remove-ai-marks

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Remove AI marks

移除AI标记

Multi-vendor anti-detection hygiene for text (Unicode + statistical rewrite) and files (C2PA / AI metadata across common containers).

Read if needed:

```
references/mark-classes.md
```
— Unicode / sampling / C2PA / containers
```
references/vendor-notes.md
```
— Claude, Gemini/SynthID, OpenAI, open-LLM
```
references/removal-matrix.md
```
— which layer when
```
references/ethics.md
```
— intended use
```
references/how-claude-marks.md
```
— Anthropic-specific detail
```
references/markdiffusion.md
```
— optional MarkDiffusion image harness (schemes, honesty caveats)

This skill is a thin client. All deterministic cleaning machinery runs in a separate HTTP service (this repo's

service/

), so the agent host needs no Python, venvs, or cleaning tools. Call the service with

curl

; never run cleaning scripts directly.

多厂商反检测清理工具，支持文本（Unicode + 统计重写）和文件（常见容器中的C2PA / AI元数据）。

如需了解详情可查看：

```
references/mark-classes.md
```
— Unicode / 采样 / C2PA / 容器相关说明
```
references/vendor-notes.md
```
— Claude、Gemini/SynthID、OpenAI、开源大语言模型相关说明
```
references/removal-matrix.md
```
— 不同场景下对应使用的清理层级
```
references/ethics.md
```
— 工具使用规范
```
references/how-claude-marks.md
```
— Anthropic专属标记细节
```
references/markdiffusion.md
```
— 可选的MarkDiffusion图像工具包（方案、诚信说明）

本技能是一个轻量客户端。所有确定性清理机制都在独立的HTTP服务（本仓库的

service/

目录）中运行，因此代理主机无需安装Python、虚拟环境或清理工具。通过

curl

调用该服务；切勿直接运行清理脚本。

Service access

服务访问

Base URL comes from

WATERMARKS_SERVICE_URL

, default

http://127.0.0.1:8765

bash

WM="${WATERMARKS_SERVICE_URL:-http://127.0.0.1:8765}"

The service is started either by the operator (

docker compose up -d

, or a published GHCR image) or locally (

make serve

). Always check it first, and stop with a clear message if it is unreachable — never fall back to local cleaning:

bash

curl -sf "$WM/health"

基础URL由

WATERMARKS_SERVICE_URL

环境变量指定，默认值为

http://127.0.0.1:8765

：

bash

WM="${WATERMARKS_SERVICE_URL:-http://127.0.0.1:8765}"

服务可由运维人员启动（

docker compose up -d

，或使用已发布的GHCR镜像），也可本地启动（

make serve

）。请先检查服务状态，如果服务不可达，需给出明确提示后终止操作——切勿回退到本地清理：

bash

curl -sf "$WM/health"

{"ok": true, "version": "..."}

{"ok": true, "version": "..."}"


If `WATERMARKS_SERVER_API_KEY` is set on the service, every request needs
`-H "Authorization: Bearer $WATERMARKS_SERVICE_API_KEY"`.


如果服务端设置了`WATERMARKS_SERVER_API_KEY`，则每个请求都需要添加请求头`-H "Authorization: Bearer $WATERMARKS_SERVICE_API_KEY"`。

Capabilities

功能特性

bash

curl -s "$WM/capabilities"

Reports which optional tools are available server-side (

c2patool

exiftool

qpdf

), scorers present (

scorers.stylometry

scorers.synthid

), and which heavy backends are configured (

pixel_backends.ctrlregen

pixel_backends.diffusion

harnesses.markllm

). Drive your advice from this: only recommend pixel removal / SynthID scoring when the service reports the backend present.

bash

curl -s "$WM/capabilities"

该接口会返回服务端可用的可选工具（

c2patool

、

exiftool

、

qpdf

）、已部署的评分器（

scorers.stylometry

、

scorers.synthid

），以及已配置的重量级后端（

pixel_backends.ctrlregen

、

pixel_backends.diffusion

、

harnesses.markllm

）。请根据该返回结果提供建议：只有当服务报告对应的后端已存在时，才推荐像素级移除/SynthID评分功能。

HTTP API (curl)

HTTP API（curl调用）

Payloads are JSON with the file as base64. The agent decodes the

cleaned

field and writes it to the output path itself.

