Skip to main content
AI Watermark Removal

Modality

Image AI Watermarking: OpenAI, Google, Meta, and Amazon

Images are the most mature corner of AI provenance. OpenAI, Google, Meta and Amazon all confirm invisible watermarks, and most of them pair that with C2PA metadata, engineered through adversarial training so the pixel signal outlasts a crop or a re-save. Google says SynthID has marked more than ten billion images and video frames across its services, a self-reported number. But a thread on OpenAI's own developer forum shows valid C2PA metadata getting stripped on a single round trip through ChatGPT, and academic work has broken the broader category of low-perturbation pixel watermarks in controlled tests. None of this is what the generic watermark-remover tools do, which is erase a photographer's visible logo.

Published 2026-08-11Updated 2026-08-11Confirmed

Key takeaways

  • OpenAI (since 2026-05-19) and Amazon's Titan confirm invisible watermark plus C2PA metadata by default on generated images. Meta confirms invisible watermark plus metadata, not specifically C2PA. Amazon's Nova Canvas is confirmed only for the invisible watermark.
  • Google's SynthID-Image paper claims over ten billion images and video frames watermarked. That is a Google-authored figure, not a third-party audit.
  • Metadata and pixel watermarks are complementary, not redundant. C2PA carries far more context but is easily stripped by re-uploads; a pixel watermark carries almost no context but is trained against a distortion-detector network to survive transformations.
  • Independent testing found real gaps: a ChatGPT-uploaded PNG lost its valid C2PA metadata down to bare chunks, an unresolved OpenAI developer-forum report from 2026-06-28.
  • Research on the broader class of invisible pixel watermarks, not these specific shipped systems, has shown diffusion purification can remove them, that black-box access can spoof one onto an unmarked image, and that a fully black-box universal attack exists (UnMarker, IEEE S&P 2025).
  • If you want to erase a visible logo from an ordinary photo, you need a completely different kind of tool. The invisible provenance layer is not something you can crop out.

Media watermarking

How image, audio, and video marking differs from text

Embedded in the signal, not the sampling

Image, audio, and video watermarks (SynthID, Content Seal, Stable Signature) are embedded directly into pixels, audio samples, or frames after generation. This is a different mechanism from statistical text watermarking, which biases token choice during generation.

Designed for robustness, not guaranteed

Providers describe these signals as surviving common transformations such as cropping, compression, or resizing better than file metadata does. That is a robustness design goal, not a claim that the signal is unremovable.

Why this matters for removal tools

A tool that strips file metadata does not touch an embedded pixel, audio, or video watermark, and vice versa. Claims of "AI watermark removal" for media should specify which of these signals (metadata, embedded signal, or visible mark) a tool actually addresses.

Who marks images, and what's actually confirmed

Confirmed

You'll get the exact confirmation level for each of the four big image generators, including where the documentation stops.

Every major image generator now embeds something. The differences are in what, and in how much of it is actually documented.

  • OpenAI: SynthID invisible watermark plus C2PA Content Credentials on images from ChatGPT, the API and Codex, since 2026-05-19, the day it joined the C2PA steering committee and achieved C2PA Conforming Generator Product status. Checkable at openai.com/verify.
  • Google: SynthID across its own services. The DeepMind SynthID-Image paper states the system "has been used to watermark over ten billion images and video frames across Google's services."
  • Meta: visible markers, invisible watermarks and metadata together on photorealistic AI images across its apps. Meta does not specify C2PA for this, though it sits on the C2PA steering committee. Content Seal separately watermarks images generated via Muse Image in the Meta AI app and meta.ai, and is designed to survive cropping, compression, resizing and screenshotting.
  • Amazon: Titan Image Generator adds an invisible watermark plus C2PA metadata by default, at no extra charge. Nova Canvas adds the same invisible watermark by default, but C2PA is confirmed only for Titan.

OpenAI's framing of the pair is worth memorizing. C2PA carries detailed context; SynthID preserves a signal when the metadata does not survive.

Amazon also ships a detector, not just a marker. Bedrock's Watermark Detection feature scores whether an image carries a Titan or Nova Canvas mark, and as of the source date it runs in only two AWS regions, us-east-1 and us-west-2.

A separate AWS post reportedly extends C2PA Content Credentials to Nova Reel video, though that one was not independently re-verified here.

Why the pixel layer outlives the metadata

Confirmed

Here's the engineering that lets a watermark survive a crop, plus the specific number hiding behind the phrase "survives cropping."

A pixel watermark surviving a re-save or a crop is not luck. It is training.

A Google-assigned patent for an "End-to-End Watermarking System" (US 12,238,322 B2), filed in 2022 and granted in 2025, describes jointly training a watermark encoder and decoder alongside a distortion-detector network. That third network predicts likely distortions and mangles the image during training, forcing the decoder to recover the signal anyway.

The filing predates the public 2023 SynthID-Image launch and is never branded SynthID. It describes the engineering, not the product name.

Meta's shipped Content Seal is described in exactly those terms, surviving cropping, compression, resizing and screenshotting. Same design goal, in product form.

