Remove ChatGPT Watermark: Text vs Image Provenance

• C2PA Content Credentials metadata: documented by OpenAI, attached to generated images, and the most fragile layer by far.
• SynthID: documented for images and, since July 31, 2026, supported audio from ChatGPT Voice, GPT-Live, and the API. It lives in the pixels or the waveform, not in a metadata field.
• An ordinary-text watermark in chat output: not deployed, and never confirmed by OpenAI as live.

The first two do not fail the same way. Metadata can be lost to format conversion, re-saving, screenshotting, or a plain re-upload, gone in a single step.

Losing the metadata tells you nothing about whether SynthID is still present. SynthID is embedded in the content itself and is designed to survive common transformations better than metadata does.

That is exactly why removing it reliably takes more than a metadata-stripping tool, and why OpenAI keeps repeating that "no detection method is foolproof." OpenAI also shipped a Content Provenance API on July 31, 2026, two days before EU AI Act Article 50 obligations took effect, so third parties can check supported audio programmatically.

A thread on OpenAI's own Developer Community forum, dated June 28, 2026, found that a PNG carrying valid OpenAI C2PA metadata gets that metadata stripped down to bare PNG chunks the moment it is re-uploaded into a ChatGPT conversation. The original file still verifies fine on openai.com/verify, with SynthID and Content Credentials both intact. OpenAI staff had not responded as of this writing.

Separately, a November 2025 investigation checked Sora 2 videos against both OpenAI's Verify tool and the open-source c2pa-rs CLI. Some videos carrying the visible OpenAI watermark had no detectable C2PA metadata at all, while some Pro-tier videos without the visible watermark did carry it.

That is close to the reverse of OpenAI's own claim that every Sora video includes both visible and invisible signals. Read together, both findings point the same way: metadata is the part of OpenAI's provenance stack that breaks first, often without anyone trying to break it.

OpenAI reportedly built an internal ChatGPT text-watermarking system years before its 2026 image and audio work. Leaked internal documents, reported by the Wall Street Journal and covered by Tom's Hardware on August 5, 2024, described it as roughly 99.9 percent effective at flagging ChatGPT-written text.

OpenAI chose not to release it, reportedly citing circumvention risk, false positives, and a disproportionate impact on non-native English writers, plus internal survey data suggesting about 30 percent of users would use ChatGPT less if it shipped. OpenAI has separately discussed the same tradeoffs in its own public writing on content provenance, so this is not only a leak.

A tool that claims to remove ChatGPT's text watermark today is making a claim about a mechanism OpenAI built and shelved. There is no known public detector to test that claim against in either direction, and OpenAI's current documentation still frames text as a future goal.

The Hacker News thread about a CLI watermark-removal tool, posted May 19, 2026, pulled 387 points and 258 comments, making it the highest-engagement watermark discussion found there. It reported a hard technical limit: the tool cleanly strips the visible watermark, and defeating SynthID reportedly required regenerating the image entirely through Stable Diffusion XL, degrading quality in the process.

Commenters split on whether that is good news or bad news.

• The privacy and resistance framing: removal tools push back on tracking built into generated media.
• The abuse framing: the same techniques enable deepfake scams, with one commenter raising a Kentucky political deepfake ad reported to have cost $1.7 million and reached 49 million views.
• The sidestep: newer watermark-free local models make the whole removal question moot for anyone who just does not use a watermarking provider.

A separate discussion on the same site, from the day of OpenAI's SynthID announcement, drew 332 points and 180 comments. One commenter claimed Stable Diffusion at 10 to 15 percent denoising strength was enough to defeat SynthID, saying they tested it the day Nano Banana Pro shipped. Nobody published a reproducible test alongside that claim, so it stays community discussion, not a documented result.

For text, a July 2026 thread titled "Text AI watermarks will always be trivial to remove" asked whether foundation-model labs already use watermark removal internally to keep synthetic text out of their own training data. It proposed low-denoising image-to-image regeneration as a practical bypass, but that is an image technique, not a text one.

Nobody in that thread demonstrated an actual removal method against ChatGPT text, because there is no live ChatGPT text watermark and no public detector to test a removal claim against. That is the honest state of the art: active debate, real technical argument, and zero documented method for removing something that has not been confirmed to be there.