Method	Path	Body	Returns
GET	`/health`	—	`{"ok": true, "version": ...}`
GET	`/capabilities`	—	optional tools / backends present
GET	`/openapi.json`	—	dynamically generated OpenAPI 3.0.3 spec
POST	`/inspect`	`{"file": "<base64>", "name": "notes.md"}`	`{"ok", "kind", "suspicious", "report"}`
POST	`/clean`	`{"file": "<base64>", "name": "notes.md", "options": {...}}`	`{"ok", "kind", "cleaned": "<base64>", "report"}`

The machine-readable contract lives at

$WM/openapi.json

— plug it into any OpenAPI tooling (client generators, Swagger UI, editors) instead of hand-rolling clients.

options

accepted by

/clean

nfkc

aggressive_homoglyphs

(text),

keep_non_ai_metadata

strip_all_metadata

remove_pixel

(

ctrlregen

diffusion

) (images),

also_layer_a_text

(containers).

Inspect first (decide, don't guess):

bash

curl -s -X POST "$WM/inspect" -H 'Content-Type: application/json' \
  -d "{\"file\": \"$(base64 -w0 notes.md)\", \"name\": \"notes.md\"}"

Clean (text / image / container are auto-detected by name + bytes):

bash

curl -s -X POST "$WM/clean" -H 'Content-Type: application/json' \
  -d "{\"file\": \"$(base64 -w0 notes.md)\", \"name\": \"notes.md\"}"

Decode the returned

cleaned

base64 into the output file (

*.cleaned.*

by default unless the user asked in-place) and summarize

report

honestly.

(On Windows agents, build base64 with

[Convert]::ToBase64String([IO.File]::ReadAllBytes("notes.md"))

请求体为JSON格式，文件内容需以base64编码。代理需要解码返回结果中的

cleaned

字段，并将其写入输出路径。

请求方法	路径	请求体	返回内容
GET	`/health`	—	`{"ok": true, "version": ...}`
GET	`/capabilities`	—	可用的可选工具/后端信息
GET	`/openapi.json`	—	动态生成的OpenAPI 3.0.3规范
POST	`/inspect`	`{"file": "<base64>", "name": "notes.md"}`	`{"ok", "kind", "suspicious", "report"}`
POST	`/clean`	`{"file": "<base64>", "name": "notes.md", "options": {...}}`	`{"ok", "kind", "cleaned": "<base64>", "report"}`

机器可读的接口定义位于

$WM/openapi.json

——请将其接入任意OpenAPI工具（客户端生成器、Swagger UI、编辑器），而非手动编写客户端。

/clean

接口支持的

options

参数：

nfkc

、

aggressive_homoglyphs

（文本清理）、

keep_non_ai_metadata

、

strip_all_metadata

、

remove_pixel

（

ctrlregen

diffusion

，图像清理）、

also_layer_a_text

（容器清理）。

先检测再清理（基于判断，而非猜测）：

bash

curl -s -X POST "$WM/inspect" -H 'Content-Type: application/json' \
  -d "{\"file\": \"$(base64 -w0 notes.md)\", \"name\": \"notes.md\"}"

执行清理（文本/图像/容器会根据文件名+字节内容自动识别）：

bash

curl -s -X POST "$WM/clean" -H 'Content-Type: application/json' \
  -d "{\"file\": \"$(base64 -w0 notes.md)\", \"name\": \"notes.md\"}"

将返回结果中的

cleaned

字段解码为输出文件（默认命名为

*.cleaned.*

，除非用户要求原地覆盖），并如实总结

report

中的内容。

（在Windows代理中，可通过

[Convert]::ToBase64String([IO.File]::ReadAllBytes("notes.md"))

生成base64编码内容。）

Ethics

使用规范

Intended for your own content (privacy, hygiene, research). Do not market results as "proves human-written." If the user clearly wants academic fraud or illegal non-disclosure, warn using

references/ethics.md

and still only perform technical cleaning they own.