The layer that keeps falling off

Community discussion

You'll see precisely where C2PA metadata disappears, inside OpenAI's own product, and why that's a design limit rather than a scandal.

C2PA metadata is the richer layer. It carries what tool made the file, what edits happened, what source assets went in.

It is also the fragile one. Many re-uploads strip it, and a screenshot never had it to begin with.

The best-documented case happened inside OpenAI's own product. A PNG carrying valid OpenAI C2PA metadata, uploaded back into a ChatGPT conversation on 2026-06-28, came out with that metadata reduced to bare PNG chunks.

The original file still verified correctly on openai.com/verify. The thread was unresolved and unanswered by OpenAI staff as of retrieval.

OpenAI does not oversell any of this. Its own language says provenance signals are "not a guarantee that content is accurate, unedited, legally owned, or presented in the correct context," and that "no detection method is foolproof."

A 2023 Hacker News thread on watermark robustness (106 points, 87 comments) arrived at a similar place from the opposite direction. Commenters argued imperceptible watermarks have a long history of eventually failing, and favored cryptographic chain-of-custody provenance like C2PA as the more durable bet.

Their technical reason was blunt: single-sample watermark detection runs into fundamental statistical limits regardless of how good the engineering is. So one camp trusts the metadata, one trusts the pixels, and the providers hedge by shipping both.

What actually breaks these watermarks, and what only claimed to

Research/proposal

Here's the honest state of image watermark removal, including the viral claim that fell apart and the peer-reviewed attack that didn't.

Start with what is published. Saberi, Sadasivan, Rezaei, Kumar, Chegini, Wang and Feizi's "Robustness of AI-Image Detectors: Fundamental Limits and Practical Attacks" (2023) showed diffusion purification can strip low-perturbation image watermarks with minimal visible quality loss.

The same paper runs the attack in reverse. With black-box access to a watermarking method, you can make a real, unwatermarked photo falsely register as watermarked.

A stronger result landed at the 46th IEEE Symposium on Security and Privacy in 2025: UnMarker, by Andre Kassis and Urs Hengartner at the University of Waterloo. It works with no detector feedback and no knowledge of the watermarking algorithm, and the authors conclude that "defensive watermarking is not a viable defense against deepfakes."

A follow-up social-media thread put numbers on UnMarker that its abstract does not, reporting SynthID detection dropping from 100% to around 21% at the cost of roughly a $10,000 A100 GPU rather than a laptop. Those figures come from a summary, not the paper, so hold them loosely.

The practical version of the same lesson showed up on the most-discussed removal thread found, 387 points and 258 comments, for a CLI tool that strips AI watermarks from images. It cleanly removed the visible mark. Defeating SynthID reportedly required regenerating the entire image through SDXL, which degraded it.

None of these attacks was demonstrated against SynthID-Image, Content Seal or Amazon's watermark by name. Treat removal of those specific products as an open question, not a solved one.

FAQ

Is an invisible image watermark the same as C2PA?

No. C2PA is signed, structured provenance metadata attached to a file. An invisible watermark (SynthID, Content Seal, Amazon's Titan or Nova mark) is a signal embedded directly in the pixels, engineered through adversarial training to survive more transformations than metadata can. Providers ship both together specifically because they fail in different ways.

Does uploading an AI image to another platform remove its watermark?

It depends which layer you mean. Re-uploading commonly strips C2PA metadata, documented directly for images re-uploaded into ChatGPT itself. It does not necessarily touch an invisible pixel watermark like SynthID or Content Seal, which are designed to survive common transformations, though not guaranteed to survive all of them.

How many images has Google actually watermarked with SynthID?

Google's own SynthID-Image paper states over ten billion images and video frames across Google's services. That figure is Google-reported and has not been independently validated by a third party. Treat it as an official claim, not an audited count.

Is there a published way to actually remove SynthID, Content Seal, or Amazon's image watermark?

Not against those specific systems. Independent research has shown diffusion purification can defeat the broader category of low-perturbation invisible watermarks, that detection can be fooled into flagging unwatermarked images, and that a fully black-box universal attack (UnMarker) exists. But no source found here reproduces any of those attacks against SynthID-Image, Content Seal or Amazon's watermark by name.

I want to remove a watermark from a stock photo, not check an AI image's origin. What do I use?

A generic tool built for that job, like Dewatermark.ai or Cleanup.pictures, erases a visible logo or copyright notice from an ordinary photo. That is a different problem from the invisible provenance signal AI image generators embed, which is not a visible mark you can crop or paint out.

Next steps

  • Find out what a detector can and cannot tell you before you rely on one to settle an argument. AI watermark detectors
  • If you're choosing which provenance layer to build on, read the head-to-head between the metadata standard and the pixel signal. C2PA vs SynthID
  • Video and audio marking work on the same ideas but are years behind images in coverage and detection. Video AI watermarking
  • For the removal question across every modality, including text, start with the evidence review. Can AI watermarks be removed?

Sources and citation status