bypass platform policies or misrepresent authorship. Keep original files when running experiments. Comply with applicable laws and terms of service.

---

Quick Start

pip install "noai-watermark[watermark]"

noai-watermark source.png --remove-watermark -o cleaned.png

For best quality (larger download):

pip install "noai-watermark[ctrlregen]"

noai-watermark source.png --remove-watermark --model-profile ctrlregen -o cleaned.png

---

Installation

From PyPI

# Metadata tools only (no ML dependencies)
pip install noai-watermark

# Default watermark removal (img2img)
pip install "noai-watermark[watermark]"

# CtrlRegen watermark removal (best quality)
pip install "noai-watermark[ctrlregen]"

From GitHub

pip install "git+https://github.com/mertizci/noai-watermark.git"
pip install "noai-watermark[watermark] @ git+https://github.com/mertizci/noai-watermark.git"

Local Development

git clone https://github.com/mertizci/noai-watermark.git
cd noai-watermark
pip install -e ".[dev,watermark,ctrlregen]"

Requirements

• Python >= 3.10
• Core: pillow >= 10.0.0, piexif >= 1.1.3
• Watermark removal: torch >= 2.0.0, diffusers >= 0.25.0, transformers >= 4.35.0, accelerate >= 0.25.0
• Supported formats: PNG, JPEG

---

Pipeline Profiles

Two regeneration pipelines are available. Both use diffusion-based reconstruction — they differ in quality, speed, and download size.

	default	ctrlregen
Method	Img2img — adds noise then denoises to reconstruct the image	ControlNet (canny edges) + DINOv2 IP-Adapter (semantic guidance) + histogram color matching
Quality	Good — may drift on fine details at high strength	Best — preserves structure and color more faithfully
Speed	Faster	Slower (multiple models in the pipeline)
Install	pip install "noai-watermark[watermark]"	pip install "noai-watermark[ctrlregen]"

Recommendation: Start with default for quick iteration. Switch to ctrlregen when output quality is the priority.

Download sizes are estimated dynamically from HuggingFace Hub before the first run. Models are cached locally after download — subsequent runs are instant.

CtrlRegen model breakdown

Model	Role
SG161222/Realistic_Vision_V4.0_noVAE	SD 1.5 base model
yepengliu/ctrlregen	ControlNet + IP-Adapter weights
facebook/dinov2-giant	DINOv2 image encoder
stabilityai/sd-vae-ft-mse	High-quality VAE

--model-profile vs --model

These are two different CLI flags:

• --model-profile selects the pipeline architecture — default (simple img2img) or ctrlregen (ControlNet + IP-Adapter).
• --model selects the base Stable Diffusion checkpoint used inside that pipeline. Any SD 1.5-compatible HuggingFace model ID works.

Example: --model-profile default --model runwayml/stable-diffusion-v1-5 uses the simple img2img pipeline with SD v1.5 weights instead of the default DreamShaper.

---

CLI Reference

All commands use noai-watermark (alias: photo-metadata). Add -v to any command for verbose output.

Watermark Removal

# Basic removal
noai-watermark source.png --remove-watermark -o cleaned.png

# Force CPU inference (recommended on Mac)
noai-watermark source.png --remove-watermark --device cpu -o cleaned.png

# Custom strength and steps
noai-watermark source.png --remove-watermark --strength 0.7 --steps 60 -o cleaned.png

# CtrlRegen profile
noai-watermark source.png --remove-watermark --model-profile ctrlregen -o cleaned.png

# Skip download confirmation prompt
noai-watermark source.png --remove-watermark -y -o cleaned.png

# With HuggingFace token (or set HF_TOKEN env var)
noai-watermark source.png --remove-watermark --hf-token hf_xxxxx -o cleaned.png

