Removing an AI watermark from an image

Three different operations, one name

"Remove the watermark" covers three unrelated jobs, and which one applies depends entirely on where the badge sits.

• Cropping. If the logo lives in a corner and you can spare that strip, this is the cleanest answer available. No remaining pixel is touched and nothing is invented. The cost is your aspect ratio and a few hundred pixels.
• Inpainting. The selected region is rebuilt from the pixels around it. This is the only option when the logo sits inside the frame or the composition will not survive a crop.
• Regenerating. If the image is your own output, most generation tools offer a route to a version without the badge. That gives the most accurate result, because no pixel is guessed.

Whichever you pick, the file you end up with is not the original restored. The real pixels underneath the logo were never present in the file you hold. Inpainting does not recover them; it manufactures something plausible in their place.

What inpainting actually does

You supply a mask: a black and white image marking which pixels to discard. The algorithm starts at the boundary of that region and works inwards, carrying colour and structure from the edge into the hole. The quality of the result is therefore decided by what surrounds the mask, not by what was inside it. Flat sky, a blurred background or a solid panel produce near perfect results, because the information read from the edge remains true further in.

The Gemini logo remover runs this on the server rather than in the browser. Once the image is uploaded there are two paths. In automatic mode the server first trims uniform black or white letterbox bands so the corners map onto the real photo, then searches a corner quadrant for a four-pointed sparkle shape at six different scales, weighting the bottom corners more heavily. If the shape match is not confident it falls back to picking the most compact blob that stands out from the corner's background colour, and if that fails too it cleans a modest corner square roughly a sixth of the short edge. In manual mode you brush over the logo yourself; the browser scales that selection up to the image's native resolution, turns it into a black and white mask and sends it alongside the file.

Reconstruction then runs on a small box cropped around the mask. Frequency selective reconstruction is used where it is available, with Telea or Navier-Stokes as the fallback. The mask is grown by a few pixels on purpose, because a logo's soft edge and the faint halo around it leave a visible ghost if they fall outside the selection. PNG, JPG and WebP are accepted up to 25 MB, and the temporary files are deleted once the job finishes.

The easy case and the hard case

You can predict how cleanly a logo will lift before you try.

The reasoning is consistent. Inpainting extends structure inwards from the boundary. When a real object genuinely continues under the mask, such as an eye, a letterform or a window frame, the algorithm has no knowledge of it and simply continues what it can see around the edge. What comes out looks reasonable and bears no relationship to what was there. Semi-transparent watermarks are the worst case, because the region to rebuild is not a small blob but a large share of the picture.

Removing the visible mark does not remove the invisible one

This is the part almost every article on the subject leaves out. The corner badge is not the only thing marking an image as generated. A file can carry up to three further layers that you cannot see, and erasing the badge removes none of them.

Content credentials (C2PA)

C2PA embeds a signed provenance record, called a manifest, inside the file. The specification defines two kinds of binding: a hard binding built from cryptographic hashes, and a soft binding built from a fingerprint or an invisible watermark. Editing pixels breaks the hard binding, but that is not a win for anyone trying to hide an edit: validation then reports that the asset has been tampered with, so the change is detected rather than erased. The soft binding is designed to survive editing outright. The specification itself gives the example of an asset separated from its manifest by metadata removal, where a fingerprint of the content is used to look the intact manifest back up from a database.

Embedded signals such as SynthID

Google's SynthID writes its mark into the pixels themselves. DeepMind describes the watermark as imperceptible to humans and designed to stand up to modifications like cropping, adding filters, changing frame rates or lossy compression. The Gemini API documentation puts the scope in one line: all generated images include a SynthID watermark. Painting out the sparkle in the corner removes the visible badge and leaves that signal in place, and Google can check an uploaded image against it.

EXIF and XMP fields

The third layer is ordinary metadata. Software fields inside EXIF can name the program that wrote the file, and the IPTC digital source type field exists specifically to state how an image was produced. Those extension fields live only in XMP, not in EXIF. The EXIF remover is useful here but bounded: it runs in the browser and targets the EXIF blocks in JPEG files, either stripping them entirely or keeping the categories you choose. It does not touch XMP packets or the container that holds a C2PA manifest. Output from the logo remover is re-encoded by the imaging library, so it carries no embedded metadata to begin with, which clears EXIF and does nothing to a mark living in the pixels.

The one-line version: taking off the badge changes how the image looks, not what it is. It does not make an AI image undetectable, and it does not make it unattributable.

Permission and disclosure

The legitimate case is clear enough. Images you generated yourself, where a corner badge simply clutters your own slide, product page or cover layout, and removing it is a design decision like any other.

Three situations are genuinely problematic, and none of them is a technical question.

• Someone else's work. A watermark is frequently the licensing signal. Removing it does not grant you any right to use the image, and in many jurisdictions stripping rights-management information is treated as a separate wrong from the copying itself.
• Places that require disclosure. Competitions, stock libraries, newsrooms, many platform policies and most client contracts ask whether AI was used. The European Union's AI regulation also sets transparency obligations around marking and disclosing synthetic content.
• Passing it off as human-made. Deleting the badge and delivering the work as your own where disclosure is expected is a problem regardless of whether anyone catches it, and the embedded signals above make catching it more likely than people assume.

The order of operations matters

The same steps in a different sequence give a different result.

1. Remove the logo first, while the image is still at full resolution. On a downscaled copy the logo edges have already softened, the mask is harder to draw and the region to rebuild is surrounded by less information.
2. Then crop or resize. If cropping can remove the badge outright, skip inpainting entirely and nothing gets invented.
3. Leave compression until last. The image compressor works in the browser and lets you judge quality as you go. JPEG artefacts show up faster around a reconstructed region, so compressing early makes the repair more obvious.
4. If you only need the subject, the background remover often beats inpainting: isolating the object discards the corner badge along with everything else behind it.
5. Check metadata at the end, and clean it separately where that matters.

Short checklist

1. Is the image yours? If not, stop before the technical steps.
2. Would a crop do the job? If so, do not inpaint.
3. Paint slightly past the logo edge; leaving the halo produces a faint ghost.
4. Inspect the result at 100 per cent, because a small preview hides soft patches.
5. Assume the badge going away does not hide the origin, because it does not.