本工具仅适用于您自己的内容（隐私保护、清理需求、研究用途）。请勿将处理后的内容宣传为“人工撰写”。如果用户明确想要用于学术欺诈或非法保密，需通过

references/ethics.md

中的内容发出警告，但仍仅对用户拥有所有权的内容执行技术清理。

Workflow

工作流程

1. Classify input

1. 分类输入内容

Input	Route
Pasted / clipboard text	temp file → `/inspect` then `/clean` (text)
`.txt` / code	text Layer A (+ formatter for code)
`.md` / `.html`	container clean (frontmatter/meta) + Layer A
`.png` / `.jpg` / `.jpeg` / `.webp`	image metadata strip
`.svg` / `.pdf` / `.docx` / `.odt`	container metadata strip
Directory / website	aggregate audit via the service CLIs (see below)

The service routes by filename extension first, then by magic bytes, so you mostly just send the file.

输入类型	处理流程
粘贴/剪贴板文本	保存为临时文件 → 调用 `/inspect` 检测，再调用 `/clean` 清理（文本类型）
`.txt` / 代码文件	文本Layer A清理（代码文件额外使用格式化工具）
`.md` / `.html`	容器元数据清理（前置内容/元数据） + Layer A文本清理
`.png` / `.jpg` / `.jpeg` / `.webp`	图像元数据移除
`.svg` / `.pdf` / `.docx` / `.odt`	容器元数据移除
目录/网站	通过服务端CLI进行批量审计（详见下文）

服务会优先根据文件扩展名判断类型，其次根据文件字节特征，因此您只需直接发送文件即可。

2. Inspect first

2. 先执行检测

bash

curl -s -X POST "$WM/inspect" -H 'Content-Type: application/json' \
  -d "{\"file\": \"$(base64 -w0 path)\", \"name\": \"$(basename path)\"}"

Show a short summary (suspicious codepoints; C2PA/AI flags; confidence labels

confirmed

probable

informational

likely_false_positive

Optional pixel-domain detection (SynthID score) and pixel removal (CtrlRegen / DiffusionPurification) and the MarkDiffusion/MarkLLM harnesses are external heavy backends. They run in the service's optional containers or host checkouts — check

/capabilities

before promising them, and never pretend a local detector is an official vendor detector.

bash

curl -s -X POST "$WM/inspect" -H 'Content-Type: application/json' \
  -d "{\"file\": \"$(base64 -w0 path)\", \"name\": \"$(basename path)\"}"

展示简短的检测总结（可疑编码点；C2PA/AI标记；置信度标签

confirmed

probable

informational

likely_false_positive

）。

可选的像素域检测（SynthID评分）和像素域移除（CtrlRegen / DiffusionPurification）以及MarkDiffusion/MarkLLM工具包属于外部重量级后端。它们运行在服务的可选容器或本地检出环境中——在承诺提供这些功能前请先检查

/capabilities

接口返回结果，切勿将本地检测器伪装成官方厂商检测器。

3. Deterministic clean (always for matching inputs)

3. 执行确定性清理（匹配输入类型时始终执行）

Any supported file (unified):

bash

curl -s -X POST "$WM/clean" -H 'Content-Type: application/json' \
  -d "{\"file\": \"$(base64 -w0 INPUT)\", \"name\": \"$(basename INPUT)\"}"

Decode

cleaned

→

OUTPUT

(

*.cleaned.*

unless the user asked in-place). Re-inspect the result when residual risk matters.

