Can AI watermarks be removed? What research and the law say

If you searched for an AI watermark remover, the short answer is that research has shown most AI watermarks can be weakened or removed by a determined attacker, and that removing them can break the law. In Switzerland, as in the EU and the US, stripping rights-management information from a work can be an offence, and China bans maliciously removing AI labels or supplying tools to do it. This page sets out what researchers found and what the law says. It doesn't list removal tools or explain how to use them.

Visible marks, invisible watermarks and metadata

"AI watermark" covers three different things, and they behave very differently.

• Visible marks are a logo or label you can see on the image or video. OpenAI put a visible watermark on every Sora video at launch, and stock-photo agencies have long marked their preview images the same way.
• Invisible watermarks are woven into the content itself. Google's SynthID hides a signal in the pixels of images and video and in audio, and Google DeepMind says it is designed to stand up to cropping, filters, changed frame rates and lossy compression. Text watermarks from Anthropic, OpenAI and Google are statistical patterns in the choice of words (how they work is in does ChatGPT watermark text?).
• Metadata, such as Content Credentials built on the C2PA standard, is a signed record attached to the file. OpenAI notes that because it is metadata, it can be removed, which is why it pairs Content Credentials with an invisible watermark.

What research shows about removing AI watermarks

Watermarks survive everyday handling better than determined attacks. The research on images is blunt:

• Zhao and colleagues (NeurIPS 2024) showed that invisible pixel-level watermarks are vulnerable to regeneration with a generative model, across the four schemes they tested, and proposed watermarks built into an image's meaning instead.
• The WAVES benchmark (ICML 2024) put image watermarks through distortion, regeneration and adversarial attacks and found previously unknown weaknesses in several modern schemes.
• UnMarker (Kassis and Hengartner, IEEE S&P 2025) attacked the meaning-based watermarks as well, cutting the best detection rate to 43%. Its authors concluded that defensive watermarking is not a viable defence against deepfakes.

For text, the picture is more mixed:

• Krishna and colleagues (NeurIPS 2023) found that machine paraphrasing cut detection of an early text watermark from 100% to 57.2%, yet still rated watermarking the most resilient detector to paraphrasing of those they tested.
• Kirchenbauer and colleagues (ICLR 2024) found their watermark still detectable after strong paraphrasing by people, once about 800 tokens of text were available on average.
• Jovanović, Staab and Vechev (ICML 2024) showed that for under $50 an attacker could both scrub state-of-the-art text watermarks and forge them onto other text, with average success above 80%.
• A July 2026 preprint by Tamim and Khan found that paraphrasing removed Google's SynthID Text watermark from 98.3% of the texts where it had first been detected.

The companies say much the same. OpenAI reports that replacing a quarter of the words in a passage with synonyms cut detection of its text watermark to 17%, and Anthropic says a complete rewrite removes Claude's. That is why both treat a watermark as one signal among several and say a missing watermark proves nothing. It follows that removing a watermark doesn't make anything human-made: it only removes one way of tracing it.

Is it legal to remove an AI watermark?

Sometimes not. The rules below protect "rights-management information", the data that identifies a work, its author or rightholder, or its terms of use. This is a summary, not legal advice.

• Switzerland. The Copyright Act (URG) says rights-management information may not be removed or altered (Art. 39c). Doing so wilfully and unlawfully is punishable by a fine, on complaint, when the person knows or must know that it causes, enables, makes easier or hides a copyright infringement. Done commercially, it is prosecuted automatically and carries up to one year's custodial sentence or a monetary penalty (Art. 69a).
• European Union. The Copyright Directive requires member states to protect rights-management information against anyone who knowingly removes or alters it without authority (Art. 7 of Directive 2001/29/EC). Separately, the EU's Code of Practice on AI-generated content commits the providers that signed it to forbid removing or tampering with their metadata markings in their terms of use, and not to market or promote tools whose purpose is to get around the markings.
• United States. Copyright law forbids intentionally removing or altering copyright management information without authority, when the person knows, or for civil claims has reasonable grounds to know, that it will help bring about or hide an infringement (17 U.S.C. §1202).
• China. Since 1 September 2025, the Measures for Labeling AI-Generated Synthetic Content forbid any organisation or person to maliciously delete, alter, forge or hide the labels on AI-generated content, or to provide tools or services that help others do so (Art. 10).

