Can AI Watermarks Be Removed?

OpenAI's documentation says C2PA metadata can be stripped, lost through uploads and downloads, or broken by transformations such as format changes, resizing, or screenshots.

That is exactly why OpenAI pairs metadata with a separate SynthID watermark on generated images. C2PA carries detailed context when it survives, and SynthID is meant to preserve a signal when the metadata does not.

The forum thread above shows how low the bar really is. The original file still verified fine on OpenAI's own tool, both SynthID and Content Credentials intact, while the re-uploaded copy came back bare.

A missing manifest, in other words, is not proof that content was never generated or edited by AI. It might just mean the file passed through one ordinary upload.

OpenAI and Meta both describe invisible media watermarks as signals built to survive common transformations better than metadata does, including cropping, recompression, and minor edits.

Meta layers three things on its AI images: visible markers, invisible watermarks, and metadata. "Robust" here means intended to persist better than ordinary metadata under normal editing and sharing, not immune to a determined attacker.

Independent testing has found real daylight between that design intent and practice. A November 2025 investigation, published on LessWrong and cross-posted to the EA Forum, checked Sora 2 videos against both OpenAI's own Verify tool and the open-source c2pa-rs CLI.

Videos carrying OpenAI's visible watermark had no detectable C2PA metadata at all. Pro-tier videos without the visible watermark did carry detectable metadata.

That is close to the reverse of OpenAI's own public claim that every video generated with Sora includes both visible and invisible provenance signals.

A command-line tool for removing AI watermarks from images cleanly stripped only the visible watermark, and defeating SynthID reportedly required regenerating the whole image through SDXL, which degraded quality.

That was the technical finding buried in the highest-engagement watermark thread on Hacker News, 387 points and 258 comments on May 19, 2026.

On a separate thread the same day, a commenter claimed that running an image back through Stable Diffusion at 10 to 15 percent denoising strength defeated OpenAI's SynthID check, saying they tested it on the day Nano Banana Pro shipped.

None of this is an audited test. But it matches a pattern commenters keep returning to: a watermark only exists on systems that choose to participate, so pushing content through a different pipeline sidesteps the scheme rather than attacking it.

Google's own documentation says SynthID Text's detector confidence can be greatly reduced when text is thoroughly rewritten or translated into another language.

The same docs describe it as robust to milder edits: cropping a passage, changing a few words, light paraphrasing. The Nature paper behind SynthID Text frames edits, paraphrasing, stealing, spoofing, and scrubbing as open research problems, not solved ones.

A separate, non-SynthID benchmark gives a concrete sense of scale. Kirchenbauer and colleagues stress-tested the original green-list token watermarking scheme against human rewriting, LLM paraphrasing, and dilution inside longer mixed documents.

The mark stayed statistically detectable after strong human paraphrasing once a detector had roughly 800 tokens to examine, at a 1-in-100,000 false-positive rate. That is a different scheme from SynthID Text, so the number does not transfer directly.

Whether removing a watermark is legal depends on ownership, consent, platform terms, and jurisdiction. Several governments have already moved from vague policy language to specific prohibitions.