PDF needs

exiftool

qpdf

server-side for a real strip; the report notes a degraded (best-effort) result when either is missing — check

/capabilities

Images — optional pixel removal: only when

capabilities.pixel_backends

says the backend is present:

bash

curl -s -X POST "$WM/clean" -H 'Content-Type: application/json' \
  -d "{\"file\": \"$(base64 -w0 shot.png)\", \"name\": \"shot.png\", \
       \"options\": {\"remove_pixel\": \"ctrlregen\"}}"

所有支持的文件（统一流程）：

bash

curl -s -X POST "$WM/clean" -H 'Content-Type: application/json' \
  -d "{\"file\": \"$(base64 -w0 INPUT)\", \"name\": \"$(basename INPUT)\"}"

解码

cleaned

字段内容 → 写入

OUTPUT

文件（默认命名为

*.cleaned.*

，除非用户要求原地覆盖）。如果存在残留风险，需对结果重新执行检测。

若服务端未安装

exiftool

和

qpdf

，PDF文件的清理仅为“尽力而为”；当任一工具缺失时，报告中会注明清理结果存在局限性——请先检查

/capabilities

接口返回结果。

**图像文件 — 可选像素级移除：**仅当

capabilities.pixel_backends

返回结果显示对应后端已存在时才可执行：

bash

curl -s -X POST "$WM/clean" -H 'Content-Type: application/json' \
  -d "{\"file\": \"$(base64 -w0 shot.png)\", \"name\": \"shot.png\", \
       \"options\": {\"remove_pixel\": \"ctrlregen\"}}"

4. Layer B — always offer rewrite (prose)

4. Layer B — 始终提供重写建议（ prose类文本）

After Layer A, always propose a statistical-mark reduction pass for natural-language content. Do not skip this step silently.

The service does not hold a rewrite model — you are the rewrite model. Run the prompts below on the cleaned text with a model ≠ suspected origin (Claude text → not Claude; Gemini → not Gemini; etc.). Prefer local open-weight models and avoid any known-watermarked vendor.

Multi-pass recipe:

Layer A clean (via
```
/clean
```
)
Paraphrase (default) — explicit word-choice + syntax churn: change clause order, connectors, transition words, and sentence boundaries; replace content and function words where meaning allows; preserve facts, numbers, names, code IDs
Optional strong pass —
```
humanize
```
(natural-human prose), back-translate, or structural outline→regen
Layer A again on the result (
```
/clean
```
)
Report residual risk honestly (short/highly predictable text = lower; long, high-entropy prose = higher)

Code files: Prefer formatter (

prettier

black

gofmt

, …) + Layer A. Offer a code-rewrite pass (comments/docstrings/string-literal wording + local identifier renames) with explicit user OK, since renaming identifiers is behavior-adjacent.

完成Layer A清理后，始终建议对自然语言内容执行统计标记弱化处理。请勿跳过此步骤。

服务端不包含重写模型——您需要自行调用重写模型。请使用与疑似来源模型不同的模型对清理后的文本执行以下提示词（例如Claude生成的文本 → 不要使用Claude重写；Gemini生成的文本 → 不要使用Gemini重写等）。优先使用本地开源模型，避免使用任何已知会添加水印的厂商模型。

多步骤重写方案：

执行Layer A清理（通过
```
/clean
```
接口）
释义重写（默认）——明确调整用词和语法：改变从句顺序、连接词、过渡词，调整句子边界和长度；在不改变含义的前提下替换实词和虚词；保留事实、数字、名称、代码ID
可选强化处理——
```
人性化改写
```
（自然人类风格文本）、反向翻译、结构化大纲→重新生成
对结果再次执行Layer A清理（调用
```
/clean
```
接口）
如实报告残留风险（简短/高可预测性文本残留风险较低；长篇、高熵文本残留风险较高）

**代码文件：**优先使用格式化工具（

prettier

、

black

、

gofmt

等） + Layer A清理。如需执行代码重写（注释/文档字符串/字符串字面量改写 + 本地标识符重命名），需先获得用户明确许可，因为标识符重命名可能影响代码行为。

Rewrite prompts (use as-is)

重写提示词（直接使用）

Paraphrase preserve meaning (word choice + syntax):

Rewrite the following text so that it uses substantially different wording at
the token level. Change clause order, connectors, and transition words; vary
sentence boundaries and length; and replace both content words and function
words where meaning allows. Preserve all facts, numbers, names, and technical
identifiers. Do not add or remove claims. Output only the rewritten text.

