# In-Band Text Watermarks Are Removable by the Text's Holder ## Claim A provenance mark embedded in the text's own characters or token-selection statistics cannot survive against a holder motivated to strip it, because the holder controls the exact medium the mark lives in. <!-- atomicity: 1 idea ✓ --> ## Scope & conditions - Holds for in-band marks: invisible Unicode characters and statistical (token-sampling) watermarks embedded directly in AI-generated text. - Character-level marks are removed deterministically and near-losslessly; statistical marks require rewriting and cost some fidelity/style drift — so the two layers aren't equally cheap to defeat, but both are defeatable. - Does not extend to out-of-band provenance (signed metadata, platform attestation at upload/generation time) — that mechanism sits outside the text the holder controls and is not addressed by this claim. ## Evidence Guillaume Meyer's MIT-licensed `watermarks-remover` tool went from stripping only Claude's text watermarks to covering OpenAI's and Gemini's output as well, in a single small repository. It targets invisible-Unicode marks with deterministic stdlib scripts and statistical marks (SynthID-Text-style) via agent-driven rewriting. One open-source project covering all three major vendors' in-band schemes is a practical demonstration, not a formal proof, that character-embedded provenance signals don't survive a determined holder. ## Links - [[3. Resources/Permanent Notes/A Detector the Sophisticated Evade and the Naive Fail Is Worse Than No Detector]] — because applies-in: the same evasion-by-the-sophisticated pattern, here applied to watermark removal rather than AI-text detection. - [[3. Resources/Literature Notes/watermarks-remover Supports OpenAI + Gemini + Claude - Literature Note]] — because evidence-for: the specific release this claim generalizes from. - [[3. Resources/MOCs/AI & the Future of Knowledge Work MOC]] — because applies-in: bears directly on any AI-content disclosure or provenance policy the vault tracks. ## Tests / falsifiers - If a vendor ships a watermark scheme this tool (or a comparable successor) cannot strip without unacceptable text-quality loss, that would show in-band marking can be made durable against holder-side removal, at least for some fidelity tolerance — weakening the claim as stated. - Track whether AI-content regulation that mandates machine-detectable output marking shifts toward out-of-band attestation once in-band removal tools are widely known; continued reliance on in-band marking despite public removability would be a policy-lag finding, not a falsification of the technical claim. ## Maintenance - Last tended: 2026-08-16 - Next review: 2026-11-16 ## Source - [[3. Resources/Literature Notes/watermarks-remover Supports OpenAI + Gemini + Claude - Literature Note]] — the release-announcement tweet and the linked repository's documented two-layer approach.