Metadata Operations

# Clone all metadata from source to target
noai-watermark source.png target.png -o output.png

# Clone only AI metadata
noai-watermark source.png target.png -o output.png --ai-only

# Check for AI metadata
noai-watermark source.png --check-ai

# Remove AI metadata (keeps standard EXIF/XMP)
noai-watermark source.png --remove-ai -o cleaned.png

# Remove all metadata
noai-watermark source.png --remove-ai --remove-all-metadata -o cleaned.png

---

Python API

Watermark Removal

from pathlib import Path
from watermark_remover import WatermarkRemover, remove_watermark, is_watermark_removal_available

if is_watermark_removal_available():
    # Quick one-off usage
    remove_watermark(
        image_path=Path("watermarked.png"),
        output_path=Path("cleaned.png"),
        strength=0.15,
    )

    # Persistent instance (recommended for batch/repeated use)
    remover = WatermarkRemover(model_id="Lykon/dreamshaper-8", device="cpu")
    remover.remove_watermark(
        image_path=Path("watermarked.png"),
        output_path=Path("cleaned.png"),
        strength=0.15,
        num_inference_steps=50,
        guidance_scale=7.5,
        seed=42,
    )

    # Batch mode
    remover.remove_watermark_batch(
        input_dir=Path("input_images"),
        output_dir=Path("cleaned_images"),
        strength=0.15,
    )

Metadata Operations

from pathlib import Path
from metadata_handler import (
    clone_metadata, extract_metadata, extract_ai_metadata,
    has_ai_metadata, remove_ai_metadata, has_c2pa_metadata, extract_c2pa_info,
)

# Clone metadata between images
clone_metadata(Path("source.png"), Path("target.png"), Path("output.png"))

# Inspect AI metadata
ai_meta = extract_ai_metadata(Path("image.png"))
print(has_ai_metadata(Path("image.png")))

# C2PA provenance
if has_c2pa_metadata(Path("image.png")):
    print(extract_c2pa_info(Path("image.png")))

# Strip AI metadata
remove_ai_metadata(Path("image.png"), Path("cleaned.png"))

---

Watermark Removal Guide

How It Works

1. Encode — the input image is projected into diffusion latent space via the VAE encoder.
2. Noise — controlled noise is injected according to strength, disrupting hidden watermark patterns embedded in the pixel data.
3. Denoise — the diffusion model reconstructs the image over steps iterations via reverse diffusion.
4. Decode — the VAE decoder converts the clean latents back to pixel space, producing an output with reduced or eliminated watermark artifacts.

This targets invisible/embedded watermark traces (SynthID, StableSignature, TreeRing, etc.), not visible logos or text overlays.

Parameters

Parameter	Default	Description
--strength	0.15	How strongly the image is regenerated (0.0–1.0). Higher = more watermark removal but more visual change.
--steps	50	Denoising iterations. More steps = better quality, slower.
--model-profile	default	Pipeline architecture: default or ctrlregen. See Pipeline Profiles.
--model	Lykon/dreamshaper-8	Base SD checkpoint. Any SD 1.5-compatible HuggingFace model ID.
--device	auto	Inference device: auto, cpu, mps, or cuda.
--hf-token	—	HuggingFace API token. Falls back to HF_TOKEN env var.
-y	—	Skip the download confirmation prompt.

Recommended Presets

Use Case	Flags
Minimal change (default)	--strength 0.15 --steps 50
Balanced	--strength 0.35 --steps 50
Aggressive cleanup	--strength 0.65 --steps 60
Maximum removal	--strength 0.7 --steps 60

Tuning Tips

• Watermark still detected? Increase --strength by 0.05–0.1.
• Image changed too much? Decrease --strength, keep --steps moderate.
• Output noisy or rough? Increase --steps by 10–20.
• Too slow? Reduce --steps first, then consider a smaller model.
• MPS out of memory? Use --device cpu or lower --strength.

Compatible Base Models

Any SD 1.5-compatible model from HuggingFace works with --model:

Model	Notes
Lykon/dreamshaper-8	Default. Balanced quality and speed.
runwayml/stable-diffusion-v1-5	Classic baseline.
SG161222/Realistic_Vision_V5.1_noVAE	Photorealistic output.
segmind/tiny-sd	Lower memory usage, smaller download.

