Can Watermark Removal Be Detected? Yes — and Here Is the Trace We Measured

How we tested it (a real run, not a guess)

Removal is inpainting: the tool identifies the painted region and fills the gap with a plausible continuation of the surrounding pixels. We built two 640×420 test images — one with real photographic-style texture (colored blocks plus fine grain), one flat — stamped each with a semi-transparent rotated SAMPLE watermark, then ran the tool's actual engine over the mark footprint (Telea fill, 24 px brush, mask dilated by the brush radius, matching how a painted brush truly covers pixels) and compared the result two ways. Every number below is from that run.

Finding 1: if someone holds the original, the edit is obvious

The simplest case is a reviewer who has the un-watermarked file. We kept the clean original, so we could measure exactly how far the fill strays from what was actually there. On the textured image the filled region differed from the true content by a mean of 68 per pixel; the natural noise in a clean untouched patch of the same image measured only 11. That is roughly a 6× gap — the fill is not the original, it is a reconstruction, and the difference is large. On the plain background the gap was small (7.6 versus 2.4), because there was almost nothing to reconstruct.

Lesson: the moment a removal is compared against the source, it fails. Keep both versions if provenance ever matters.

Finding 2: no-reference detection — the fill is too smooth

Most real-world checks have no original to compare against. They look instead for regions whose statistics do not match the rest of the image. Inpainting rebuilds a hole with a low-frequency, smooth continuation, so the filled patch carries far less high-frequency energy than genuine photo texture. We measured that energy as |image − 5×5 median| per pixel and compared the filled region to untouched texture.

On the textured image the fill is about 29× smoother than its surroundings, and nearly four out of five fill pixels fall below the texture's own 10th percentile of detail — a detector that flags anomalously smooth regions would catch it. On the plain background the whole surface is already smooth, so the fill blends in and only 13% stands out. This is the mathematical version of the well-known practical rule: removal is clean on plain backgrounds and betrays itself on busy ones.

What the research says (and what it does not say)

A 2026 paper, Removing the Watermark Is Not Enough: Forensic Stealth in Generative-AI Watermark Removal (Goonatilake & Ateniese, arXiv:2605.09203, v2 Aug 2026), studies the removal of invisible generative-AI watermarks — a different problem from removing a visible mark on a photo. Its result is still the strongest statement on the topic: across six attacks spanning four removal strategies, all left strong forensic traces, and at a 1% false-positive target, attack-specific detectors identified at least 99% of removal outputs. In a per-image check of five attacks, only 1 of 750 outputs both removed the watermark, stayed within a fidelity budget, and evaded forensic detection. The authors name the missing requirement forensic stealth. We cite it to show that detectable removal traces are a studied, real phenomenon — our own test shows the same holds for visible-watermark inpainting, but we are not claiming that paper tested this tool.

When you can see it with your own eyes

Our numbers line up with what practical guides report. MagicToolbelt's removal guide (July 2026) states plainly that inpainting 'reconstructs' the background and that on a busy, high-detail area 'you'll often see a soft blur or smudge where the text used to be.' imagic-ai's guide (updated July 2026) agrees: removal over fine detail 'leaves artifacts,' and a careful clone-and-heal pass is needed to hide it. That 'soft blur' is the same low-frequency smoothness our detector caught at 78% on textured backgrounds. So the eye and the forensic detector are catching the same thing — the fill simply does not contain the detail the original had.

If you must remove a watermark you have the right to remove

1. Paint tightly. A smaller, accurate mask means less invented area and a smaller trace. Zoom in and stay on the mark.
2. Expect plain backgrounds to hide it and busy ones to show it. Our test: 13% detectable on flat, 78% on textured. Don't promise a clean result over detail.
3. Keep the original. If provenance is ever questioned, the un-edited file is your proof — and as Finding 1 shows, the edited file will not match it.
4. Respect ownership. Detection is a separate question from permission. Only remove marks on images you own or are licensed to edit; a cleaner technical result does not change who holds the copyright.

For the mechanics on specific surfaces, our text test, logo test, and product-photo test cover how the same engine behaves on captions, logos, and supplier marks.

FAQ

Does removing a watermark leave a trace? Yes. The fill is a reconstruction, not a reversal, so it differs from the original and from the surrounding image's texture.

Can forensic software detect it? On textured, photo-like images, yes — in our test 78% of the fill was detectably smoother than the real texture, and that is exactly the anomaly no-reference detectors flag. On plain backgrounds it is hard to detect (13%).

What if no one has the original? Detection then relies on the fill's anomalous statistics, which our no-reference measurement shows are strong on detailed images and weak on flat ones.

Is removal illegal? Detection and legality are different questions. You may remove a watermark only from images you own or are licensed to edit; the technical ease of removal has no bearing on the right to do it.

Does this mean the tool is broken? No. It does what inpainting does: a plausible fill. The trace is the honest cost of reconstruction, and it is smaller on the plain backgrounds where removal works best.