Almost every confusing conversation about “removing AI watermarks” comes from collapsing four different signals into one word. They differ in where they live, how they're detected, and — critically — how removable they are. Get this map straight and every other guide falls into place.
The four signal classes
- Container metadataEXIF, XMP, and IPTC fields — generator labels, timestamps, prompts. Structured, and strippable deterministically.
- C2PA / Content CredentialsA signed provenance manifest in the container. Also structural; a walk-and-remove problem, not a pixel one.
- Visible marksLogos and sparkles drawn into the image. Removing them means reconstructing what was behind, best done with a neural inpaint.
- Embedded watermarksSynthID-class signals spread across pixels or tokens. Only disruptable best-effort — never cleanly deletable.
Deterministic vs. best-effort
The first two classes are deterministic: the signal is discrete data, so a correct parse-and-remove clears it. The last two are not. Visible-mark reconstruction depends on model quality and hardware, and embedded-watermark disruption is inherently probabilistic — you're lowering a detector's confidence, not deleting a field. Any tool that treats all four as “one click clean” is glossing over the part that actually matters.
Putting it together
A real pipeline handles each class on its own terms: strip metadata and C2PA structurally, reconstruct visible marks where hardware allows, disrupt embedded signals best-effort, then report residual risk honestly. That layered, honest approach is the whole design of AI Stripped — and the reason we won't print a “100% undetectable” badge.
Best-effort, multi-layer, and reported honestly — originals always preserved.