---
{TEXT}

Humanize (write like a human):

Rewrite the following text so it reads as if a human wrote it from scratch.
Vary sentence rhythm and length, replace formulaic AI-style transitions and
filler with concrete natural phrasing, and use plain, varied wording. Preserve
all facts, numbers, names, and technical identifiers. Do not add or remove
claims. Output only the rewritten text.

---
{TEXT}

Code (comments / docstrings / identifiers):

Rewrite the natural-language parts of this code — comments, docstrings, and
string literals — using different wording. Rename local variables, function
parameters, and private helper names to semantically equivalent names. Preserve
program behavior, public API names, and all values that affect output. Output
only the rewritten code.

---
{TEXT}

Back-translate (two steps):

Translate the following text to {LANG}. Output only the translation.

Translate the following text to {ORIGINAL_LANG}. Preserve meaning; use natural
phrasing. Output only the translation.

Structural:

Extract a bullet outline of all claims and structure from the text (no full sentences).

Then:

Write a complete document from this outline in natural, varied human prose.
Avoid formulaic transitions. Do not omit any bullet. Output only the document.

释义重写（保留含义，调整用词+语法）：

重写以下文本，使其在token层面使用完全不同的措辞。改变从句顺序、连接词和过渡词；调整句子边界和长度；在不改变含义的前提下替换实词和虚词。保留所有事实、数字、名称和技术标识符。请勿添加或删除任何陈述。仅输出重写后的文本。

---
{TEXT}

人性化改写（模拟人工撰写风格）：

重写以下文本，使其读起来像是人类从头撰写的内容。调整句子节奏和长度，用具体自然的措辞替换格式化的AI风格过渡语和填充内容，使用简洁多样的表述。保留所有事实、数字、名称和技术标识符。请勿添加或删除任何陈述。仅输出重写后的文本。

---
{TEXT}

代码文件（注释/文档字符串/标识符）：

重写此代码中的自然语言部分——注释、文档字符串和字符串字面量，使用不同措辞。将局部变量、函数参数和私有辅助函数重命名为语义等价的名称。保留程序行为、公共API名称和所有影响输出的值。仅输出重写后的代码。

---
{TEXT}

反向翻译（两步执行）：

将以下文本翻译为{LANG}语言。仅输出翻译结果。

将以下文本翻译回{ORIGINAL_LANG}语言。保留含义；使用自然措辞。仅输出翻译结果。

结构化重写：

提取文本中所有陈述和结构的项目符号大纲（不要完整句子）。

然后执行：

根据此大纲撰写完整文档，使用自然多样的人类风格文本。避免格式化过渡语。请勿遗漏任何项目符号。仅输出文档内容。

Aggregate audits (directories / websites)

批量审计（目录/网站）

The service image also ships the audit CLIs. Run them as one-shot containers when a directory or website audit is needed:

bash

undefined

服务镜像中还包含审计CLI工具。当需要对目录或网站进行审计时，可通过一次性容器运行：

bash

undefined

Local checkout, or inside the service image:

本地检出代码，或在服务镜像内部执行：

docker run --rm -v "$(pwd)/src:/data:ro" watermarks-remover
/app/scripts/audit_dir.py /data --json


Or against a local checkout of the repo: `python3 service/scripts/audit_dir.py DIR --json`.

docker run --rm -v "$(pwd)/src:/data:ro" watermarks-remover
/app/scripts/audit_dir.py /data --json