Browse more at HuggingFace.

---

Verification

Test watermark removal end-to-end with Google SynthID:

1. Generate a watermarked image at Google AI Studio or Gemini.
2. Remove the watermark:

noai-watermark image.png --remove-watermark -o cleaned.png

3. Verify by uploading both images to AI Studio and using the SynthID detection tool.

Image	Expected SynthID Result
Original	"This image contains a SynthID watermark, which indicates that all or part of it was generated or edited using Google AI."
Cleaned	"This image was not made with Google AI."

See the Example section for a real before/after comparison with default settings.

Results vary with strength, steps, and model choice.

---

AI Metadata Types

The following AI metadata sources are detected and can be cloned or stripped:

Source	Fields
Stable Diffusion WebUI	parameters, postprocessing, extras
ComfyUI	workflow, prompt
Common AI keys	prompt, seed, model, sampler, etc.
C2PA provenance	Google Imagen, OpenAI DALL-E, Adobe Firefly, Microsoft Designer

---

Troubleshooting

Problem	Solution
ImportError for torch / diffusers	pip install "noai-watermark[watermark]"
HuggingFace Hub rate limit	Set HF_TOKEN env var or pass --hf-token
MPS backend out of memory	Use --device cpu, or lower --strength and --steps
Output too different from input	Decrease --strength
Very slow on CPU	Reduce --steps, or use a GPU with --device cuda

---

Project Structure

src/
  __init__.py            # Package root and public API re-exports
  metadata_handler.py    # Public API facade for metadata operations
  constants.py           # AI metadata detection lists and config
  utils.py               # Format helpers
  c2pa.py                # C2PA chunk detection / extraction / injection
  extractor.py           # Read-only metadata extraction
  injector.py            # Write metadata into images
  cleaner.py             # AI metadata identification and removal
  cloner.py              # High-level extract -> inject pipeline
  watermark_remover.py   # WatermarkRemover class and orchestration
  watermark_profiles.py  # Model IDs, strength presets, profile detection
  img2img_runner.py      # Img2img execution with progress and MPS fallback
  cli.py                 # CLI argument parsing and routing
  cli_watermark.py       # --remove-watermark command handler
  download_ui.py         # Download progress bars, size estimation, prompts
  progress.py            # Terminal animation and shared pipeline helpers
  ctrlregen/             # CtrlRegen sub-package (optional)
    __init__.py
    engine.py            # Pipeline orchestration and single-image inference
    tiling.py            # Tile-based processing for large images
    pipeline.py          # SD + ControlNet + IP-Adapter pipeline
    ip_adapter.py        # DINOv2-based IP-Adapter mixin
    color.py             # Histogram color matching

tests/
  conftest.py              test_constants.py
  test_utils.py            test_c2pa.py
  test_extractor.py        test_injector.py
  test_cleaner.py          test_cloner.py
  test_metadata_handler.py test_watermark_remover.py
  test_watermark_profiles.py
  test_download_ui.py      test_progress.py
  test_ctrlregen.py

---

Testing

pip install -e ".[dev]"
pytest
pytest --cov=src --cov-report=html

---

Acknowledgements

The CtrlRegen integration is adapted from yepengliu/CtrlRegen (Apache-2.0) by Yepeng Liu, Yiren Song, Hai Ci, Yu Zhang, Haofan Wang, Mike Zheng Shou, and Yuheng Bu.

@article{liu2024ctrlregen,
  title   = {Image watermarks are removable using controllable regeneration from clean noise},
  author  = {Liu, Yepeng and Song, Yiren and Ci, Hai and Zhang, Yu and Wang, Haofan and Shou, Mike Zheng and Bu, Yuheng},
  journal = {arXiv preprint arXiv:2410.05470},
  year    = {2024}
}