A stock-photo watermark that names the agency is the textbook case of rights-management information. Whether a mark that only says "made with AI" counts is untested: as of 1 November 2026 we found no court decision or official guidance on it. Removing one can still break the terms of the tool that made the content, and China's rules ban malicious removal of AI labels whatever copyright law says.

Why people search for a video watermark remover, and why Sora is gone

Much of the search interest in removing watermarks from AI video came from Sora, OpenAI's video app, which put a visible watermark on its videos. OpenAI has since closed it: the Sora app and website were discontinued on 26 April 2026, and the Sora API on 24 September 2026. If you made videos there, OpenAI's help page explains how to export your own content before your data is deleted.

Legitimate ways to get a clean image or video

• Your own work. Keep the original files you made, and check what the tool you used allows when you export.
• Stock and licensed content. Buy a licence: the licensed file is the clean one, and the licence tells you how you may use it.
• Someone else's work. Ask the rightholder for a clean copy or permission. A watermark usually says who to ask.
• AI content you publish. Keep the label. Under the EU AI Act, anyone using AI professionally to make a deepfake, meaning images, audio or video of real people, objects, places or events that would falsely appear authentic, must disclose that it is AI-generated (Art. 50(4)).

What about an AI watermark remover for text?

Text watermarks aren't made of characters, so tools that strip characters do nothing to them. Anthropic says plainly that with Claude's watermark "nothing is added to the text and there are no hidden characters", and OpenAI describes its own as a statistical signal in the model's choice of words.

Hidden characters do turn up in copied text, from PDFs, websites and chat apps alike, and they can break word counts, search and spell checkers. Our free invisible character remover finds zero-width characters, look-alike letters and odd spaces and gives you a clean copy, with no sign-up, no length limit and nothing uploaded. To see how AI-like a piece of writing reads, paste it into our free AI detector, which works the same way: free, no word limit, and the text stays in your browser.

Sources

1. OpenAI, Launching Sora responsibly (30 September 2025), checked November 2026
2. OpenAI Help Center, What to know about the Sora discontinuation, checked November 2026
3. Google DeepMind, SynthID, checked November 2026
4. OpenAI, Verify content generated by OpenAI, checked November 2026
5. OpenAI, Our approach to EU text provenance rules (5 October 2026), checked November 2026
6. Anthropic, Claude text watermarking (14 August 2026, updated 1 September 2026), checked November 2026
7. Zhao et al., Invisible Image Watermarks Are Provably Removable Using Generative AI (NeurIPS 2024), checked November 2026
8. An et al., WAVES: Benchmarking the Robustness of Image Watermarks (ICML 2024), checked November 2026
9. Kassis and Hengartner, UnMarker (IEEE S&P 2025), checked November 2026
10. Krishna et al., Paraphrasing evades detectors of AI-generated text, but retrieval is an effective defense (NeurIPS 2023), checked November 2026
11. Kirchenbauer et al., On the Reliability of Watermarks for Large Language Models (ICLR 2024), checked November 2026
12. Jovanović, Staab and Vechev, Watermark Stealing in Large Language Models (ICML 2024), checked November 2026
13. Tamim and Khan, AI Watermark Evidence Fails Forensic Readiness: An Empirical Evaluation (preprint, July 2026), checked November 2026
14. Swiss Copyright Act (URG, SR 231.1), Art. 39c and 69a, checked November 2026
15. Directive 2001/29/EC, Art. 7, checked November 2026
16. 17 U.S.C. §1202, Integrity of copyright management information, checked November 2026
17. Cyberspace Administration of China, Measures for Labeling AI-Generated Synthetic Content (14 March 2025), checked November 2026
18. Regulation (EU) 2024/1689 (AI Act), Articles 3 and 50, checked November 2026
19. European Commission, Code of Practice on Transparency of AI-Generated Content (10 June 2026), checked November 2026