# What can actually be removed 31 provenance marks, grouped by where the bytes actually sit. 22 are removable and countable. 2 can only be disturbed, never certified. 7 we will not claim to handle at all. A mark that lives in the bytes can be deleted, and the deletion is verifiable — re-inspect the output and count it yourself. A mark that lives in the statistics of word choice cannot be deleted at all. The only lever there is rewriting, which changes your prose and proves nothing about a private detector. ## How to read the columns - **Removable** — whether the bytes can be taken out of the file we are given. - **Verifiable** — whether a third party can confirm the change without trusting us. Every deletion is verifiable. A rewrite never is. - **What it does not mean** — the qualification that belongs to that row. It is not a footnote; a claim quoted without it is wrong. ## Invisible characters in text These genuinely sit in the bytes, so removal is countable and you can confirm it yourself by re-inspecting the output. Everything here is free and runs in the browser. | Mark | Where it lives | Removable | Verifiable | What Gifi does | What it does not mean | | -------------------------- | ---------------------------------------------------------------- | --------- | ---------- | ------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------- | | Zero-width characters | U+200B ZWSP, U+200C ZWNJ, U+200D ZWJ, U+2060 word joiner, U+FEFF | Yes | Yes | Deleted, and the count is reported per codepoint | ZWNJ and ZWJ carry meaning in Persian, Arabic, Devanagari and emoji sequences. Those are preserved, so a document can legitimately keep some. | | Bidirectional controls | LRM, RLM, LRO, RLO, PDF, and the isolate family U+2066–U+2069 | Yes | Yes | Deleted when unbalanced or decorative | Balanced pairs in genuine right-to-left text are kept. Stripping them naively corrupts Arabic and Hebrew layout. | | Tag characters | U+E0020–U+E007F, the plane-14 tag block | Yes | Yes | Deleted | Subdivision flag sequences (Scotland, Wales, England) are built from tag characters and are preserved. | | Variation selectors | VS1–VS16, plus the supplement U+E0100–U+E01EF | Yes | Yes | Deleted | An ideographic variation sequence after a CJK character is meaningful and is kept. | | Private-use codepoints | BMP and supplementary private-use planes | Yes | Yes | Deleted | These have no portable meaning by definition, so nothing is lost — but a font that shipped custom glyphs will stop rendering them. | | Other format controls | Remaining Unicode Cf general-category characters | Yes | Yes | Deleted | Orthographic joiners — Mongolian free variation selectors, Khmer vowels, Hangul fillers — are excluded from this sweep. | | Space homoglyphs | Non-breaking, thin, hair, en and em spaces | Yes | Yes | Replaced with a plain space | A replacement changes the text you meant to keep. Typographic non-breaking spaces in a citation are collateral. | | Homoglyphs and confusables | Cyrillic, Greek and other lookalikes for Latin letters (UTS #39) | Yes | Yes | Detected, then folded script-aware | Folding is skipped where the surrounding script makes the character legitimate, so a Russian sentence is not mangled into Latin. | ## Style surfaces Real signals that are not watermarks. We separate them because treating a house-style tell as proof of anything is how this category gets dishonest. | Mark | Where it lives | Removable | Verifiable | What Gifi does | What it does not mean | | ------------------------ | -------------------------------------------------------- | --------- | ---------- | ------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------ | | Punctuation fingerprints | Smart quotes, em and en dashes, ellipsis characters | Yes | Yes | Normalised to ASCII equivalents on request | This is a house-style tell, not a watermark. Plenty of human writers use an em dash, and normalising it proves nothing. | | AI cadence | Sentence-length variance, burstiness, lexical repetition | No | No | Scored, never edited | The score is a writing-style heuristic. It is not proof of authorship in either direction, and a low score is not a clearance. | ## Image metadata Named fields in the container, not in the picture. Images are stripped losslessly — the pixels are never re-encoded. | Mark | Where it lives | Removable | Verifiable | What Gifi does | What it does not mean | | ---------------------------------- | -------------------------------------------------------- | --------- | ---------- | ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | EXIF, including GPS | PNG, JPEG, WebP | Yes | Yes | Stripped losslessly — pixels are not re-encoded | Location may also survive in a filename, a sidecar file, or the service you upload to next. | | XMP packets | Images, PDF, and Office containers | Yes | Yes | Removed | An editor that re-saves the file will write a fresh packet. | | C2PA Content Credentials, embedded | Signed manifest inside the file | Yes | Yes | Removed with the rest of the metadata | Deleting a signed note removes the note. It does not change how the pixels were made and does not prove human authorship. | | C2PA soft binding | A fingerprint held on a remote service, not in your file | No | No | Nothing — it is not in the bytes we are given | After the local credential is gone the fingerprint can still match the file to a remote manifest. We can promise the embedded credential is gone. We cannot promise a registry has forgotten it. | | Image comment blocks | PNG tEXt and iTXt chunks, JPEG COM segments | Yes | Yes | Removed | Generator strings often hide here rather than in EXIF. | | ICC colour profile | Images | No | Yes | Deliberately kept | It is a rendering instruction, not a provenance mark. Stripping it shifts colours for no privacy gain. | ## Document metadata Office and PDF containers keep more identifying state than the properties panel shows. | Mark | Where it lives | Removable | Verifiable | What Gifi does | What it does not mean | | ------------------------------- | ----------------------------------- | --------- | ---------- | ---------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- | | Author and company fields | DOCX, ODT | Yes | Yes | Cleared | The document title is kept. The body text is never rewritten. | | Custom document properties | DOCX, ODT | Yes | Yes | Cleared | Template and DMS systems write identifying keys here that survive a Save As. | | Revision save IDs (RSIDs) | DOCX | Yes | Yes | Removed | RSIDs can link separate documents to the same editing session, which is why they matter more than the author field. | | Embedded thumbnail | DOCX, ODT | Yes | Yes | Removed | The thumbnail renders page one, so it can leak content that was later edited out. | | Metadata inside embedded images | Images packaged within DOCX and ODT | Yes | Yes | Stripped in place | This is the surface most document cleaners miss — the container is cleaned and the pictures inside it are not. | | PDF info dictionary and XMP | PDF | Yes | Yes | Cleared, then the file is structurally rebuilt | Without the rebuild the old values stay recoverable in unused objects. PDFs are handled by a worker that runs exiftool and qpdf. | ## Markup and text containers A format we cannot fully clean is refused rather than half-stripped. | Mark | Where it lives | Removable | Verifiable | What Gifi does | What it does not mean | | ------------------------------------------ | -------------- | --------- | ---------- | -------------------------------------------------------------- | ------------------------------------------------------------------------ | | SVG metadata and RDF | SVG | Yes | Yes | Named provenance elements removed | Editor-specific namespaced attributes vary; unknown ones are left alone. | | HTML generator and author meta, AI JSON-LD | HTML | Yes | Yes | Removed | Only named surfaces. Arbitrary inline comments are not guessed at. | | Frontmatter provenance keys | Markdown | Yes | Yes | Keys such as generator and model removed, plus a Unicode clean | Other frontmatter is preserved so the document still builds. | ## Statistical marks in the words Nothing to delete. The only honest lever is changing the words, and that is lossy by construction. | Mark | Where it lives | Removable | Verifiable | What Gifi does | What it does not mean | | -------------------------------------- | ----------------------------------------------------------- | --------- | ---------- | ------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | SynthID-Text and keyed text watermarks | The pattern of word choice itself — no characters to delete | Partly | No | Disturbed by rewriting, which changes the words | The key is private. No third party can certify that rewritten text will fail a vendor's detector, and we will not claim it. Rewriting is lossy: tone and precision degrade, and the result cannot exceed the rewriting model's ceiling. | | Model stylistic fingerprint | Phrasing habits characteristic of one model family | Partly | No | Best effort via rewrite, ideally routed to a different model family | Rewriting Claude output with Claude risks re-applying the same sampling bias. Configure two families so a rewrite can route away from the origin. | ## Out of scope Named so that a reader gets a straight answer instead of discovering the gap after paying. | Mark | Where it lives | Removable | Verifiable | What Gifi does | What it does not mean | | ------------------------------- | ------------------------------------------------------------------ | ------------ | ---------- | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | | Pixel-embedded image watermarks | SynthID-in-image, Tree-Ring, StegaStamp — printed into the picture | Out of scope | No | Not attempted | The available implementations are not commercially licensable: CtrlRegen ships no licence at all, and reverse-SynthID is non-commercial research only. | | Audio watermarks | SynthID in generated speech and music | Out of scope | No | Not attempted | Audio files are not accepted at all, rather than half-processed. | | Video watermarks | Frame-level and container-level marks | Out of scope | No | Not attempted | Video is not accepted. | | Visible logos and overlays | Drawn into the image a viewer sees | Out of scope | No | Not attempted | This is inpainting, not provenance removal, and it is a different product with different rights questions. | ## Questions this table gets asked ### Can C2PA Content Credentials be removed? The embedded manifest, yes — it is metadata, and removing it is countable. Soft binding is a separate thing and the answer there is no: a fingerprint held on a remote service can still match your file after the local credential is gone. ### Can SynthID be removed from text? No. SynthID-Text is a keyed pattern in word choice, not a character you can delete. Rewriting changes the words so the original sequence is gone, but the key is private and no third party can certify the result against a vendor's detector. ### Does removing metadata prove a file was not AI-generated? No. Deleting a signed note removes the note. It does not change how the pixels or the words were made, and it is not a substitute for a disclosure the law or a platform requires. ### What is the difference between removable and verifiable? Removable means the bytes are gone. Verifiable means you can confirm it without trusting us — re-inspect the returned file and count the change yourself. Every deletion is verifiable; a rewrite never is, because there is no before-and-after byte to count. ### Can you remove a watermark baked into the image itself? No, and it is not on the roadmap. SynthID-in-image, Tree-Ring and StegaStamp live in the pixels. The published implementations that attack them are not commercially licensable, so we decline rather than ship something we cannot license. ### Does ChatGPT text contain invisible characters? Sometimes, and when it does they are removable and free to remove in the browser. But ChatGPT does not watermark text statistically, so finding nothing on inspection is the common result rather than a failure. ## See also - [How ChatGPT, Claude and Gemini watermarks work](https://gifi.ai/how-ai-text-watermarks-work) - [How file watermarks work](https://gifi.ai/how-file-watermarks-work) - [Official information about Gifi](https://gifi.ai/ai-info) - [Inspect a file or text](https://gifi.ai/clean)