也可针对本地检出的仓库执行：`python3 service/scripts/audit_dir.py DIR --json`。

5. Report

5. 生成报告

Always state:

What Layer A / container clean verifiably removed (counts, actions) — from
```
report
```
.
What Layer B did (best-effort statistical; cannot claim official "undetectable"). Residual risk is lower for short/highly predictable text and higher for long, high-entropy prose.
Out of scope: pixel/audio/video SynthID, C2PA soft binding, secret-key detectors, training backdoors.
Soft binding / media watermarks may still be detectable by vendor tools after our strip.
Prefer writing
```
*.cleaned.*
```
unless user asked in-place.
Ethics one-liner: own content / no compliance theater.

报告中需包含以下内容：

Layer A/容器清理已验证移除的内容（数量、操作）——来自
```
report
```
字段。
Layer B执行的操作（尽力而为的统计处理；不得声称“完全无法检测”）。残留风险：简短/高可预测性文本风险较低，长篇、高熵文本风险较高。
超出范围的内容：像素/音频/视频SynthID标记、C2PA软绑定、密钥检测器、训练后门。
软绑定/媒体水印在我们移除后仍可能被厂商工具检测到。
优先保存为
```
*.cleaned.*
```
文件，除非用户要求原地覆盖。
使用规范提示：仅用于自有内容/勿用于合规造假。

Limitations

局限性

Layer A does not remove token-sampling watermarks.
Layer B cannot be gold-verified without vendor detectors / keys. Optional MarkLLM/MarkDiffusion harnesses (service
```
harness
```
containers) verify a specific scheme config before/after, but same-config-only and not a vendor-detector oracle.
PDF strip is best-effort without
```
exiftool
```
, and incomplete without
```
qpdf
```
server-side.
Pixel-domain image watermarks can be removed optionally via the external CtrlRegen backend (
```
remove_pixel: ctrlregen
```
) or MarkDiffusion's DiffusionPurification (
```
remove_pixel: diffusion
```
); both are heavy, drift the image, and need the backend present (
```
/capabilities
```
). Audio/video watermarks remain out of scope.
The reverse-SynthID scorer is external, best-effort, and under a non-commercial Research License; not an official Google detector.
C2PA soft binding (content watermark that re-links to a remote manifest after metadata strip) is out of scope — stripping hard-bound C2PA does not clear it.
Data-driven / backdoor model marks (trigger phrases) are out of scope.

Layer A无法移除token采样水印。
若无厂商检测器/密钥，Layer B的效果无法得到权威验证。可选的MarkLLM/MarkDiffusion工具包（服务端
```
harness
```
容器）可在处理前后验证特定方案配置，但仅适用于相同配置场景，并非厂商检测器的替代方案。
若无
```
exiftool
```
，PDF文件的清理仅为尽力而为；若无
```
qpdf
```
，清理会不彻底。
像素域图像水印可通过外部CtrlRegen后端（
```
remove_pixel: ctrlregen
```
）或MarkDiffusion的DiffusionPurification（
```
remove_pixel: diffusion
```
）可选移除；两者均为重量级操作，会导致图像失真，且需要对应后端已部署（查看
```
/capabilities
```
接口）。音频/视频水印不在处理范围内。
反向SynthID评分器属于外部工具，仅为尽力而为的方案，且受非商业研究许可限制；并非官方Google检测器。
C2PA软绑定（移除元数据后仍可链接到远程清单的内容水印）不在处理范围内——移除硬绑定C2PA无法清除软绑定水印。
数据驱动/后门模型标记（触发短语）不在处理范围内。

Service not reachable?

服务不可达？

$WM/health

fails: tell the user the service is down and how to start it (

docker compose up -d

make serve

, or the published GHCR image). Do not attempt to clean locally — this skill contains no cleaning code.

如果

$WM/health

请求失败：告知用户服务已宕机，并说明启动方式（

docker compose up -d

、

make serve

或使用已发布的GHCR镜像）。切勿尝试本地清理——本技能不包含任何清理代码。